List-Id: <stable.vger.kernel.org>

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Niklas Cassel <[email-masked]>

[ Upstream commit b4ec98303f9fc9b1da0053106716db6a7e002d8b ]

Avoid duplicated code by adding a helper to get the local phy id.

No functional changes intended.

Signed-off-by: Niklas Cassel <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Reviewed-by: Damien Le Moal <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Stable-dep-of: ad70c6bc776b ("scsi: pm80xx: Fix pm8001_abort_task() for chip_8006 when using an expander")
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/pm8001/pm8001_hwi.c |  7 +++----
 drivers/scsi/pm8001/pm8001_sas.c | 10 ++++++++++
 drivers/scsi/pm8001/pm8001_sas.h |  1 +
 drivers/scsi/pm8001/pm80xx_hwi.c |  6 ++----
 4 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index fb4913547b00f..8005995a317c1 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -4184,10 +4184,9 @@ static int pm8001_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
 			dev_is_expander(pm8001_dev->dev_type))
 			stp_sspsmp_sata = 0x01; /*ssp or smp*/
 	}
-	if (dev_parent_is_expander(dev))
-		phy_id = dev->parent->ex_dev.ex_phy->phy_id;
-	else
-		phy_id = pm8001_dev->attached_phy;
+
+	phy_id = pm80xx_get_local_phy_id(dev);
+
 	opc = OPC_INB_REG_DEV;
 	linkrate = (pm8001_dev->sas_device->linkrate < dev->port->linkrate) ?
 			pm8001_dev->sas_device->linkrate : dev->port->linkrate;
diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index 2bdeace6c6bfe..5595913eb7fc1 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -130,6 +130,16 @@ static void pm80xx_get_tag_opcodes(struct sas_task *task, int *ata_op,
 	}
 }
 
+u32 pm80xx_get_local_phy_id(struct domain_device *dev)
+{
+	struct pm8001_device *pm8001_dev = dev->lldd_dev;
+
+	if (dev_parent_is_expander(dev))
+		return dev->parent->ex_dev.ex_phy->phy_id;
+
+	return pm8001_dev->attached_phy;
+}
+
 void pm80xx_show_pending_commands(struct pm8001_hba_info *pm8001_ha,
 				  struct pm8001_device *target_pm8001_dev)
 {
diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
index 334485bb2c12d..91b2cdf3535cd 100644
--- a/drivers/scsi/pm8001/pm8001_sas.h
+++ b/drivers/scsi/pm8001/pm8001_sas.h
@@ -798,6 +798,7 @@ void pm8001_setds_completion(struct domain_device *dev);
 void pm8001_tmf_aborted(struct sas_task *task);
 void pm80xx_show_pending_commands(struct pm8001_hba_info *pm8001_ha,
 				  struct pm8001_device *dev);
+u32 pm80xx_get_local_phy_id(struct domain_device *dev);
 
 #endif
 
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index 546d0d26f7a17..31960b72c1e92 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -4797,10 +4797,8 @@ static int pm80xx_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
 			dev_is_expander(pm8001_dev->dev_type))
 			stp_sspsmp_sata = 0x01; /*ssp or smp*/
 	}
-	if (dev_parent_is_expander(dev))
-		phy_id = dev->parent->ex_dev.ex_phy->phy_id;
-	else
-		phy_id = pm8001_dev->attached_phy;
+
+	phy_id = pm80xx_get_local_phy_id(dev);
 
 	opc = OPC_INB_REG_DEV;
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:50:09 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369436; cv=none; b=YTYmtHAly21zhCSZejlf944/Hn/Mueq6FzzM0kELjzJeJbWnYAHJ1HcELuXmN0ulvv2GzgGUpHT5sGcgAFejgvMsHfa5r/hjPeKg6Asaf2vKtR6ZNRx+3msL3O2rHjV0WXSeomVYU3KCHsKpbVGfky0/wVcT18h9/P2erQtOIAU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369436; c=relaxed/simple;
	bh=AfclcZJywmnDxYbhpekWnqXTBt7Pg5M7tasMzPTm0xg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bEIuS1K73vgCNaSyOqdchyPovG3As1ZhaJpOGk4kjA03XMBY48KhRbJ6nvrOM1796bdNyBddQomll4DyuOy6Kdht9CmyRdss21fiCFC1rfX4kB/L+8cK7BvqIfZUEZFn397s0ZEX/K1sMtbYzPEpj+GXoo40U1il9uaxJvGNf88=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PhNXx+2u; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Igor Pylypiv <[email-masked]>,
	Niklas Cassel <[email-masked]>,
	Damien Le Moal <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 246/563] scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
Date: Mon, 13 Oct 2025 16:41:47 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Niklas Cassel <[email-masked]>

[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]

Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when
device is gone") UBSAN reports:

  UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
  index 28 is out of range for type 'pm8001_phy [16]'

on rmmod when using an expander.

For a direct attached device, attached_phy contains the local phy id.
For a device behind an expander, attached_phy contains the remote phy
id, not the local phy id.

I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
device behind an expander, attached_phy can be much larger than
pm8001_ha->chip->n_phy (depending on the amount of phys of the
expander).

E.g. on my system pm8001_ha has 8 phys with phy ids 0-7.  One of the
ports has an expander connected.  The expander has 31 phys with phy ids
0-30.

The pm8001_ha->phy array only contains the phys of the HBA.  It does not
contain the phys of the expander.  Thus, it is wrong to use attached_phy
to index the pm8001_ha->phy array for a device behind an expander.

Thus, we can only clear phy_attached for devices that are directly
attached.

Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
Reviewed-by: Igor Pylypiv <[email-masked]>
Signed-off-by: Niklas Cassel <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Reviewed-by: Damien Le Moal <[email-masked]>
Tested-by: Damien Le Moal <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index 753c09363cbbc..3e1dac4b820fe 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -749,6 +749,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
 	unsigned long flags = 0;
 	struct pm8001_hba_info *pm8001_ha;
 	struct pm8001_device *pm8001_dev = dev->lldd_dev;
+	struct domain_device *parent_dev = dev->parent;
 
 	pm8001_ha = pm8001_find_ha_by_dev(dev);
 	spin_lock_irqsave(&pm8001_ha->lock, flags);
@@ -765,7 +766,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
 			spin_lock_irqsave(&pm8001_ha->lock, flags);
 		}
 		PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
-		pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
+
+		/*
+		 * The phy array only contains local phys. Thus, we cannot clear
+		 * phy_attached for a device behind an expander.
+		 */
+		if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
+			pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
 		pm8001_free_dev(pm8001_dev);
 	} else {
 		pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n");
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:50:06 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369430; cv=none; b=dPoLf8vVb3IxhY+6Sk32PosA0+wDwl6rYViqklQt00WF5iHXwjyfwEIQ+y4UhhkaYBGlxZQvjZQzU/LjM3UJDrZzG1qnJ4+55NU8cS50jr+mjfBIH4S8Rvgw3xf+b2I6vw++JTLJrfxy2p49UGdlGkfOsXuwJogVQmYc8NZYRtg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369430; c=relaxed/simple;
	bh=mqOniKok2LzM3zlbjfGBpi9CgzfQUbtu7U/T2cqbl68=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=AreJa8+DzKPV6fldvww7DiQtSNTaMACB9sjE0Or1I/CIEN1BLtsXqS8ZfKnd5yQQU1mn9UavqNvQ78PJXjIsxfl5ndlUIGOPBQcd7jdfzFa+QSQtftIeTT1Q/VP4p1EPm5um20aXC2RsrXwVFStEWpHIPJ7S1y0eWV/q75CAxoU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ESWa9gsI; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Akhilesh Patil <[email-masked]>,
	Dave Jiang <[email-masked]>,
	Alison Schofield <[email-masked]>,
	Jason Gunthorpe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 244/563] fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc()
Date: Mon, 13 Oct 2025 16:41:45 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Akhilesh Patil <[email-masked]>

[ Upstream commit 7f059e47326746ceebe2a984bd6124459df3b458 ]

Use kvfree() to free memory allocated by kvzalloc() instead of kfree().
Avoid potential memory management issue considering kvzalloc() can
internally choose to use either kmalloc() or vmalloc() based on memory
request and current system memory state. Hence, use more appropriate
kvfree() which automatically determines correct free method to avoid
potential hard to debug memory issues.  Fix this issue discovered by
running spatch static analysis tool using coccinelle script -
scripts/coccinelle/api/kfree_mismatch.cocci

Fixes: 52929c2142041 ("fwctl/mlx5: Support for communicating with mlx5 fw")
Link: https://patch.msgid.link/r/[email-masked]
Signed-off-by: Akhilesh Patil <[email-masked]>
Reviewed-by: Dave Jiang <[email-masked]>
Reviewed-by: Alison Schofield <[email-masked]>
Signed-off-by: Jason Gunthorpe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/fwctl/mlx5/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/fwctl/mlx5/main.c b/drivers/fwctl/mlx5/main.c
index f93aa0cecdb97..4b379f695eb73 100644
--- a/drivers/fwctl/mlx5/main.c
+++ b/drivers/fwctl/mlx5/main.c
@@ -345,7 +345,7 @@ static void *mlx5ctl_fw_rpc(struct fwctl_uctx *uctx, enum fwctl_rpc_scope scope,
 	 */
 	if (ret && ret != -EREMOTEIO) {
 		if (rpc_out != rpc_in)
-			kfree(rpc_out);
+			kvfree(rpc_out);
 		return ERR_PTR(ret);
 	}
 	return rpc_out;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:50:04 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369424; cv=none; b=P0LaixI40/i6qZdCM3EdmYIHBa4ayYnpBFBXqIgeBxyi+m3GtZHdO738dFwT+6aKMtoS+5nDkS/AvcMr5I0eetUU1HkHStC2ziZGeR5solsn4czjh9pD8y76G+Re2Ac2mmxiSeK2D1xuvW4vleub/PgkNNSs5iDy6R8rigNXvCk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369424; c=relaxed/simple;
	bh=zFbZM8GIrd10A8XaQLMcJNW302pFauLkqzeNFZVKhP0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=l2PkQa+lN0aMW/7pty5sg5ETt9JKBdJRaq3mAUxaqTDkFQ+R/bZD0Kekyt640PF8gVircZzPfK4RpTsynFRNDmgcm1FHFw1GYEc2N0lVtGHc41T2fztDkv1jRSPahRL0oFOJOKXlWMKwVxpM6NaYs6Yxpg+t4VTsLwvW+GHyGGw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=n5B9CpTT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Arnd Bergmann <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 242/563] hwrng: nomadik - add ARM_AMBA dependency
Date: Mon, 13 Oct 2025 16:41:43 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email-masked]>

[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ]

Compile-testing this driver is only possible when the AMBA bus driver is
available in the kernel:

x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove':
nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions'
x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe':
nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions'
x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions'

The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be
specified for the COMPILE_TEST case.

Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST")
Signed-off-by: Arnd Bergmann <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/char/hw_random/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index c858278434475..7826fd7c4603f 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -312,6 +312,7 @@ config HW_RANDOM_INGENIC_TRNG
 config HW_RANDOM_NOMADIK
 	tristate "ST-Ericsson Nomadik Random Number Generator support"
 	depends on ARCH_NOMADIK || COMPILE_TEST
+	depends on ARM_AMBA
 	default HW_RANDOM
 	help
 	  This driver provides kernel-side support for the Random Number
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:50:43 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369509; cv=none; b=EbOkCLi+/qacO63T12yS5JDDi4ifvHWBP5tNKc8aZFlqgEHfLNtd+DdjnQWsEm0Jp0M8Fy6cY1hxPxUlJWY+sAWrH5xnHxmQMv3CBpdRmMpOrKdb1Bn1cCMperFa7OPA+DOErIeHLwcA85DMrILQmPiBp14kRkmGVCve3EImbB0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369509; c=relaxed/simple;
	bh=oUUQzcZiBWgUt8j0wmREue2HAMy2WGkQVC0PVi3rSDI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=hwDR9k13Vda50LTP4B149+XWck2pPnJ0KOjF7uV/09L9rbrDHbV3zhHU/aFwuS/sCehU4RzCbU3ckxCNWSUJMn9SiRH7NmExI8GY2l7i9tFGLsBxuLJw7WSbPnDO4ht9lL3c7iqXfMJqrkBJXXucZE9TWxo0kv1ZjT6tyANQ6OE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YqjZhVDI; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Liao Yuanhong <[email-masked]>,
	Alex Deucher <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 239/563] drm/amd/display: Remove redundant semicolons
Date: Mon, 13 Oct 2025 16:41:40 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Liao Yuanhong <[email-masked]>

[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ]

Remove unnecessary semicolons.

Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321")
Signed-off-by: Liao Yuanhong <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c    | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
index 9ba6cb67655f4..6c75aa82327ac 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs,
 	if (dual_plane) {
 		unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param,
 				num_pipes, pipe_idx);
-		;
 		if (src->sw_mode == dm_sw_linear)
 			ASSERT(p1_pte_row_height_linear >= 8);
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:49:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369399; cv=none; b=Q2jzBQtk5hzXhQcKcXwc0kC3vS+GkgqfjWMQy28DrPPLsxTIOVG5cgfd+le2Onji7cC1X0Z3tOBMpnONoQhVH1srUOQRIY2z0asGx70P9G6/GBkYeGKhrw+Xk9Ia+IP9GcEOmTqVJdvYE/9FlIEIvtOlOR8xcdDjo5h1SMG74PM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369399; c=relaxed/simple;
	bh=YZkBU7qvkhA9pnBbQC5zBdLiFiWYAtmYFjFjcM7m1po=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=C3o15iYl1Y8C7JTyjn4e25WCG98sv+LBIPQw23Be/38mpXuDO9JDGv7CWhDV7Gty/TO4KxAEyKbqlN5/Mhv9hh34YWx6igwWntKVWeDIuC/BJhOgkDwVpbyV/2G+BMLjzKy9m1KHEU3Z71T4odqiMPsWkUo/Hcn4Zs5XGYuBQoQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Xtk5Uz71; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jacopo Mondi <[email-masked]>,
	Laurent Pinchart <[email-masked]>,
	Hans Verkuil <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 231/563] media: zoran: Remove zoran_fh structure
Date: Mon, 13 Oct 2025 16:41:32 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jacopo Mondi <[email-masked]>

[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ]

The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been
mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"),
but the structure stayed by mistake. It is now used in a single
location, assigned from a void pointer and then recast to a void
pointer, without being every accessed. Drop it.

Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2")
Signed-off-by: Jacopo Mondi <[email-masked]>
Signed-off-by: Laurent Pinchart <[email-masked]>
Signed-off-by: Hans Verkuil <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/media/pci/zoran/zoran.h        | 6 ------
 drivers/media/pci/zoran/zoran_driver.c | 3 +--
 2 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h
index 1cd990468d3de..d05e222b39215 100644
--- a/drivers/media/pci/zoran/zoran.h
+++ b/drivers/media/pci/zoran/zoran.h
@@ -154,12 +154,6 @@ struct zoran_jpg_settings {
 
 struct zoran;
 
-/* zoran_fh contains per-open() settings */
-struct zoran_fh {
-	struct v4l2_fh fh;
-	struct zoran *zr;
-};
-
 struct card_info {
 	enum card_type type;
 	char name[32];
diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c
index f42f596d3e629..ec7fc1da4cc02 100644
--- a/drivers/media/pci/zoran/zoran_driver.c
+++ b/drivers/media/pci/zoran/zoran_driver.c
@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh,
 			       struct v4l2_format *fmt)
 {
 	struct zoran *zr = video_drvdata(file);
-	struct zoran_fh *fh = __fh;
 	int i;
 	int res = 0;
 
 	if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG)
-		return zoran_s_fmt_vid_out(file, fh, fmt);
+		return zoran_s_fmt_vid_out(file, __fh, fmt);
 
 	for (i = 0; i < NUM_FORMATS; i++)
 		if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc)
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:49:48 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369388; cv=none; b=fX9f8qQqehLlrXME8Bh48xrq02xW1vAesqphwDshIJJib0klWmnIBL86vTKy58OfzZBXx5kzHXhbhe06uXGVMB45LBAn09TLDoU8mHTMy464CuzJCumvKn1W+fNZhUsPx1NRGVxlBRb4X5gBEdt0sp87SEkuWBQY09Mv1K3geps=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369388; c=relaxed/simple;
	bh=xC5sy1ovZOx3Nv71FEQXjAf1RHBZILqDA7YidY28gpU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Onl0uzpGnsqUgPg/IVS5l6dVI0aUftQfwbeIE/kE0rjIXg89yTYNmrzJUZnoGzYWlht2YgKoT4F9lgPoGUeqfxDMwj48K5qthJUajohrL/YznbAj9JYCyD4eW9XhP4YmUrHGQRwkw5w5UoSjxLT8UUvW1a3k9bOXbqg6LWxvRNA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=swbanb4C; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chia-I Wu <[email-masked]>,
	Chen-Yu Tsai <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 227/563] drm/bridge: it6505: select REGMAP_I2C
Date: Mon, 13 Oct 2025 16:41:28 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chia-I Wu <[email-masked]>

[ Upstream commit 21b137f651cf9d981e22d2c60a2a8105f50a6361 ]

Fix

  aarch64-linux-gnu-ld: drivers/gpu/drm/bridge/ite-it6505.o: in function `it6505_i2c_probe':
  ite-it6505.c:(.text+0x754): undefined reference to `__devm_regmap_init_i2c'

Signed-off-by: Chia-I Wu <[email-masked]>
Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver")
Reviewed-by: Chen-Yu Tsai <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Chen-Yu Tsai <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/bridge/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig
index b9e0ca85226a6..a6d6e62071a0e 100644
--- a/drivers/gpu/drm/bridge/Kconfig
+++ b/drivers/gpu/drm/bridge/Kconfig
@@ -122,6 +122,7 @@ config DRM_ITE_IT6505
 	select EXTCON
 	select CRYPTO
 	select CRYPTO_HASH
+	select REGMAP_I2C
 	help
 	  ITE IT6505 DisplayPort bridge chip driver.
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:49:40 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369371; cv=none; b=DqfFBMBPqvMzBnEyCRtYK2NfpH5qHctpbkaxSrX3O8VxjqZRvAv92T56t0CGDUN9s1DITfhbdf4fjTXOtMZB2QEPD1fWk3mRbt+wu0hMvpnlq38kY6YuHHfLapDVmeQ5CSnrBPlxPyGKf2xRIB154DtjLgAQhn+G7WEk5AaaNq0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369371; c=relaxed/simple;
	bh=Ww4tNlScWI5474GnrGR6yvwCN8d3SY8FxNDHcOYhluc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=KZWGIKBJbUA6fmjF5Mg+faOUhkjDwMy3A6udqRhsPRUu5ZrVeu/eJF7P3uQn+JmIETfV5dc23K70cZ93z5GGx4ce/jr6ctFd2Sk6DvfHopef0os6Nub4cVWXKgDSec6dHLHwDAsG1cjXlQl6DGtVj+8jooVo+kcnjKB2eZ5VAL4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=H68rGoBT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	Manivannan Sadhasivam <[email-masked]>,
	Marc Zyngier <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 222/563] PCI: xgene-msi: Return negative -EINVAL in xgene_msi_handler_setup()
Date: Mon, 13 Oct 2025 16:41:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email-masked]>

[ Upstream commit b26fc701a25195134ff0327709a0421767c4c7b2 ]

There is a typo so we accidentally return positive EINVAL instead of
negative -EINVAL. Add the missing '-' character.

Fixes: 6aceb36f17ab ("PCI: xgene-msi: Restructure handler setup/teardown")
Signed-off-by: Dan Carpenter <[email-masked]>
Signed-off-by: Manivannan Sadhasivam <[email-masked]>
Acked-by: Marc Zyngier <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pci/controller/pci-xgene-msi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pci-xgene-msi.c b/drivers/pci/controller/pci-xgene-msi.c
index 0a37a3f1809c5..654639bccd10e 100644
--- a/drivers/pci/controller/pci-xgene-msi.c
+++ b/drivers/pci/controller/pci-xgene-msi.c
@@ -311,7 +311,7 @@ static int xgene_msi_handler_setup(struct platform_device *pdev)
 		msi_val = xgene_msi_int_read(xgene_msi, i);
 		if (msi_val) {
 			dev_err(&pdev->dev, "Failed to clear spurious IRQ\n");
-			return EINVAL;
+			return -EINVAL;
 		}
 
 		irq = platform_get_irq(pdev, i);
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:49:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369368; cv=none; b=hwUdN57/PsQYLBYu+nhNliuDbshoYDETBDDrtsYhx5ye1VFv0ucqaFPTmJVcJKUc6pkC7i4XUCZXQhZKnfBoYfqCUbxKlaNVhxzTAZoIjKpRZJVpbSwznvT4J+g3XEtCk5uqf9DBxjr0BBWLUrEdb9JYb9E14thmcB9vWt7oNQ4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369368; c=relaxed/simple;
	bh=qC6lm2IVaGZzbW+ZH2c5gmNVuur+4Zl8vbeeziyhBMc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=kCqWYVIvLVetMmm6K5Dm9ppL3B+KlpTjXiEx4+zVaCJIGALvOrmx+ZW19y7z73yk+udvkQQJUgV3DmD9EglSOLpuGNCbymRTetKTQeoP627p6wbh9KhSNIN1fHPZ55XyTEv+QMsaXdG2Hqq2ClbGyJRnxex0Bv/7XkpcXmoTX9g=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=grxEKqmf; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	Manivannan Sadhasivam <[email-masked]>,
	Frank Li <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 221/563] PCI: endpoint: pci-ep-msi: Fix NULL vs IS_ERR() check in pci_epf_write_msi_msg()
Date: Mon, 13 Oct 2025 16:41:22 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email-masked]>

[ Upstream commit 57a75fa9d56e310e883e4377205690e88c05781b ]

The pci_epc_get() function returns error pointers. It never returns NULL.
Update the check to match.

Fixes: 1c3b002c6bf6 ("PCI: endpoint: Add RC-to-EP doorbell support using platform MSI controller")
Signed-off-by: Dan Carpenter <[email-masked]>
Signed-off-by: Manivannan Sadhasivam <[email-masked]>
Reviewed-by: Frank Li <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pci/endpoint/pci-ep-msi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/endpoint/pci-ep-msi.c b/drivers/pci/endpoint/pci-ep-msi.c
index 9ca89cbfec15d..1b58357b905fa 100644
--- a/drivers/pci/endpoint/pci-ep-msi.c
+++ b/drivers/pci/endpoint/pci-ep-msi.c
@@ -24,7 +24,7 @@ static void pci_epf_write_msi_msg(struct msi_desc *desc, struct msi_msg *msg)
 	struct pci_epf *epf;
 
 	epc = pci_epc_get(dev_name(msi_desc_to_dev(desc)));
-	if (!epc)
+	if (IS_ERR(epc))
 		return;
 
 	epf = list_first_entry_or_null(&epc->pci_epf, struct pci_epf, list);
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:49:34 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369356; cv=none; b=tQxO4xtVZleQrT/K/vpyUn1l5IvM7LqMhczmSs1fFiUVX75qAylhky5Q0oeOU1LWmyYdI6Mbvbc26HM9lRkyUXkkulaPRg+A95qBU0Wrj8F1vR6gRVxfv7KDNUCeRw0ZNasHsyWmS8mD2HrjSmZ0eVFqrSuQ8JLLdTIqveK69rQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369356; c=relaxed/simple;
	bh=DI2NAFoNFWAUkzhHhBLJDDJhCYqJx0F/UXrqBhR+NJQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=nEmhtx34Noq3uFonydx+W+++YUiQEPRZKswwMG47k6oKEcm8WZPaN70UPgz66HuW6kXIwzx+VVxzc+Sg5KzGTvy+HBFcd08OpWI4yEoT52LrbDmMMt5/+3Ob1G6PyIa8+HXYXcDVwFZ/Q4vpkzWL4TEnpHnfAKsxmvJD3TQjBVQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=UYBY0M2j; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Douglas Anderson <[email-masked]>,
	Neil Armstrong <[email-masked]>,
	Brigham Campbell <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 217/563] drm/panel: novatek-nt35560: Fix invalid return value
Date: Mon, 13 Oct 2025 16:41:18 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brigham Campbell <[email-masked]>

[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ]

Fix bug in nt35560_set_brightness() which causes the function to
erroneously report an error. mipi_dsi_dcs_write() returns either a
negative value when an error occurred or a positive number of bytes
written when no error occurred. The buggy code reports an error under
either condition.

Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel")
Reviewed-by: Douglas Anderson <[email-masked]>
Reviewed-by: Neil Armstrong <[email-masked]>
Signed-off-by: Brigham Campbell <[email-masked]>
Signed-off-by: Neil Armstrong <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
index 98f0782c84111..17898a29efe87 100644
--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl)
 		par = 0x00;
 		ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY,
 					 &par, 1);
-		if (ret) {
+		if (ret < 0) {
 			dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret);
 			return ret;
 		}
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:49:33 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369353; cv=none; b=QVwaQi2PpGargNB2hgRuubSrh1xIb/gzCWk19rhsAURTw+dGbzs5GpAJcbyF67cMZcsbX1PU8esNuhAkpIs5yZcw/1hB1Vh31DPdWpbKSKHJxgeWZ47KcCksMeDHeBUsqZwnVLKOe6lGHp3BuZREqZDOBnNrvsbIwTrPRQV22yA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369353; c=relaxed/simple;
	bh=t2OHuwNWEuuNjg3jbWJExlVAhCW857tflQhQp97n1Pc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=jdDG3hfK9s8yKuli9/CP6CouufhF7hnH+4nUvCa70dPehclAtkZO+Qh3Qhqp5UJZeRTb0L2PYB2iHhOEksbncvk9fU7WBYg2RIxwX1wVChbfdkNklfB3MRpNvx8RT5rishLUAoMvrvWErJtIIMA+90Q4Y/kcvkggp3T3L+h6I/g=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=N6+vARAq; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0204AC4CEE7;
	Mon, 13 Oct 2025 15:29:13 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760369353;
	bh=t2OHuwNWEuuNjg3jbWJExlVAhCW857tflQhQp97n1Pc=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=N6+vARAqQoH3lsxJz2glkcg55kxcMut4/gGZs5JoPZeP7wwWPbhcALhlp8jHyuLaI
	 6gAcC4jSC9u/zkjuu45gUWXZUzicy28JKyjZoDh5vbRmPrC2mQbzbYs0DI+lw5YxNV
	 mSws/XbFlxRLlOJ2zP1duSveTxRjBfOBf5sxeTfM=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Wayne Lin <[email-masked]>,
	George Shen <[email-masked]>,
	Michael Strauss <[email-masked]>,
	Alvin Lee <[email-masked]>,
	Ray Wu <[email-masked]>,
	Wenjing Liu <[email-masked]>,
	Harry Wentland <[email-masked]>,
	Tom Chung <[email-masked]>,
	Roman Li <[email-masked]>,
	Alex Hung <[email-masked]>,
	Aurabindo Pillai <[email-masked]>,
	Srinivasan Shanmugam <[email-masked]>,
	Alex Deucher <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 216/563] drm/amd/display: Reduce Stack Usage by moving audio_output into stream_res v4
Date: Mon, 13 Oct 2025 16:41:17 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Srinivasan Shanmugam <[email-masked]>

[ Upstream commit 1cf1205ef2685cf43db3785706b017d1e54e0bec ]

The function `dp_retrain_link_dp_test` currently allocates a large
audio_output array on the stack, causing the stack frame size to exceed
the compiler limit (1080 bytes > 1024 bytes).

This change prevents stack overflow issues:
amdgpu/../display/dc/link/accessories/link_dp_cts.c:65:13: warning: stack frame size (1080) exceeds limit (1024) in 'dp_retrain_link_dp_test' [-Wframe-larger-than]
static void dp_retrain_link_dp_test(struct dc_link *link,

v2: Move audio-related data like `audio_output` is kept "per pipe" to
    manage the audio for that specific display pipeline/display output path
    (stream). (Wenjing)

v3: Update in all the places where `build_audio_output` is currently
    called with a separate audio_output variable on the stack & wherever
    `audio_output` is passed to other functions
    `dce110_apply_single_controller_ctx_to_hw()` &
    `dce110_setup_audio_dto()` (like `az_configure`, `wall_dto_setup`)
    replace with usage of `pipe_ctx->stream_res.audio_output`
    to centralize audio data per pipe.

v4: Remove empty lines before `build_audio_output`. (Alex)

Fixes: 9c6669c2e21a ("drm/amd/display: Fix Link Override Sequencing When Switching Between DIO/HPO")
Cc: Wayne Lin <[email-masked]>
Cc: George Shen <[email-masked]>
Cc: Michael Strauss <[email-masked]>
Cc: Alvin Lee <[email-masked]>
Cc: Ray Wu <[email-masked]>
Cc: Wenjing Liu <[email-masked]>
Cc: Harry Wentland <[email-masked]>
Cc: Tom Chung <[email-masked]>
Cc: Roman Li <[email-masked]>
Cc: Alex Hung <[email-masked]>
Cc: Aurabindo Pillai <[email-masked]>
Signed-off-by: Srinivasan Shanmugam <[email-masked]>
Reviewed-by: Wenjing Liu <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 32 ++++++++-----------
 .../gpu/drm/amd/display/dc/inc/core_types.h   |  5 +--
 .../display/dc/link/accessories/link_dp_cts.c | 12 +++----
 .../dc/resource/dcn31/dcn31_resource.c        |  5 ++-
 .../dc/resource/dcn31/dcn31_resource.h        |  3 +-
 5 files changed, 26 insertions(+), 31 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
index 4ea13d0bf815e..c69194e04ff93 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
@@ -1600,19 +1600,17 @@ enum dc_status dce110_apply_single_controller_ctx_to_hw(
 	}
 
 	if (pipe_ctx->stream_res.audio != NULL) {
-		struct audio_output audio_output = {0};
+		build_audio_output(context, pipe_ctx, &pipe_ctx->stream_res.audio_output);
 
-		build_audio_output(context, pipe_ctx, &audio_output);
-
-		link_hwss->setup_audio_output(pipe_ctx, &audio_output,
+		link_hwss->setup_audio_output(pipe_ctx, &pipe_ctx->stream_res.audio_output,
 				pipe_ctx->stream_res.audio->inst);
 
 		pipe_ctx->stream_res.audio->funcs->az_configure(
 				pipe_ctx->stream_res.audio,
 				pipe_ctx->stream->signal,
-				&audio_output.crtc_info,
+				&pipe_ctx->stream_res.audio_output.crtc_info,
 				&pipe_ctx->stream->audio_info,
-				&audio_output.dp_link_info);
+				&pipe_ctx->stream_res.audio_output.dp_link_info);
 
 		if (dc->config.disable_hbr_audio_dp2)
 			if (pipe_ctx->stream_res.audio->funcs->az_disable_hbr_audio &&
@@ -2386,9 +2384,7 @@ static void dce110_setup_audio_dto(
 		if (pipe_ctx->stream->signal != SIGNAL_TYPE_HDMI_TYPE_A)
 			continue;
 		if (pipe_ctx->stream_res.audio != NULL) {
-			struct audio_output audio_output;
-
-			build_audio_output(context, pipe_ctx, &audio_output);
+			build_audio_output(context, pipe_ctx, &pipe_ctx->stream_res.audio_output);
 
 			if (dc->res_pool->dccg && dc->res_pool->dccg->funcs->set_audio_dtbclk_dto) {
 				struct dtbclk_dto_params dto_params = {0};
@@ -2399,14 +2395,14 @@ static void dce110_setup_audio_dto(
 				pipe_ctx->stream_res.audio->funcs->wall_dto_setup(
 						pipe_ctx->stream_res.audio,
 						pipe_ctx->stream->signal,
-						&audio_output.crtc_info,
-						&audio_output.pll_info);
+						&pipe_ctx->stream_res.audio_output.crtc_info,
+						&pipe_ctx->stream_res.audio_output.pll_info);
 			} else
 				pipe_ctx->stream_res.audio->funcs->wall_dto_setup(
 					pipe_ctx->stream_res.audio,
 					pipe_ctx->stream->signal,
-					&audio_output.crtc_info,
-					&audio_output.pll_info);
+					&pipe_ctx->stream_res.audio_output.crtc_info,
+					&pipe_ctx->stream_res.audio_output.pll_info);
 			break;
 		}
 	}
@@ -2426,15 +2422,15 @@ static void dce110_setup_audio_dto(
 				continue;
 
 			if (pipe_ctx->stream_res.audio != NULL) {
-				struct audio_output audio_output = {0};
-
-				build_audio_output(context, pipe_ctx, &audio_output);
+				build_audio_output(context,
+						   pipe_ctx,
+						   &pipe_ctx->stream_res.audio_output);
 
 				pipe_ctx->stream_res.audio->funcs->wall_dto_setup(
 					pipe_ctx->stream_res.audio,
 					pipe_ctx->stream->signal,
-					&audio_output.crtc_info,
-					&audio_output.pll_info);
+					&pipe_ctx->stream_res.audio_output.crtc_info,
+					&pipe_ctx->stream_res.audio_output.pll_info);
 				break;
 			}
 		}
diff --git a/drivers/gpu/drm/amd/display/dc/inc/core_types.h b/drivers/gpu/drm/amd/display/dc/inc/core_types.h
index f0d7185153b2a..f896cce87b8d4 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/core_types.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/core_types.h
@@ -228,8 +228,7 @@ struct resource_funcs {
 	enum dc_status (*update_dc_state_for_encoder_switch)(struct dc_link *link,
 		struct dc_link_settings *link_setting,
 		uint8_t pipe_count,
-		struct pipe_ctx *pipes,
-		struct audio_output *audio_output);
+		struct pipe_ctx *pipes);
 };
 
 struct audio_support{
@@ -361,6 +360,8 @@ struct stream_resource {
 	uint8_t gsl_group;
 
 	struct test_pattern_params test_pattern_params;
+
+	struct audio_output audio_output;
 };
 
 struct plane_resource {
diff --git a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
index 2956c2b3ad1aa..b12d61701d4d9 100644
--- a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
+++ b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
@@ -75,7 +75,6 @@ static void dp_retrain_link_dp_test(struct dc_link *link,
 	bool is_hpo_acquired;
 	uint8_t count;
 	int i;
-	struct audio_output audio_output[MAX_PIPES];
 
 	needs_divider_update = (link->dc->link_srv->dp_get_encoding_format(link_setting) !=
 	link->dc->link_srv->dp_get_encoding_format((const struct dc_link_settings *) &link->cur_link_settings));
@@ -99,7 +98,7 @@ static void dp_retrain_link_dp_test(struct dc_link *link,
 	if (needs_divider_update && link->dc->res_pool->funcs->update_dc_state_for_encoder_switch) {
 		link->dc->res_pool->funcs->update_dc_state_for_encoder_switch(link,
 				link_setting, count,
-				*pipes, &audio_output[0]);
+				*pipes);
 		for (i = 0; i < count; i++) {
 			pipes[i]->clock_source->funcs->program_pix_clk(
 					pipes[i]->clock_source,
@@ -111,15 +110,16 @@ static void dp_retrain_link_dp_test(struct dc_link *link,
 				const struct link_hwss *link_hwss = get_link_hwss(
 					link, &pipes[i]->link_res);
 
-				link_hwss->setup_audio_output(pipes[i], &audio_output[i],
-						pipes[i]->stream_res.audio->inst);
+				link_hwss->setup_audio_output(pipes[i],
+							      &pipes[i]->stream_res.audio_output,
+							      pipes[i]->stream_res.audio->inst);
 
 				pipes[i]->stream_res.audio->funcs->az_configure(
 						pipes[i]->stream_res.audio,
 						pipes[i]->stream->signal,
-						&audio_output[i].crtc_info,
+						&pipes[i]->stream_res.audio_output.crtc_info,
 						&pipes[i]->stream->audio_info,
-						&audio_output[i].dp_link_info);
+						&pipes[i]->stream_res.audio_output.dp_link_info);
 
 				if (link->dc->config.disable_hbr_audio_dp2 &&
 						pipes[i]->stream_res.audio->funcs->az_disable_hbr_audio &&
diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
index 3ed7f50554e21..ca17e5d8fdc2a 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
@@ -2239,8 +2239,7 @@ struct resource_pool *dcn31_create_resource_pool(
 enum dc_status dcn31_update_dc_state_for_encoder_switch(struct dc_link *link,
 	struct dc_link_settings *link_setting,
 	uint8_t pipe_count,
-	struct pipe_ctx *pipes,
-	struct audio_output *audio_output)
+	struct pipe_ctx *pipes)
 {
 	struct dc_state *state = link->dc->current_state;
 	int i;
@@ -2255,7 +2254,7 @@ enum dc_status dcn31_update_dc_state_for_encoder_switch(struct dc_link *link,
 
 		// Setup audio
 		if (pipes[i].stream_res.audio != NULL)
-			build_audio_output(state, &pipes[i], &audio_output[i]);
+			build_audio_output(state, &pipes[i], &pipes[i].stream_res.audio_output);
 	}
 #else
 	/* This DCN requires rate divider updates and audio reprogramming to allow DP1<-->DP2 link rate switching,
diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h
index c32c85ef0ba47..7e8fde65528f1 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.h
@@ -69,8 +69,7 @@ unsigned int dcn31_get_det_buffer_size(
 enum dc_status dcn31_update_dc_state_for_encoder_switch(struct dc_link *link,
 	struct dc_link_settings *link_setting,
 	uint8_t pipe_count,
-	struct pipe_ctx *pipes,
-	struct audio_output *audio_output);
+	struct pipe_ctx *pipes);
 
 /*temp: B0 specific before switch to dcn313 headers*/
 #ifndef regPHYPLLF_PIXCLK_RESYNC_CNTL
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:49:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369348; cv=none; b=RoTptQWJsVdgbcFeAqRGMZRPQm+aWXHTyf/7pBPsUndF8v1PSswMNNyXjpgMJxgX9Rf/VicONt7nd6yVsrv2mvGnKKSvcRzsSx5vs9QqiQDgV7Oj5uH6vU7v7K+M8FOn0qTnGnHTBD7ZuYmPg2qGZV9eh9M4VViHePdmvEiwMzg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369348; c=relaxed/simple;
	bh=zHlbfeGax2Aal3ODVM6GGp2jDrzjduEzuUxXx+jXPCY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=cj9M7xvaR/Ht9bfXABWQaFuEuljBQiQel+vFU9Uuzl7YUhsJGKrMqouGX/EQb0Ph68zgFn6v1ODZ5s5m10nz4O7mJG7WCvCZdajwpC2KIybaE4VXe9baK5b4jDlJrKJrwmdwzds5i1H/c3CbdI+vrLSrzM7q3D8HmypJOW6+kgI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=F8uScBzW; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Colin Ian King <[email-masked]>,
	Ian Forbes <[email-masked]>,
	Zack Rusin <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 215/563] drm/vmwgfx: fix missing assignment to ts
Date: Mon, 13 Oct 2025 16:41:16 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Colin Ian King <[email-masked]>

[ Upstream commit 33f8f321e7aa7715ce19560801ee5223ba8b9a7d ]

The assignment to ts is missing on the call to ktime_to_timespec64.
Fix this by adding the missing assignment.

Fixes: db6a94b26354 ("drm/vmwgfx: Implement dma_fence_ops properly")
Signed-off-by: Colin Ian King <[email-masked]>
Reviewed-by: Ian Forbes <[email-masked]>
Signed-off-by: Zack Rusin <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index c2294abbe7534..00be92da55097 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -538,7 +538,7 @@ static void vmw_event_fence_action_seq_passed(struct dma_fence *f,
 	if (likely(eaction->tv_sec != NULL)) {
 		struct timespec64 ts;
 
-		ktime_to_timespec64(f->timestamp);
+		ts = ktime_to_timespec64(f->timestamp);
 		/* monotonic time, so no y2038 overflow */
 		*eaction->tv_sec = ts.tv_sec;
 		*eaction->tv_usec = ts.tv_nsec / NSEC_PER_USEC;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:49:28 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369336; cv=none; b=K/xhOnu5b7oBVLzPcWS8sr9YIvgTZO7VldRtRVa0lPvahnWValbrFeuxLNix/7pqNszY1Tg8hSUikRGpfJADnJz0k1EF9RD+oyEtRet5hgqgGerYxD8ghhblHTJwtXP58ihcR1VRD7A+5W0CubdiRRvomKnlrD9xNW25cCXi1iA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369336; c=relaxed/simple;
	bh=hnI5s/FycRJEGna1oHiE6UAy5iUqypB9gmh2uWV6yek=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=mhgIPDZ9IwqbCF32PvOkxlpP2zqb+7joQ9F0AosB+OMHojQ5bTl1rbhox/DHSxVncuGyA2Wh9AwyT6AemaxdLKZtZwP4C/spkuhaK1IohZu9Srzo3lgF7UeKakycomPJE72kfqXOScXIl0yHGxoKTdfNIwJkhED9g6ybIo/AQtg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=F0J0M+0x; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Tvrtko Ursulin <[email-masked]>,
	=?UTF-8?q?Ma=C3=ADra=20Canal?= <[email-masked]>,
	Philipp Stanner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 211/563] drm/sched: Fix a race in DRM_GPU_SCHED_STAT_NO_HANG test
Date: Mon, 13 Oct 2025 16:41:12 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tvrtko Ursulin <[email-masked]>

[ Upstream commit 2650bc4007c15e05f995f472b4fc89e793162bc4 ]

The "skip reset" test waits for the timeout handler to run for the
duration of 2 * MOCK_TIMEOUT, and because the mock scheduler opted to
remove the "skip reset" flag once it fires, this gives opportunity for the
timeout handler to run twice. Second time the job will be removed from the
mock scheduler job list and the drm_mock_sched_advance() call in the test
will fail.

Fix it by making the "don't reset" flag persist for the lifetime of the
job and add a new flag to verify that the code path had executed as
expected.

Signed-off-by: Tvrtko Ursulin <[email-masked]>
Fixes: 1472e7549f84 ("drm/sched: Add new test for DRM_GPU_SCHED_STAT_NO_HANG")
Cc: Maíra Canal <[email-masked]>
Cc: Philipp Stanner <[email-masked]>
Reviewed-by: Maíra Canal <[email-masked]>
Signed-off-by: Philipp Stanner <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/scheduler/tests/mock_scheduler.c | 2 +-
 drivers/gpu/drm/scheduler/tests/sched_tests.h    | 7 ++++---
 drivers/gpu/drm/scheduler/tests/tests_basic.c    | 4 ++--
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
index 65acffc3fea82..8e9ae7d980eb2 100644
--- a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
+++ b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
@@ -219,7 +219,7 @@ mock_sched_timedout_job(struct drm_sched_job *sched_job)
 	unsigned long flags;
 
 	if (job->flags & DRM_MOCK_SCHED_JOB_DONT_RESET) {
-		job->flags &= ~DRM_MOCK_SCHED_JOB_DONT_RESET;
+		job->flags |= DRM_MOCK_SCHED_JOB_RESET_SKIPPED;
 		return DRM_GPU_SCHED_STAT_NO_HANG;
 	}
 
diff --git a/drivers/gpu/drm/scheduler/tests/sched_tests.h b/drivers/gpu/drm/scheduler/tests/sched_tests.h
index 63d4f2ac70749..5b262126b7760 100644
--- a/drivers/gpu/drm/scheduler/tests/sched_tests.h
+++ b/drivers/gpu/drm/scheduler/tests/sched_tests.h
@@ -95,9 +95,10 @@ struct drm_mock_sched_job {
 
 	struct completion	done;
 
-#define DRM_MOCK_SCHED_JOB_DONE		0x1
-#define DRM_MOCK_SCHED_JOB_TIMEDOUT	0x2
-#define DRM_MOCK_SCHED_JOB_DONT_RESET	0x4
+#define DRM_MOCK_SCHED_JOB_DONE			0x1
+#define DRM_MOCK_SCHED_JOB_TIMEDOUT		0x2
+#define DRM_MOCK_SCHED_JOB_DONT_RESET		0x4
+#define DRM_MOCK_SCHED_JOB_RESET_SKIPPED	0x8
 	unsigned long		flags;
 
 	struct list_head	link;
diff --git a/drivers/gpu/drm/scheduler/tests/tests_basic.c b/drivers/gpu/drm/scheduler/tests/tests_basic.c
index 55eb142bd7c5d..82a41a456b0a8 100644
--- a/drivers/gpu/drm/scheduler/tests/tests_basic.c
+++ b/drivers/gpu/drm/scheduler/tests/tests_basic.c
@@ -317,8 +317,8 @@ static void drm_sched_skip_reset(struct kunit *test)
 	KUNIT_ASSERT_FALSE(test, done);
 
 	KUNIT_ASSERT_EQ(test,
-			job->flags & DRM_MOCK_SCHED_JOB_DONT_RESET,
-			0);
+			job->flags & DRM_MOCK_SCHED_JOB_RESET_SKIPPED,
+			DRM_MOCK_SCHED_JOB_RESET_SKIPPED);
 
 	i = drm_mock_sched_advance(sched, 1);
 	KUNIT_ASSERT_EQ(test, i, 1);
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:49:20 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369330; cv=none; b=R4k5XzLQbB7kmDvofJynMhTvjYWaSRXpZNDONGZR7EP3lsBObmeHdQXTnb1kXD3haJ1B7yASNdu6nCNMPctk9p1qF6CEUpHJ5XilsihpfgbPJre2uuNQN3rbzkmvSzJ+26jRqY1DjxgHuJtlgv5abMUnpTit685F5aWcauOSt7A=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369330; c=relaxed/simple;
	bh=5zZwYoh/NuQkij9+yefiYZAfwJJW7obrLAZ4chrPKwc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=GzOeUo7EfkBb60EOJBCA6yKGjVuA8lISrKLQa/gNuFekpH7eLnqf/4id6pj6g4XtSuFR9o46I/yQj6FDbh8Ec2Tq70+Dlb8ZUAqp2fhqRhB26rii/wmuSXC57MROqRtgk+Jy5gfvCRcSFlmlMSTZOVUwLRYeat56wmBzjSeOR6s=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=TbGiNPXu; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Manikanta Guntupalli <[email-masked]>,
	Arnd Bergmann <[email-masked]>,
	Jorge Marques <[email-masked]>,
	Alexandre Belloni <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 209/563] i3c: fix big-endian FIFO transfers
Date: Mon, 13 Oct 2025 16:41:10 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email-masked]>

[ Upstream commit d6ddd9beb1a5c32acb9b80f5c2cd8b17f41371d1 ]

Short MMIO transfers that are not a multiple of four bytes in size need
a special case for the final bytes, however the existing implementation
is not endian-safe and introduces an incorrect byteswap on big-endian
kernels.

This usually does not cause problems because most systems are
little-endian and most transfers are multiple of four bytes long, but
still needs to be fixed to avoid the extra byteswap.

Change the special case for both i3c_writel_fifo() and i3c_readl_fifo()
to use non-byteswapping writesl() and readsl() with a single element
instead of the byteswapping writel()/readl() that are meant for individual
MMIO registers. As data is copied between a FIFO and a memory buffer,
the writesl()/readsl() loops are typically based on __raw_readl()/
__raw_writel(), resulting in the order of bytes in the FIFO to match
the order in the buffer, regardless of the CPU endianess.

The earlier versions in the dw-i3c and i3c-master-cdns had a correct
implementation, but the generic version that was recently added broke it.

Fixes: 733b439375b4 ("i3c: master: Add inline i3c_readl_fifo() and i3c_writel_fifo()")
Cc: Manikanta Guntupalli <[email-masked]>
Signed-off-by: Arnd Bergmann <[email-masked]>
Reviewed-by: Jorge Marques <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexandre Belloni <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i3c/internals.h | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/i3c/internals.h b/drivers/i3c/internals.h
index 0d857cc68cc5d..79ceaa5f5afd6 100644
--- a/drivers/i3c/internals.h
+++ b/drivers/i3c/internals.h
@@ -38,7 +38,11 @@ static inline void i3c_writel_fifo(void __iomem *addr, const void *buf,
 		u32 tmp = 0;
 
 		memcpy(&tmp, buf + (nbytes & ~3), nbytes & 3);
-		writel(tmp, addr);
+		/*
+		 * writesl() instead of writel() to keep FIFO
+		 * byteorder on big-endian targets
+		 */
+		writesl(addr, &tmp, 1);
 	}
 }
 
@@ -55,7 +59,11 @@ static inline void i3c_readl_fifo(const void __iomem *addr, void *buf,
 	if (nbytes & 3) {
 		u32 tmp;
 
-		tmp = readl(addr);
+		/*
+		 * readsl() instead of readl() to keep FIFO
+		 * byteorder on big-endian targets
+		 */
+		readsl(addr, &tmp, 1);
 		memcpy(buf + (nbytes & ~3), &tmp, nbytes & 3);
 	}
 }
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:49:56 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369408; cv=none; b=azF828izdhWE40fOi1RVqdhnII4sNa8HhDqjyQFtSO3jgo56lASSmsb+8BQMxY6Luvi9l/gyjHsgv94wM5wCxerlpvbnztJ3O1Ct3mGE3PGOXecrWRPsqhVaUmzOvlh5lJRgg/PCZvSDc5pIgSFeaoDxxsKeHcifuoLp55hxsxg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369408; c=relaxed/simple;
	bh=F5wS2Of/fBtGjtZ5nXZh9/6YlGl6Yn86XzXyYXR5vkY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=RtJtxX6XMBfUqh+snS/VvrJ/9lvmoAN+b1JlAYOFiNvxh6pNuW+YijlFAPKhQyTHJjWGfEHLk6EAkKU2FXguBUgRtlc76DWGnII+BCGp2G5+aPzugHH2Tt9OCEWUMvYNsnVf8NBJvS7kWTNDczs/MduqPnOxAZFi5VYyxxtIGX8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=qKaiiE2U; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Aurelien Jarno <[email-masked]>,
	Troy Mitchell <[email-masked]>,
	Wolfram Sang <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 202/563] i2c: spacemit: disable SDA glitch fix to avoid restart delay
Date: Mon, 13 Oct 2025 16:41:03 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Troy Mitchell <[email-masked]>

[ Upstream commit 11f40684ccd84e792eced110f0a5d3d6adbdf90d ]

The K1 I2C controller has an SDA glitch fix that introduces a small
delay on restart signals. While this feature can suppress glitches
on SDA when SCL = 0, it also delays the restart signal, which may
cause unexpected behavior in some transfers.

The glitch itself does not affect normal I2C operation, because
the I2C specification allows SDA to change while SCL is low.

To ensure correct transmission for every message, we disable the
SDA glitch fix by setting the RCR.SDA_GLITCH_NOFIX bit during
initialization.

This guarantees that restarts are issued promptly without
unintended delays.

Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
Reviewed-by: Aurelien Jarno <[email-masked]>
Signed-off-by: Troy Mitchell <[email-masked]>
Signed-off-by: Wolfram Sang <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i2c/busses/i2c-k1.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/i2c/busses/i2c-k1.c b/drivers/i2c/busses/i2c-k1.c
index 84f132d0504dc..9bf9f01aa68bd 100644
--- a/drivers/i2c/busses/i2c-k1.c
+++ b/drivers/i2c/busses/i2c-k1.c
@@ -14,6 +14,7 @@
 #define SPACEMIT_ICR		 0x0		/* Control register */
 #define SPACEMIT_ISR		 0x4		/* Status register */
 #define SPACEMIT_IDBR		 0xc		/* Data buffer register */
+#define SPACEMIT_IRCR		 0x18		/* Reset cycle counter */
 #define SPACEMIT_IBMR		 0x1c		/* Bus monitor register */
 
 /* SPACEMIT_ICR register fields */
@@ -76,6 +77,8 @@
 					SPACEMIT_SR_GCAD | SPACEMIT_SR_IRF | SPACEMIT_SR_ITE | \
 					SPACEMIT_SR_ALD)
 
+#define SPACEMIT_RCR_SDA_GLITCH_NOFIX		BIT(7)		/* bypass the SDA glitch fix */
+
 /* SPACEMIT_IBMR register fields */
 #define SPACEMIT_BMR_SDA         BIT(0)		/* SDA line level */
 #define SPACEMIT_BMR_SCL         BIT(1)		/* SCL line level */
@@ -237,6 +240,14 @@ static void spacemit_i2c_init(struct spacemit_i2c_dev *i2c)
 	val |= SPACEMIT_CR_MSDE | SPACEMIT_CR_MSDIE;
 
 	writel(val, i2c->base + SPACEMIT_ICR);
+
+	/*
+	 * The glitch fix in the K1 I2C controller introduces a delay
+	 * on restart signals, so we disable the fix here.
+	 */
+	val = readl(i2c->base + SPACEMIT_IRCR);
+	val |= SPACEMIT_RCR_SDA_GLITCH_NOFIX;
+	writel(val, i2c->base + SPACEMIT_IRCR);
 }
 
 static inline void
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:47:29 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369296; cv=none; b=q8Trzn+L2SssXvp/sGtwLS3j99pmbxgE1NLkl9VKWbVBN0z78hgNLM13LGTGLv8ov/WDweUfESrQlxehe3z6lg2NW41mhzqEMzVEwYU8QG9q3biw7mJ6sPbwNty5iESLXoYXVSeoYScFFGitTAhWGofTP7hgH1bZird04Eu4XBE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369296; c=relaxed/simple;
	bh=sheLHEuDuu4EdynuqsF/SKg5fFFqVIPC6zyCJjE39cE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=QqPECoGz/twUAk8XUcHd286ySCjKQVj3N3d+BHnVj719MNIi8c1okRhkHpJVRDPkWvBaT8ONRqmjnq41YX/sR8jxZFzDGsmnSr62+teNdsMlb52z5ac9WrL0lnLrg/KYQu9M/+MsgrX5/y49smVKjsd6KnRcvCpwUQxWnE0eDxo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Nhcx2ZlN; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Vadim Pasternak <[email-masked]>,
	Guenter Roeck <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 195/563] hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems
Date: Mon, 13 Oct 2025 16:40:56 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vadim Pasternak <[email-masked]>

[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ]

Distinct between fan speed setting request coming for hwmon and
thermal subsystems.

There are fields 'last_hwmon_state' and 'last_thermal_state' in the
structure 'mlxreg_fan_pwm', which respectively store the cooling state
set by the 'hwmon' and 'thermal' subsystem.
The purpose is to make arbitration of fan speed setting. For example, if
fan speed required to be not lower than some limit, such setting is to
be performed through 'hwmon' subsystem, thus 'thermal' subsystem will
not set fan below this limit.

Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing
cooling state to never be set to a lower value.

Eliminate update of 'last_thermal_state', when request is coming from
'hwmon' subsystem.

Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit")
Signed-off-by: Vadim Pasternak <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Guenter Roeck <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
index c25a54d5b39ad..0ba9195c9d713 100644
--- a/drivers/hwmon/mlxreg-fan.c
+++ b/drivers/hwmon/mlxreg-fan.c
@@ -113,8 +113,8 @@ struct mlxreg_fan {
 	int divider;
 };
 
-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
-				    unsigned long state);
+static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+				     unsigned long state, bool thermal);
 
 static int
 mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,
@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr,
 				 * last thermal state.
 				 */
 				if (pwm->last_hwmon_state >= pwm->last_thermal_state)
-					return mlxreg_fan_set_cur_state(pwm->cdev,
-									pwm->last_hwmon_state);
+					return _mlxreg_fan_set_cur_state(pwm->cdev,
+									 pwm->last_hwmon_state,
+									 false);
 				return 0;
 			}
 			return regmap_write(fan->regmap, pwm->reg, val);
@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev,
 	return 0;
 }
 
-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
-				    unsigned long state)
-
+static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+				     unsigned long state, bool thermal)
 {
 	struct mlxreg_fan_pwm *pwm = cdev->devdata;
 	struct mlxreg_fan *fan = pwm->fan;
@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
 		return -EINVAL;
 
 	/* Save thermal state. */
-	pwm->last_thermal_state = state;
+	if (thermal)
+		pwm->last_thermal_state = state;
 
 	state = max_t(unsigned long, state, pwm->last_hwmon_state);
 	err = regmap_write(fan->regmap, pwm->reg,
@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
 	return 0;
 }
 
+static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+				    unsigned long state)
+
+{
+	return _mlxreg_fan_set_cur_state(cdev, state, true);
+}
+
 static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {
 	.get_max_state	= mlxreg_fan_get_max_state,
 	.get_cur_state	= mlxreg_fan_get_cur_state,
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:54:28 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369290; cv=none; b=V61ZAdDpqzeK5URBDAlDdGIYyGqd7QtJI4B7p05PTmozFSEys7w7WX/iBLgahTQ57dUpteFso6KWxaUK6GXEHnWDLCTFpG7Ehh0NlS88I6JHUa+sUxGmKXFk8CQP1W1QRP6Yum6JZFNHtgQ5gI3TpAnXr081uju9e9jtGo9xfUc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369290; c=relaxed/simple;
	bh=BmQkQi5TBCYJy2x2Y9ouQ0qZa2zzpXV9C4xMHL9B99U=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=rL3c0pfX6U+WrRJUUqZWlud9uVt1DGqXzHLM7USpLnXNYOpLIt2ELcZWsw1Ujo4LkQo+2z79p+LIcW/7zTmVpIthPmwWpdNR3hc943yCxhHd5Mfi5T72UCnoduYM24OpxcZyoqAxI+fqMPqjDinf5YvG2kxELcTy2mILpA2N+/I=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WRiPNjb3; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	David Vernet <[email-masked]>,
	Yonghong Song <[email-masked]>,
	Andrea Righi <[email-masked]>,
	Alexei Starovoitov <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 193/563] bpf: Mark kfuncs as __noclone
Date: Mon, 13 Oct 2025 16:40:54 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrea Righi <[email-masked]>

[ Upstream commit d4680a11e14c7baf683cb8453d91d71d2e0b9d3e ]

Some distributions (e.g., CachyOS) support building the kernel with -O3,
but doing so may break kfuncs, resulting in their symbols not being
properly exported.

In fact, with gcc -O3, some kfuncs may be optimized away despite being
annotated as noinline. This happens because gcc can still clone the
function during IPA optimizations, e.g., by duplicating or inlining it
into callers, and then dropping the standalone symbol. This breaks BTF
ID resolution since resolve_btfids relies on the presence of a global
symbol for each kfunc.

Currently, this is not an issue for upstream, because we don't allow
building the kernel with -O3, but it may be safer to address it anyway,
to prevent potential issues in the future if compilers become more
aggressive with optimizations.

Therefore, add __noclone to __bpf_kfunc to ensure kfuncs are never
cloned and remain distinct, globally visible symbols, regardless of
the optimization level.

Fixes: 57e7c169cd6af ("bpf: Add __bpf_kfunc tag for marking kernel functions as kfuncs")
Acked-by: David Vernet <[email-masked]>
Acked-by: Yonghong Song <[email-masked]>
Signed-off-by: Andrea Righi <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexei Starovoitov <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 include/linux/btf.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/btf.h b/include/linux/btf.h
index 9eda6b113f9b4..f06976ffb63f9 100644
--- a/include/linux/btf.h
+++ b/include/linux/btf.h
@@ -86,7 +86,7 @@
  * as to avoid issues such as the compiler inlining or eliding either a static
  * kfunc, or a global kfunc in an LTO build.
  */
-#define __bpf_kfunc __used __retain noinline
+#define __bpf_kfunc __used __retain __noclone noinline
 
 #define __bpf_kfunc_start_defs()					       \
 	__diag_push();							       \
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:46:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369282; cv=none; b=Lg/9e/KZ+XqQD9z/x3SP0XEIDw66/2i4Vv8P04G0aB/PE8CHxzaxqhkHyr77MJLX7qfn0HhR65g8/JdnOV5Qptchge0DIIs0dM22PRFuzjTJF8V9MPSQv0MhLydQ5rGr4E+vMYtpIBufow+qcjGKhAU7+He4N8G3akSA+VvunqM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369282; c=relaxed/simple;
	bh=GFwMyrWxiZbW4Lq/lhCMvSXjcay59XAdPilzVDwnrbs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=WAjP2CX8z9+LAjFLZ532P8KEKwxMe+hxDgoSOWmShjpGgEHxn7xV6jyMor0ou9n0Zau33lLY0TvOqOI1vH/C6LejW7PkqhAtUrNGD43AVSPdiQBsrT3LpGVd0BhvlB9VTXbkxbzEOQNWGlsrzgO6/xAd0GjZWuS2BkuQgCheFG8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=oRIQfOca; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jonas Gorski <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 190/563] spi: fix return code when spi device has too many chipselects
Date: Mon, 13 Oct 2025 16:40:51 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jonas Gorski <[email-masked]>

[ Upstream commit 188f63235bcdd207646773a8739387d85347ed76 ]

Don't return a positive value when there are too many chipselects.

Fixes: 4d8ff6b0991d ("spi: Add multi-cs memories support in SPI core")
Signed-off-by: Jonas Gorski <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/spi/spi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index a388f372b27a7..19c2a6eb9922a 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2449,7 +2449,7 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi,
 	if (rc > ctlr->num_chipselect) {
 		dev_err(&ctlr->dev, "%pOF has number of CS > ctlr->num_chipselect (%d)\n",
 			nc, rc);
-		return rc;
+		return -EINVAL;
 	}
 	if ((of_property_present(nc, "parallel-memories")) &&
 	    (!(ctlr->flags & SPI_CONTROLLER_MULTI_CS))) {
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:45:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369276; cv=none; b=L18NwV2fjiITrIn93Y/Sj7JTr8jJQD4WmrHWycwZigTWkrGtrUpsIofAG3bbxVWSsqpzkOvs5107f8RbzKd4/3mhryH/ruo0M3pW0ld6mW4eFbpPySK0FQLGcivPr8YEB8iiEiSSoX+wczLY4DZKqeXNYFWpkeut+GxawceO0rs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369276; c=relaxed/simple;
	bh=6dkao3N9iNXm/80wYU5+BFWIwNJR6ZO9Rznp/+rkt9w=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=Qe97J+25KFsR4B9/mibVT4oTsft6bftv5xCs2WarvfdKOrqOSdd/mXQiLIpFWAlRbDHOHgHHJ5/biFgJYogxIPIdNwmVHT/ak3kk4cX8USGKRuNs1dMsbdNuxY5yHi1AV+MsTXU0kaOG/J3DgOYEqhRSndW+Nr4dcKwk3waidXc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Vwywniv/; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhouyi Zhou <[email-masked]>,
	=?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 189/563] tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
Date: Mon, 13 Oct 2025 16:40:50 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhouyi Zhou <[email-masked]>

[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ]

Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of
__kernel_old_time_t") made nolibc use the kernel's time type so that
`time_t` matches `timespec::tv_sec` on all ABIs (notably x32).

But since __kernel_old_time_t is fairly new, notably from 2020 in commit
94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"),
nolibc builds that rely on host headers may fail.

Switch to __kernel_time_t, which is the same as __kernel_old_time_t and
has existed for longer.

Tested in PPC VM of Open Source Lab of Oregon State University
(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh)

Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t")
Signed-off-by: Zhouyi Zhou <[email-masked]>
[Thomas: Reformat commit and its message a bit]
Signed-off-by: Thomas Weißschuh <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/include/nolibc/std.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h
index ba950f0e73384..2c1ad23b9b5c1 100644
--- a/tools/include/nolibc/std.h
+++ b/tools/include/nolibc/std.h
@@ -29,6 +29,6 @@ typedef unsigned long       nlink_t;
 typedef   signed long         off_t;
 typedef   signed long     blksize_t;
 typedef   signed long      blkcnt_t;
-typedef __kernel_old_time_t  time_t;
+typedef __kernel_time_t      time_t;
 
 #endif /* _NOLIBC_STD_H */
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:45:20 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369261; cv=none; b=AWXqqUvZzKoW6DFNRM7COMDbz8zrG8BpceN1XB/+fZklkGSjWPJTX0naoiQvE4g/OhZWflJC5RpaN+TanMGE7rDbSIqhIj15vqgIuIxkkh3wX4FYR4Y9xpCaywWibkKwvLSkrpzQ2NAQiYvEf6MZzKLqiNNZJUOSUayjFV7OcKE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369261; c=relaxed/simple;
	bh=cnmoIyxay2scur52ZzGd+pgWgjhrbNc3OniGg0D5WPQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=XWBuzXEs5xwhoe4h6Gg9U0j3YKfreCfPw2qNlmCeIhe5JwWCdnRqtrBFbsVFlOeFhqxyt2CWWaxYAC3ukcud3LPy3mFvO7NXccEI98pO74u/qJiqDzQRjV3JquAR/C9efL+eLbK5qeoVTmlF7COMuFxT1sXq3Rk4t51IhfcAV8k=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=suab8+nG; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	"Rafael J. Wysocki" <[email-masked]>,
	Thomas Gleixner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 184/563] smp: Fix up and expand the smp_call_function_many() kerneldoc
Date: Mon, 13 Oct 2025 16:40:45 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email-masked]>

[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ]

The smp_call_function_many() kerneldoc comment got out of sync with the
function definition (bool parameter "wait" is incorrectly described as a
bitmask in it), so fix it up by copying the "wait" description from the
smp_call_function() kerneldoc and add information regarding the handling
of the local CPU to it.

Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings")
Signed-off-by: Rafael J. Wysocki <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/smp.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/kernel/smp.c b/kernel/smp.c
index 56f83aa58ec82..02f52291fae42 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -884,16 +884,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask,
  * @mask: The set of cpus to run on (only runs on online subset).
  * @func: The function to run. This must be fast and non-blocking.
  * @info: An arbitrary pointer to pass to the function.
- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait
- *        (atomically) until function has completed on other CPUs. If
- *        %SCF_RUN_LOCAL is set, the function will also be run locally
- *        if the local CPU is set in the @cpumask.
- *
- * If @wait is true, then returns once @func has returned.
+ * @wait: If true, wait (atomically) until function has completed
+ *        on other CPUs.
  *
  * You must not call this function with disabled interrupts or from a
  * hardware interrupt handler or from a bottom half handler. Preemption
  * must be disabled when calling this function.
+ *
+ * @func is not called on the local CPU even if @mask contains it.  Consider
+ * using on_each_cpu_cond_mask() instead if this is not desirable.
  */
 void smp_call_function_many(const struct cpumask *mask,
 			    smp_call_func_t func, void *info, bool wait)
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:44:29 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369249; cv=none; b=XaDpJBmk7sv24WDJSCOsgYOkk/TybFf+hB6+bRP4oNIKrbe+u3m2FV8nGQ1Yy8KAWDoxNDLGeHTpLIFErSoGHs8gu594G2cEsuR18P6KbnBMg+idV9Na2YwggIq9+eD6jxG0c5Vd9X4aY8cNppK8UEfAw4RPPAhJ98dYs6+jKAM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369249; c=relaxed/simple;
	bh=/7LyWUBIeBGvVgy8h+QDDxGgGqCBi9sRM2rLDB2txJM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Cl1SzR9DC7v/DTFZiZaMW0/UDKMXxvw2up2fk/wzvRr4Bn/i/AXXmw0ecPtJkLePahypvuJ2GzY5XzHdIeBuhl0LZOkWQ9lG4ppviWf8NqnZuGYAKG43pJFG5R6ToYqRFHi13aAO6HMQcGP/2xA9wQpzj0S5Y3O54jPHw9NSY8w=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=UwCYPC1D; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Hector Martin <[email-masked]>,
	Neal Gompa <[email-masked]>,
	Sven Peter <[email-masked]>,
	Janne Grunau <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 180/563] arm64: dts: apple: t600x: Add missing WiFi properties
Date: Mon, 13 Oct 2025 16:40:41 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hector Martin <[email-masked]>

[ Upstream commit 3050713d84f58d2e4ba463c5474092fa6738c527 ]

Add compatible and antenna-sku properties to the shared node and
brcm,board-type property to individuall board device trees.

Signed-off-by: Hector Martin <[email-masked]>
Reviewed-by: Neal Gompa <[email-masked]>
Reviewed-by: Sven Peter <[email-masked]>
Signed-off-by: Janne Grunau <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sven Peter <[email-masked]>
Stable-dep-of: 6313115c55f4 ("arm64: dts: apple: Add ethernet0 alias for J375 template")
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/apple/t6000-j314s.dts      | 4 ++++
 arch/arm64/boot/dts/apple/t6000-j316s.dts      | 4 ++++
 arch/arm64/boot/dts/apple/t6001-j314c.dts      | 4 ++++
 arch/arm64/boot/dts/apple/t6001-j316c.dts      | 4 ++++
 arch/arm64/boot/dts/apple/t6001-j375c.dts      | 4 ++++
 arch/arm64/boot/dts/apple/t6002-j375d.dts      | 4 ++++
 arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi | 2 ++
 arch/arm64/boot/dts/apple/t600x-j375.dtsi      | 2 ++
 8 files changed, 28 insertions(+)

diff --git a/arch/arm64/boot/dts/apple/t6000-j314s.dts b/arch/arm64/boot/dts/apple/t6000-j314s.dts
index c9e192848fe3f..ac35870ca129c 100644
--- a/arch/arm64/boot/dts/apple/t6000-j314s.dts
+++ b/arch/arm64/boot/dts/apple/t6000-j314s.dts
@@ -16,3 +16,7 @@ / {
 	compatible = "apple,j314s", "apple,t6000", "apple,arm-platform";
 	model = "Apple MacBook Pro (14-inch, M1 Pro, 2021)";
 };
+
+&wifi0 {
+	brcm,board-type = "apple,maldives";
+};
diff --git a/arch/arm64/boot/dts/apple/t6000-j316s.dts b/arch/arm64/boot/dts/apple/t6000-j316s.dts
index ff1803ce23001..77d6d8c14d741 100644
--- a/arch/arm64/boot/dts/apple/t6000-j316s.dts
+++ b/arch/arm64/boot/dts/apple/t6000-j316s.dts
@@ -16,3 +16,7 @@ / {
 	compatible = "apple,j316s", "apple,t6000", "apple,arm-platform";
 	model = "Apple MacBook Pro (16-inch, M1 Pro, 2021)";
 };
+
+&wifi0 {
+	brcm,board-type = "apple,madagascar";
+};
diff --git a/arch/arm64/boot/dts/apple/t6001-j314c.dts b/arch/arm64/boot/dts/apple/t6001-j314c.dts
index 1761d15b98c12..0a5655792a8f1 100644
--- a/arch/arm64/boot/dts/apple/t6001-j314c.dts
+++ b/arch/arm64/boot/dts/apple/t6001-j314c.dts
@@ -16,3 +16,7 @@ / {
 	compatible = "apple,j314c", "apple,t6001", "apple,arm-platform";
 	model = "Apple MacBook Pro (14-inch, M1 Max, 2021)";
 };
+
+&wifi0 {
+	brcm,board-type = "apple,maldives";
+};
diff --git a/arch/arm64/boot/dts/apple/t6001-j316c.dts b/arch/arm64/boot/dts/apple/t6001-j316c.dts
index 750e9beeffc0a..9c215531ea543 100644
--- a/arch/arm64/boot/dts/apple/t6001-j316c.dts
+++ b/arch/arm64/boot/dts/apple/t6001-j316c.dts
@@ -16,3 +16,7 @@ / {
 	compatible = "apple,j316c", "apple,t6001", "apple,arm-platform";
 	model = "Apple MacBook Pro (16-inch, M1 Max, 2021)";
 };
+
+&wifi0 {
+	brcm,board-type = "apple,madagascar";
+};
diff --git a/arch/arm64/boot/dts/apple/t6001-j375c.dts b/arch/arm64/boot/dts/apple/t6001-j375c.dts
index 62ea437b58b25..88ca2037556ce 100644
--- a/arch/arm64/boot/dts/apple/t6001-j375c.dts
+++ b/arch/arm64/boot/dts/apple/t6001-j375c.dts
@@ -16,3 +16,7 @@ / {
 	compatible = "apple,j375c", "apple,t6001", "apple,arm-platform";
 	model = "Apple Mac Studio (M1 Max, 2022)";
 };
+
+&wifi0 {
+	brcm,board-type = "apple,okinawa";
+};
diff --git a/arch/arm64/boot/dts/apple/t6002-j375d.dts b/arch/arm64/boot/dts/apple/t6002-j375d.dts
index 3365429bdc8be..f56d13b37eaff 100644
--- a/arch/arm64/boot/dts/apple/t6002-j375d.dts
+++ b/arch/arm64/boot/dts/apple/t6002-j375d.dts
@@ -38,6 +38,10 @@ hpm5: usb-pd@3a {
 	};
 };
 
+&wifi0 {
+	brcm,board-type = "apple,okinawa";
+};
+
 /* delete unused always-on power-domains on die 1 */
 
 /delete-node/ &ps_atc2_usb_aon_die1;
diff --git a/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi b/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
index 22ebc78e120bf..b699672a5543c 100644
--- a/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
+++ b/arch/arm64/boot/dts/apple/t600x-j314-j316.dtsi
@@ -99,9 +99,11 @@ &port00 {
 	/* WLAN */
 	bus-range = <1 1>;
 	wifi0: wifi@0,0 {
+		compatible = "pci14e4,4433";
 		reg = <0x10000 0x0 0x0 0x0 0x0>;
 		/* To be filled by the loader */
 		local-mac-address = [00 10 18 00 00 10];
+		apple,antenna-sku = "XX";
 	};
 };
 
diff --git a/arch/arm64/boot/dts/apple/t600x-j375.dtsi b/arch/arm64/boot/dts/apple/t600x-j375.dtsi
index d5b985ad56793..95560bf3798bf 100644
--- a/arch/arm64/boot/dts/apple/t600x-j375.dtsi
+++ b/arch/arm64/boot/dts/apple/t600x-j375.dtsi
@@ -84,9 +84,11 @@ &port00 {
 	/* WLAN */
 	bus-range = <1 1>;
 	wifi0: wifi@0,0 {
+		compatible = "pci14e4,4433";
 		reg = <0x10000 0x0 0x0 0x0 0x0>;
 		/* To be filled by the loader */
 		local-mac-address = [00 10 18 00 00 10];
+		apple,antenna-sku = "XX";
 	};
 };
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:44:12 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369235; cv=none; b=aaFo6htfKU6NgSX49qT+DgHk0GRQaEY+TzG2t9Z+VkqWnrDi+a7zgtHbOdhoJ3cMqvXyOKGKuNTwbZfHautZm64QqYYs4GdUp9NrhYmUXtJqn42JvB0lYCT9tFmjnDwI7PLilHDKrn6GAYnfYhmoVSdRNU9s4Q4lJXEOBgNXY1s=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369235; c=relaxed/simple;
	bh=OiUM+tk5Jfd3BChCxDjczN8PHMIoIIBuwU/SnJJTJhw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=qhN3la3zEhPE3iDHBy1BDokFj7e7uh1qUYPWqkJuAHP6vhaVQbTMGiqToOwXsBcN5Nhvsk927VhQb8bGoNQLYUoVA16a6+8CZDjg3CxZ4F272hyLXpDOcER9UnXGUSELSaMlmo/VMIIF/i8hyXdGybSyj3y5Kv4X7pcSpMWeGXo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=m0V4+9bW; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Andr=C3=A9=20Almeida?= <[email-masked]>,
	Sebastian Andrzej Siewior <[email-masked]>,
	"Peter Zijlstra (Intel)" <[email-masked]>,
	Waiman Long <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 176/563] selftest/futex: Make the error check more precise for futex_numa_mpol
Date: Mon, 13 Oct 2025 16:40:37 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: André Almeida <[email-masked]>

[ Upstream commit c1c863457780adfb2e29fa9a85897179ad3903e6 ]

Instead of just checking if the syscall failed as expected, check as
well if the returned error code matches the expected error code.

[ bigeasy: reword the commmit message ]

Signed-off-by: André Almeida <[email-masked]>
Signed-off-by: Sebastian Andrzej Siewior <[email-masked]>
Signed-off-by: Peter Zijlstra (Intel) <[email-masked]>
Reviewed-by: Waiman Long <[email-masked]>
Stable-dep-of: ed323aeda5e0 ("selftest/futex: Compile also with libnuma < 2.0.16")
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../futex/functional/futex_numa_mpol.c        | 36 +++++++++++--------
 1 file changed, 21 insertions(+), 15 deletions(-)

diff --git a/tools/testing/selftests/futex/functional/futex_numa_mpol.c b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
index 802c15c821906..dd7b05e8cda45 100644
--- a/tools/testing/selftests/futex/functional/futex_numa_mpol.c
+++ b/tools/testing/selftests/futex/functional/futex_numa_mpol.c
@@ -77,7 +77,7 @@ static void join_max_threads(void)
 	}
 }
 
-static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flags)
+static void __test_futex(void *futex_ptr, int err_value, unsigned int futex_flags)
 {
 	int to_wake, ret, i, need_exit = 0;
 
@@ -88,11 +88,17 @@ static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flag
 
 	do {
 		ret = futex2_wake(futex_ptr, to_wake, futex_flags);
-		if (must_fail) {
-			if (ret < 0)
-				break;
-			ksft_exit_fail_msg("futex2_wake(%d, 0x%x) should fail, but didn't\n",
-					   to_wake, futex_flags);
+
+		if (err_value) {
+			if (ret >= 0)
+				ksft_exit_fail_msg("futex2_wake(%d, 0x%x) should fail, but didn't\n",
+						   to_wake, futex_flags);
+
+			if (errno != err_value)
+				ksft_exit_fail_msg("futex2_wake(%d, 0x%x) expected error was %d, but returned %d (%s)\n",
+						   to_wake, futex_flags, err_value, errno, strerror(errno));
+
+			break;
 		}
 		if (ret < 0) {
 			ksft_exit_fail_msg("Failed futex2_wake(%d, 0x%x): %m\n",
@@ -106,12 +112,12 @@ static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flag
 	join_max_threads();
 
 	for (i = 0; i < MAX_THREADS; i++) {
-		if (must_fail && thread_args[i].result != -1) {
+		if (err_value && thread_args[i].result != -1) {
 			ksft_print_msg("Thread %d should fail but succeeded (%d)\n",
 				       i, thread_args[i].result);
 			need_exit = 1;
 		}
-		if (!must_fail && thread_args[i].result != 0) {
+		if (!err_value && thread_args[i].result != 0) {
 			ksft_print_msg("Thread %d failed (%d)\n", i, thread_args[i].result);
 			need_exit = 1;
 		}
@@ -120,14 +126,14 @@ static void __test_futex(void *futex_ptr, int must_fail, unsigned int futex_flag
 		ksft_exit_fail_msg("Aborting due to earlier errors.\n");
 }
 
-static void test_futex(void *futex_ptr, int must_fail)
+static void test_futex(void *futex_ptr, int err_value)
 {
-	__test_futex(futex_ptr, must_fail, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA);
+	__test_futex(futex_ptr, err_value, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA);
 }
 
-static void test_futex_mpol(void *futex_ptr, int must_fail)
+static void test_futex_mpol(void *futex_ptr, int err_value)
 {
-	__test_futex(futex_ptr, must_fail, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA | FUTEX2_MPOL);
+	__test_futex(futex_ptr, err_value, FUTEX2_SIZE_U32 | FUTEX_PRIVATE_FLAG | FUTEX2_NUMA | FUTEX2_MPOL);
 }
 
 static void usage(char *prog)
@@ -184,16 +190,16 @@ int main(int argc, char *argv[])
 
 	/* FUTEX2_NUMA futex must be 8-byte aligned */
 	ksft_print_msg("Mis-aligned futex\n");
-	test_futex(futex_ptr + mem_size - 4, 1);
+	test_futex(futex_ptr + mem_size - 4, EINVAL);
 
 	futex_numa->numa = FUTEX_NO_NODE;
 	mprotect(futex_ptr, mem_size, PROT_READ);
 	ksft_print_msg("Memory, RO\n");
-	test_futex(futex_ptr, 1);
+	test_futex(futex_ptr, EFAULT);
 
 	mprotect(futex_ptr, mem_size, PROT_NONE);
 	ksft_print_msg("Memory, no access\n");
-	test_futex(futex_ptr, 1);
+	test_futex(futex_ptr, EFAULT);
 
 	mprotect(futex_ptr, mem_size, PROT_READ | PROT_WRITE);
 	ksft_print_msg("Memory back to RW\n");
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:44:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369224; cv=none; b=l4L4XCf9MpkzFhu3nlq7NsZ+yDayAbN78/25W3ALGVz9Ue34gl54OrWFJQsY3GDDIx0KEWsnqKTAi/E5uYeV9jtGgVRXEJBGBbZAkJpNqP7bomKJpNPB6MTbwNlDkDrZv48boQzgNJMTsMVIlG86J5xorWKk8OsnQOdiRz0zeQI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369224; c=relaxed/simple;
	bh=H5wjjLNruY6/cSC/elI9joYxf2kVzBI6i0qa62zH9Fs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=capHTBfQO2m+rgNGvjv46IeNaJ0igHO9p2DpJhTeZNnjsV8ocfefTX8wdVObhZ9PQJ/ztW3uaU3tk+E39ajuXK6QlG8EuvAXrwaZK6QQIPdomN5akT5JNmQBsjAD6NrK+QpPJ0Xa+s2E4Jat+xGmwvkhBigkqXRDLJt+xzGFICE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=b4/iZIDl; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yi Zhang <[email-masked]>,
	Yu Kuai <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 172/563] blk-throttle: fix throtl_data leak during disk release
Date: Mon, 13 Oct 2025 16:40:33 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yu Kuai <[email-masked]>

[ Upstream commit 336aec7b06be860477be80a4299263a2e9355789 ]

Tightening the throttle activation check in blk_throtl_activated() to
require both q->td presence and policy bit set introduced a memory leak
during disk release:

blkg_destroy_all() clears the policy bit first during queue deactivation,
causing subsequent blk_throtl_exit() to skip throtl_data cleanup when
blk_throtl_activated() fails policy check.

Idealy we should avoid modifying blk_throtl_exit() activation check because
it's intuitive that blk-throtl start from blk_throtl_init() and end in
blk_throtl_exit(). However, call blk_throtl_exit() before
blkg_destroy_all() will make a long term deadlock problem easier to
trigger[1], hence fix this problem by checking if q->td is NULL from
blk_throtl_exit(), and remove policy deactivation as well since it's
useless.

[1] https://lore.kernel.org/all/CAHj4cs9p9H5yx+ywsb3CMUdbqGPhM+8tuBvhW=[email-masked]/#t

Fixes: bd9fd5be6bc0 ("blk-throttle: fix access race during throttle policy activation")
Reported-by: Yi Zhang <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]/
Signed-off-by: Yu Kuai <[email-masked]>
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/blk-throttle.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index f510ae072868c..2c5b64b1a724a 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -1842,12 +1842,15 @@ void blk_throtl_exit(struct gendisk *disk)
 {
 	struct request_queue *q = disk->queue;
 
-	if (!blk_throtl_activated(q))
+	/*
+	 * blkg_destroy_all() already deactivate throtl policy, just check and
+	 * free throtl data.
+	 */
+	if (!q->td)
 		return;
 
 	timer_delete_sync(&q->td->service_queue.pending_timer);
 	throtl_shutdown_wq(q);
-	blkcg_deactivate_policy(disk, &blkcg_policy_throtl);
 	kfree(q->td);
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:51:15 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369218; cv=none; b=WP3YEHWke92I5OTwBYuzAsK+9zpKsoojnLNmOcxfZiIQkesOEJVDzJPWYxggom3NIOMFlfoKi5ZCDElaxuIxshCm4oJGa1nngYFa5Ob7LXf6bDQ/Z/wy+KZUXTcXU41VvfGmKEEa66E3lP6qiZzgLdYMkJI8SP3JfZjK8D4MrH4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369218; c=relaxed/simple;
	bh=ZptFrQa9F44TCl5kpDAgn+KNWNTPw/xnOYy0P7yvscs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=tuWgTufEaicq5sBg9nx8MHikdR54JCQMp4INkD/ggKQzt2DmziJzzR+PSU6QiaDcfE5ldltZfb3g9225zvE9siafJAjRvrLjXbCPKRmOVC0mmh+b2LOifLEhAeFgM61xRONmaDpzPOd70MPw8k4Be/zml/JmHoKGVTjSAAfTH30=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zRRJ+4Zf; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Akhilesh Patil <[email-masked]>,
	Shuah Khan <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 170/563] selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
Date: Mon, 13 Oct 2025 16:40:31 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Akhilesh Patil <[email-masked]>

[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]

Check if watchdog device supports WDIOF_KEEPALIVEPING option before
entering keep_alive() ping test loop. Fix watchdog-test silently looping
if ioctl based ping is not supported by the device. Exit from test in
such case instead of getting stuck in loop executing failing keep_alive()

watchdog_info:
 identity:              m41t93 rtc Watchdog
 firmware_version:      0
Support/Status: Set timeout (in seconds)
Support/Status: Watchdog triggers a management or other external alarm not a reboot

Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.
WDIOC_KEEPALIVE not supported by this device

without this change
Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.
Watchdog Ticking Away!
(Where test stuck here forver silently)

Updated change log at commit time:
Shuah Khan <[email-masked]>

Link: https://lore.kernel.org/r/[email-masked]
Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path")
Signed-off-by: Akhilesh Patil <[email-masked]>
Signed-off-by: Shuah Khan <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
index a1f506ba55786..4f09c5db0c7f3 100644
--- a/tools/testing/selftests/watchdog/watchdog-test.c
+++ b/tools/testing/selftests/watchdog/watchdog-test.c
@@ -332,6 +332,12 @@ int main(int argc, char *argv[])
 	if (oneshot)
 		goto end;
 
+	/* Check if WDIOF_KEEPALIVEPING is supported */
+	if (!(info.options & WDIOF_KEEPALIVEPING)) {
+		printf("WDIOC_KEEPALIVE not supported by this device\n");
+		goto end;
+	}
+
 	printf("Watchdog Ticking Away!\n");
 
 	/*
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:55:10 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369307; cv=none; b=T6X69GJh/lUgk7v/FMt225GdQdPFdNo0dg4TzOglOCbK332GbjwWQnHsGqIoFZwFkqEps8Q+L/tyjhqRh4CR398F9fQL87FKUVzhiZWfDiwMMKJ7ZfHOZHBMzsdPpk3960UmwdY+4kNIrrOFr0YpGetYDFn065k6yq8HzrKNJPk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369307; c=relaxed/simple;
	bh=v6muUyFG6d0Yeo78bfkygZaMmSyVTjJUFG3/XAt9LTA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=RSJlvHGhmAn8m88bOfUmgqklXU+LkgNUsl6TEeHWrC56l3fwRMQjiEIILKv1K/+lQvG7G3XWIJgzTJoktZlVxJihsjOxcUJAmocPezlWvI1IACSvFTUVtOnxqCmyqMVo7wr1ytm/wf9fjGfDY9g4Ir8ZAxjL/LPWkYCgWo/P3aw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0ibMkKRJ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Stanley Chu <[email-masked]>,
	Frank Li <[email-masked]>,
	Alexandre Belloni <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 167/563] i3c: master: svc: Recycle unused IBI slot
Date: Mon, 13 Oct 2025 16:40:28 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stanley Chu <[email-masked]>

[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ]

In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool
to store the IBI payload. However, when an error condition is encountered,
the function returns without recycling the IBI slot, resulting in an IBI
slot leak.

Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte")
Signed-off-by: Stanley Chu <[email-masked]>
Reviewed-by: Frank Li <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexandre Belloni <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i3c/master/svc-i3c-master.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index 8e7b4ab919e3d..9641e66a4e5f2 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -417,6 +417,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,
 						SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000);
 	if (ret) {
 		dev_err(master->dev, "Timeout when polling for COMPLETE\n");
+		i3c_generic_ibi_recycle_slot(data->ibi_pool, slot);
 		return ret;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:48:25 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369304; cv=none; b=p0gM5wXLQXrfhJfU7gYnrfRLsdbdWcXzPN8R61ZfArCm67ohIc3tbf8F68K4Q/UosvBoEcpYQnpHOV43nhwtuX73Ps1MuvUuzHsnH6mdyDKxaOYVrj0RWg6u3d0l+2/ZCoulE7BYfBB5jgGVZALgDejH9Q/M5+2/yXsgWMVrFFQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369304; c=relaxed/simple;
	bh=Xz03bDBjR0PdCsE3sAvFR1sw+AW4PX9opUqXQWp+cso=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=oNwZN+J1G7JRxBd9Ev5sbarvTcAC7c10JmlX3JHbrUpxIcDTpKlftm76hEBgP97D+ZI91/1n5Qi49CTvTiDTS7E9mIx/7O+pfsjZjSAP3kbqUgFonqjHQZHUX+wXmvWBmb24xOzjbBuDIsGouxEA4reVFybyQi+f6utKoTgViHw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KN3ChKAf; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Stanley Chu <[email-masked]>,
	Frank Li <[email-masked]>,
	Alexandre Belloni <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 166/563] i3c: master: svc: Use manual response for IBI events
Date: Mon, 13 Oct 2025 16:40:27 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stanley Chu <[email-masked]>

[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ]

Driver wants to nack the IBI request when the target is not in the
known address list. In below code, svc_i3c_master_nack_ibi() will
cause undefined behavior when using AUTOIBI with auto response rule,
because hw always auto ack the IBI request.

    switch (ibitype) {
    case SVC_I3C_MSTATUS_IBITYPE_IBI:
            dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
            if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
                    svc_i3c_master_nack_ibi(master);
            ...
            break;

AutoIBI has another issue that the controller doesn't quit AutoIBI state
after IBIWON polling timeout when there is a SDA glitch(high->low->high).
1. SDA high->low: raising an interrupt to execute IBI ISR
2. SDA low->high
3. Driver writes an AutoIBI request
4. AutoIBI process does not start because SDA is not low
5. IBIWON polling times out
6. Controller reamins in AutoIBI state and doesn't accept EmitStop request

Emitting broadcast address with IBIRESP_MANUAL avoids both issues.

Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
Signed-off-by: Stanley Chu <[email-masked]>
Reviewed-by: Frank Li <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexandre Belloni <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index 701ae165b25b7..8e7b4ab919e3d 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -517,9 +517,24 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
 	 */
 	writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS);
 
-	/* Acknowledge the incoming interrupt with the AUTOIBI mechanism */
-	writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI |
-	       SVC_I3C_MCTRL_IBIRESP_AUTO,
+	/*
+	 * Write REQUEST_START_ADDR request to emit broadcast address for arbitration,
+	 * instend of using AUTO_IBI.
+	 *
+	 * Using AutoIBI request may cause controller to remain in AutoIBI state when
+	 * there is a glitch on SDA line (high->low->high).
+	 * 1. SDA high->low, raising an interrupt to execute IBI isr.
+	 * 2. SDA low->high.
+	 * 3. IBI isr writes an AutoIBI request.
+	 * 4. The controller will not start AutoIBI process because SDA is not low.
+	 * 5. IBIWON polling times out.
+	 * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request.
+	 */
+	writel(SVC_I3C_MCTRL_REQUEST_START_ADDR |
+	       SVC_I3C_MCTRL_TYPE_I3C |
+	       SVC_I3C_MCTRL_IBIRESP_MANUAL |
+	       SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) |
+	       SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR),
 	       master->regs + SVC_I3C_MCTRL);
 
 	/* Wait for IBIWON, should take approximately 100us */
@@ -539,10 +554,15 @@ static void svc_i3c_master_ibi_isr(struct svc_i3c_master *master)
 	switch (ibitype) {
 	case SVC_I3C_MSTATUS_IBITYPE_IBI:
 		dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
-		if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
+		if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) {
 			svc_i3c_master_nack_ibi(master);
-		else
+		} else {
+			if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD)
+				svc_i3c_master_ack_ibi(master, true);
+			else
+				svc_i3c_master_ack_ibi(master, false);
 			svc_i3c_master_handle_ibi(master, dev);
+		}
 		break;
 	case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN:
 		if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN))
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:48:06 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369299; cv=none; b=BAMRzh42ffD1BXMiGAZisuJqs2vGp9yjXhPAle1hnb+tvqfpZa7fDeNhtVgIiNhgeIQE1JJffr63MeYIYQn0ndkZIClTH09cC3jOMeXRDcyEyEUE+BiWQ7KjcJNess5PlwOmXipz8zmy4b+xXTtKOtwkQA3NT5z4zYUvzrlcIBw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369299; c=relaxed/simple;
	bh=+PCIuAvnutkTUpjffJC9KqJMNJpmjWis+V7BcUO3sBw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Mhk9NSjm1BuY8+Wi0dM8Wr/NEIZYJqgBOWj2rei+cpm8FpnOjuIJO3T5iq0aIRyMd3g5ZJ0TzSC+q0QTVLkpzwZs1qHXspamH3P9ZBVtpMcFXfBZ7VGW4jdeO0tzyhoAdj3u76a0Vt/n1/HRyBL+v1gukjybQ6EIJMtjU6+8qGE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=SJWRjUd2; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yi Zhang <[email-masked]>,
	Hannes Reinecke <[email-masked]>,
	Daniel Wagner <[email-masked]>,
	Keith Busch <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 164/563] nvmet-fcloop: call done callback even when remote port is gone
Date: Mon, 13 Oct 2025 16:40:25 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Wagner <[email-masked]>

[ Upstream commit 10c165af35d225eb033f4edc7fcc699a8d2d533d ]

When the target port is gone, it's not possible to access any of the
request resources. The function should just silently drop the response.
The comment is misleading in this regard.

Though it's still necessary to call the driver via the ->done callback
so the driver is able to release all resources.

Reported-by: Yi Zhang <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]/
Fixes: 84eedced1c5b ("nvmet-fcloop: drop response if targetport is gone")
Reviewed-by: Hannes Reinecke <[email-masked]>
Signed-off-by: Daniel Wagner <[email-masked]>
Signed-off-by: Keith Busch <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/nvme/target/fcloop.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
index 257b497d515a8..5dffcc5becae8 100644
--- a/drivers/nvme/target/fcloop.c
+++ b/drivers/nvme/target/fcloop.c
@@ -496,13 +496,15 @@ fcloop_t2h_xmt_ls_rsp(struct nvme_fc_local_port *localport,
 	if (!targetport) {
 		/*
 		 * The target port is gone. The target doesn't expect any
-		 * response anymore and the ->done call is not valid
-		 * because the resources have been freed by
-		 * nvmet_fc_free_pending_reqs.
+		 * response anymore and thus lsreq can't be accessed anymore.
 		 *
 		 * We end up here from delete association exchange:
 		 * nvmet_fc_xmt_disconnect_assoc sends an async request.
+		 *
+		 * Return success because this is what LLDDs do; silently
+		 * drop the response.
 		 */
+		lsrsp->done(lsrsp);
 		kmem_cache_free(lsreq_cache, tls_req);
 		return 0;
 	}
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:46:26 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369278; cv=none; b=mVODFcpxgL88IwE2lPsb7IIRi866vwAezJfL2kHx5V4H3joxZkyay6Vhmmb8CXxEz04Mfbo8ewK5Q2v2TteaLwFX556eZTI+yxVRTV2Vyhr89oAQVDI835ZZ2SbqW0g35ML9oxt/IYrpxXROX0UMQ2iEA63+BZ6LjpkMj3tfavQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369278; c=relaxed/simple;
	bh=+g8a78zURAS++fvM5nmoU1wZ2Lq0bDNcgYmoXu/rDfg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=ORLEb9LMyEO5pkTcQI5yeXjEHc1aaVMAg76+8O2oR4IxAbI7KLOShGlzIM6qAm1EVns49sKPkmAV5plReqJXAlIGDl7TwkBL8Vo/+BLUHXTvL1TCm6ZSQmqRgN4IbGfv5Sje6xmMrcw8Fgs6yHyvZ4OS0kF+o637bl/iM2bkOCA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aUCCx8Rw; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Hannes Reinecke <[email-masked]>,
	Daniel Wagner <[email-masked]>,
	Keith Busch <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 163/563] nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
Date: Mon, 13 Oct 2025 16:40:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Wagner <[email-masked]>

[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ]

It’s possible for more than one async command to be in flight from
__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.

In the current code, only one put work item is queued at a time, which
results in a leaked reference.

To fix this, move the work item to the nvmet_fc_ls_req_op struct, which
already tracks all resources related to the command.

Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path")
Reviewed-by: Hannes Reinecke <[email-masked]>
Signed-off-by: Daniel Wagner <[email-masked]>
Signed-off-by: Keith Busch <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/nvme/target/fc.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index a9b18c051f5bd..6725c34dd7c90 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op {		/* for an LS RQST XMT */
 	int				ls_error;
 	struct list_head		lsreq_list; /* tgtport->ls_req_list */
 	bool				req_queued;
+
+	struct work_struct		put_work;
 };

@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport {
 	struct nvmet_fc_port_entry	*pe;
 	struct kref			ref;
 	u32				max_sg_cnt;
-
-	struct work_struct		put_work;
 };
 
 struct nvmet_fc_port_entry {
@@ -235,12 +235,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc);
 static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
 static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
 static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
-static void nvmet_fc_put_tgtport_work(struct work_struct *work)
+static void nvmet_fc_put_lsop_work(struct work_struct *work)
 {
-	struct nvmet_fc_tgtport *tgtport =
-		container_of(work, struct nvmet_fc_tgtport, put_work);
+	struct nvmet_fc_ls_req_op *lsop =
+		container_of(work, struct nvmet_fc_ls_req_op, put_work);
 
-	nvmet_fc_tgtport_put(tgtport);
+	nvmet_fc_tgtport_put(lsop->tgtport);
+	kfree(lsop);
 }
 static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
 static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
@@ -367,7 +368,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
 				  DMA_BIDIRECTIONAL);
 
 out_putwork:
-	queue_work(nvmet_wq, &tgtport->put_work);
+	queue_work(nvmet_wq, &lsop->put_work);
 }
 
 static int
@@ -388,6 +389,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport,
 	lsreq->done = done;
 	lsop->req_queued = false;
 	INIT_LIST_HEAD(&lsop->lsreq_list);
+	INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work);
 
 	lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr,
 				  lsreq->rqstlen + lsreq->rsplen,
@@ -447,8 +449,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status)
 	__nvmet_fc_finish_ls_req(lsop);
 
 	/* fc-nvme target doesn't care about success or failure of cmd */
-
-	kfree(lsop);
 }
 
 /*
@@ -1410,7 +1410,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
 	kref_init(&newrec->ref);
 	ida_init(&newrec->assoc_cnt);
 	newrec->max_sg_cnt = template->max_sgl_segments;
-	INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work);
 
 	ret = nvmet_fc_alloc_ls_iodlist(newrec);
 	if (ret) {
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:44:27 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369247; cv=none; b=blsANDE6nz4kWKiE2ra1c3BFm3bpPr/OKHwykvsKRbQie9lBf+ilBbvUHys/pkvgwbvqwyaXDDTScRDui9UGfuo0T7CNGgAftSemAWz2K51hGXbcDTDIKEV5si3q39X+43MRg0IKX4+8kL+CRxojPl56UM4vHLQNZYBCU97gtAM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369247; c=relaxed/simple;
	bh=BhEdtwNnZzwvLFWNRP33UjJ5TQzx4wIF81bBJq0zSc4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=OFE6ShKkM66QQoPqY1l2smJeDlPUHKUxyNhoerixz3+WpgJpPgTX2xOUa2T8z2z02Jm6cv0wjQY6MZ55FBaGa3SRZO9J4gpEdPnWtMi/iJH6kHdy5PxnuBhJyeEqL+fk6ZDZz9rCkUL9gJHIE6eCgi+VS8Nt7aS8rUDYJPCQSWI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OL36bCbS; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Martin George <[email-masked]>,
	Hannes Reinecke <[email-masked]>,
	Keith Busch <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 162/563] nvme-auth: update bi_directional flag
Date: Mon, 13 Oct 2025 16:40:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Martin George <[email-masked]>

[ Upstream commit 6ff1bd7846680dfdaafc68d7fcd0ab7e3bcbc4a0 ]

While setting chap->s2 to zero as part of secure channel
concatenation, the host missed out to disable the bi_directional
flag to indicate that controller authentication is not requested.
Fix the same.

Fixes: e88a7595b57f ("nvme-tcp: request secure channel concatenation")
Signed-off-by: Martin George <[email-masked]>
Reviewed-by: Hannes Reinecke <[email-masked]>
Signed-off-by: Keith Busch <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/nvme/host/auth.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
index 201fc8809a628..012fcfc79a73b 100644
--- a/drivers/nvme/host/auth.c
+++ b/drivers/nvme/host/auth.c
@@ -331,9 +331,10 @@ static int nvme_auth_set_dhchap_reply_data(struct nvme_ctrl *ctrl,
 	} else {
 		memset(chap->c2, 0, chap->hash_len);
 	}
-	if (ctrl->opts->concat)
+	if (ctrl->opts->concat) {
 		chap->s2 = 0;
-	else
+		chap->bi_directional = false;
+	} else
 		chap->s2 = nvme_auth_get_seqnum();
 	data->seqnum = cpu_to_le32(chap->s2);
 	if (chap->host_key_len) {
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:41:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369193; cv=none; b=iq604LRvuXs+p4qP54aRBsgOpIyqc+n+OR3rdONwrP1QwgQXwdAKPXhkEXTVP6uj1vizmHZUCDP2z7zzxrburaK6JC99PPG8pV9GxI0wQztdo5wL4CfUwuv9gPKnWO2o97cQWf3uHSNJKeVDsml17zCrEW47bT5ppuFn1EyVC6k=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369193; c=relaxed/simple;
	bh=e+O9cjkwgBDmGPnZfpp/F6xXI6kcbP5oJnDxy4Ley9g=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=a9HBnIkOi7dKq8OVYO5FXGqI5sJXl5huyXAJQx6uwsl/K/THaYYtrvf8v7MTPF7ij9SwVBGxb6VmApO0ckZux08MDE/3GYcb9c18x9EdZYQkTAIIHRgUX5EGTMiEaph4ecb5+SnnwBCBQFjIAYDRCqdDBz2GVHzrP30FECgImvw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vItVGPPg; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ahmed Salem <[email-masked]>,
	"Rafael J. Wysocki" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 159/563] ACPICA: Apply ACPI_NONSTRING
Date: Mon, 13 Oct 2025 16:40:20 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ahmed Salem <[email-masked]>

[ Upstream commit 12fd607554c4efb4856959f0e5823f541bc0e701 ]

Add ACPI_NONSTRING for destination char arrays without a terminating NUL
character.

This is a follow-up to commit 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING")
where a few more destination arrays were missed.

Link: https://github.com/acpica/acpica/commit/f359e5ed
Fixes: 2b82118845e0 ("ACPICA: Apply ACPI_NONSTRING")
Signed-off-by: Ahmed Salem <[email-masked]>
Signed-off-by: Rafael J. Wysocki <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 include/acpi/actbl.h                                     | 2 +-
 tools/power/acpi/os_specific/service_layers/oslinuxtbl.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/acpi/actbl.h b/include/acpi/actbl.h
index 243097a3da636..8a67d4ea6e3fe 100644
--- a/include/acpi/actbl.h
+++ b/include/acpi/actbl.h
@@ -73,7 +73,7 @@ struct acpi_table_header {
 	char oem_id[ACPI_OEM_ID_SIZE] ACPI_NONSTRING;	/* ASCII OEM identification */
 	char oem_table_id[ACPI_OEM_TABLE_ID_SIZE] ACPI_NONSTRING;	/* ASCII OEM table identification */
 	u32 oem_revision;	/* OEM revision number */
-	char asl_compiler_id[ACPI_NAMESEG_SIZE];	/* ASCII ASL compiler vendor ID */
+	char asl_compiler_id[ACPI_NAMESEG_SIZE] ACPI_NONSTRING;	/* ASCII ASL compiler vendor ID */
 	u32 asl_compiler_revision;	/* ASL compiler version */
 };
 
diff --git a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
index 9741e7503591c..de93067a5da32 100644
--- a/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
+++ b/tools/power/acpi/os_specific/service_layers/oslinuxtbl.c
@@ -995,7 +995,7 @@ static acpi_status osl_list_customized_tables(char *directory)
 {
 	void *table_dir;
 	u32 instance;
-	char temp_name[ACPI_NAMESEG_SIZE];
+	char temp_name[ACPI_NAMESEG_SIZE] ACPI_NONSTRING;
 	char *filename;
 	acpi_status status = AE_OK;
 
@@ -1312,7 +1312,7 @@ osl_get_customized_table(char *pathname,
 {
 	void *table_dir;
 	u32 current_instance = 0;
-	char temp_name[ACPI_NAMESEG_SIZE];
+	char temp_name[ACPI_NAMESEG_SIZE] ACPI_NONSTRING;
 	char table_filename[PATH_MAX];
 	char *filename;
 	acpi_status status;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:40:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369190; cv=none; b=IIRQT3v4L/axmey0wADQjL0ZOKoMYKXgzfnterBjOcdwtXhUrVAL0zwYC3zwpsN86LYbGxK6Ys60SgJ0r+viqPtlu20tRgLukx566dTnQXkshtz3BDTUAUjc/oXFf105Jggr4spMJvlJIGFryBj1crKmX+FoKWISUj3gc+fTjVM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369190; c=relaxed/simple;
	bh=Qsk7r1vTd9BDaXtqhWgA7jubrV6PkfkBcFUAavTfOJ0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=o3HMumhq7lP54KtNt3wYewWcgeINUkrKrrBdh+ZQQk5dUKAutv6fO0EN/SFAiG33N3+FzAjRFttz75xGl5Yr006mbIkr7X8s13vy5TFZhvb/BYbQDgHtHAX76KiwDzu5BQnzqeD4oHWFzJe+ov4FGFrOZqcQTxnpQJPNKRLBSEg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JqlWgina; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <[email-masked]>,
	=?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 158/563] pwm: tiehrpwm: Fix corner case in clock divisor calculation
Date: Mon, 13 Oct 2025 16:40:19 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Uwe Kleine-König <[email-masked]>

[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]

The function set_prescale_div() is responsible for calculating the clock
divisor settings such that the input clock rate is divided down such that
the required period length is at most 0x10000 clock ticks. If period_cycles
is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is
good enough. So round up in the calculation of the required divisor and
compare it using >= instead of >.

Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
Signed-off-by: Uwe Kleine-König <[email-masked]>
Link: https://lore.kernel.org/r/8548861[email-masked]
Signed-off-by: Uwe Kleine-König <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pwm/pwm-tiehrpwm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index a23e48b8523db..7a86cb090f76f 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -161,7 +161,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
 
 			*prescale_div = (1 << clkdiv) *
 					(hspclkdiv ? (hspclkdiv * 2) : 1);
-			if (*prescale_div > rqst_prescaler) {
+			if (*prescale_div >= rqst_prescaler) {
 				*tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) |
 					(hspclkdiv << TBCTL_HSPCLKDIV_SHIFT);
 				return 0;
@@ -224,7 +224,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
 	pc->period_cycles[pwm->hwpwm] = period_cycles;
 
 	/* Configure clock prescaler to support Low frequency PWM wave */
-	if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
+	if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval,
 			     &tb_divval)) {
 		dev_err(pwmchip_parent(chip), "Unsupported values\n");
 		return -EINVAL;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:47:02 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369184; cv=none; b=YXHcIdARe2mTEYQ/m+O1P+Tv16VY7BEjbSv2gH8GWnZk23uRxNKGmwNwrM+yiQTfTSV7CoiuqAY3uTYrMxnutN1ogSevWuKr9qlFvVex/F+8S1Wup8SP2M/ful3PmdI91QwTtqQbFamcvf2dzPOejojKYdpkMxSyYUHT4byAAhU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369184; c=relaxed/simple;
	bh=NzaMegead0bwEbYROQFYLJ6tYo867EvRNwuDSmsLF2E=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=Sj4mvas0SkCGf8wgRirmiKYVftKHDnt1PWHqlATInkq8TcppefzLXPP7f5qznmRPHXMzduez/nr9+cqbRnak73et7aaa2fJTsxpW42fly+iaZ91vFMkKGToxsXa0m3W17pA90oSeJZca1q1PmU81pABWYP1AM4yoizG3TT0GLro=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ZyOolsPC; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <[email-masked]>,
	=?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 156/563] pwm: tiehrpwm: Make code comment in .free() more useful
Date: Mon, 13 Oct 2025 16:40:17 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Uwe Kleine-König <[email-masked]>

[ Upstream commit 878dbfc12cc52b17d79d205560c0fafcf5332b13 ]

Instead of explaining trivia to everyone who can read C describe the
higher-level effect of setting pc->period_cycles[pwm->hwpwm] to zero.

Fixes: 01b2d4536f02 ("pwm: pwm-tiehrpwm: Fix conflicting channel period setting")
Signed-off-by: Uwe Kleine-König <[email-masked]>
Link: https://lore.kernel.org/r/4c38dd1[email-masked]
Signed-off-by: Uwe Kleine-König <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pwm/pwm-tiehrpwm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index 5e674a7bbf3be..a94b1e387b924 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -391,7 +391,7 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
 {
 	struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
 
-	/* set period value to zero on free */
+	/* Don't let a pwm without consumer block requests to the other channel */
 	pc->period_cycles[pwm->hwpwm] = 0;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:40:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369173; cv=none; b=ttcytQ6xZt9o2Vo4cRRi5lgBS04RMdrhcXk1bx45tf0Sw2LjSzl4BUnfJf0yPfUfwz5OZktSN6vm0MPNTJnYvuy3407+lUi1tjl3cl1/noUh+LNWesF9cTqOyFunnG5iDM2CHF7BML0OI2Kc7SDS9o0NsLTpQv7K6EW8UGBgG7I=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369173; c=relaxed/simple;
	bh=NY8ImeykUexv8hE+10CJW6RTlCJoMSau7LpXm/FOBbM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=RBaOYhgb8eb2dszueQSg7jNoMF1vddsFE7ROmlem1XSEjSw5iNGcv7EpmH8kWgBRlEZVYxxlF0B+ZzsLoishBTfg9Ao6qOPLKtyTzgOuxgllp3S6efkhiEBH6zGITpPIohWCxKoKVMv/wrvjNmu/vxePUD2w3u+KUECnM7ky7W4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=MV0EZxGZ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jernej Skrabec <[email-masked]>,
	Chen-Yu Tsai <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 153/563] arm64: dts: allwinner: t527: avaota-a1: hook up external 32k crystal
Date: Mon, 13 Oct 2025 16:40:14 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chen-Yu Tsai <[email-masked]>

[ Upstream commit 3d5e1ba00af8dd34ae1e573c2c07e00b5ec65267 ]

When the board was added, its external 32.768 KHz crystal was described
but not hooked up correctly. This meant the device had to fall back to
the SoC's internal oscillator or divide a 32 KHz clock from the main
oscillator, neither of which are accurate for the RTC. As a result the
RTC clock will drift badly.

Hook the crystal up to the RTC block and request the correct clock rate.

Fixes: dbe54efa32af ("arm64: dts: allwinner: a523: add Avaota-A1 router support")
Acked-by: Jernej Skrabec <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Chen-Yu Tsai <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
index e7713678208d4..4e71055fbd159 100644
--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
+++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
@@ -309,6 +309,14 @@ &r_pio {
 	vcc-pm-supply = <&reg_aldo3>;
 };
 
+&rtc {
+	clocks = <&r_ccu CLK_BUS_R_RTC>, <&osc24M>,
+		 <&r_ccu CLK_R_AHB>, <&ext_osc32k>;
+	clock-names = "bus", "hosc", "ahb", "ext-osc32k";
+	assigned-clocks = <&rtc CLK_OSC32K>;
+	assigned-clock-rates = <32768>;
+};
+
 &uart0 {
 	pinctrl-names = "default";
 	pinctrl-0 = <&uart0_pb_pins>;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:40:16 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369167; cv=none; b=n8YfodT+eeQLhlWD02uf69pcBnCCyemaXqhtx4gFoj72jAiydfcqwxan2ljHcdWIKTnV644eqgelMnnf8n93RsKyWaFP/qzu5pLh2vht+f8ItCpb+OCd5W//IAWwM2Ul5hxi/6CfbjkubeO0uLKlrgxoUDfLvrINPa+Hs1X9Zhc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369167; c=relaxed/simple;
	bh=XXbz+16kMYivWr9Co4C0RWGGS0dJwfHtCVurSqPOo+I=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=fnApJcvmnNhtg0zS2eJMVLJK5m9CmqYh9X8IVGfc73xsCEJiYpNtj8EmaTKO32lzNRqSB7jnzoPxGTAnA6cfk0h/YzPT85N5RFTmZYiDgrwYbTr5Y/g4aTEPEZ8KtpfmaMnGHiH+bJsj/wVvj6+QyaTsjN8zhltylYkunVY7ObU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OtH1PptN; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jernej Skrabec <[email-masked]>,
	Chen-Yu Tsai <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 151/563] arm64: dts: allwinner: a527: cubie-a5e: Add LEDs
Date: Mon, 13 Oct 2025 16:40:12 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chen-Yu Tsai <[email-masked]>

[ Upstream commit 4184f0190792aea06553af963741a24cc9b47689 ]

The Radxa Cubie A5E has a 3-color LED. The green and blue LEDs are wired
to GPIO pins on the SoC, and the green one is lit by default to serve as
a power indicator. The red LED is wired to the M.2 slot.

Add device nodes for the green and blue LEDs.

A default "heartbeat" trigger is set for the green power LED, though in
practice it might be better if it were inverted, i.e. lit most of the
time.

Acked-by: Jernej Skrabec <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Chen-Yu Tsai <[email-masked]>
Stable-dep-of: 9f01e1e14e71 ("arm64: dts: allwinner: a527: cubie-a5e: Drop external 32.768 KHz crystal")
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../dts/allwinner/sun55i-a527-cubie-a5e.dts   | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
index 43251042d1bd5..d4cee22221045 100644
--- a/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
+++ b/arch/arm64/boot/dts/allwinner/sun55i-a527-cubie-a5e.dts
@@ -6,6 +6,7 @@
 #include "sun55i-a523.dtsi"
 
 #include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
 
 / {
 	model = "Radxa Cubie A5E";
@@ -27,6 +28,24 @@ ext_osc32k: ext-osc32k-clk {
 		clock-output-names = "ext_osc32k";
 	};
 
+	leds {
+		compatible = "gpio-leds";
+
+		power-led {
+			function = LED_FUNCTION_POWER;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&r_pio 0 4 GPIO_ACTIVE_LOW>; /* PL4 */
+			default-state = "on";
+			linux,default-trigger = "heartbeat";
+		};
+
+		use-led {
+			function = LED_FUNCTION_ACTIVITY;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&r_pio 0 5 GPIO_ACTIVE_LOW>; /* PL5 */
+		};
+	};
+
 	reg_vcc5v: vcc5v {
 		/* board wide 5V supply from the USB-C connector */
 		compatible = "regulator-fixed";
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:47:50 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369156; cv=none; b=KzzIL0OJv65/Lvoy2T1wNRtpXEv21Rhk5AEcu5PVQ8Tz46+mH3pyjuhavZ39aeGzMLyZA+qa6ZQXixCG7Fc/v7dmS/BScXByUDIjtvOyeXwfBLdC3LQ009A1OHQSBPjAx5B95B35kZ7HTi8IeGDKeEy6STj86PKhGWYKhMU7pn0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369156; c=relaxed/simple;
	bh=HW18WppH+Peqr2fj51Hmi7I2FNKvcIf+NZDnS+WAT6o=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=uixnkQuJdoPQTzXTzYOBUHpKxkA7fE6aJblyXiGT1NdKQHT76YZaUeomgxeOPx2rRTWUZCYNsfwX0rSSIBZxi3NJ91eJjEnZdcea4dEO8RYSDnb9HDVqOdCciLZKR4i/KqKNrw1dfzw6/PgCi9lweXc6omIkf60Y8ylcGJGdXFQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=up5ARrDM; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	AngeloGioacchino Del Regno <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 147/563] arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
Date: Mon, 13 Oct 2025 16:40:08 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: AngeloGioacchino Del Regno <[email-masked]>

[ Upstream commit 236681fb64102f25ed11df55999e6985c1bc2f7d ]

Change the latch-ck value from 0x14 to 4: as only bits [0-3] are
actually used, the final value that gets written to the register
field for DAT_LATCH_CK_SEL is just 0x4.

This also fixes dtbs_check warnings.

Fixes: 5a65dcccf483 ("arm64: dts: mediatek: mt6795-xperia-m5: Add eMMC, MicroSD slot, SDIO")
Signed-off-by: AngeloGioacchino Del Regno <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
index 91de920c22457..03cc48321a3f4 100644
--- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
+++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
@@ -212,7 +212,7 @@ proximity@48 {
 
 &mmc0 {
 	/* eMMC controller */
-	mediatek,latch-ck = <0x14>; /* hs400 */
+	mediatek,latch-ck = <4>; /* hs400 */
 	mediatek,hs200-cmd-int-delay = <1>;
 	mediatek,hs400-cmd-int-delay = <1>;
 	mediatek,hs400-ds-dly3 = <0x1a>;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:40:08 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369147; cv=none; b=pSYEn5fuh3S3hXK9I49IX3geTn5fhHbddc8ekLHrkocibpMizVrmkN3MyrEvgcvjTIpcaUiCeqOSXpVChH2TCuOB8SqIQqqXawjIFjwwclx2MN7JKpR2IKDAPPB8ovYXVY4XMbqOziRqymOY82HM3/U3QQ/vvXjIhvIEZ18iek8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369147; c=relaxed/simple;
	bh=k65OPWpR9O2rtGbWHz9ACcS01m7lpkzTnzv9c7/uHl0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=M9okkTAfcYL9hHdExwY8JlmFwxBwsVeXQ3WMcuvFbhzXQjmx+xakDowS+4miXEJCRm3aA0iK1nmn3oR6gIGgamhqnpvJCPykyUOFLzz0H96oFEq4E0X1l2Vpdz9ONFDKa3idmur6n4cMJxwQZqKGSA9kCKBXUZDUawGPb/2W/84=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hbqXM6Lk; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Biju Das <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 144/563] arm64: dts: renesas: r9a09g047e57-smarc: Fix gpio keys pin control node
Date: Mon, 13 Oct 2025 16:40:05 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Biju Das <[email-masked]>

[ Upstream commit 3e5df910b592d47734b6dcd03d57498d4766bf6c ]

Adding pin control node to the child won't parse the pins during driver
bind. Fix the issue by moving it to parent node.

This issue is observed while adding Schmitt input enable for PS0 pin on
later patch. Currently the reset value of the PIN is set to NMI function
and hence there is no breakage.

Fixes: 9e95446b0cf9 ("arm64: dts: renesas: r9a09g047e57-smarc: Add gpio keys")
Signed-off-by: Biju Das <[email-masked]>
Reviewed-by: Geert Uytterhoeven <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts b/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts
index 1e67f0a2a945c..9f6716fa10860 100644
--- a/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts
+++ b/arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts
@@ -90,10 +90,10 @@ &i2c0 {
 };
 
 &keys {
-	key-sleep {
-		pinctrl-0 = <&nmi_pins>;
-		pinctrl-names = "default";
+	pinctrl-0 = <&nmi_pins>;
+	pinctrl-names = "default";
 
+	key-sleep {
 		interrupts-extended = <&icu 0 IRQ_TYPE_EDGE_FALLING>;
 		linux,code = <KEY_SLEEP>;
 		label = "SLEEP";
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:44:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369141; cv=none; b=AgcYb1onbhFwwM54OiQMuJwAR6zsR0WxuFIpyC5neS4HJYC1tY7+m2132htop02/mbsYVAYuBmDdCY40RhdfCFBRorj1bWHmzC+QKNCjew6ifDXXbW5NMkKJ28dp1idVKdZlEWLkC32OEimH02yfWUeBKRsL2XsxVnxKFQPh9PQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369141; c=relaxed/simple;
	bh=vQzOsZqZ3nQGlBo7sa8cNxSUk/yIv2n3HsoXI8DvU/k=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=UDdDRUZgTQ1/2+uTmt79I3lTTF8bM8uhTQ+VwRLrE/KwSeaPC7Dbt+kuhwaBSosVRpnUPNJ0aOj8gG36+hFPQmwJHKiHwFY+DTFUa6UsMntSpBlFiVKtxvRRneWHbYr2GlBmetQqU1OiNLOxZSAuwawmXzAWcJmLKmeO+WUjfFs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OVlnW+7X; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Kendall Willis <[email-masked]>,
	Dhruva Gole <[email-masked]>,
	Vignesh Raghavendra <[email-masked]>,
	Akashdeep Kaur <[email-masked]>,
	Nishanth Menon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 143/563] arm64: dts: ti: k3-pinctrl: Fix the bug in existing macros
Date: Mon, 13 Oct 2025 16:40:04 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Akashdeep Kaur <[email-masked]>

[ Upstream commit 2e79ee4d64e9ba4a3fc90e91dfd715407efab16d ]

Currently, DS_IO_OVERRIDE_EN_SHIFT macro is not defined anywhere but
used for defining other macro.
Replace this undefined macro with valid macro. Rename the existing macro
to reflect the actual behavior.

Fixes: 325aa0f6b36e ("arm64: dts: ti: k3-pinctrl: Introduce deep sleep macros")

Reviewed-by: Kendall Willis <[email-masked]>
Reviewed-by: Dhruva Gole <[email-masked]>
Reviewed-by: Vignesh Raghavendra <[email-masked]>
Signed-off-by: Akashdeep Kaur <[email-masked]>
Fixes: 325aa0f6b36e ("arm64: dts: ti: k3-pinctrl: Introduce deep sleep macros")
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Nishanth Menon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/ti/k3-pinctrl.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/ti/k3-pinctrl.h b/arch/arm64/boot/dts/ti/k3-pinctrl.h
index c0f09be8d3f94..146b780f3bd4a 100644
--- a/arch/arm64/boot/dts/ti/k3-pinctrl.h
+++ b/arch/arm64/boot/dts/ti/k3-pinctrl.h
@@ -55,8 +55,8 @@
 
 #define PIN_DS_FORCE_DISABLE		(0 << FORCE_DS_EN_SHIFT)
 #define PIN_DS_FORCE_ENABLE		(1 << FORCE_DS_EN_SHIFT)
-#define PIN_DS_IO_OVERRIDE_DISABLE	(0 << DS_IO_OVERRIDE_EN_SHIFT)
-#define PIN_DS_IO_OVERRIDE_ENABLE	(1 << DS_IO_OVERRIDE_EN_SHIFT)
+#define PIN_DS_ISO_OVERRIDE_DISABLE     (0 << ISO_OVERRIDE_EN_SHIFT)
+#define PIN_DS_ISO_OVERRIDE_ENABLE      (1 << ISO_OVERRIDE_EN_SHIFT)
 #define PIN_DS_OUT_ENABLE		(0 << DS_OUT_DIS_SHIFT)
 #define PIN_DS_OUT_DISABLE		(1 << DS_OUT_DIS_SHIFT)
 #define PIN_DS_OUT_VALUE_ZERO		(0 << DS_OUT_VAL_SHIFT)
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:53:22 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369127; cv=none; b=d6aZNnlBPqdVWWPjy08dR4GGFWk/T5NSQw+eO63wT527ED5skWOjlQyfvzAWEFq++ACn8DuYp265kTDxh9QlIm/gN0omnV0T/hEbTzmX4btzR4ddTY9kC6vqXpL2OZpHQUt2E40HdGCtEAK7nwL7pOHIDhD3VWkLNJU6jpU91e0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369127; c=relaxed/simple;
	bh=WGqVvdgcFxLHewFSdYhVkQ9JlGQP4ue6Al79wTs54qs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=o2oviIlblwXfT2Qd5/1nQlrpvLPIu0QjyqWKx8kELAWr8OuTfXNq+FvW+Cm7pYJYv69viec3NbgpUxGj4PusOVjKToixzpX9SScarte0Ouna368CUNaO8bH2FarN/5saelH0DfX5e0aGDROxQqvf7tS8m8jCSSTg1DDVJzae3pk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=107RIkvT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Beleswar Padhi <[email-masked]>,
	Francesco Dolcini <[email-masked]>,
	Nishanth Menon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 138/563] arm64: dts: ti: k3: Rename rproc reserved-mem nodes to memory@addr
Date: Mon, 13 Oct 2025 16:39:59 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Beleswar Padhi <[email-masked]>

[ Upstream commit aee0678597c63e5427e91b2e49a6c5ed4951f277 ]

Currently, the reserved memory carveouts used by remote processors are
named like 'rproc-name-<dma>-memory-region@addr'. While it is
descriptive, the node label already serves that purpose. Rename reserved
memory nodes to generic 'memory@addr' to align with the device tree
specifications. This is done for all TI K3 based boards.

Signed-off-by: Beleswar Padhi <[email-masked]>
Reviewed-by: Francesco Dolcini <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Nishanth Menon <[email-masked]>
Stable-dep-of: 79a1778c7819 ("Revert "arm64: dts: ti: k3-j721e-sk: Fix reversed C6x carveout locations"")
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../boot/dts/ti/k3-am62-phycore-som.dtsi      | 10 ++--
 .../boot/dts/ti/k3-am62-pocketbeagle2.dts     |  6 +--
 arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi    |  2 +-
 .../arm64/boot/dts/ti/k3-am625-beagleplay.dts |  2 +-
 .../boot/dts/ti/k3-am62a-phycore-som.dtsi     | 12 ++---
 arch/arm64/boot/dts/ti/k3-am62a7-sk.dts       | 12 ++---
 arch/arm64/boot/dts/ti/k3-am62d2-evm.dts      | 14 +++---
 arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi   |  2 +-
 arch/arm64/boot/dts/ti/k3-am62p5-sk.dts       |  8 ++--
 .../arm64/boot/dts/ti/k3-am62x-sk-common.dtsi |  8 ++--
 .../boot/dts/ti/k3-am64-phycore-som.dtsi      | 22 ++++-----
 arch/arm64/boot/dts/ti/k3-am642-evm.dts       | 22 ++++-----
 arch/arm64/boot/dts/ti/k3-am642-sk.dts        | 22 ++++-----
 arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi   | 16 +++----
 .../arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi | 18 +++----
 .../boot/dts/ti/k3-am65-iot2050-common.dtsi   | 10 ++--
 .../arm64/boot/dts/ti/k3-am654-base-board.dts | 10 ++--
 .../arm64/boot/dts/ti/k3-am67a-beagley-ai.dts | 22 ++++-----
 .../boot/dts/ti/k3-am68-phycore-som.dtsi      | 34 ++++++-------
 arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi    | 34 ++++++-------
 arch/arm64/boot/dts/ti/k3-am69-sk.dts         | 48 +++++++++----------
 arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi   | 18 +++----
 .../boot/dts/ti/k3-j721e-beagleboneai64.dts   | 38 +++++++--------
 arch/arm64/boot/dts/ti/k3-j721e-sk.dts        | 38 +++++++--------
 arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi   | 38 +++++++--------
 arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi  | 34 ++++++-------
 arch/arm64/boot/dts/ti/k3-j722s-evm.dts       | 22 ++++-----
 arch/arm64/boot/dts/ti/k3-j784s4-evm.dts      |  4 +-
 .../dts/ti/k3-j784s4-j742s2-evm-common.dtsi   | 44 ++++++++---------
 29 files changed, 285 insertions(+), 285 deletions(-)

diff --git a/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
index 10e6b5c08619e..737ff54c3cd2f 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62-phycore-som.dtsi
@@ -46,31 +46,31 @@ ramoops@9c700000 {
 			pmsg-size = <0x8000>;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@9c800000 {
+		rtos_ipc_memory_region: memory@9c800000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9c800000 0x00 0x00300000>;
 			no-map;
 		};
 
-		mcu_m4fss_dma_memory_region: m4f-dma-memory@9cb00000 {
+		mcu_m4fss_dma_memory_region: memory@9cb00000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9cb00000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_m4fss_memory_region: m4f-memory@9cc00000 {
+		mcu_m4fss_memory_region: memory@9cc00000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9cc00000 0x00 0xe00000>;
 			no-map;
 		};
 
-		wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9da00000 {
+		wkup_r5fss0_core0_dma_memory_region: memory@9da00000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9da00000 0x00 0x100000>;
 			no-map;
 		};
 
-		wkup_r5fss0_core0_memory_region: r5f-memory@9db00000 {
+		wkup_r5fss0_core0_memory_region: memory@9db00000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9db00000 0x00 0xc00000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts b/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
index 2e4cf65ee3239..1c95947430d3e 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62-pocketbeagle2.dts
@@ -54,13 +54,13 @@ linux,cma {
 			linux,cma-default;
 		};
 
-		mcu_m4fss_dma_memory_region: m4f-dma-memory@9cb00000 {
+		mcu_m4fss_dma_memory_region: memory@9cb00000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9cb00000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_m4fss_memory_region: m4f-memory@9cc00000 {
+		mcu_m4fss_memory_region: memory@9cc00000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9cc00000 0x00 0xe00000>;
 			no-map;
@@ -78,7 +78,7 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9db00000 {
+		wkup_r5fss0_core0_dma_memory_region: memory@9db00000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9db00000 0x00 0xc00000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
index bc2289d747745..2b8b2c76e9946 100644
--- a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
@@ -206,7 +206,7 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9db00000 {
+		wkup_r5fss0_core0_dma_memory_region: memory@9db00000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9db00000 0x00 0xc00000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
index 72b09f9c69d8c..7028d9835c4a8 100644
--- a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
+++ b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts
@@ -83,7 +83,7 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9db00000 {
+		wkup_r5fss0_core0_dma_memory_region: memory@9db00000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9db00000 0x00 0xc00000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
index 5dc5d2cb20ccd..175fa5048a0bc 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62a-phycore-som.dtsi
@@ -59,37 +59,37 @@ linux,cma {
 			linux,cma-default;
 		};
 
-		c7x_0_dma_memory_region: c7x-dma-memory@99800000 {
+		c7x_0_dma_memory_region: memory@99800000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x99800000 0x00 0x100000>;
 			no-map;
 		};
 
-		c7x_0_memory_region: c7x-memory@99900000 {
+		c7x_0_memory_region: memory@99900000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x99900000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@9b800000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@9b800000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9b800000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: r5f-dma-memory@9b900000 {
+		mcu_r5fss0_core0_memory_region: memory@9b900000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9b900000 0x00 0xf00000>;
 			no-map;
 		};
 
-		wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 {
+		wkup_r5fss0_core0_dma_memory_region: memory@9c800000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9c800000 0x00 0x100000>;
 			no-map;
 		};
 
-		wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 {
+		wkup_r5fss0_core0_memory_region: memory@9c900000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9c900000 0x00 0xf00000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
index bceead5e288e6..4761c3dc2d8e6 100644
--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
@@ -53,37 +53,37 @@ linux,cma {
 			linux,cma-default;
 		};
 
-		c7x_0_dma_memory_region: c7x-dma-memory@99800000 {
+		c7x_0_dma_memory_region: memory@99800000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x99800000 0x00 0x100000>;
 			no-map;
 		};
 
-		c7x_0_memory_region: c7x-memory@99900000 {
+		c7x_0_memory_region: memory@99900000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x99900000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@9b800000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@9b800000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9b800000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: r5f-dma-memory@9b900000 {
+		mcu_r5fss0_core0_memory_region: memory@9b900000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9b900000 0x00 0xf00000>;
 			no-map;
 		};
 
-		wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 {
+		wkup_r5fss0_core0_dma_memory_region: memory@9c800000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9c800000 0x00 0x100000>;
 			no-map;
 		};
 
-		wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 {
+		wkup_r5fss0_core0_memory_region: memory@9c900000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9c900000 0x00 0xf00000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts b/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
index daea18b0bc61c..19a7ca7ee173a 100644
--- a/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62d2-evm.dts
@@ -58,37 +58,37 @@ secure_tfa_ddr: tfa@80000000 {
 			no-map;
 		};
 
-		c7x_0_dma_memory_region: c7x-dma-memory@99800000 {
+		c7x_0_dma_memory_region: memory@99800000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x99800000 0x00 0x100000>;
 			no-map;
 		};
 
-		c7x_0_memory_region: c7x-memory@99900000 {
+		c7x_0_memory_region: memory@99900000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x99900000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@9b800000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@9b800000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9b800000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: r5f-dma-memory@9b900000 {
+		mcu_r5fss0_core0_memory_region: memory@9b900000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9b900000 0x00 0xf00000>;
 			no-map;
 		};
 
-		wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 {
+		wkup_r5fss0_core0_dma_memory_region: memory@9c800000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9c800000 0x00 0x100000>;
 			no-map;
 		};
 
-		wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 {
+		wkup_r5fss0_core0_memory_region: memory@9c900000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9c900000 0x00 0xf00000>;
 			no-map;
@@ -100,7 +100,7 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@a0000000 {
+		rtos_ipc_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x01000000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi b/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi
index a2fdc6741da2c..3963dbc1faeff 100644
--- a/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62p-verdin.dtsi
@@ -162,7 +162,7 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		wkup_r5fss0_core0_memory_region: r5f-dma-memory@9c900000 {
+		wkup_r5fss0_core0_memory_region: memory@9c900000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9c900000 0x00 0x01e00000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts
index 899da7896563b..2e081c329d6c2 100644
--- a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts
@@ -49,25 +49,25 @@ reserved-memory {
 		#size-cells = <2>;
 		ranges;
 
-		mcu_r5fss0_core0_dma_memory_region: mcu-r5fss-dma-memory-region@9b800000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@9b800000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9b800000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: mcu-r5fss-memory-region@9b900000 {
+		mcu_r5fss0_core0_memory_region: memory@9b900000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9b900000 0x00 0xf00000>;
 			no-map;
 		};
 
-		wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9c800000 {
+		wkup_r5fss0_core0_dma_memory_region: memory@9c800000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9c800000 0x00 0x100000>;
 			no-map;
 		};
 
-		wkup_r5fss0_core0_memory_region: r5f-memory@9c900000 {
+		wkup_r5fss0_core0_memory_region: memory@9c900000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9c900000 0x00 0xf00000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
index 13e1d36123d51..8eed8be2e8bad 100644
--- a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi
@@ -58,25 +58,25 @@ linux,cma {
 			linux,cma-default;
 		};
 
-		mcu_m4fss_dma_memory_region: m4f-dma-memory@9cb00000 {
+		mcu_m4fss_dma_memory_region: memory@9cb00000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9cb00000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_m4fss_memory_region: m4f-memory@9cc00000 {
+		mcu_m4fss_memory_region: memory@9cc00000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9cc00000 0x00 0xe00000>;
 			no-map;
 		};
 
-		wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@9da00000 {
+		wkup_r5fss0_core0_dma_memory_region: memory@9da00000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9da00000 0x00 0x100000>;
 			no-map;
 		};
 
-		wkup_r5fss0_core0_memory_region: r5f-memory@9db00000 {
+		wkup_r5fss0_core0_memory_region: memory@9db00000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0x9db00000 0x00 0xc00000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi
index d9d491b12c33a..97ad433e49394 100644
--- a/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am64-phycore-som.dtsi
@@ -41,67 +41,67 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		main_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		main_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		main_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+		main_r5fss1_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
+		main_r5fss1_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+		main_r5fss1_core1_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
+		main_r5fss1_core1_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_m4fss_dma_memory_region: m4f-dma-memory@a4000000 {
+		mcu_m4fss_dma_memory_region: memory@a4000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_m4fss_memory_region: m4f-memory@a4100000 {
+		mcu_m4fss_memory_region: memory@a4100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@a5000000 {
+		rtos_ipc_memory_region: memory@a5000000 {
 			reg = <0x00 0xa5000000 0x00 0x00800000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am642-evm.dts b/arch/arm64/boot/dts/ti/k3-am642-evm.dts
index e01866372293b..ccb04a3d97c9a 100644
--- a/arch/arm64/boot/dts/ti/k3-am642-evm.dts
+++ b/arch/arm64/boot/dts/ti/k3-am642-evm.dts
@@ -53,67 +53,67 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		main_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		main_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		main_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+		main_r5fss1_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
+		main_r5fss1_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+		main_r5fss1_core1_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
+		main_r5fss1_core1_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_m4fss_dma_memory_region: m4f-dma-memory@a4000000 {
+		mcu_m4fss_dma_memory_region: memory@a4000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_m4fss_memory_region: m4f-memory@a4100000 {
+		mcu_m4fss_memory_region: memory@a4100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@a5000000 {
+		rtos_ipc_memory_region: memory@a5000000 {
 			reg = <0x00 0xa5000000 0x00 0x00800000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am642-sk.dts b/arch/arm64/boot/dts/ti/k3-am642-sk.dts
index 1deaa0be0085c..1982608732ee2 100644
--- a/arch/arm64/boot/dts/ti/k3-am642-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am642-sk.dts
@@ -51,67 +51,67 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		main_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		main_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		main_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+		main_r5fss1_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
+		main_r5fss1_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+		main_r5fss1_core1_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
+		main_r5fss1_core1_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_m4fss_dma_memory_region: m4f-dma-memory@a4000000 {
+		mcu_m4fss_dma_memory_region: memory@a4000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_m4fss_memory_region: m4f-memory@a4100000 {
+		mcu_m4fss_memory_region: memory@a4100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@a5000000 {
+		rtos_ipc_memory_region: memory@a5000000 {
 			reg = <0x00 0xa5000000 0x00 0x00800000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi b/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi
index a5cec9a075109..dfe570e0b7071 100644
--- a/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am642-sr-som.dtsi
@@ -115,49 +115,49 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		main_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		main_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		main_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+		main_r5fss1_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
+		main_r5fss1_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+		main_r5fss1_core1_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
+		main_r5fss1_core1_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi b/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi
index 828d815d6bdfc..a8d5144ab1b33 100644
--- a/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am642-tqma64xxl.dtsi
@@ -31,55 +31,55 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		main_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		main_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		main_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+		main_r5fss1_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_memory_region: r5f-memory@a2100000 {
+		main_r5fss1_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+		main_r5fss1_core1_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_memory_region: r5f-memory@a3100000 {
+		main_r5fss1_core1_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@a5000000 {
+		rtos_ipc_memory_region: memory@a5000000 {
 			reg = <0x00 0xa5000000 0x00 0x00800000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi b/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi
index e5136ed947651..211eb9d93159d 100644
--- a/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi
@@ -47,31 +47,31 @@ secure_ddr: secure-ddr@9e800000 {
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0 0xa0000000 0 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		mcu_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0 0xa0100000 0 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0 0xa1000000 0 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		mcu_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0 0xa1100000 0 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@a2000000 {
+		rtos_ipc_memory_region: memory@a2000000 {
 			reg = <0x00 0xa2000000 0x00 0x00200000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am654-base-board.dts b/arch/arm64/boot/dts/ti/k3-am654-base-board.dts
index e589690c7c821..dac36ca77a30e 100644
--- a/arch/arm64/boot/dts/ti/k3-am654-base-board.dts
+++ b/arch/arm64/boot/dts/ti/k3-am654-base-board.dts
@@ -50,31 +50,31 @@ secure_ddr: secure-ddr@9e800000 {
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0 0xa0000000 0 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		mcu_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0 0xa0100000 0 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0 0xa1000000 0 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		mcu_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0 0xa1100000 0 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@a2000000 {
+		rtos_ipc_memory_region: memory@a2000000 {
 			reg = <0x00 0xa2000000 0x00 0x00100000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts b/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts
index bf9b23df1da2a..859294b9a2f31 100644
--- a/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts
+++ b/arch/arm64/boot/dts/ti/k3-am67a-beagley-ai.dts
@@ -50,67 +50,67 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		wkup_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		wkup_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		wkup_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: mcu-r5fss-dma-memory-region@a1000000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: mcu-r5fss-memory-region@a1100000 {
+		mcu_r5fss0_core0_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: main-r5fss-dma-memory-region@a2000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: main-r5fss-memory-region@a2100000 {
+		main_r5fss0_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c7x_0_dma_memory_region: c7x-dma-memory@a3000000 {
+		c7x_0_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c7x_0_memory_region: c7x-memory@a3100000 {
+		c7x_0_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c7x_1_dma_memory_region: c7x-dma-memory@a4000000 {
+		c7x_1_dma_memory_region: memory@a4000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c7x_1_memory_region: c7x-memory@a4100000 {
+		c7x_1_memory_region: memory@a4100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@a5000000 {
+		rtos_ipc_memory_region: memory@a5000000 {
 			reg = <0x00 0xa5000000 0x00 0x1c00000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi b/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi
index fd715fee8170e..71f56f0f5363c 100644
--- a/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am68-phycore-som.dtsi
@@ -49,103 +49,103 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		mcu_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		mcu_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+		main_r5fss0_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+		main_r5fss0_core1_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+		main_r5fss0_core1_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+		main_r5fss1_core0_dma_memory_region: memory@a4000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+		main_r5fss1_core0_memory_region: memory@a4100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+		main_r5fss1_core1_dma_memory_region: memory@a5000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+		main_r5fss1_core1_memory_region: memory@a5100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_0_dma_memory_region: c71-dma-memory@a6000000 {
+		c71_0_dma_memory_region: memory@a6000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_0_memory_region: c71-memory@a6100000 {
+		c71_0_memory_region: memory@a6100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_1_dma_memory_region: c71-dma-memory@a7000000 {
+		c71_1_dma_memory_region: memory@a7000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_1_memory_region: c71-memory@a7100000 {
+		c71_1_memory_region: memory@a7100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@a8000000 {
+		rtos_ipc_memory_region: memory@a8000000 {
 			reg = <0x00 0xa8000000 0x00 0x01c00000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi b/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi
index 4ca2d4e2fb9b0..ecc7b3a100d00 100644
--- a/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am68-sk-som.dtsi
@@ -27,103 +27,103 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		mcu_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		mcu_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+		main_r5fss0_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+		main_r5fss0_core1_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+		main_r5fss0_core1_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+		main_r5fss1_core0_dma_memory_region: memory@a4000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+		main_r5fss1_core0_memory_region: memory@a4100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+		main_r5fss1_core1_dma_memory_region: memory@a5000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+		main_r5fss1_core1_memory_region: memory@a5100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_0_dma_memory_region: c71-dma-memory@a6000000 {
+		c71_0_dma_memory_region: memory@a6000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_0_memory_region: c71-memory@a6100000 {
+		c71_0_memory_region: memory@a6100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_1_dma_memory_region: c71-dma-memory@a7000000 {
+		c71_1_dma_memory_region: memory@a7000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_1_memory_region: c71-memory@a7100000 {
+		c71_1_memory_region: memory@a7100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@a8000000 {
+		rtos_ipc_memory_region: memory@a8000000 {
 			reg = <0x00 0xa8000000 0x00 0x01c00000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-am69-sk.dts b/arch/arm64/boot/dts/ti/k3-am69-sk.dts
index 612ac27643d2c..922866b96e66a 100644
--- a/arch/arm64/boot/dts/ti/k3-am69-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am69-sk.dts
@@ -49,145 +49,145 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		mcu_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		mcu_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+		main_r5fss0_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+		main_r5fss0_core1_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+		main_r5fss0_core1_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+		main_r5fss1_core0_dma_memory_region: memory@a4000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+		main_r5fss1_core0_memory_region: memory@a4100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+		main_r5fss1_core1_dma_memory_region: memory@a5000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+		main_r5fss1_core1_memory_region: memory@a5100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss2_core0_dma_memory_region: r5f-dma-memory@a6000000 {
+		main_r5fss2_core0_dma_memory_region: memory@a6000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss2_core0_memory_region: r5f-memory@a6100000 {
+		main_r5fss2_core0_memory_region: memory@a6100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss2_core1_dma_memory_region: r5f-dma-memory@a7000000 {
+		main_r5fss2_core1_dma_memory_region: memory@a7000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss2_core1_memory_region: r5f-memory@a7100000 {
+		main_r5fss2_core1_memory_region: memory@a7100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_0_dma_memory_region: c71-dma-memory@a8000000 {
+		c71_0_dma_memory_region: memory@a8000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa8000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_0_memory_region: c71-memory@a8100000 {
+		c71_0_memory_region: memory@a8100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa8100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_1_dma_memory_region: c71-dma-memory@a9000000 {
+		c71_1_dma_memory_region: memory@a9000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa9000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_1_memory_region: c71-memory@a9100000 {
+		c71_1_memory_region: memory@a9100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa9100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_2_dma_memory_region: c71-dma-memory@aa000000 {
+		c71_2_dma_memory_region: memory@aa000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xaa000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_2_memory_region: c71-memory@aa100000 {
+		c71_2_memory_region: memory@aa100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xaa100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_3_dma_memory_region: c71-dma-memory@ab000000 {
+		c71_3_dma_memory_region: memory@ab000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xab000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_3_memory_region: c71-memory@ab100000 {
+		c71_3_memory_region: memory@ab100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xab100000 0x00 0xf00000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi
index 291ab9bb414d7..e8cec315e381b 100644
--- a/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi
@@ -29,55 +29,55 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		mcu_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		mcu_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+		main_r5fss0_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+		main_r5fss0_core1_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+		main_r5fss0_core1_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@a4000000 {
+		rtos_ipc_memory_region: memory@a4000000 {
 			reg = <0x00 0xa4000000 0x00 0x00800000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts b/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
index fb899c99753ec..6a1b32169678e 100644
--- a/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
+++ b/arch/arm64/boot/dts/ti/k3-j721e-beagleboneai64.dts
@@ -51,115 +51,115 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		mcu_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		mcu_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+		main_r5fss0_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+		main_r5fss0_core1_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+		main_r5fss0_core1_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+		main_r5fss1_core0_dma_memory_region: memory@a4000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+		main_r5fss1_core0_memory_region: memory@a4100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+		main_r5fss1_core1_dma_memory_region: memory@a5000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+		main_r5fss1_core1_memory_region: memory@a5100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c66_0_dma_memory_region: c66-dma-memory@a6000000 {
+		c66_0_dma_memory_region: memory@a6000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c66_0_memory_region: c66-memory@a6100000 {
+		c66_0_memory_region: memory@a6100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c66_1_dma_memory_region: c66-dma-memory@a7000000 {
+		c66_1_dma_memory_region: memory@a7000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c66_1_memory_region: c66-memory@a7100000 {
+		c66_1_memory_region: memory@a7100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_0_dma_memory_region: c71-dma-memory@a8000000 {
+		c71_0_dma_memory_region: memory@a8000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa8000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_0_memory_region: c71-memory@a8100000 {
+		c71_0_memory_region: memory@a8100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa8100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@aa000000 {
+		rtos_ipc_memory_region: memory@aa000000 {
 			reg = <0x00 0xaa000000 0x00 0x01c00000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
index ffef3d1cfd553..d1b0257048de2 100644
--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
@@ -48,115 +48,115 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		mcu_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		mcu_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+		main_r5fss0_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+		main_r5fss0_core1_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+		main_r5fss0_core1_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+		main_r5fss1_core0_dma_memory_region: memory@a4000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+		main_r5fss1_core0_memory_region: memory@a4100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+		main_r5fss1_core1_dma_memory_region: memory@a5000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+		main_r5fss1_core1_memory_region: memory@a5100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c66_0_dma_memory_region: c66-dma-memory@a6000000 {
+		c66_0_dma_memory_region: memory@a6000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c66_0_memory_region: c66-memory@a6100000 {
+		c66_0_memory_region: memory@a6100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c66_1_dma_memory_region: c66-dma-memory@a7000000 {
+		c66_1_dma_memory_region: memory@a7000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c66_1_memory_region: c66-memory@a7100000 {
+		c66_1_memory_region: memory@a7100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_0_dma_memory_region: c71-dma-memory@a8000000 {
+		c71_0_dma_memory_region: memory@a8000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa8000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_0_memory_region: c71-memory@a8100000 {
+		c71_0_memory_region: memory@a8100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa8100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@aa000000 {
+		rtos_ipc_memory_region: memory@aa000000 {
 			reg = <0x00 0xaa000000 0x00 0x01c00000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi
index 0722f6361cc8b..ef11a5fb6ad56 100644
--- a/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j721e-som-p0.dtsi
@@ -29,115 +29,115 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		mcu_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		mcu_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+		main_r5fss0_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+		main_r5fss0_core1_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+		main_r5fss0_core1_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+		main_r5fss1_core0_dma_memory_region: memory@a4000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+		main_r5fss1_core0_memory_region: memory@a4100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+		main_r5fss1_core1_dma_memory_region: memory@a5000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+		main_r5fss1_core1_memory_region: memory@a5100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c66_1_dma_memory_region: c66-dma-memory@a6000000 {
+		c66_1_dma_memory_region: memory@a6000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c66_0_memory_region: c66-memory@a6100000 {
+		c66_0_memory_region: memory@a6100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c66_0_dma_memory_region: c66-dma-memory@a7000000 {
+		c66_0_dma_memory_region: memory@a7000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c66_1_memory_region: c66-memory@a7100000 {
+		c66_1_memory_region: memory@a7100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_0_dma_memory_region: c71-dma-memory@a8000000 {
+		c71_0_dma_memory_region: memory@a8000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa8000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_0_memory_region: c71-memory@a8100000 {
+		c71_0_memory_region: memory@a8100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa8100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@aa000000 {
+		rtos_ipc_memory_region: memory@aa000000 {
 			reg = <0x00 0xaa000000 0x00 0x01c00000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi b/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi
index 54fc5c4f8c3f5..391e8e3ac2680 100644
--- a/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi
@@ -31,103 +31,103 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		mcu_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		mcu_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+		main_r5fss0_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+		main_r5fss0_core1_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+		main_r5fss0_core1_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+		main_r5fss1_core0_dma_memory_region: memory@a4000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+		main_r5fss1_core0_memory_region: memory@a4100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+		main_r5fss1_core1_dma_memory_region: memory@a5000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+		main_r5fss1_core1_memory_region: memory@a5100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_0_dma_memory_region: c71-dma-memory@a6000000 {
+		c71_0_dma_memory_region: memory@a6000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_0_memory_region: c71-memory@a6100000 {
+		c71_0_memory_region: memory@a6100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_1_dma_memory_region: c71-dma-memory@a7000000 {
+		c71_1_dma_memory_region: memory@a7000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_1_memory_region: c71-memory@a7100000 {
+		c71_1_memory_region: memory@a7100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@a8000000 {
+		rtos_ipc_memory_region: memory@a8000000 {
 			reg = <0x00 0xa8000000 0x00 0x01c00000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j722s-evm.dts b/arch/arm64/boot/dts/ti/k3-j722s-evm.dts
index 9d8abfa9afd27..4cfe5c88e48f5 100644
--- a/arch/arm64/boot/dts/ti/k3-j722s-evm.dts
+++ b/arch/arm64/boot/dts/ti/k3-j722s-evm.dts
@@ -52,67 +52,67 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		wkup_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		wkup_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		wkup_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		wkup_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: mcu-r5fss-dma-memory-region@a1000000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: mcu-r5fss-memory-region@a1100000 {
+		mcu_r5fss0_core0_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: main-r5fss-dma-memory-region@a2000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: main-r5fss-memory-region@a2100000 {
+		main_r5fss0_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c7x_0_dma_memory_region: c7x-dma-memory@a3000000 {
+		c7x_0_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c7x_0_memory_region: c7x-memory@a3100000 {
+		c7x_0_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c7x_1_dma_memory_region: c7x-dma-memory@a4000000 {
+		c7x_1_dma_memory_region: memory@a4000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c7x_1_memory_region: c7x-memory@a4100000 {
+		c7x_1_memory_region: memory@a4100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		rtos_ipc_memory_region: ipc-memories@a5000000 {
+		rtos_ipc_memory_region: memory@a5000000 {
 			reg = <0x00 0xa5000000 0x00 0x1c00000>;
 			alignment = <0x1000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts b/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
index a84bde08f85e4..2ed1ec6d53c88 100644
--- a/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
+++ b/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
@@ -28,13 +28,13 @@ reserved_memory: reserved-memory {
 		#address-cells = <2>;
 		#size-cells = <2>;
 
-		c71_3_dma_memory_region: c71-dma-memory@ab000000 {
+		c71_3_dma_memory_region: memory@ab000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xab000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_3_memory_region: c71-memory@ab100000 {
+		c71_3_memory_region: memory@ab100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xab100000 0x00 0xf00000>;
 			no-map;
diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi b/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi
index fa656b7b13a1d..877b50991ee69 100644
--- a/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j784s4-j742s2-evm-common.dtsi
@@ -35,133 +35,133 @@ secure_ddr: optee@9e800000 {
 			no-map;
 		};
 
-		mcu_r5fss0_core0_dma_memory_region: r5f-dma-memory@a0000000 {
+		mcu_r5fss0_core0_dma_memory_region: memory@a0000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core0_memory_region: r5f-memory@a0100000 {
+		mcu_r5fss0_core0_memory_region: memory@a0100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa0100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_dma_memory_region: r5f-dma-memory@a1000000 {
+		mcu_r5fss0_core1_dma_memory_region: memory@a1000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1000000 0x00 0x100000>;
 			no-map;
 		};
 
-		mcu_r5fss0_core1_memory_region: r5f-memory@a1100000 {
+		mcu_r5fss0_core1_memory_region: memory@a1100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa1100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_dma_memory_region: r5f-dma-memory@a2000000 {
+		main_r5fss0_core0_dma_memory_region: memory@a2000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core0_memory_region: r5f-memory@a2100000 {
+		main_r5fss0_core0_memory_region: memory@a2100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa2100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_dma_memory_region: r5f-dma-memory@a3000000 {
+		main_r5fss0_core1_dma_memory_region: memory@a3000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss0_core1_memory_region: r5f-memory@a3100000 {
+		main_r5fss0_core1_memory_region: memory@a3100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa3100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_dma_memory_region: r5f-dma-memory@a4000000 {
+		main_r5fss1_core0_dma_memory_region: memory@a4000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core0_memory_region: r5f-memory@a4100000 {
+		main_r5fss1_core0_memory_region: memory@a4100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa4100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_dma_memory_region: r5f-dma-memory@a5000000 {
+		main_r5fss1_core1_dma_memory_region: memory@a5000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss1_core1_memory_region: r5f-memory@a5100000 {
+		main_r5fss1_core1_memory_region: memory@a5100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa5100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss2_core0_dma_memory_region: r5f-dma-memory@a6000000 {
+		main_r5fss2_core0_dma_memory_region: memory@a6000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss2_core0_memory_region: r5f-memory@a6100000 {
+		main_r5fss2_core0_memory_region: memory@a6100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa6100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		main_r5fss2_core1_dma_memory_region: r5f-dma-memory@a7000000 {
+		main_r5fss2_core1_dma_memory_region: memory@a7000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7000000 0x00 0x100000>;
 			no-map;
 		};
 
-		main_r5fss2_core1_memory_region: r5f-memory@a7100000 {
+		main_r5fss2_core1_memory_region: memory@a7100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa7100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_0_dma_memory_region: c71-dma-memory@a8000000 {
+		c71_0_dma_memory_region: memory@a8000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa8000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_0_memory_region: c71-memory@a8100000 {
+		c71_0_memory_region: memory@a8100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa8100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_1_dma_memory_region: c71-dma-memory@a9000000 {
+		c71_1_dma_memory_region: memory@a9000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa9000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_1_memory_region: c71-memory@a9100000 {
+		c71_1_memory_region: memory@a9100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xa9100000 0x00 0xf00000>;
 			no-map;
 		};
 
-		c71_2_dma_memory_region: c71-dma-memory@aa000000 {
+		c71_2_dma_memory_region: memory@aa000000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xaa000000 0x00 0x100000>;
 			no-map;
 		};
 
-		c71_2_memory_region: c71-memory@aa100000 {
+		c71_2_memory_region: memory@aa100000 {
 			compatible = "shared-dma-pool";
 			reg = <0x00 0xaa100000 0x00 0xf00000>;
 			no-map;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:39:37 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369124; cv=none; b=qmJ2eckCdz9s+nQn6NkF+uMea/bYFiB3HVN8iydZmBIwCCUhFVHIg3xf7yYNG+scukj1fF6J4J+sel6qSqEV68/UivJypSfbMbXIAkAJ7OFNpV3t9tv71+PA/RvyXKFyGb588+vLaVt22H90QkjM0q81Lda+2xVT1Pc4ncTch2Q=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369124; c=relaxed/simple;
	bh=12kFANR8Te0d73exV7uCijNBQq7NvScHScrYhf537hs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=O3lJNlEvi3BsYJ0jQ7A2RiETmbzyTovyKUcQVPLrYluyRJ9UUORDsMNRj9Nc+05sapYLmsvKYcWb9/g7/cz/TED0HDae2vHLVzUTR2j2VABwVXnmipnEomXpPG3VFfVe26jw7zUBquPqQL+ZXnyZuCGS6n4qiGX/9wh2lpmcIi8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=VbAJDdL2; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Beleswar Padhi <[email-masked]>,
	Udit Kumar <[email-masked]>,
	Nishanth Menon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 137/563] arm64: dts: ti: k3-j742s2-mcu-wakeup: Override firmware-name for MCU R5F cores
Date: Mon, 13 Oct 2025 16:39:58 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: ti.com]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Beleswar Padhi <[email-masked]>

[ Upstream commit 00c8fdc2809f05422d919809106f54c23de3cba3 ]

The J742S2 SoC reuses the common k3-j784s4-j742s2-mcu-wakeup-common.dtsi
for its MCU domain, but it does not override the firmware-name property
for its R5F cores. This causes the wrong firmware binaries to be
referenced.

Introduce a new k3-j742s2-mcu-wakeup.dtsi file to override the
firmware-name property with correct names for J742s2.

Fixes: 38fd90a3e1ac ("arm64: dts: ti: Introduce J742S2 SoC family")
Signed-off-by: Beleswar Padhi <[email-masked]>
Reviewed-by: Udit Kumar <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Nishanth Menon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi | 17 +++++++++++++++++
 arch/arm64/boot/dts/ti/k3-j742s2.dtsi           |  1 +
 2 files changed, 18 insertions(+)
 create mode 100644 arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi

diff --git a/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi
new file mode 100644
index 0000000000000..61db2348d6a47
--- /dev/null
+++ b/arch/arm64/boot/dts/ti/k3-j742s2-mcu-wakeup.dtsi
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+/*
+ * Device Tree Source for J742S2 SoC Family
+ *
+ * TRM: https://www.ti.com/lit/pdf/spruje3
+ *
+ * Copyright (C) 2025 Texas Instruments Incorporated - https://www.ti.com/
+ *
+ */
+
+&mcu_r5fss0_core0 {
+	firmware-name = "j742s2-mcu-r5f0_0-fw";
+};
+
+&mcu_r5fss0_core1 {
+	firmware-name = "j742s2-mcu-r5f0_1-fw";
+};
diff --git a/arch/arm64/boot/dts/ti/k3-j742s2.dtsi b/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
index 7a72f82f56d68..d265df1abade1 100644
--- a/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j742s2.dtsi
@@ -96,3 +96,4 @@ cpu3: cpu@3 {
 };
 
 #include "k3-j742s2-main.dtsi"
+#include "k3-j742s2-mcu-wakeup.dtsi"
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:52:41 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369121; cv=none; b=JAeVuf6ve0j3ngs8TcirEJkVEsbyS0TlQN5OzHYlpyuBOpvKdx6MyMHwMeyXSz+OFSElO9Vqh0vVZo9pOC5mBcuVUVHaA+3hnqXlI87R+G7V5OKxMlmVKPJuZQNTe63RSB0pCAEVt9u/aAu2+bNhzHIsKCLElz5rK166Ku+OMSg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369121; c=relaxed/simple;
	bh=ZuE9c0wSVU1MfODwS+Eogv7hfaBBuhlPDX/sc3dUZe8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=eWxuXjbSCVOhzVf8YfKZHBuHFeRK2iKYXAYg3worJR8onMWR6jyzGeds8JhhuZP/3CF6ubWsITrimPsW+mnFpxZ/ci1mybebjW6EZBW/xCEqBtqvXWlXnbBfyrHLWJhVTwTk1k2O+fKU0az5SF6JLcc4a8E8ZmFR3N/2L0q40Yc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Fha45uJ8; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Sebastian Reichel <[email-masked]>,
	Heiko Stuebner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 136/563] arm64: dts: rockchip: Fix network on rk3576 evb1 board
Date: Mon, 13 Oct 2025 16:39:57 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sebastian Reichel <[email-masked]>

[ Upstream commit 843367c7ed196bd0806c8776cba108aaf6923b82 ]

The RK3576 EVB1 has a RTL8211F PHY for each GMAC interface with
a dedicated reset line and the 25MHz clock provided by the SoC.
The current description results in non-working Ethernet as the
clocks are only enabled by the PHY driver, but probing the right
PHY driver currently requires that the PHY ID register can be read
for automatic identification.

This fixes up the network description to get the network functionality
working reliably and cleans up usage of deprecated DT properties while
at it.

Fixes: f135a1a07352 ("arm64: dts: rockchip: Add rk3576 evb1 board")
Signed-off-by: Sebastian Reichel <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Heiko Stuebner <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../boot/dts/rockchip/rk3576-evb1-v10.dts     | 38 ++++++++++++++-----
 1 file changed, 28 insertions(+), 10 deletions(-)

diff --git a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
index 3007e0179611b..012c21b58a5a1 100644
--- a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
@@ -275,9 +275,6 @@ &eth0m0_rx_bus2
 		     &eth0m0_rgmii_clk
 		     &eth0m0_rgmii_bus
 		     &ethm0_clk0_25m_out>;
-	snps,reset-gpio = <&gpio2 RK_PB5 GPIO_ACTIVE_LOW>;
-	snps,reset-active-low;
-	snps,reset-delays-us = <0 20000 100000>;
 	tx_delay = <0x21>;
 	status = "okay";
 };
@@ -293,9 +290,6 @@ &eth1m0_rx_bus2
 		     &eth1m0_rgmii_clk
 		     &eth1m0_rgmii_bus
 		     &ethm0_clk1_25m_out>;
-	snps,reset-gpio = <&gpio3 RK_PA3 GPIO_ACTIVE_LOW>;
-	snps,reset-active-low;
-	snps,reset-delays-us = <0 20000 100000>;
 	tx_delay = <0x20>;
 	status = "okay";
 };
@@ -715,18 +709,32 @@ hym8563: rtc@51 {
 };
 
 &mdio0 {
-	rgmii_phy0: phy@1 {
-		compatible = "ethernet-phy-ieee802.3-c22";
+	rgmii_phy0: ethernet-phy@1 {
+		compatible = "ethernet-phy-id001c.c916";
 		reg = <0x1>;
 		clocks = <&cru REFCLKO25M_GMAC0_OUT>;
+		assigned-clocks = <&cru REFCLKO25M_GMAC0_OUT>;
+		assigned-clock-rates = <25000000>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&rgmii_phy0_rst>;
+		reset-assert-us = <20000>;
+		reset-deassert-us = <100000>;
+		reset-gpios = <&gpio2 RK_PB5 GPIO_ACTIVE_LOW>;
 	};
 };
 
 &mdio1 {
-	rgmii_phy1: phy@1 {
-		compatible = "ethernet-phy-ieee802.3-c22";
+	rgmii_phy1: ethernet-phy@1 {
+		compatible = "ethernet-phy-id001c.c916";
 		reg = <0x1>;
 		clocks = <&cru REFCLKO25M_GMAC1_OUT>;
+		assigned-clocks = <&cru REFCLKO25M_GMAC1_OUT>;
+		assigned-clock-rates = <25000000>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&rgmii_phy1_rst>;
+		reset-assert-us = <20000>;
+		reset-deassert-us = <100000>;
+		reset-gpios = <&gpio3 RK_PA3 GPIO_ACTIVE_LOW>;
 	};
 };
 
@@ -772,6 +780,16 @@ rtc_int: rtc-int {
 		};
 	};
 
+	network {
+		rgmii_phy0_rst: rgmii-phy0-rst {
+			rockchip,pins = <2 RK_PB5 RK_FUNC_GPIO &pcfg_pull_none>;
+		};
+
+		rgmii_phy1_rst: rgmii-phy1-rst {
+			rockchip,pins = <3 RK_PA3 RK_FUNC_GPIO &pcfg_pull_none>;
+		};
+	};
+
 	pcie0 {
 		pcie0_rst: pcie0-rst {
 			rockchip,pins = <2 RK_PB4 RK_FUNC_GPIO &pcfg_pull_none>;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:39:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369118; cv=none; b=UTGdV+vRovqn15CQvzbUPr/WFpEafjLbxclZGJbi2GYsU+MyaLLzHnbOPwMc8wqKqTw8HLRVWcSJZ0Dk9YNuoIj13y1GFfLhttiKG/SmeBZDCu0CP3ltObajl14Go+PQjLHsVQhvO4mxBdrGGAspU8u+Skv3M9JLEZ6o5BVH77M=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369118; c=relaxed/simple;
	bh=/GTwU0p139y9tv+6Wob/2YAFaLk4/AYPxd9Vb/G3gMA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=MbZGiJGznFcls2EB1qQATDgAsqgABa7lNG0pEXzOoqCUTTTrUujEiolHhkPrMN65z0C9FZufW1moMYqu0e9sHj1wEEudQxTIbWS/JL65JorFbY+6ovo9zEE0V8Q+BsPRXTxjhxtvixXUrSm9EN6IH3GLSmQKhqdq/+M9fZShlpQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uz5oagxO; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Pavel Zhovner <[email-masked]>,
	Alexey Charkov <[email-masked]>,
	Heiko Stuebner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 135/563] arm64: dts: rockchip: Add WiFi on rk3576-evb1-v10
Date: Mon, 13 Oct 2025 16:39:56 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexey Charkov <[email-masked]>

[ Upstream commit ebf8183ad08afc4fcabe1379a5098354829d950d ]

Add device tree nodes to enable the onboard Ampak AP6275P WiFi chip
connected over a PCIe link on Rockchip RK3576 EVB1.

It takes an external 32 kHz clock from the RTC chip and requires the
WIFI_REG_ON signal to be enabled before the bus is enumerated to
initialize properly.

Tested-by: Pavel Zhovner <[email-masked]>
Signed-off-by: Alexey Charkov <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Heiko Stuebner <[email-masked]>
Stable-dep-of: 843367c7ed19 ("arm64: dts: rockchip: Fix network on rk3576 evb1 board")
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../boot/dts/rockchip/rk3576-evb1-v10.dts     | 58 +++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
index bfefd37a1ab8c..3007e0179611b 100644
--- a/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3576-evb1-v10.dts
@@ -232,6 +232,20 @@ vcc_ufs_s0: regulator-vcc-ufs-s0 {
 		regulator-max-microvolt = <3300000>;
 		vin-supply = <&vcc_sys>;
 	};
+
+	vcc_wifi_reg_on: regulator-wifi-reg-on {
+		compatible = "regulator-fixed";
+		enable-active-high;
+		gpios = <&gpio1 RK_PC6 GPIO_ACTIVE_HIGH>;
+		pinctrl-0 = <&wifi_reg_on>;
+		pinctrl-names = "default";
+		regulator-name = "wifi_reg_on";
+		regulator-always-on;
+		regulator-boot-on;
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		vin-supply = <&vcc_1v8_s3>;
+	};
 };
 
 &cpu_l0 {
@@ -242,6 +256,10 @@ &cpu_b0 {
 	cpu-supply = <&vdd_cpu_big_s0>;
 };
 
+&combphy0_ps {
+	status = "okay";
+};
+
 &combphy1_psu {
 	status = "okay";
 };
@@ -712,6 +730,30 @@ rgmii_phy1: phy@1 {
 	};
 };
 
+&pcie0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie0_rst>;
+	reset-gpios = <&gpio2 RK_PB4 GPIO_ACTIVE_HIGH>;
+	vpcie3v3-supply = <&vcc_3v3_s3>;
+	status = "okay";
+
+	pcie@0,0 {
+		reg = <0x0 0 0 0 0>;
+		bus-range = <0x0 0xf>;
+		device_type = "pci";
+		ranges;
+		#address-cells = <3>;
+		#size-cells = <2>;
+
+		wifi: wifi@0,0 {
+			compatible = "pci14e4,449d";
+			reg = <0x10000 0 0 0 0>;
+			clocks = <&hym8563>;
+			clock-names = "lpo";
+		};
+	};
+};
+
 &pcie1 {
 	reset-gpios = <&gpio4 RK_PC4 GPIO_ACTIVE_HIGH>;
 	vpcie3v3-supply = <&vcc3v3_pcie1>;
@@ -730,6 +772,12 @@ rtc_int: rtc-int {
 		};
 	};
 
+	pcie0 {
+		pcie0_rst: pcie0-rst {
+			rockchip,pins = <2 RK_PB4 RK_FUNC_GPIO &pcfg_pull_none>;
+		};
+	};
+
 	usb {
 		usb_host_pwren: usb-host-pwren {
 			rockchip,pins = <0 RK_PC7 RK_FUNC_GPIO &pcfg_pull_none>;
@@ -743,6 +791,16 @@ usbc0_int: usbc0-int {
 			rockchip,pins = <0 RK_PA5 RK_FUNC_GPIO &pcfg_pull_up>;
 		};
 	};
+
+	wifi {
+		wifi_reg_on: wifi-reg-on {
+			rockchip,pins = <1 RK_PC6 RK_FUNC_GPIO &pcfg_pull_up>;
+		};
+
+		wifi_wake_host: wifi-wake-host {
+			rockchip,pins = <0 RK_PB0 RK_FUNC_GPIO &pcfg_pull_down>;
+		};
+	};
 };
 
 &sdmmc {
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:41:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369210; cv=none; b=KTdE5u7pJNYItABAdOWuTvigNS37zylpX5f8UAPZpFkBB4CaP3wuK6rMqR0tZNUzvCELYfRn8VAJK7/QCYUrPlIfO/aFLgL3gLTh+rYzJyt7lnK93Np00HcPkvOli1yZEwUOzvtlqy/oyE3AuQhoUsMUK17iMy2aYFbSdOTpA+Q=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369210; c=relaxed/simple;
	bh=pj+Ho1HSziqp1nrc8lPRnNjMNLH+Sk945piiY2wG+xg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=hNjAhnsDj5c2cVZwsSzCtAjFulbz3WbEG8GP/IlB50pTyqrWdqP7HkZTgx/xBIJjSVuNrBMyRMxUI/lsVny2f7bIq+OoowafdBSSJ9FHop97kqD/RTgv1yPUo/0vOm33SIwDwnvfByTkv4dwREwDadpqRRQMA9pZ6R62OsuUOpE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DSdAUaLO; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jernej Skrabec <[email-masked]>,
	Chen-Yu Tsai <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 133/563] arm64: dts: allwinner: t527: avaota-a1: Add ethernet PHY reset setting
Date: Mon, 13 Oct 2025 16:39:54 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chen-Yu Tsai <[email-masked]>

[ Upstream commit 8dc3f973b2ff7ea19f7637983c11b005daa8fe45 ]

The external Ethernet PHY has a reset pin that is connected to the SoC.
It is missing from the original submission.

Add it to complete the description.

Fixes: c6800f15998b ("arm64: dts: allwinner: t527: add EMAC0 to Avaota-A1 board")
Acked-by: Jernej Skrabec <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Chen-Yu Tsai <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
index b9eeb6753e9e3..e7713678208d4 100644
--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
+++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-avaota-a1.dts
@@ -85,6 +85,9 @@ &mdio0 {
 	ext_rgmii_phy: ethernet-phy@1 {
 		compatible = "ethernet-phy-ieee802.3-c22";
 		reg = <1>;
+		reset-gpios = <&pio 7 8 GPIO_ACTIVE_LOW>; /* PH8 */
+		reset-assert-us = <10000>;
+		reset-deassert-us = <150000>;
 	};
 };
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:50:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369198; cv=none; b=I69/1MFN+43jy+x+H0zmOCjLgJOtu2xn7NEdGQEakkS2TmMPziHA+qWX3TK5GBTvwQwdG3HnquhlVqsjX3yS5EU/am/CMtdTvqtLvv4rO5YgHolIgX+z5Q94Dwcy6y1wgRHnNU//lqA4FbV1Fg4FYLkz4CGedxPz9FFIdZiG2HI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369198; c=relaxed/simple;
	bh=8ayDkpx1GsifngGwHK+jFZAyLaoEuIC8OresiwSKnLs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Xm8bpxO1qZloGxB4d6lHHX5FzuoSHOWVANS0d5RUggTEnP4G87lmyX6S0OpGKDMsu/YEMGUpfecgsYUDvrhttnHJCOT5/LqoQl3bEV84ELQRwRBVy4mtae/E2DLlx1HFPAQl815+tjB1YknDnJ67ywlxmg4mcWPe0xBzzP4sSDs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=TcTxdh9U; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yu Kuai <[email-masked]>,
	Nilay Shroff <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 129/563] blk-mq: split bitmap grow and resize case in blk_mq_update_nr_requests()
Date: Mon, 13 Oct 2025 16:39:50 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yu Kuai <[email-masked]>

[ Upstream commit e63200404477456ec60c62dd8b3b1092aba2e211 ]

No functional changes are intended, make code cleaner and prepare to fix
the grow case in following patches.

Signed-off-by: Yu Kuai <[email-masked]>
Reviewed-by: Nilay Shroff <[email-masked]>
Signed-off-by: Jens Axboe <[email-masked]>
Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown")
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/blk-mq.c | 39 +++++++++++++++++++++++++++------------
 1 file changed, 27 insertions(+), 12 deletions(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index bcb7495893a09..1bafbdced7bd5 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4935,25 +4935,40 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
 	blk_mq_quiesce_queue(q);
 
 	if (blk_mq_is_shared_tags(set->flags)) {
+		/*
+		 * Shared tags, for sched tags, we allocate max initially hence
+		 * tags can't grow, see blk_mq_alloc_sched_tags().
+		 */
 		if (q->elevator)
 			blk_mq_tag_update_sched_shared_tags(q);
 		else
 			blk_mq_tag_resize_shared_tags(set, nr);
-	} else {
+	} else if (!q->elevator) {
+		/*
+		 * Non-shared hardware tags, nr is already checked from
+		 * queue_requests_store() and tags can't grow.
+		 */
 		queue_for_each_hw_ctx(q, hctx, i) {
 			if (!hctx->tags)
 				continue;
-			/*
-			 * If we're using an MQ scheduler, just update the
-			 * scheduler queue depth. This is similar to what the
-			 * old code would do.
-			 */
-			if (hctx->sched_tags)
-				ret = blk_mq_tag_update_depth(hctx,
-							&hctx->sched_tags, nr);
-			else
-				ret = blk_mq_tag_update_depth(hctx,
-							&hctx->tags, nr);
+			sbitmap_queue_resize(&hctx->tags->bitmap_tags,
+				nr - hctx->tags->nr_reserved_tags);
+		}
+	} else if (nr <= q->elevator->et->nr_requests) {
+		/* Non-shared sched tags, and tags don't grow. */
+		queue_for_each_hw_ctx(q, hctx, i) {
+			if (!hctx->sched_tags)
+				continue;
+			sbitmap_queue_resize(&hctx->sched_tags->bitmap_tags,
+				nr - hctx->sched_tags->nr_reserved_tags);
+		}
+	} else {
+		/* Non-shared sched tags, and tags grow */
+		queue_for_each_hw_ctx(q, hctx, i) {
+			if (!hctx->sched_tags)
+				continue;
+			ret = blk_mq_tag_update_depth(hctx, &hctx->sched_tags,
+						      nr);
 			if (ret)
 				goto out;
 		}
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:41:50 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369213; cv=none; b=grPYvOzm2mjItFLD+UGTz6WYDmvnxZj1+6pltbMfRO9m0Li/rgKvor1WT8jt36kxKxKBjdmNIENiGhVCpjvM2xVAv6T7Ijpxvd/AXSDTNCM910UVdX2gqS0D2ShBOpEOrVPtoodKmoS5D2G3yjUz6RoRQbE/zfsZt9ETYXTBqXk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369213; c=relaxed/simple;
	bh=pe/gq6GXn55t6uAHoAsCnKjz8M02ynqRYTmG/2qLYPM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=nnXUdrvMqEGwyW6bQbmH8raFpWkq3lDAxqaqGFemXaTZzBcopywl6Uw347uaJ12zuED/mlRq7vllVSqnLe0rwXoyzPPH+4e15CxBx24GvIJazhhlreXV6LYAW2mippLniIQJfhva6ioo15rFtFK+7OChoohjxtzxH4f14gPbze8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IFYkLCwY; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Tie Ren <[email-masked]>,
	Yu Kuai <[email-masked]>,
	Bart Van Assche <[email-masked]>,
	Christoph Hellwig <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 124/563] block: fix ordering of recursive split IO
Date: Mon, 13 Oct 2025 16:39:45 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yu Kuai <[email-masked]>

[ Upstream commit b2f5974079d82a4761f002e80601064d4e39a81f ]

Currently, split bio will be chained to original bio, and original bio
will be resubmitted to the tail of current->bio_list, waiting for
split bio to be issued. However, if split bio get split again, the IO
order will be messed up. This problem, on the one hand, will cause
performance degradation, especially for mdraid with large IO size; on
the other hand, will cause write errors for zoned block devices[1].

For example, in raid456 IO will first be split by max_sector from
md_submit_bio(), and then later be split again by chunksize for internal
handling:

For example, assume max_sectors is 1M, and chunksize is 512k

1) issue a 2M IO:

bio issuing: 0+2M
current->bio_list: NULL

2) md_submit_bio() split by max_sector:

bio issuing: 0+1M
current->bio_list: 1M+1M

3) chunk_aligned_read() split by chunksize:

bio issuing: 0+512k
current->bio_list: 1M+1M -> 512k+512k

4) after first bio issued, __submit_bio_noacct() will contuine issuing
next bio:

bio issuing: 1M+1M
current->bio_list: 512k+512k
bio issued: 0+512k

5) chunk_aligned_read() split by chunksize:

bio issuing: 1M+512k
current->bio_list: 512k+512k -> 1536k+512k
bio issued: 0+512k

6) no split afterwards, finally the issue order is:

0+512k -> 1M+512k -> 512k+512k -> 1536k+512k

This behaviour will cause large IO read on raid456 endup to be small
discontinuous IO in underlying disks. Fix this problem by placing split
bio to the head of current->bio_list.

Test script: test on 8 disk raid5 with 64k chunksize
dd if=/dev/md0 of=/dev/null bs=4480k iflag=direct

Test results:
Before this patch
1) iostat results:
Device            r/s     rMB/s   rrqm/s  %rrqm r_await rareq-sz  aqu-sz  %util
md0           52430.00   3276.87     0.00   0.00    0.62    64.00   32.60  80.10
sd*           4487.00    409.00  2054.00  31.40    0.82    93.34    3.68  71.20
2) blktrace G stage:
  8,0    0   486445    11.357392936   843  G   R 14071424 + 128 [dd]
  8,0    0   486451    11.357466360   843  G   R 14071168 + 128 [dd]
  8,0    0   486454    11.357515868   843  G   R 14071296 + 128 [dd]
  8,0    0   486468    11.357968099   843  G   R 14072192 + 128 [dd]
  8,0    0   486474    11.358031320   843  G   R 14071936 + 128 [dd]
  8,0    0   486480    11.358096298   843  G   R 14071552 + 128 [dd]
  8,0    0   486490    11.358303858   843  G   R 14071808 + 128 [dd]
3) io seek for sdx:
Noted io seek is the result from blktrace D stage, statistic of:
ABS((offset of next IO) - (offset + len of previous IO))

Read|Write seek
cnt 55175, zero cnt 25079
    >=(KB) .. <(KB)     : count       ratio |distribution                            |
         0 .. 1         : 25079       45.5% |########################################|
         1 .. 2         : 0            0.0% |                                        |
         2 .. 4         : 0            0.0% |                                        |
         4 .. 8         : 0            0.0% |                                        |
         8 .. 16        : 0            0.0% |                                        |
        16 .. 32        : 0            0.0% |                                        |
        32 .. 64        : 12540       22.7% |#####################                   |
        64 .. 128       : 2508         4.5% |#####                                   |
       128 .. 256       : 0            0.0% |                                        |
       256 .. 512       : 10032       18.2% |#################                       |
       512 .. 1024      : 5016         9.1% |#########                               |

After this patch:
1) iostat results:
Device            r/s     rMB/s   rrqm/s  %rrqm r_await rareq-sz  aqu-sz  %util
md0           87965.00   5271.88     0.00   0.00    0.16    61.37   14.03  90.60
sd*           6020.00    658.44  5117.00  45.95    0.44   112.00    2.68  86.50
2) blktrace G stage:
  8,0    0   206296     5.354894072   664  G   R 7156992 + 128 [dd]
  8,0    0   206305     5.355018179   664  G   R 7157248 + 128 [dd]
  8,0    0   206316     5.355204438   664  G   R 7157504 + 128 [dd]
  8,0    0   206319     5.355241048   664  G   R 7157760 + 128 [dd]
  8,0    0   206333     5.355500923   664  G   R 7158016 + 128 [dd]
  8,0    0   206344     5.355837806   664  G   R 7158272 + 128 [dd]
  8,0    0   206353     5.355960395   664  G   R 7158528 + 128 [dd]
  8,0    0   206357     5.356020772   664  G   R 7158784 + 128 [dd]
3) io seek for sdx
Read|Write seek
cnt 28644, zero cnt 21483
    >=(KB) .. <(KB)     : count       ratio |distribution                            |
         0 .. 1         : 21483       75.0% |########################################|
         1 .. 2         : 0            0.0% |                                        |
         2 .. 4         : 0            0.0% |                                        |
         4 .. 8         : 0            0.0% |                                        |
         8 .. 16        : 0            0.0% |                                        |
        16 .. 32        : 0            0.0% |                                        |
        32 .. 64        : 7161        25.0% |##############                          |

BTW, this looks like a long term problem from day one, and large
sequential IO read is pretty common case like video playing.

And even with this patch, in this test case IO is merged to at most 128k
is due to block layer plug limit BLK_PLUG_FLUSH_SIZE, increase such
limit can get even better performance. However, we'll figure out how to do
this properly later.

[1] https://lore.kernel.org/all/[email-masked]/

Fixes: d89d87965dcb ("When stacked block devices are in-use (e.g. md or dm), the recursive calls")
Reported-by: Tie Ren <[email-masked]>
Closes: https://lore.kernel.org/all/7dro5o7u5t64d6bgiansesjavxcuvkq5p2pok7dtwkav7b7ape@3isfr44b6352/
Signed-off-by: Yu Kuai <[email-masked]>
Reviewed-by: Bart Van Assche <[email-masked]>
Reviewed-by: Christoph Hellwig <[email-masked]>
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/blk-core.c     | 16 ++++++++++------
 block/blk-merge.c    |  2 +-
 block/blk-throttle.c |  2 +-
 block/blk.h          |  2 +-
 4 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/block/blk-core.c b/block/blk-core.c
index 03a5d4c9cbf72..14ae73eebe0d7 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -727,7 +727,7 @@ static void __submit_bio_noacct_mq(struct bio *bio)
 	current->bio_list = NULL;
 }
 
-void submit_bio_noacct_nocheck(struct bio *bio)
+void submit_bio_noacct_nocheck(struct bio *bio, bool split)
 {
 	blk_cgroup_bio_start(bio);
 
@@ -746,12 +746,16 @@ void submit_bio_noacct_nocheck(struct bio *bio)
 	 * to collect a list of requests submited by a ->submit_bio method while
 	 * it is active, and then process them after it returned.
 	 */
-	if (current->bio_list)
-		bio_list_add(&current->bio_list[0], bio);
-	else if (!bdev_test_flag(bio->bi_bdev, BD_HAS_SUBMIT_BIO))
+	if (current->bio_list) {
+		if (split)
+			bio_list_add_head(&current->bio_list[0], bio);
+		else
+			bio_list_add(&current->bio_list[0], bio);
+	} else if (!bdev_test_flag(bio->bi_bdev, BD_HAS_SUBMIT_BIO)) {
 		__submit_bio_noacct_mq(bio);
-	else
+	} else {
 		__submit_bio_noacct(bio);
+	}
 }
 
 static blk_status_t blk_validate_atomic_write_op_size(struct request_queue *q,
@@ -872,7 +876,7 @@ void submit_bio_noacct(struct bio *bio)
 
 	if (blk_throtl_bio(bio))
 		return;
-	submit_bio_noacct_nocheck(bio);
+	submit_bio_noacct_nocheck(bio, false);
 	return;
 
 not_supported:
diff --git a/block/blk-merge.c b/block/blk-merge.c
index c411045fcf03a..77488f11a9441 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -134,7 +134,7 @@ struct bio *bio_submit_split_bioset(struct bio *bio, unsigned int split_sectors,
 	if (should_fail_bio(bio))
 		bio_io_error(bio);
 	else if (!blk_throtl_bio(bio))
-		submit_bio_noacct_nocheck(bio);
+		submit_bio_noacct_nocheck(bio, true);
 
 	return split;
 }
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index cfa1cd60d2c5f..f510ae072868c 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -1224,7 +1224,7 @@ static void blk_throtl_dispatch_work_fn(struct work_struct *work)
 	if (!bio_list_empty(&bio_list_on_stack)) {
 		blk_start_plug(&plug);
 		while ((bio = bio_list_pop(&bio_list_on_stack)))
-			submit_bio_noacct_nocheck(bio);
+			submit_bio_noacct_nocheck(bio, false);
 		blk_finish_plug(&plug);
 	}
 }
diff --git a/block/blk.h b/block/blk.h
index 18cc3c2afdd4d..d9efc8693aa48 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -54,7 +54,7 @@ bool blk_queue_start_drain(struct request_queue *q);
 bool __blk_freeze_queue_start(struct request_queue *q,
 			      struct task_struct *owner);
 int __bio_queue_enter(struct request_queue *q, struct bio *bio);
-void submit_bio_noacct_nocheck(struct bio *bio);
+void submit_bio_noacct_nocheck(struct bio *bio, bool split);
 void bio_await_chain(struct bio *bio);
 
 static inline bool blk_try_enter_queue(struct request_queue *q, bool pm)
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:55:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369090; cv=none; b=CcVoct+T7H6eZ7mFDADB6OVJQPBM6GoHcyoJel6dYZ+fEjvZ9wZWNONGOWAXqM8LxxyUIGGt8SQDM8U1l/E0WEYD8V7BGByoXVx6MldTr3IVBA5afb4Bs+4FYr9eNf7jZiutKmt2vKsqy43lemu26E5FAj58ukwxfJoxelkkX+Y=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369090; c=relaxed/simple;
	bh=Jj7Ebs5D1rUUdBoFnjQpprEhC+Hx+eRY0/Tc3R/Z+eU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=KBIMVgFPMcOhZjkUWaZkk9FZmdiKck8M7NOyngeOXXAMfXiUZDeEpB7AawckQCBCrGA8oNmx1iiBSYuj/3QObGMDtGu6qklJSlgbnEPfVqQPy/Ydwd54c3Hvv1BC5zEnBAOUdqRAETliE4aGigfDvwEjTGN9MPfAiOnMM6b2O98=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yup7bkW8; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yu Kuai <[email-masked]>,
	Christoph Hellwig <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 123/563] block: skip unnecessary checks for split bio
Date: Mon, 13 Oct 2025 16:39:44 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yu Kuai <[email-masked]>

[ Upstream commit 0b64682e78f7a53ea863e368b1aa66f05767858d ]

Lots of checks are already done while submitting this bio the first
time, and there is no need to check them again when this bio is
resubmitted after split.

Hence open code should_fail_bio() and blk_throtl_bio() that are still
necessary from submit_bio_split_bioset().

Signed-off-by: Yu Kuai <[email-masked]>
Reviewed-by: Christoph Hellwig <[email-masked]>
Signed-off-by: Jens Axboe <[email-masked]>
Stable-dep-of: b2f5974079d8 ("block: fix ordering of recursive split IO")
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/blk-core.c  | 2 +-
 block/blk-merge.c | 6 +++++-
 block/blk.h       | 1 +
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/block/blk-core.c b/block/blk-core.c
index e5af6eda5a459..03a5d4c9cbf72 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -539,7 +539,7 @@ static inline void bio_check_ro(struct bio *bio)
 	}
 }
 
-static noinline int should_fail_bio(struct bio *bio)
+int should_fail_bio(struct bio *bio)
 {
 	if (should_fail_request(bdev_whole(bio->bi_bdev), bio->bi_iter.bi_size))
 		return -EIO;
diff --git a/block/blk-merge.c b/block/blk-merge.c
index 51fe4ed5b7c0b..c411045fcf03a 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -130,7 +130,11 @@ struct bio *bio_submit_split_bioset(struct bio *bio, unsigned int split_sectors,
 	bio_chain(split, bio);
 	trace_block_split(split, bio->bi_iter.bi_sector);
 	WARN_ON_ONCE(bio_zone_write_plugging(bio));
-	submit_bio_noacct(bio);
+
+	if (should_fail_bio(bio))
+		bio_io_error(bio);
+	else if (!blk_throtl_bio(bio))
+		submit_bio_noacct_nocheck(bio);
 
 	return split;
 }
diff --git a/block/blk.h b/block/blk.h
index 0268deb222688..18cc3c2afdd4d 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -615,6 +615,7 @@ extern const struct address_space_operations def_blk_aops;
 int disk_register_independent_access_ranges(struct gendisk *disk);
 void disk_unregister_independent_access_ranges(struct gendisk *disk);
 
+int should_fail_bio(struct bio *bio);
 #ifdef CONFIG_FAIL_MAKE_REQUEST
 bool should_fail_request(struct block_device *part, unsigned int bytes);
 #else /* CONFIG_FAIL_MAKE_REQUEST */
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:48:02 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369084; cv=none; b=ogfLZNdd0CDx264UEkwCXxIrswDg2m2eV/WjfebvCAewbj9Siy/Ia54zmYDeuTXuybqdlUQThblkHOFAQtTD0LfLabyc1taR4sfwrW9jIokkN1GSIa/nlRwWcPMgfjLxzUI3kCfr23V8UJiHLUvaITCCVX9xb23hMCrbGRaqz9g=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369084; c=relaxed/simple;
	bh=INgivSK8bHOmnCzuqhDq9dchKR5xZYqn/9698tc8ClE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pRPZ69sVFBewcO1Z3RSK7NO3/FE9iqOuwKYouMimquEOtDflCxXnISktBBE/IdoAqbJoyG+DOCqjo23g/+5e9M6LZEYMoFWL3WwsmXJdJpamhgZevb5eg8L0n5d3+1hYkcBRVQTjjY4FIB34EDYqEE8J7EN4Akh6hpwizxzxADs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0bnU+ga8; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yu Kuai <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 121/563] block: initialize bio issue time in blk_mq_submit_bio()
Date: Mon, 13 Oct 2025 16:39:42 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yu Kuai <[email-masked]>

[ Upstream commit 1f963bdd6420b6080bcfd0ee84a75c96f35545a6 ]

bio->issue_time_ns is only used by blk-iolatency, which can only be
enabled for rq-based disk, hence it's not necessary to initialize
the time for bio-based disk.

Meanwhile, if bio is split by blk_crypto_fallback_split_bio_if_needed(),
the issue time is not initialized for new split bio, this can be fixed
as well.

Noted the next patch will optimize better that bio issue time will
only be used when blk-iolatency is really enabled by the disk.

Fixes: 488f6682c832 ("block: blk-crypto-fallback for Inline Encryption")
Signed-off-by: Yu Kuai <[email-masked]>
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/blk-cgroup.h | 6 ------
 block/blk-core.c   | 1 -
 block/blk-merge.c  | 1 -
 block/blk-mq.c     | 8 ++++++++
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
index 8328427e31657..1cce3294634d1 100644
--- a/block/blk-cgroup.h
+++ b/block/blk-cgroup.h
@@ -370,11 +370,6 @@ static inline void blkg_put(struct blkcg_gq *blkg)
 		if (((d_blkg) = blkg_lookup(css_to_blkcg(pos_css),	\
 					    (p_blkg)->q)))
 
-static inline void blkcg_bio_issue_init(struct bio *bio)
-{
-	bio->issue_time_ns = blk_time_get_ns();
-}
-
 static inline void blkcg_use_delay(struct blkcg_gq *blkg)
 {
 	if (WARN_ON_ONCE(atomic_read(&blkg->use_delay) < 0))
@@ -497,7 +492,6 @@ static inline struct blkg_policy_data *blkg_to_pd(struct blkcg_gq *blkg,
 static inline struct blkcg_gq *pd_to_blkg(struct blkg_policy_data *pd) { return NULL; }
 static inline void blkg_get(struct blkcg_gq *blkg) { }
 static inline void blkg_put(struct blkcg_gq *blkg) { }
-static inline void blkcg_bio_issue_init(struct bio *bio) { }
 static inline void blk_cgroup_bio_start(struct bio *bio) { }
 static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) { return true; }
 
diff --git a/block/blk-core.c b/block/blk-core.c
index a27185cd8edea..e5af6eda5a459 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -730,7 +730,6 @@ static void __submit_bio_noacct_mq(struct bio *bio)
 void submit_bio_noacct_nocheck(struct bio *bio)
 {
 	blk_cgroup_bio_start(bio);
-	blkcg_bio_issue_init(bio);
 
 	if (!bio_flagged(bio, BIO_TRACE_COMPLETION)) {
 		trace_block_bio_queue(bio);
diff --git a/block/blk-merge.c b/block/blk-merge.c
index 70d704615be52..5538356770a47 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -119,7 +119,6 @@ static struct bio *bio_submit_split(struct bio *bio, int split_sectors)
 			goto error;
 		}
 		split->bi_opf |= REQ_NOMERGE;
-		blkcg_bio_issue_init(split);
 		bio_chain(split, bio);
 		trace_block_split(split, bio->bi_iter.bi_sector);
 		WARN_ON_ONCE(bio_zone_write_plugging(bio));
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 9055cd6247004..19b50110376c6 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -396,6 +396,13 @@ static inline void blk_mq_rq_time_init(struct request *rq, u64 alloc_time_ns)
 #endif
 }
 
+static inline void blk_mq_bio_issue_init(struct bio *bio)
+{
+#ifdef CONFIG_BLK_CGROUP
+	bio->issue_time_ns = blk_time_get_ns();
+#endif
+}
+
 static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data,
 		struct blk_mq_tags *tags, unsigned int tag)
 {
@@ -3168,6 +3175,7 @@ void blk_mq_submit_bio(struct bio *bio)
 	if (!bio_integrity_prep(bio))
 		goto queue_exit;
 
+	blk_mq_bio_issue_init(bio);
 	if (blk_mq_attempt_bio_merge(q, bio, nr_segs))
 		goto queue_exit;
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:39:08 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369081; cv=none; b=JaApyyXLk2NJZ5X7quxXA2r7+8MIMyhvs7xlU+hCBrLsmfSrzlTUoultO4WiXkgF5OW41QpG1kZfRVvdDVOCHmKz1MJzEOgjC9zu3uo5lxzEVzw6TJi/LhveQ6mzkcdKN13iqAOiKn54MeV0XwL/hpcLhQrHTlFJblX1fEv/XtQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369081; c=relaxed/simple;
	bh=Borexb4ossLqvtP7GQ6JqbAWuxd/qa7iZZPI9klEEAQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=UTtOFEy0uY4ee57qil7wZEK6LqmO/RMRY6jnIYVIqXS0ZYGId3UCvJGzhWhbUKfK0mPnOMeDybv2QrQzlv+hlUURSk4R1fHtzVHn1cdyQEmkLo25Z3L15L1G0inupTCEWysDS80cImdwHors2Ja65gQXTNAqHA27qdAr6QbCfJY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=F5wt3xCQ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yu Kuai <[email-masked]>,
	Christoph Hellwig <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 120/563] block: cleanup bio_issue
Date: Mon, 13 Oct 2025 16:39:41 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yu Kuai <[email-masked]>

[ Upstream commit 1733e88874838ddebf7774440c285700865e6b08 ]

Now that bio->bi_issue is only used by blk-iolatency to get bio issue
time, replace bio_issue with u64 time directly and remove bio_issue to
make code cleaner.

Signed-off-by: Yu Kuai <[email-masked]>
Reviewed-by: Christoph Hellwig <[email-masked]>
Signed-off-by: Jens Axboe <[email-masked]>
Stable-dep-of: 1f963bdd6420 ("block: initialize bio issue time in blk_mq_submit_bio()")
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/bio.c               |  2 +-
 block/blk-cgroup.h        |  2 +-
 block/blk-iolatency.c     | 14 +++----------
 block/blk.h               | 42 ---------------------------------------
 include/linux/blk_types.h |  7 ++-----
 5 files changed, 7 insertions(+), 60 deletions(-)

diff --git a/block/bio.c b/block/bio.c
index 3b371a5da159e..1904683f7ab05 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -261,7 +261,7 @@ void bio_init(struct bio *bio, struct block_device *bdev, struct bio_vec *table,
 	bio->bi_private = NULL;
 #ifdef CONFIG_BLK_CGROUP
 	bio->bi_blkg = NULL;
-	bio->bi_issue.value = 0;
+	bio->issue_time_ns = 0;
 	if (bdev)
 		bio_associate_blkg(bio);
 #ifdef CONFIG_BLK_CGROUP_IOCOST
diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
index 83367086cb6ae..8328427e31657 100644
--- a/block/blk-cgroup.h
+++ b/block/blk-cgroup.h
@@ -372,7 +372,7 @@ static inline void blkg_put(struct blkcg_gq *blkg)
 
 static inline void blkcg_bio_issue_init(struct bio *bio)
 {
-	bio_issue_init(&bio->bi_issue, bio_sectors(bio));
+	bio->issue_time_ns = blk_time_get_ns();
 }
 
 static inline void blkcg_use_delay(struct blkcg_gq *blkg)
diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
index 2f8fdecdd7a9b..554b191a68921 100644
--- a/block/blk-iolatency.c
+++ b/block/blk-iolatency.c
@@ -485,19 +485,11 @@ static void blkcg_iolatency_throttle(struct rq_qos *rqos, struct bio *bio)
 		mod_timer(&blkiolat->timer, jiffies + HZ);
 }
 
-static void iolatency_record_time(struct iolatency_grp *iolat,
-				  struct bio_issue *issue, u64 now,
-				  bool issue_as_root)
+static void iolatency_record_time(struct iolatency_grp *iolat, u64 start,
+				  u64 now, bool issue_as_root)
 {
-	u64 start = bio_issue_time(issue);
 	u64 req_time;
 
-	/*
-	 * Have to do this so we are truncated to the correct time that our
-	 * issue is truncated to.
-	 */
-	now = __bio_issue_time(now);
-
 	if (now <= start)
 		return;
 
@@ -625,7 +617,7 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
 		 * submitted, so do not account for it.
 		 */
 		if (iolat->min_lat_nsec && bio->bi_status != BLK_STS_AGAIN) {
-			iolatency_record_time(iolat, &bio->bi_issue, now,
+			iolatency_record_time(iolat, bio->issue_time_ns, now,
 					      issue_as_root);
 			window_start = atomic64_read(&iolat->window_start);
 			if (now > window_start &&
diff --git a/block/blk.h b/block/blk.h
index 46f566f9b1266..0268deb222688 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -680,48 +680,6 @@ static inline ktime_t blk_time_get(void)
 	return ns_to_ktime(blk_time_get_ns());
 }
 
-/*
- * From most significant bit:
- * 1 bit: reserved for other usage, see below
- * 12 bits: original size of bio
- * 51 bits: issue time of bio
- */
-#define BIO_ISSUE_RES_BITS      1
-#define BIO_ISSUE_SIZE_BITS     12
-#define BIO_ISSUE_RES_SHIFT     (64 - BIO_ISSUE_RES_BITS)
-#define BIO_ISSUE_SIZE_SHIFT    (BIO_ISSUE_RES_SHIFT - BIO_ISSUE_SIZE_BITS)
-#define BIO_ISSUE_TIME_MASK     ((1ULL << BIO_ISSUE_SIZE_SHIFT) - 1)
-#define BIO_ISSUE_SIZE_MASK     \
-	(((1ULL << BIO_ISSUE_SIZE_BITS) - 1) << BIO_ISSUE_SIZE_SHIFT)
-#define BIO_ISSUE_RES_MASK      (~((1ULL << BIO_ISSUE_RES_SHIFT) - 1))
-
-/* Reserved bit for blk-throtl */
-#define BIO_ISSUE_THROTL_SKIP_LATENCY (1ULL << 63)
-
-static inline u64 __bio_issue_time(u64 time)
-{
-	return time & BIO_ISSUE_TIME_MASK;
-}
-
-static inline u64 bio_issue_time(struct bio_issue *issue)
-{
-	return __bio_issue_time(issue->value);
-}
-
-static inline sector_t bio_issue_size(struct bio_issue *issue)
-{
-	return ((issue->value & BIO_ISSUE_SIZE_MASK) >> BIO_ISSUE_SIZE_SHIFT);
-}
-
-static inline void bio_issue_init(struct bio_issue *issue,
-				       sector_t size)
-{
-	size &= (1ULL << BIO_ISSUE_SIZE_BITS) - 1;
-	issue->value = ((issue->value & BIO_ISSUE_RES_MASK) |
-			(blk_time_get_ns() & BIO_ISSUE_TIME_MASK) |
-			((u64)size << BIO_ISSUE_SIZE_SHIFT));
-}
-
 void bdev_release(struct file *bdev_file);
 int bdev_open(struct block_device *bdev, blk_mode_t mode, void *holder,
 	      const struct blk_holder_ops *hops, struct file *bdev_file);
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 09b99d52fd365..f78145be77df5 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -198,10 +198,6 @@ static inline bool blk_path_error(blk_status_t error)
 	return true;
 }
 
-struct bio_issue {
-	u64 value;
-};
-
 typedef __u32 __bitwise blk_opf_t;
 
 typedef unsigned int blk_qc_t;
@@ -242,7 +238,8 @@ struct bio {
 	 * on release of the bio.
 	 */
 	struct blkcg_gq		*bi_blkg;
-	struct bio_issue	bi_issue;
+	/* Time that this bio was issued. */
+	u64			issue_time_ns;
 #ifdef CONFIG_BLK_CGROUP_IOCOST
 	u64			bi_iocost_cost;
 #endif
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:51:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369070; cv=none; b=eLrZayUU7wMGBsMYhx2F7OxvBtYwjlTS0WrmDuodDmWgUhnLQJQOgXqL69XQQCAK8aLyKCBwxGxPOW0s3Oup8KqW+/n4oKSXKiXi68eLH+puL1SH9oF0qcBep6Dxeyu/DL5/SjXeVfeODc66zEAnYnzdvtfUYTVdTiCzELgt7Xg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369070; c=relaxed/simple;
	bh=k8j9BfqzH5uyccw8XtD0woJ5C1p5zp3B8pnFo0rlTH4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pQ9kEsMoXbfhAdu+3t1iATNdA/03VJ6B5A6xUEFnmVKfsr69dXRBI7ddV06Nhz8UR50AHMrTdvDqaGDZ0pIK0GWhXC+W71yqE3GW5shX63YngCRd3YCVAoC/Hs+FgZ7LzR5q41hl3iGZwJJiWmiXZ15y8sL7UHXsSD4AwUgdpG4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=P2F79Esx; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Roger Lu <[email-masked]>,
	Johan Hovold <[email-masked]>,
	AngeloGioacchino Del Regno <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 117/563] soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
Date: Mon, 13 Oct 2025 16:39:38 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email-masked]>

[ Upstream commit 6ab4f79ea92324f7f2eb22692054a34bbba7cf35 ]

Make sure to drop the references taken by of_find_device_by_node() when
looking up the thermal sensor and opp devices during probe on probe
failure (e.g. probe deferral) and on driver unbind.

Fixes: 681a02e95000 ("soc: mediatek: SVS: introduce MTK SVS engine")
Cc: Roger Lu <[email-masked]>
Signed-off-by: Johan Hovold <[email-masked]>
Reviewed-by: AngeloGioacchino Del Regno <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/soc/mediatek/mtk-svs.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c
index 7c349a94b45c0..48804e1e5a6c8 100644
--- a/drivers/soc/mediatek/mtk-svs.c
+++ b/drivers/soc/mediatek/mtk-svs.c
@@ -2165,6 +2165,13 @@ static struct device *svs_add_device_link(struct svs_platform *svsp,
 	return dev;
 }
 
+static void svs_put_device(void *_dev)
+{
+	struct device *dev = _dev;
+
+	put_device(dev);
+}
+
 static int svs_mt8192_platform_probe(struct svs_platform *svsp)
 {
 	struct device *dev;
@@ -2216,11 +2223,13 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
 {
 	struct device *dev;
 	u32 idx;
+	int ret;
 
 	dev = svs_add_device_link(svsp, "thermal-sensor");
 	if (IS_ERR(dev))
 		return dev_err_probe(svsp->dev, PTR_ERR(dev),
 				     "failed to get thermal device\n");
+	put_device(dev);
 
 	for (idx = 0; idx < svsp->bank_max; idx++) {
 		struct svs_bank *svsb = &svsp->banks[idx];
@@ -2230,6 +2239,7 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
 		case SVSB_SWID_CPU_LITTLE:
 		case SVSB_SWID_CPU_BIG:
 			svsb->opp_dev = get_cpu_device(bdata->cpu_id);
+			get_device(svsb->opp_dev);
 			break;
 		case SVSB_SWID_CCI:
 			svsb->opp_dev = svs_add_device_link(svsp, "cci");
@@ -2246,6 +2256,11 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
 			return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev),
 					     "failed to get OPP device for bank %d\n",
 					     idx);
+
+		ret = devm_add_action_or_reset(svsp->dev, svs_put_device,
+					       svsb->opp_dev);
+		if (ret)
+			return ret;
 	}
 
 	return 0;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:53:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369067; cv=none; b=J9GkGxGy3PROEYqfUYoprUxNN6Gf2Ftspcm/pkM2lb1wKNreWXeUq12Vc0OBgV1qIBHS0tvXAglxrsPQzccW/znGJ/NyW+mncuZz6qSn/H9AtsXYvOhHfisJ+heKUkrZHmGo//nzulg4r+mItCE1BXy66N09It981X7C+f70HO8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369067; c=relaxed/simple;
	bh=UhWpqT2i2nclpC5jaF8eYBDEWOcS1HgoQQDLWF/3Hyo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=aj0kSz1w6PiDlc5osRys+0w+RUAo8aJy4iwErUzVqVhragI0JO2EJw76tRMvs/KKZVafuQR5WWRidh/fmS8GnYjCZ9bCc30XiELON11YfdQuRSyJXONBytxQlVOYqRGlY7VqKFNtk2yxes//TEvjNf1dSb/8ZD5eTfddmaj4yfc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0ECQ20P9; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Xianwei Zhao <[email-masked]>,
	Martin Blumenstingl <[email-masked]>,
	Neil Armstrong <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 116/563] dts: arm: amlogic: fix pwm node for c3
Date: Mon, 13 Oct 2025 16:39:37 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xianwei Zhao <[email-masked]>

[ Upstream commit f8c9fabf2f3d87773613734a8479d0ef9b662b11 ]

Fix reg address for c3 pwm node.

Fixes: be90cd4bd422 ("arm64: dts: amlogic: Add Amlogic C3 PWM")
Signed-off-by: Xianwei Zhao <[email-masked]>
Reviewed-by: Martin Blumenstingl <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Neil Armstrong <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi b/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
index cb9ea3ca6ee0f..71b2b3b547f7c 100644
--- a/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
+++ b/arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi
@@ -792,7 +792,7 @@ spicc1: spi@52000 {
 			pwm_mn: pwm@54000 {
 				compatible = "amlogic,c3-pwm",
 					     "amlogic,meson-s4-pwm";
-				reg = <0x0 54000 0x0 0x24>;
+				reg = <0x0 0x54000 0x0 0x24>;
 				clocks = <&clkc_periphs CLKID_PWM_M>,
 					 <&clkc_periphs CLKID_PWM_N>;
 				#pwm-cells = <3>;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:46:55 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369064; cv=none; b=uTsZ9Rp9TcuTBJIAKf34Nm5Aqyh8jIPJDGsxpXmufQcnousLRqLn3HypwrCbwJvsZArNLQkyfSFJzc4xqW+fWPdz6p5fyL253soLS/YQeZDIVKk99d27WlaHC/rOQrEcodc4JLLy1T58HFDR070F082ixegTym8mE6vTYnOKWZw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369064; c=relaxed/simple;
	bh=duX7APL3Xq+tqxfalxxwiUM2ReG0ExLTLY27zDJqxG0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=BNVHhnnVKcmo/bzS2WzLEX0RKrrWT1bEhtr25DeT17j3oNE8dilbNKHFs4El8MX/IgsP8nO8P8IiwLjWad6quoxWCGMblIA7aJ/bYk33bArLvijmTGK6WpcojCRwa1jWiFKLKHjbK+JqN4IjB+Ity/O7yb/o90WsjBtOkKsAWOA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=wRfkyYv7; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Johan Hovold <[email-masked]>,
	Neil Armstrong <[email-masked]>,
	Martin Blumenstingl <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 115/563] firmware: firmware: meson-sm: fix compile-test default
Date: Mon, 13 Oct 2025 16:39:36 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email-masked]>

[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ]

Enabling compile testing should not enable every individual driver (we
have "allyesconfig" for that).

Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module")
Signed-off-by: Johan Hovold <[email-masked]>
Reviewed-by: Neil Armstrong <[email-masked]>
Reviewed-by: Martin Blumenstingl <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Neil Armstrong <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/firmware/meson/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig
index f2fdd37566482..179f5d46d8ddf 100644
--- a/drivers/firmware/meson/Kconfig
+++ b/drivers/firmware/meson/Kconfig
@@ -5,7 +5,7 @@
 config MESON_SM
 	tristate "Amlogic Secure Monitor driver"
 	depends on ARCH_MESON || COMPILE_TEST
-	default y
+	default ARCH_MESON
 	depends on ARM64_4K_PAGES
 	help
 	  Say y here to enable the Amlogic secure monitor driver
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:38:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369062; cv=none; b=QoHS3syn2WOaFdgzBGrYpTpHi3AJhOa2LBuhUE14OEkHwfWgUB+OfRYCIJKvOYmp6pwAfjcimshUb9EUCXuqZI2ubXHVJYT/J0omLjCBR7PaiyOf33eQEMiGgddzt2iAMz2ccvZW3uenh6n//cKJuglRUe0+FJz4MIz5l2pZWeE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369062; c=relaxed/simple;
	bh=vGT79vvu6gM8RTugh9J/OyB/sJZAnFbhgSKPZZiy3C0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=osEqF638Q0MuD1Tt7ejEMrGCOXwm6+R7WFh7JMXZ4L17iKQFV6itIjeFN7E0U9uk5PBQ4Vl0lJNLXN831vFmWk6Fs7GKXKkSl8CC+sA8BfMv+sG6gmBo26UfGMbGKg7it8jNXedC0XWMSuL4YRjYLw+HPLPZT4VNDNY7z/JDAvw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=afyf85fm; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Nicolas Frattaroli <[email-masked]>,
	Chanwoo Choi <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 114/563] PM / devfreq: rockchip-dfi: double count on RK3588
Date: Mon, 13 Oct 2025 16:39:35 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolas Frattaroli <[email-masked]>

[ Upstream commit f89c7fb83ae95578e355bed1a7aeea5f3ca5a067 ]

On RK3588 with LPDDR4X memory, the cycle count as returned by

  perf stat -a -e rockchip_ddr/cycles/ sleep 1

consistently reads half as much as what the actual DDR frequency is at.
For a LPDDR4X module running at 2112MHz, I get more like 1056059916
cycles per second, which is almost bang-on half what it should be. No,
I'm not mixing up megatransfers and megahertz.

Consulting the downstream driver, this appears to be because the RK3588
hardware specifically (and RK3528 as well, for future reference) needs a
multiplier of 2 to get to the correct frequency with everything but
LPDDR5.

The RK3588's actual memory bandwidth measurements in MB/s are correct
however, as confirmed with stress-ng --stream. This makes me think the
access counters are not affected in the same way. This tracks with the
vendor kernel not multiplying the access counts either.

Solve this by adding a new member to the dfi struct, which each SoC can
set to whatever they want, but defaults to 1 if left unset by the SoC
init functions. The event_get_count op can then use this multiplier if
the cycle count is requested.

The cycle multiplier is not used in rockchip_dfi_get_event because the
vendor driver doesn't use it there either, and we don't do other actual
bandwidth unit conversion stuff in there anyway.

Fixes: 481d97ba61e1 ("PM / devfreq: rockchip-dfi: add support for RK3588")
Signed-off-by: Nicolas Frattaroli <[email-masked]>
Signed-off-by: Chanwoo Choi <[email-masked]>
Link: https://lore.kernel.org/lkml/[email-masked]/
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/devfreq/event/rockchip-dfi.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/devfreq/event/rockchip-dfi.c b/drivers/devfreq/event/rockchip-dfi.c
index 0470d7c175f4f..54effb6351965 100644
--- a/drivers/devfreq/event/rockchip-dfi.c
+++ b/drivers/devfreq/event/rockchip-dfi.c
@@ -116,6 +116,7 @@ struct rockchip_dfi {
 	int buswidth[DMC_MAX_CHANNELS];
 	int ddrmon_stride;
 	bool ddrmon_ctrl_single;
+	unsigned int count_multiplier;	/* number of data clocks per count */
 };
 
 static int rockchip_dfi_enable(struct rockchip_dfi *dfi)
@@ -435,7 +436,7 @@ static u64 rockchip_ddr_perf_event_get_count(struct perf_event *event)
 
 	switch (event->attr.config) {
 	case PERF_EVENT_CYCLES:
-		count = total.c[0].clock_cycles;
+		count = total.c[0].clock_cycles * dfi->count_multiplier;
 		break;
 	case PERF_EVENT_READ_BYTES:
 		for (i = 0; i < dfi->max_channels; i++)
@@ -655,6 +656,9 @@ static int rockchip_ddr_perf_init(struct rockchip_dfi *dfi)
 		break;
 	}
 
+	if (!dfi->count_multiplier)
+		dfi->count_multiplier = 1;
+
 	ret = perf_pmu_register(pmu, "rockchip_ddr", -1);
 	if (ret)
 		return ret;
@@ -751,6 +755,7 @@ static int rk3588_dfi_init(struct rockchip_dfi *dfi)
 	dfi->max_channels = 4;
 
 	dfi->ddrmon_stride = 0x4000;
+	dfi->count_multiplier = 2;
 
 	return 0;
 };
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:38:48 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369058; cv=none; b=dryrSIgOWtQV2H9eEZm8awwgWsdLFplNjERM/YtYtzbvp02BK7KGvkflU2V+IuwCJl00o3Uue4pe0K0UDd7kdl+wCgzTePE7aYTyNCSSomFjt5rfJG8+NVvFUO0ISW5JaiLZkDoiXiK0kVb5ZK4J6mCW4bxjmU6EzKnE1f7pzoA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369058; c=relaxed/simple;
	bh=s/03muLX84TLkR0AqENV0+EaulM58z/rfNsu6M2LL1Y=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=X0sRk+w6eJQeODZogy4vYxeh9omnoOKCVMzS9iqyklrLQ5iAoCapFCsqaf3WgSonL715XjhbC9DNjdPsg4Un3XszMgBHuvwY71fNDi4Oi5lUl9TJtpG3eVnnRij8tRMMyF6cL99iwZbiaFIOvjIhsdhwURW23+LyO+lYRrC8EGk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Os6/gFKU; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1821FC4CEFE;
	Mon, 13 Oct 2025 15:24:17 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760369058;
	bh=s/03muLX84TLkR0AqENV0+EaulM58z/rfNsu6M2LL1Y=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=Os6/gFKUs93jZPTKOHpunX+6RoINl3P4beaa1O98PObuyaQ+BWotR7ZqINdGcxiB2
	 e5QaGaT0hiTKFoQ6AZbJfzYqbnk4+gJIvr4vLfLXQKxo2oUZ6n32MFH39vghmYOj/W
	 zCyvwuR6i2dgPDy3d//esWNCQHYXjTQzyyOzqZ20=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Eric Dumazet <[email-masked]>,
	Mike Christie <[email-masked]>,
	"Richard W.M. Jones" <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Yu Kuai <[email-masked]>,
	[email-masked],
	[email-masked],
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 113/563] nbd: restrict sockets to TCP and UDP
Date: Mon, 13 Oct 2025 16:39:34 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email-masked]>

[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ]

Recently, syzbot started to abuse NBD with all kinds of sockets.

Commit cf1b2326b734 ("nbd: verify socket is supported during setup")
made sure the socket supported a shutdown() method.

Explicitely accept TCP and UNIX stream sockets.

Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup")
Reported-by: [email-masked]
Closes: https://lore.kernel.org/netdev/[email-masked]/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154
Signed-off-by: Eric Dumazet <[email-masked]>
Cc: Mike Christie <[email-masked]>
Cc: Richard W.M. Jones <[email-masked]>
Cc: Jens Axboe <[email-masked]>
Cc: Yu Kuai <[email-masked]>
Cc: [email-masked]
Cc: [email-masked]
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/block/nbd.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 6463d0e8d0cef..87b0b78249da3 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1217,6 +1217,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd,
 	if (!sock)
 		return NULL;
 
+	if (!sk_is_tcp(sock->sk) &&
+	    !sk_is_stream_unix(sock->sk)) {
+		dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n");
+		*err = -EINVAL;
+		sockfd_put(sock);
+		return NULL;
+	}
+
 	if (sock->ops->shutdown == sock_no_shutdown) {
 		dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n");
 		*err = -EINVAL;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:51:40 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369055; cv=none; b=UUR8ObDSiU9FmhL90j9GfeyFhnQw7cRoS9kPuJZTOlH0FTUGMH8EtU7UpM/b9LrT02zzTf3HcAZNVPJHNS78GxJLdW0y4D+OxJHCEMIF2otE/nnNTcYA/ugRfqlW2LepBBYiJiSGHjcuPWh0KHRe25G/KAvKc8pkQWmFeR/SOP4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369055; c=relaxed/simple;
	bh=kmqBNyz4A93wTLrcbXC5DaCpgWxXRlDa2sthNMsBGyQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=NKF67xYv5Re7DKwQmTrUHkcpSQ9qkRPDTy6gY0+hovtQC4Fy+cqe1+fak/RYMli/h58lUW3ulDbSLKAF++OTtrycS0eVNbRWnGS0hcT7E9ZEBWd1uytiXDjZg6F6JYTfhA9kUDSCUZuWQUCCOLsHUF3jMdECYc8CzDJVPO6b3aA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=fObBx4lt; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	"Rob Herring (Arm)" <[email-masked]>,
	AngeloGioacchino Del Regno <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 112/563] arm64: dts: mediatek: mt8183: Fix out of range pull values
Date: Mon, 13 Oct 2025 16:39:33 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Rob Herring (Arm) <[email-masked]>

[ Upstream commit 0aeb7ed4bcb244862a35f880053cd64d28c6fb04 ]

A value of 10 is not valid for "mediatek,pull-down-adv" and
"mediatek,pull-up-adv" properties which have defined values of 0-3. It
appears the "10" was written as a binary value. The driver only looks at
the lowest 2 bits, so the value "10" decimal works out the same as if
"2" was used.

Fixes: cd894e274b74 ("arm64: dts: mt8183: Add krane-sku176 board")
Fixes: 19b6403f1e2a ("arm64: dts: mt8183: add mt8183 pumpkin board")
Signed-off-by: Rob Herring (Arm) <[email-masked]>
Reviewed-by: AngeloGioacchino Del Regno <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi  | 14 +++++++-------
 arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts | 14 +++++++-------
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
index 400c61d110356..fff93e26eb760 100644
--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
@@ -580,7 +580,7 @@ pins-cmd-dat {
 		pins-clk {
 			pinmux = <PINMUX_GPIO124__FUNC_MSDC0_CLK>;
 			drive-strength = <MTK_DRIVE_14mA>;
-			mediatek,pull-down-adv = <10>;
+			mediatek,pull-down-adv = <2>;
 		};
 
 		pins-rst {
@@ -609,13 +609,13 @@ pins-cmd-dat {
 		pins-clk {
 			pinmux = <PINMUX_GPIO124__FUNC_MSDC0_CLK>;
 			drive-strength = <MTK_DRIVE_14mA>;
-			mediatek,pull-down-adv = <10>;
+			mediatek,pull-down-adv = <2>;
 		};
 
 		pins-ds {
 			pinmux = <PINMUX_GPIO131__FUNC_MSDC0_DSL>;
 			drive-strength = <MTK_DRIVE_14mA>;
-			mediatek,pull-down-adv = <10>;
+			mediatek,pull-down-adv = <2>;
 		};
 
 		pins-rst {
@@ -633,13 +633,13 @@ pins-cmd-dat {
 				 <PINMUX_GPIO33__FUNC_MSDC1_DAT2>,
 				 <PINMUX_GPIO30__FUNC_MSDC1_DAT3>;
 			input-enable;
-			mediatek,pull-up-adv = <10>;
+			mediatek,pull-up-adv = <2>;
 		};
 
 		pins-clk {
 			pinmux = <PINMUX_GPIO29__FUNC_MSDC1_CLK>;
 			input-enable;
-			mediatek,pull-down-adv = <10>;
+			mediatek,pull-down-adv = <2>;
 		};
 	};
 
@@ -652,13 +652,13 @@ pins-cmd-dat {
 				 <PINMUX_GPIO30__FUNC_MSDC1_DAT3>;
 			drive-strength = <6>;
 			input-enable;
-			mediatek,pull-up-adv = <10>;
+			mediatek,pull-up-adv = <2>;
 		};
 
 		pins-clk {
 			pinmux = <PINMUX_GPIO29__FUNC_MSDC1_CLK>;
 			drive-strength = <8>;
-			mediatek,pull-down-adv = <10>;
+			mediatek,pull-down-adv = <2>;
 			input-enable;
 		};
 	};
diff --git a/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts
index dbdee604edab4..7c3010889ae73 100644
--- a/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts
@@ -324,7 +324,7 @@ pins_cmd_dat {
 		pins_clk {
 			pinmux = <PINMUX_GPIO124__FUNC_MSDC0_CLK>;
 			drive-strength = <MTK_DRIVE_14mA>;
-			mediatek,pull-down-adv = <10>;
+			mediatek,pull-down-adv = <2>;
 		};
 
 		pins_rst {
@@ -353,13 +353,13 @@ pins_cmd_dat {
 		pins_clk {
 			pinmux = <PINMUX_GPIO124__FUNC_MSDC0_CLK>;
 			drive-strength = <MTK_DRIVE_14mA>;
-			mediatek,pull-down-adv = <10>;
+			mediatek,pull-down-adv = <2>;
 		};
 
 		pins_ds {
 			pinmux = <PINMUX_GPIO131__FUNC_MSDC0_DSL>;
 			drive-strength = <MTK_DRIVE_14mA>;
-			mediatek,pull-down-adv = <10>;
+			mediatek,pull-down-adv = <2>;
 		};
 
 		pins_rst {
@@ -377,13 +377,13 @@ pins_cmd_dat {
 				 <PINMUX_GPIO33__FUNC_MSDC1_DAT2>,
 				 <PINMUX_GPIO30__FUNC_MSDC1_DAT3>;
 			input-enable;
-			mediatek,pull-up-adv = <10>;
+			mediatek,pull-up-adv = <2>;
 		};
 
 		pins_clk {
 			pinmux = <PINMUX_GPIO29__FUNC_MSDC1_CLK>;
 			input-enable;
-			mediatek,pull-down-adv = <10>;
+			mediatek,pull-down-adv = <2>;
 		};
 
 		pins_pmu {
@@ -401,13 +401,13 @@ pins_cmd_dat {
 				 <PINMUX_GPIO30__FUNC_MSDC1_DAT3>;
 			drive-strength = <6>;
 			input-enable;
-			mediatek,pull-up-adv = <10>;
+			mediatek,pull-up-adv = <2>;
 		};
 
 		pins_clk {
 			pinmux = <PINMUX_GPIO29__FUNC_MSDC1_CLK>;
 			drive-strength = <8>;
-			mediatek,pull-down-adv = <10>;
+			mediatek,pull-down-adv = <2>;
 			input-enable;
 		};
 	};
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:48:21 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369050; cv=none; b=rYOQITDkIjzPqbBk7C5OABm8T2zPw5UIkNXCujc2Ev+z/1o0B0TdnhreMNpJTVYCORT70DWW13R6Q2tlc8sF9wvznjwT05y4WG0dpKJYOnIjXHo/x8oOfZc49VZNCxR6H/j3Q/PE5+TIB79NeC/ypjueFpOtJBa5Ca/8PcILHx8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369050; c=relaxed/simple;
	bh=xJogdsl6cmUWTs9ixDF5/KhfzW4bYvCjHpVOqvRpbdI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=J1PRMqwB/QsTvvsr/QVEtBMhhddXdpdkVddgGd8wP8sCCHwc+Ja6TlFrectsJzcKlcf+ZXLsSrRyqXVLWtJUdeHj01Pv9pkg4NUpi3IgM5sSqoC98U7D8vS+c7wpAiHdXDVZwzYi9xMsLxC9atYvT5qfT8+Yhwly46g+qjKH+14=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xgCQGA1M; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Bibo Mao <[email-masked]>,
	Thomas Gleixner <[email-masked]>,
	Frederic Weisbecker <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 110/563] tick: Do not set device to detached state in tick_shutdown()
Date: Mon, 13 Oct 2025 16:39:31 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bibo Mao <[email-masked]>

[ Upstream commit fe2a449a45b13df1562419e0104b4777b6ea5248 ]

tick_shutdown() sets the state of the clockevent device to detached
first and the invokes clockevents_exchange_device(), which in turn
invokes clockevents_switch_state().

But clockevents_switch_state() returns without invoking the device shutdown
callback as the device is already in detached state. As a consequence the
timer device is not shutdown when a CPU goes offline.

tick_shutdown() does this because it was originally invoked on a online CPU
and not on the outgoing CPU. It therefore could not access the clockevent
device of the already offlined CPU and just set the state.

Since commit 3b1596a21fbf tick_shutdown() is called on the outgoing CPU, so
the hardware device can be accessed.

Remove the state set before calling clockevents_exchange_device(), so that
the subsequent clockevents_switch_state() handles the state transition and
invokes the shutdown callback of the clockevent device.

[ tglx: Massaged change log ]

Fixes: 3b1596a21fbf ("clockevents: Shutdown and unregister current clockevents at CPUHP_AP_TICK_DYING")
Signed-off-by: Bibo Mao <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
Reviewed-by: Frederic Weisbecker <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/time/clockevents.c   |  2 +-
 kernel/time/tick-common.c   | 16 +++++-----------
 kernel/time/tick-internal.h |  2 +-
 3 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index f3e831f62906f..a59bc75ab7c5b 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -633,7 +633,7 @@ void tick_offline_cpu(unsigned int cpu)
 	raw_spin_lock(&clockevents_lock);
 
 	tick_broadcast_offline(cpu);
-	tick_shutdown(cpu);
+	tick_shutdown();
 
 	/*
 	 * Unregister the clock event devices which were
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 9a3859443c042..7e33d3f2e889b 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -411,24 +411,18 @@ int tick_cpu_dying(unsigned int dying_cpu)
 }
 
 /*
- * Shutdown an event device on a given cpu:
+ * Shutdown an event device on the outgoing CPU:
  *
- * This is called on a life CPU, when a CPU is dead. So we cannot
- * access the hardware device itself.
- * We just set the mode and remove it from the lists.
+ * Called by the dying CPU during teardown, with clockevents_lock held
+ * and interrupts disabled.
  */
-void tick_shutdown(unsigned int cpu)
+void tick_shutdown(void)
 {
-	struct tick_device *td = &per_cpu(tick_cpu_device, cpu);
+	struct tick_device *td = this_cpu_ptr(&tick_cpu_device);
 	struct clock_event_device *dev = td->evtdev;
 
 	td->mode = TICKDEV_MODE_PERIODIC;
 	if (dev) {
-		/*
-		 * Prevent that the clock events layer tries to call
-		 * the set mode function!
-		 */
-		clockevent_set_state(dev, CLOCK_EVT_STATE_DETACHED);
 		clockevents_exchange_device(dev, NULL);
 		dev->event_handler = clockevents_handle_noop;
 		td->evtdev = NULL;
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index faac36de35b9e..4e4f7bbe2a64b 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -26,7 +26,7 @@ extern void tick_setup_periodic(struct clock_event_device *dev, int broadcast);
 extern void tick_handle_periodic(struct clock_event_device *dev);
 extern void tick_check_new_device(struct clock_event_device *dev);
 extern void tick_offline_cpu(unsigned int cpu);
-extern void tick_shutdown(unsigned int cpu);
+extern void tick_shutdown(void);
 extern void tick_suspend(void);
 extern void tick_resume(void);
 extern bool tick_check_replacement(struct clock_event_device *curdev,
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:38:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369047; cv=none; b=ESZaUi47ZwjkNV8HOboNC26ZqSQAu+pQavdw2rQf/JwvOkljoAmXC+eccFLd7Rq/je3MR6ka2JqoyM5ljRueynIjPkJbB8fIAlcLaESoXgtZJCyidDjXuQnWtObVK4imXx2S4U0kBUtfcwPSW67SAVjEn6iDmr9RqboWiZet3FY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369047; c=relaxed/simple;
	bh=hUrk/ZsVHwGAs+V+3IzB4n4QBscUT/eIViNjbpr0mvQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=MWGKEy4KlMWOGAp+nokHl6QmzR/WNCZFaqq1WG2AJDrNZ+x8wdiGm4pKCzdsUk491QSmxjv+B21kPxy4EXCMkHcay/PrJnFmcZKmcL4rG31AUjjTqYAOEauqvfoMb6FtoU4NBQMthknxzayiJr5GYZx2OxKP0GkkC8BYrHCNCF0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xE/VfEJd; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	Lorenzo Pieralisi <[email-masked]>,
	Thomas Gleixner <[email-masked]>,
	Zenghui Yu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 109/563] irqchip/gic-v5: Fix error handling in gicv5_its_irq_domain_alloc()
Date: Mon, 13 Oct 2025 16:39:30 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email-masked]>

[ Upstream commit a186120c780e21e4cfd186a925e34f718e30de88 ]

Code in gicv5_its_irq_domain_alloc() has two issues:

 - it checks the wrong return value/variable when calling gicv5_alloc_lpi()

 - The cleanup code does not take previous loop iterations into account

Fix both issues at once by adding the right gicv5_alloc_lpi() variable
check and by reworking the function cleanup code to take into account
current and previous iterations.

[ lpieralisi: Reworded commit message ]

Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support")
Signed-off-by: Dan Carpenter <[email-masked]>
Signed-off-by: Lorenzo Pieralisi <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
Reviewed-by: Zenghui Yu <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/irqchip/irq-gic-v5-its.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
index 4701ef62b8b27..2fb58d76f5214 100644
--- a/drivers/irqchip/irq-gic-v5-its.c
+++ b/drivers/irqchip/irq-gic-v5-its.c
@@ -949,15 +949,18 @@ static int gicv5_its_irq_domain_alloc(struct irq_domain *domain, unsigned int vi
 	device_id = its_dev->device_id;
 
 	for (i = 0; i < nr_irqs; i++) {
-		lpi = gicv5_alloc_lpi();
+		ret = gicv5_alloc_lpi();
 		if (ret < 0) {
 			pr_debug("Failed to find free LPI!\n");
-			goto out_eventid;
+			goto out_free_irqs;
 		}
+		lpi = ret;
 
 		ret = irq_domain_alloc_irqs_parent(domain, virq + i, 1, &lpi);
-		if (ret)
-			goto out_free_lpi;
+		if (ret) {
+			gicv5_free_lpi(lpi);
+			goto out_free_irqs;
+		}
 
 		/*
 		 * Store eventid and deviceid into the hwirq for later use.
@@ -977,8 +980,13 @@ static int gicv5_its_irq_domain_alloc(struct irq_domain *domain, unsigned int vi
 
 	return 0;
 
-out_free_lpi:
-	gicv5_free_lpi(lpi);
+out_free_irqs:
+	while (--i >= 0) {
+		irqd = irq_domain_get_irq_data(domain, virq + i);
+		gicv5_free_lpi(irqd->parent_data->hwirq);
+		irq_domain_reset_irq_data(irqd);
+		irq_domain_free_irqs_parent(domain, virq + i, 1);
+	}
 out_eventid:
 	gicv5_its_free_eventid(its_dev, event_id_base, nr_irqs);
 	return ret;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:47:11 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369038; cv=none; b=tcOwQ/ybBx1Hk9mhJ6lzeWhRE5YoImCUww9Lrk+B+oDVb0oukFh7WcYeSHk45uhksikvRhsb95FRaUII7U37licAE2x97mlT9Gg2hFK5VV5l9daqha2EvNIwSSj/OlGE2g0w0nbggi89LQ7OAXIJuSnlSBO3sikIwgUwNhc8ZVE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369038; c=relaxed/simple;
	bh=4jPOj1TvQUMgq0l1u1qmq8c7gl6I0bYfkbGg7dfurCM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=up43x53Moe+yoYRvrTDZAeNBjfBzw3xzdMReefDzOLEWdlsm3BSHk68i7GNFtp7dTFRkwlMmd/R5+VbF/EzTocpYIXnMFUqrVSp95miljrw1U4ETZQgZJZA+A/kz2EHjRLLg/c/JrQRKjMVD8u6LUR+DbUr+L6r/TpwI9FMm/go=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=S4NzAXBs; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <[email-masked]>,
	Thomas Gleixner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 107/563] selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO
Date: Mon, 13 Oct 2025 16:39:28 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Weißschuh <[email-masked]>

[ Upstream commit 4b59a9f7628fd82b24f2148f62cf327a84d26555 ]

If AT_SYSINFO_EHDR is missing the whole test needs to be skipped.
Currently this results in the following output:

	TAP version 13
	1..16
	# AT_SYSINFO_EHDR is not present!

This output is incorrect, as "1..16" still requires the subtest lines to
be printed, which isn't done however.

Switch to the correct skipping functions, so the output now correctly
indicates that no subtests are being run:

	TAP version 13
	1..0 # SKIP AT_SYSINFO_EHDR is not present!

Fixes: 693f5ca08ca0 ("kselftest: Extend vDSO selftest")
Signed-off-by: Thomas Weißschuh <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/vDSO/vdso_test_abi.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/tools/testing/selftests/vDSO/vdso_test_abi.c b/tools/testing/selftests/vDSO/vdso_test_abi.c
index a54424e2336f4..67cbfc56e4e1b 100644
--- a/tools/testing/selftests/vDSO/vdso_test_abi.c
+++ b/tools/testing/selftests/vDSO/vdso_test_abi.c
@@ -182,12 +182,11 @@ int main(int argc, char **argv)
 	unsigned long sysinfo_ehdr = getauxval(AT_SYSINFO_EHDR);
 
 	ksft_print_header();
-	ksft_set_plan(VDSO_TEST_PLAN);
 
-	if (!sysinfo_ehdr) {
-		ksft_print_msg("AT_SYSINFO_EHDR is not present!\n");
-		return KSFT_SKIP;
-	}
+	if (!sysinfo_ehdr)
+		ksft_exit_skip("AT_SYSINFO_EHDR is not present!\n");
+
+	ksft_set_plan(VDSO_TEST_PLAN);
 
 	version = versions[VDSO_VERSION];
 	name = (const char **)&names[VDSO_NAMES];
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:38:30 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369033; cv=none; b=OV24iWSVr+0VdTFK4VaRkHGfZreqLTY5AVoLyU/WN1khe8gAvL2/lF3OokLGQ7c3e/mDgbRpz0fJ5krLUi/GNkSS1+xRGK22OFtruLmHb9441t74uQbPPh3uzLVi3SH+3FzO1cwuHQu68qWJ5cxjIxwxCgAOrLcySH2S2BT0CsQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369033; c=relaxed/simple;
	bh=z7RvuLM56BzEmz+omjeAHZj/wrKd2TlCVb14q+J4iQ8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ZndUbcwDk5gUPtFuUlsZcIYTSAzYqxFL0Ei52Lx3w3FLVcZog7X1DFLUnykVQpn6YTWevaIMIgU85C5/8LQe0ZlDDMOTACGP3/ibZ+YXiIz2Rvp0NE/Ox85lEjoGkWEiaQJjAvZRId/lhFwvCdwHdXvskZ6VHrcwYL6R0dBtHVU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=NahAF5el; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Liang Jie <[email-masked]>,
	Han Guangjiang <[email-masked]>,
	Yu Kuai <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 105/563] blk-throttle: fix access race during throttle policy activation
Date: Mon, 13 Oct 2025 16:39:26 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Han Guangjiang <[email-masked]>

[ Upstream commit bd9fd5be6bc0836820500f68fff144609fbd85a9 ]

On repeated cold boots we occasionally hit a NULL pointer crash in
blk_should_throtl() when throttling is consulted before the throttle
policy is fully enabled for the queue. Checking only q->td != NULL is
insufficient during early initialization, so blkg_to_pd() for the
throttle policy can still return NULL and blkg_to_tg() becomes NULL,
which later gets dereferenced.

 Unable to handle kernel NULL pointer dereference
 at virtual address 0000000000000156
 ...
 pc : submit_bio_noacct+0x14c/0x4c8
 lr : submit_bio_noacct+0x48/0x4c8
 sp : ffff800087f0b690
 x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0
 x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70
 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000
 x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff
 x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff
 x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c
 x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60
 x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002
 x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500
 x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a
 Call trace:
  submit_bio_noacct+0x14c/0x4c8
  verity_map+0x178/0x2c8
  __map_bio+0x228/0x250
  dm_submit_bio+0x1c4/0x678
  __submit_bio+0x170/0x230
  submit_bio_noacct_nocheck+0x16c/0x388
  submit_bio_noacct+0x16c/0x4c8
  submit_bio+0xb4/0x210
  f2fs_submit_read_bio+0x4c/0xf0
  f2fs_mpage_readpages+0x3b0/0x5f0
  f2fs_readahead+0x90/0xe8

Tighten blk_throtl_activated() to also require that the throttle policy
bit is set on the queue:

  return q->td != NULL &&
         test_bit(blkcg_policy_throtl.plid, q->blkcg_pols);

This prevents blk_should_throtl() from accessing throttle group state
until policy data has been attached to blkgs.

Fixes: a3166c51702b ("blk-throttle: delay initialization until configuration")
Co-developed-by: Liang Jie <[email-masked]>
Signed-off-by: Liang Jie <[email-masked]>
Signed-off-by: Han Guangjiang <[email-masked]>
Reviewed-by: Yu Kuai <[email-masked]>
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/blk-cgroup.c   |  6 ------
 block/blk-cgroup.h   |  6 ++++++
 block/blk-throttle.c |  6 +-----
 block/blk-throttle.h | 18 +++++++++++-------
 4 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index fe9ebd6a2e14d..7246fc2563152 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -110,12 +110,6 @@ static struct cgroup_subsys_state *blkcg_css(void)
 	return task_css(current, io_cgrp_id);
 }
 
-static bool blkcg_policy_enabled(struct request_queue *q,
-				 const struct blkcg_policy *pol)
-{
-	return pol && test_bit(pol->plid, q->blkcg_pols);
-}
-
 static void blkg_free_workfn(struct work_struct *work)
 {
 	struct blkcg_gq *blkg = container_of(work, struct blkcg_gq,
diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
index 81868ad86330c..83367086cb6ae 100644
--- a/block/blk-cgroup.h
+++ b/block/blk-cgroup.h
@@ -459,6 +459,12 @@ static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio)
 		bio_issue_as_root_blkg(rq->bio) == bio_issue_as_root_blkg(bio);
 }
 
+static inline bool blkcg_policy_enabled(struct request_queue *q,
+				const struct blkcg_policy *pol)
+{
+	return pol && test_bit(pol->plid, q->blkcg_pols);
+}
+
 void blk_cgroup_bio_start(struct bio *bio);
 void blkcg_add_delay(struct blkcg_gq *blkg, u64 now, u64 delta);
 #else	/* CONFIG_BLK_CGROUP */
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index 397b6a410f9e5..cfa1cd60d2c5f 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -1327,17 +1327,13 @@ static int blk_throtl_init(struct gendisk *disk)
 	INIT_WORK(&td->dispatch_work, blk_throtl_dispatch_work_fn);
 	throtl_service_queue_init(&td->service_queue);
 
-	/*
-	 * Freeze queue before activating policy, to synchronize with IO path,
-	 * which is protected by 'q_usage_counter'.
-	 */
 	memflags = blk_mq_freeze_queue(disk->queue);
 	blk_mq_quiesce_queue(disk->queue);
 
 	q->td = td;
 	td->queue = q;
 
-	/* activate policy */
+	/* activate policy, blk_throtl_activated() will return true */
 	ret = blkcg_activate_policy(disk, &blkcg_policy_throtl);
 	if (ret) {
 		q->td = NULL;
diff --git a/block/blk-throttle.h b/block/blk-throttle.h
index 3b27755bfbff1..9d7a42c039a15 100644
--- a/block/blk-throttle.h
+++ b/block/blk-throttle.h
@@ -156,7 +156,13 @@ void blk_throtl_cancel_bios(struct gendisk *disk);
 
 static inline bool blk_throtl_activated(struct request_queue *q)
 {
-	return q->td != NULL;
+	/*
+	 * q->td guarantees that the blk-throttle module is already loaded,
+	 * and the plid of blk-throttle is assigned.
+	 * blkcg_policy_enabled() guarantees that the policy is activated
+	 * in the request_queue.
+	 */
+	return q->td != NULL && blkcg_policy_enabled(q, &blkcg_policy_throtl);
 }
 
 static inline bool blk_should_throtl(struct bio *bio)
@@ -164,11 +170,6 @@ static inline bool blk_should_throtl(struct bio *bio)
 	struct throtl_grp *tg;
 	int rw = bio_data_dir(bio);
 
-	/*
-	 * This is called under bio_queue_enter(), and it's synchronized with
-	 * the activation of blk-throtl, which is protected by
-	 * blk_mq_freeze_queue().
-	 */
 	if (!blk_throtl_activated(bio->bi_bdev->bd_queue))
 		return false;
 
@@ -194,7 +195,10 @@ static inline bool blk_should_throtl(struct bio *bio)
 
 static inline bool blk_throtl_bio(struct bio *bio)
 {
-
+	/*
+	 * block throttling takes effect if the policy is activated
+	 * in the bio's request_queue.
+	 */
 	if (!blk_should_throtl(bio))
 		return false;
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:51:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369030; cv=none; b=RwVYtNXjIhO1/sG7chzFhY6FWIFIULRomeN5Sbi5Vy+V20cUDPiS6maSdr3hAjZzxbc599vZr0HWOwezNrp4NqCDEgtykkDKrL5oWl+/WeEYDDLTlZ/zR3kH4U23WCZZPQ1Is9NnA/k5Xs0HCZgCixM0hiDerJw4MrGDNEzqd2s=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369030; c=relaxed/simple;
	bh=wcLSd64RRhJJ5e9w1P0pUIkaO2B2v64Ri+DLTfZlDcA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=dqgBWE/cMXCmUL6IJv9KGwX0rB3Kovx6Lsz4cOkIZ3Zzfa+SFu4xla4Dj4P/zkr4bc+7mGR3mVKU5PEXidC9/qewBufDmM2doAxf05XM9EUJvJZ28TdtU48i6HvfrOLezZEAWNG4hzXHtKNiN0JTjzlWVNY+57GH+3375moq1HQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=noM0Y3rx; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Genjian Zhang <[email-masked]>,
	Damien Le Moal <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 104/563] null_blk: Fix the description of the cache_size module argument
Date: Mon, 13 Oct 2025 16:39:25 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Genjian Zhang <[email-masked]>

[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ]

When executing modinfo null_blk, there is an error in the description
of module parameter mbps, and the output information of cache_size is
incomplete.The output of modinfo before and after applying this patch
is as follows:

Before:
[...]
parm:           cache_size:ulong
[...]
parm:           mbps:Cache size in MiB for memory-backed device.
		Default: 0 (none) (uint)
[...]

After:
[...]
parm:           cache_size:Cache size in MiB for memory-backed device.
		Default: 0 (none) (ulong)
[...]
parm:           mbps:Limit maximum bandwidth (in MiB/s).
		Default: 0 (no limit) (uint)
[...]

Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options")
Signed-off-by: Genjian Zhang <[email-masked]>
Reviewed-by: Damien Le Moal <[email-masked]>
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/block/null_blk/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index 91642c9a3b293..f982027e8c858 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -223,7 +223,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu
 
 static unsigned long g_cache_size;
 module_param_named(cache_size, g_cache_size, ulong, 0444);
-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)");
+MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)");
 
 static bool g_fua = true;
 module_param_named(fua, g_fua, bool, 0444);
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:53:26 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369027; cv=none; b=Dcq79EMGHcMYawNgA8mshFRSiIkdoqV+g2EECy8YQlagdmi/r0PfEA5WYPApuuWYY8QjUnsPFwRbq28OwxtIayO+d5OdKNUqfjp6nplBM73UqDs7PH5ooVORMFLh2hHNRjSYn6sBxHeGSuuEK+6Tvj7khXauNKP6wAOGLJ4hq7Q=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369027; c=relaxed/simple;
	bh=bKpdGkHDNMJ4nU6Q0ctE8ZEPrDRdXHFDU94xXQsDWQs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=hkUqmOJw7sRKovJt3YZbVRU5dx3fX+sHLhR7367r/a7gS6W65r9ijgqEL9dYYrQ/e59pvL11KnUazrZ58oYFYD26a/dNagetxR619vIRVWG96yd/gMv8A/C5SAssKS1C0g3/pv3kbDisvrvm41iZuQ53R2yYYrP4cW4dUK9cQso=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XaYwu5Od; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	Yulin Lu <[email-masked]>,
	Linus Walleij <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 103/563] pinctrl: eswin: Fix regulator error check and Kconfig dependency
Date: Mon, 13 Oct 2025 16:39:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yulin Lu <[email-masked]>

[ Upstream commit a6a2f50ab1721343ee2d5d2be888709aa886e3aa ]

Smatch reported the following warning in eic7700_pinctrl_probe():

  drivers/pinctrl/pinctrl-eic7700.c:638 eic7700_pinctrl_probe()
  warn: passing zero to 'PTR_ERR'

The root cause is that devm_regulator_get() may return NULL when
CONFIG_REGULATOR is disabled. In such case, IS_ERR_OR_NULL() triggers
PTR_ERR(NULL) which evaluates to 0, leading to passing a success code
as an error.

However, this driver cannot work without a regulator. To fix this:

 - Change the check from IS_ERR_OR_NULL() to IS_ERR()
 - Update Kconfig to explicitly select REGULATOR and
   REGULATOR_FIXED_VOLTAGE, ensuring that the regulator framework is
   always available.

This resolves the Smatch warning and enforces the correct dependency.

Suggested-by: Dan Carpenter <[email-masked]>
Fixes: 5b797bcc00ef ("pinctrl: eswin: Add EIC7700 pinctrl driver")
Reported-by: Dan Carpenter <[email-masked]>
Closes: https://lore.kernel.org/linux-gpio/[email-masked]/
Signed-off-by: Yulin Lu <[email-masked]>
Signed-off-by: Linus Walleij <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pinctrl/Kconfig           | 2 ++
 drivers/pinctrl/pinctrl-eic7700.c | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index be1ca8e85754b..0402626c4b98b 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -211,6 +211,8 @@ config PINCTRL_EIC7700
 	depends on ARCH_ESWIN || COMPILE_TEST
 	select PINMUX
 	select GENERIC_PINCONF
+	select REGULATOR
+	select REGULATOR_FIXED_VOLTAGE
 	help
 	  This driver support for the pin controller in ESWIN's EIC7700 SoC,
 	  which supports pin multiplexing, pin configuration,and rgmii voltage
diff --git a/drivers/pinctrl/pinctrl-eic7700.c b/drivers/pinctrl/pinctrl-eic7700.c
index 4874b55323439..ffcd0ec5c2dc6 100644
--- a/drivers/pinctrl/pinctrl-eic7700.c
+++ b/drivers/pinctrl/pinctrl-eic7700.c
@@ -634,7 +634,7 @@ static int eic7700_pinctrl_probe(struct platform_device *pdev)
 		return PTR_ERR(pc->base);
 
 	regulator = devm_regulator_get(dev, "vrgmii");
-	if (IS_ERR_OR_NULL(regulator)) {
+	if (IS_ERR(regulator)) {
 		return dev_err_probe(dev, PTR_ERR(regulator),
 					 "failed to get vrgmii regulator\n");
 	}
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:53:56 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369024; cv=none; b=YVerRqBCQoGP5GCjOjmlMDCVPSbMfy4nE1j3i3WtZgOaolRpr+tBIvhZZRKldYqBDfQBN2IE5Yl/UehDbcr2T4IDyPa/rw9HOIVWx+jM17++1qmm8f9nrVgrlD/WJIA1p1CRsEoks/SEGuUF/4iS1wIHhQq6iMK6EhReudV0VdI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369024; c=relaxed/simple;
	bh=6tyXyLU+yNTLz77DU1dBCOq/eYLdljfbrlvwgkmR5zc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=TPYLCc/RFvep4j7gtPHzzpVTavNvk4puPQHn4wVqD+cyUXJ03wQ/GDX9CIyHtVSYs3ZecsdQZ5EIslS3XV62x9fePvAOqnHx/ed0+m3lXT88y4FnDneRQIe4wNSqDFt2GBr01HLsSOkeabeoEYi+KrkUgkwbtaStFrIQJ30o1+E=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=BuKc8Xq5; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 102/563] pinctrl: renesas: Use int type to store negative error codes
Date: Mon, 13 Oct 2025 16:39:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ]

Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned
int to int, as it needs to store either negative error codes or zero
returned by sh_pfc_pinconf_set().

No effect on runtime.

Signed-off-by: Qianfeng Rong <[email-masked]>
Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config")
Reviewed-by: Geert Uytterhoeven <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pinctrl/renesas/pinctrl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c
index 29d16c9c1bd19..3a742f74ecd1d 100644
--- a/drivers/pinctrl/renesas/pinctrl.c
+++ b/drivers/pinctrl/renesas/pinctrl.c
@@ -726,7 +726,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
 	struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev);
 	const unsigned int *pins;
 	unsigned int num_pins;
-	unsigned int i, ret;
+	unsigned int i;
+	int ret;
 
 	pins = pmx->pfc->info->groups[group].pins;
 	num_pins = pmx->pfc->info->groups[group].nr_pins;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:38:24 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369019; cv=none; b=aN5g+Z9Ij6xdLQE10nj3DOG3/IAdhrQxJfrmF8aHNvLhYWdC2a7ZMFRSsD8CY9HC6GyA5b1NV/QcyFWM9TfIuRbDfvgK3MBcgpOehcxrdT3a2L8UaLw6GHz6qKGE4OJY/wgLrO3V+WDPK6Dz745qQwdWzJ9QUtYMSu6WCQgV0bU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369019; c=relaxed/simple;
	bh=Zf2artIZsxWEeZbsAlcatk2XA/l0EyhFczqTOFJ8le4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=qtfpklJcRf+ccagGeMakCL6sM3zczuPSmywbM4N8eA/pYURisVL4+qvm5ReOarm6a0juL9u+nESQPQSgBBITPBDDfVlZGb38FbjjkfGT7r9InqyFuRd2zM3GVp3vHsFOh72T2cwAQT8nzXnNfrCHa3vewUPVo2O7E1HFPawW2A0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Q1QhFHBB; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Andy Yan <[email-masked]>,
	Sebastian Reichel <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 100/563] power: supply: cw2015: Fix a alignment coding style issue
Date: Mon, 13 Oct 2025 16:39:21 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andy Yan <[email-masked]>

[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ]

Fix the checkpatch warning:
CHECK: Alignment should match open parenthesis

Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code")
Signed-off-by: Andy Yan <[email-masked]>
Signed-off-by: Sebastian Reichel <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/power/supply/cw2015_battery.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c
index f63c3c4104515..382dff8805c62 100644
--- a/drivers/power/supply/cw2015_battery.c
+++ b/drivers/power/supply/cw2015_battery.c
@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client)
 	if (!cw_bat->battery_workqueue)
 		return -ENOMEM;
 
-	devm_delayed_work_autocancel(&client->dev,
-							  &cw_bat->battery_delay_work, cw_bat_work);
+	devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work);
 	queue_delayed_work(cw_bat->battery_workqueue,
 			   &cw_bat->battery_delay_work, msecs_to_jiffies(10));
 	return 0;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:49:13 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369012; cv=none; b=IpnPpwI/OYBHEnRM+nbScvZgXNcokAle4YEpeKKfqsabrc7I6KfIefkQ4ELs0jTOsW+2KhJPiNVCtnSCtD3kP9q2mweco35onDuv9qJUHMgW3NTwgYnI2D+jmvZ6TKF5OaTqE+7CcSmJbyOPSEUfyTRYy6OjqG0OwETaWQJS7ik=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369012; c=relaxed/simple;
	bh=qvOeCKUX8a1tDbJq+LoPfe68W55OwdIFfcfv7kt258U=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=HdQgo42pudcFQDoqk/KkZLQLvJ0Pz8A7+CFz/C5k4p+w2ptoeXiRGmV+xEoVPCxAoFsZXXvkHyBye1jr3ktyGNTbNKtvwmBM1vuMgT7RGHsqVZgD9GeYJSCFz3T415Pw67GeTzEGXtbyfyjyPGbGE5uPJ0OTe5CFYotIgFe/PL4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Z3N+nyN0; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jihed Chaibi <[email-masked]>,
	Kevin Hilman <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 098/563] ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property
Date: Mon, 13 Oct 2025 16:39:19 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jihed Chaibi <[email-masked]>

[ Upstream commit 27322753c8b913fba05250e7b5abb1da31e6ed23 ]

The dtbs_check validation for am335x-cm-t335.dtb flags an error
for an unevaluated 'num-serializer' property in the mcasp0 node.

This property is obsolete; it is not defined in the davinci-mcasp-audio
schema and is not used by the corresponding (or any) driver.

Remove this unused property to fix the schema validation warning.

Fixes: 48ab364478e77 ("ARM: dts: cm-t335: add audio support")
Signed-off-by: Jihed Chaibi <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Kevin Hilman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts | 2 --
 1 file changed, 2 deletions(-)

diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
index 06767ea164b59..ece7f7854f6aa 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
@@ -483,8 +483,6 @@ &mcasp1 {
 
 		op-mode = <0>;          /* MCASP_IIS_MODE */
 		tdm-slots = <2>;
-		/* 16 serializers */
-		num-serializer = <16>;
 		serial-dir = <  /* 0: INACTIVE, 1: TX, 2: RX */
 			0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0
 		>;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:45:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369107; cv=none; b=ZNz0+mTXfyHpjpBJI2HCPqI9dNzaIGjsoQI3Yoyw8TsFVXRE7EVDLqymJR4nH/REtfAwsmEtB6L5xP3C2XI3KRNlqCGZU1PNNCOd36eotAWd342cA2HiPNdinCZ6HH5u6xUaUxgiNaZ391lci4EXYTqq0Ir0Z/YNX5l7q9rCt5M=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369107; c=relaxed/simple;
	bh=RCMH+A8uBeM7fl1o0AN1d9+71RwrlZb0JJUqbKIyEto=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=M8YFYYa4JjZ4YV/oA/WpwMiBJ7NVcrg+1g6Kj3XqWNIiodY54KUkm7oNVWvuzjB3Ng0Z13pUW8kw+UYCBrAJUc4jly8E2/yBs9hGv2qH8vbvho/JiVBpc5hjnuR57825AborevDADneH5085qCEB39ye8D62pfkxd7L24iAEXLM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=BPHBUGXn; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jihed Chaibi <[email-masked]>,
	Kevin Hilman <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 097/563] ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS
Date: Mon, 13 Oct 2025 16:39:18 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jihed Chaibi <[email-masked]>

[ Upstream commit 5af5b85505bc859adb338fe5d6e4842e72cdf932 ]

The ti,keep-vref-on property, defined as a boolean flag in the Device
Tree schema, was incorrectly assigned a value (<1>) in the DTS file,
causing a validation error: "size (4) error for type flag". Remove
the value to match the schema and ensure compatibility with the driver
using device_property_read_bool(). This fixes the dtbs_check error.

Fixes: ed05637c30e6 ("ARM: dts: omap3-devkit8000: Add ADS7846 Touchscreen support")
Signed-off-by: Jihed Chaibi <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Kevin Hilman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
index a7f99ae0c1fe9..78c657429f641 100644
--- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
+++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
@@ -65,7 +65,7 @@ ads7846@0 {
 		ti,debounce-max = /bits/ 16 <10>;
 		ti,debounce-tol = /bits/ 16 <5>;
 		ti,debounce-rep = /bits/ 16 <1>;
-		ti,keep-vref-on = <1>;
+		ti,keep-vref-on;
 		ti,settle-delay-usec = /bits/ 16 <150>;
 
 		wakeup-source;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:53:49 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369098; cv=none; b=hkNQqRHVue4ZGsjtc08vWxx2Y9D0gRayfHvvnHj26pHv9xa5uvDjpFCBADYLdzfB972FYtb5pOGsP+iaqfRgEXIfHYwb5chjwrrMHL3faVKayazC3hqvsNIuwvLuuPZVkuwm2ninWFrCzbzSsslEGyMUHFaKyIgt6z7k/qzBm8A=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369098; c=relaxed/simple;
	bh=vxM95Ma6qH5ekYN7tDYiz67cYN9COvSttdbUnV0uZ54=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=kGA0/JbAsigDNrfXU8Bg3TB0pVLUM6FniKoifX3uQgYkUSQ5zbtJi0rn3QiBQLVCAfzXqhiM4Mc62xK5DbUA/ofxO3s/Vqnlb1HzPrrEcMdhm3X/dfRWLahFwH3YrRdy19lstdnxrnB4AGQr3zFWwD95mBJ8kh28Yljy2TYO3Tg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=CQ5zDK8y; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yu Kuai <[email-masked]>,
	Hannes Reinecke <[email-masked]>,
	Li Nan <[email-masked]>,
	Nilay Shroff <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 094/563] blk-mq: fix elevator depth_updated method
Date: Mon, 13 Oct 2025 16:39:15 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yu Kuai <[email-masked]>

[ Upstream commit 7d337eef4affc5e26e0570513168c69ddbc40f92 ]

Current depth_updated has some problems:

1) depth_updated() will be called for each hctx, while all elevators
will update async_depth for the disk level, this is not related to hctx;
2) In blk_mq_update_nr_requests(), if previous hctx update succeed and
this hctx update failed, q->nr_requests will not be updated, while
async_depth is already updated with new nr_reqeuests in previous
depth_updated();
3) All elevators are using q->nr_requests to calculate async_depth now,
however, q->nr_requests is still the old value when depth_updated() is
called from blk_mq_update_nr_requests();

Those problems are first from error path, then mq-deadline, and recently
for bfq and kyber, fix those problems by:

- pass in request_queue instead of hctx;
- move depth_updated() after q->nr_requests is updated in
  blk_mq_update_nr_requests();
- add depth_updated() call inside init_sched() method to initialize
  async_depth;
- remove init_hctx() method for mq-deadline and bfq that is useless now;

Fixes: 77f1e0a52d26 ("bfq: update internal depth state when queue depth changes")
Fixes: 39823b47bbd4 ("block/mq-deadline: Fix the tag reservation code")
Fixes: 42e6c6ce03fd ("lib/sbitmap: convert shallow_depth from one word to the whole sbitmap")
Signed-off-by: Yu Kuai <[email-masked]>
Reviewed-by: Hannes Reinecke <[email-masked]>
Reviewed-by: Li Nan <[email-masked]>
Reviewed-by: Nilay Shroff <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/bfq-iosched.c   | 22 +++++-----------------
 block/blk-mq-sched.h  | 11 +++++++++++
 block/blk-mq.c        | 23 ++++++++++++-----------
 block/elevator.h      |  2 +-
 block/kyber-iosched.c | 19 +++++++++----------
 block/mq-deadline.c   | 16 +++-------------
 6 files changed, 41 insertions(+), 52 deletions(-)

diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 50e51047e1fe5..4a8d3d96bfe49 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -7109,9 +7109,10 @@ void bfq_put_async_queues(struct bfq_data *bfqd, struct bfq_group *bfqg)
  * See the comments on bfq_limit_depth for the purpose of
  * the depths set in the function. Return minimum shallow depth we'll use.
  */
-static void bfq_update_depths(struct bfq_data *bfqd, struct sbitmap_queue *bt)
+static void bfq_depth_updated(struct request_queue *q)
 {
-	unsigned int nr_requests = bfqd->queue->nr_requests;
+	struct bfq_data *bfqd = q->elevator->elevator_data;
+	unsigned int nr_requests = q->nr_requests;
 
 	/*
 	 * In-word depths if no bfq_queue is being weight-raised:
@@ -7143,21 +7144,8 @@ static void bfq_update_depths(struct bfq_data *bfqd, struct sbitmap_queue *bt)
 	bfqd->async_depths[1][0] = max((nr_requests * 3) >> 4, 1U);
 	/* no more than ~37% of tags for sync writes (~20% extra tags) */
 	bfqd->async_depths[1][1] = max((nr_requests * 6) >> 4, 1U);
-}
-
-static void bfq_depth_updated(struct blk_mq_hw_ctx *hctx)
-{
-	struct bfq_data *bfqd = hctx->queue->elevator->elevator_data;
-	struct blk_mq_tags *tags = hctx->sched_tags;
 
-	bfq_update_depths(bfqd, &tags->bitmap_tags);
-	sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, 1);
-}
-
-static int bfq_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int index)
-{
-	bfq_depth_updated(hctx);
-	return 0;
+	blk_mq_set_min_shallow_depth(q, 1);
 }
 
 static void bfq_exit_queue(struct elevator_queue *e)
@@ -7369,6 +7357,7 @@ static int bfq_init_queue(struct request_queue *q, struct elevator_queue *eq)
 		goto out_free;
 	bfq_init_root_group(bfqd->root_group, bfqd);
 	bfq_init_entity(&bfqd->oom_bfqq.entity, bfqd->root_group);
+	bfq_depth_updated(q);
 
 	/* We dispatch from request queue wide instead of hw queue */
 	blk_queue_flag_set(QUEUE_FLAG_SQ_SCHED, q);
@@ -7628,7 +7617,6 @@ static struct elevator_type iosched_bfq_mq = {
 		.request_merged		= bfq_request_merged,
 		.has_work		= bfq_has_work,
 		.depth_updated		= bfq_depth_updated,
-		.init_hctx		= bfq_init_hctx,
 		.init_sched		= bfq_init_queue,
 		.exit_sched		= bfq_exit_queue,
 	},
diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h
index b554e1d559508..fe83187f41db4 100644
--- a/block/blk-mq-sched.h
+++ b/block/blk-mq-sched.h
@@ -92,4 +92,15 @@ static inline bool blk_mq_sched_needs_restart(struct blk_mq_hw_ctx *hctx)
 	return test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
 }
 
+static inline void blk_mq_set_min_shallow_depth(struct request_queue *q,
+						unsigned int depth)
+{
+	struct blk_mq_hw_ctx *hctx;
+	unsigned long i;
+
+	queue_for_each_hw_ctx(q, hctx, i)
+		sbitmap_queue_min_shallow_depth(&hctx->sched_tags->bitmap_tags,
+						depth);
+}
+
 #endif
diff --git a/block/blk-mq.c b/block/blk-mq.c
index ba3a4b77f5786..9055cd6247004 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4951,20 +4951,21 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
 						      false);
 		}
 		if (ret)
-			break;
-		if (q->elevator && q->elevator->type->ops.depth_updated)
-			q->elevator->type->ops.depth_updated(hctx);
+			goto out;
 	}
-	if (!ret) {
-		q->nr_requests = nr;
-		if (blk_mq_is_shared_tags(set->flags)) {
-			if (q->elevator)
-				blk_mq_tag_update_sched_shared_tags(q);
-			else
-				blk_mq_tag_resize_shared_tags(set, nr);
-		}
+
+	q->nr_requests = nr;
+	if (q->elevator && q->elevator->type->ops.depth_updated)
+		q->elevator->type->ops.depth_updated(q);
+
+	if (blk_mq_is_shared_tags(set->flags)) {
+		if (q->elevator)
+			blk_mq_tag_update_sched_shared_tags(q);
+		else
+			blk_mq_tag_resize_shared_tags(set, nr);
 	}
 
+out:
 	blk_mq_unquiesce_queue(q);
 
 	return ret;
diff --git a/block/elevator.h b/block/elevator.h
index adc5c157e17e5..c4d20155065e8 100644
--- a/block/elevator.h
+++ b/block/elevator.h
@@ -37,7 +37,7 @@ struct elevator_mq_ops {
 	void (*exit_sched)(struct elevator_queue *);
 	int (*init_hctx)(struct blk_mq_hw_ctx *, unsigned int);
 	void (*exit_hctx)(struct blk_mq_hw_ctx *, unsigned int);
-	void (*depth_updated)(struct blk_mq_hw_ctx *);
+	void (*depth_updated)(struct request_queue *);
 
 	bool (*allow_merge)(struct request_queue *, struct request *, struct bio *);
 	bool (*bio_merge)(struct request_queue *, struct bio *, unsigned int);
diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c
index 70cbc7b2deb40..18efd6ef2a2b9 100644
--- a/block/kyber-iosched.c
+++ b/block/kyber-iosched.c
@@ -399,6 +399,14 @@ static struct kyber_queue_data *kyber_queue_data_alloc(struct request_queue *q)
 	return ERR_PTR(ret);
 }
 
+static void kyber_depth_updated(struct request_queue *q)
+{
+	struct kyber_queue_data *kqd = q->elevator->elevator_data;
+
+	kqd->async_depth = q->nr_requests * KYBER_ASYNC_PERCENT / 100U;
+	blk_mq_set_min_shallow_depth(q, kqd->async_depth);
+}
+
 static int kyber_init_sched(struct request_queue *q, struct elevator_queue *eq)
 {
 	struct kyber_queue_data *kqd;
@@ -413,6 +421,7 @@ static int kyber_init_sched(struct request_queue *q, struct elevator_queue *eq)
 
 	eq->elevator_data = kqd;
 	q->elevator = eq;
+	kyber_depth_updated(q);
 
 	return 0;
 }
@@ -440,15 +449,6 @@ static void kyber_ctx_queue_init(struct kyber_ctx_queue *kcq)
 		INIT_LIST_HEAD(&kcq->rq_list[i]);
 }
 
-static void kyber_depth_updated(struct blk_mq_hw_ctx *hctx)
-{
-	struct kyber_queue_data *kqd = hctx->queue->elevator->elevator_data;
-	struct blk_mq_tags *tags = hctx->sched_tags;
-
-	kqd->async_depth = hctx->queue->nr_requests * KYBER_ASYNC_PERCENT / 100U;
-	sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, kqd->async_depth);
-}
-
 static int kyber_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx)
 {
 	struct kyber_hctx_data *khd;
@@ -493,7 +493,6 @@ static int kyber_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx)
 	khd->batching = 0;
 
 	hctx->sched_data = khd;
-	kyber_depth_updated(hctx);
 
 	return 0;
 
diff --git a/block/mq-deadline.c b/block/mq-deadline.c
index b9b7cdf1d3c98..2e689b2c40213 100644
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -507,22 +507,12 @@ static void dd_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data)
 }
 
 /* Called by blk_mq_update_nr_requests(). */
-static void dd_depth_updated(struct blk_mq_hw_ctx *hctx)
+static void dd_depth_updated(struct request_queue *q)
 {
-	struct request_queue *q = hctx->queue;
 	struct deadline_data *dd = q->elevator->elevator_data;
-	struct blk_mq_tags *tags = hctx->sched_tags;
 
 	dd->async_depth = q->nr_requests;
-
-	sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, 1);
-}
-
-/* Called by blk_mq_init_hctx() and blk_mq_init_sched(). */
-static int dd_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx)
-{
-	dd_depth_updated(hctx);
-	return 0;
+	blk_mq_set_min_shallow_depth(q, 1);
 }
 
 static void dd_exit_sched(struct elevator_queue *e)
@@ -587,6 +577,7 @@ static int dd_init_sched(struct request_queue *q, struct elevator_queue *eq)
 	blk_queue_flag_set(QUEUE_FLAG_SQ_SCHED, q);
 
 	q->elevator = eq;
+	dd_depth_updated(q);
 	return 0;
 }
 
@@ -1048,7 +1039,6 @@ static struct elevator_type mq_deadline = {
 		.has_work		= dd_has_work,
 		.init_sched		= dd_init_sched,
 		.exit_sched		= dd_exit_sched,
-		.init_hctx		= dd_init_hctx,
 	},
 
 #ifdef CONFIG_BLK_DEBUG_FS
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:38:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369041; cv=none; b=qLxF6XY57sPYfDlW5NUQILy5z7VJrSQX/O9hJB92DiOf7yWlIPU6r5Vqg1ugpJ5CqvteSPI1NdP1vFdbguusIVqgLhgkMzgUL62QZELWYAWs/yNfTiv6oD2ufHt5kzzmMXU5xOJ/HSx6kRO8T+rbtAtUT0WChmWxcOwh5NT1Zvo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369041; c=relaxed/simple;
	bh=3AiykI2SAQfdfvnhNx/9KUeRlZAmK/dmnkcnAinrZ4k=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=OoB0AubnsK7ATFqbO7LpxdWmQJzJfpFt5b3HyxB3kt/UFNJD4MxYuCQY8qHcSMRc+tvEe/enBJ6tLrXZu+jtXL7C1q+NNWIASeE5tB32GhTn4u2Mqg7UoEg2pdH5ShHaDrYvEBZdF+Vd5fPlCoh0qR9GR2jwHpOsyV1/2y2vq/I=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lFxRmqee; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Guenter Roeck <[email-masked]>,
	Brian Norris <[email-masked]>,
	Thomas Gleixner <[email-masked]>,
	David Gow <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 090/563] genirq/test: Ensure CPU 1 is online for hotplug test
Date: Mon, 13 Oct 2025 16:39:11 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brian Norris <[email-masked]>

[ Upstream commit 8ad25ebfa70e86860559b306bbc923c7db4fcac6 ]

It's possible to run these tests on platforms that think they have a
hotpluggable CPU1, but for whatever reason, CPU1 is not online and can't be
brought online:

    # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:210
    Expected remove_cpu(1) == 0, but
        remove_cpu(1) == 1 (0x1)
CPU1: failed to boot: -38
    # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:214
    Expected add_cpu(1) == 0, but
        add_cpu(1) == -38 (0xffffffffffffffda)

Check that CPU1 is actually online before trying to run the test.

Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts")
Reported-by: Guenter Roeck <[email-masked]>
Signed-off-by: Brian Norris <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
Tested-by: Guenter Roeck <[email-masked]>
Reviewed-by: David Gow <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/irq/irq_test.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/irq/irq_test.c b/kernel/irq/irq_test.c
index 37568ec714b51..f71f46fdcfd5e 100644
--- a/kernel/irq/irq_test.c
+++ b/kernel/irq/irq_test.c
@@ -178,6 +178,8 @@ static void irq_cpuhotplug_test(struct kunit *test)
 		kunit_skip(test, "requires more than 1 CPU for CPU hotplug");
 	if (!cpu_is_hotpluggable(1))
 		kunit_skip(test, "CPU 1 must be hotpluggable");
+	if (!cpu_online(1))
+		kunit_skip(test, "CPU 1 must be online");
 
 	cpumask_copy(&affinity.mask, cpumask_of(1));
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:43:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368987; cv=none; b=N3EFHcWtXUcrd8kGNPaWj2JEhTNYkQfYt5FuX+VNglOvyPevftx2N2ARcyvDiZin4RA2m52iY6CVdupO9d35sxmYKDgWWQ2s0v+avKyWSUlNZGplPAaiWdFPYBs3hYkWzKURF1PHovaT+eOHzShuU0OSnLcSoExIJstvkhicBK8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368987; c=relaxed/simple;
	bh=b9/ohJC6hr2fwmsOoqA3U5n9equOPc36p9/BYcqmEY4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=qLaMA3qXj33HVLiGJ3e5kYYCUEsiV70REQBOdJeyVs4cOjRVDdvss1o7sqB0zVoc6F8+ihRw9/DJiNn3oNcom8nClMSFhZQtK4iRDt7qKR5mtaOe35v95BTXbUlb7/SxMUexCV6H4umypSV/7yWagdLp6R6gKKl9I6d9xebHRj0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=TtaBpBht; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Guenter Roeck <[email-masked]>,
	Brian Norris <[email-masked]>,
	Thomas Gleixner <[email-masked]>,
	David Gow <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 087/563] genirq/test: Select IRQ_DOMAIN
Date: Mon, 13 Oct 2025 16:39:08 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brian Norris <[email-masked]>

[ Upstream commit f8a44f9babd054ff19e20a30cab661d716ad5459 ]

These tests use irq_domain_alloc_descs() and so require CONFIG_IRQ_DOMAIN.

Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts")
Reported-by: Guenter Roeck <[email-masked]>
Signed-off-by: Brian Norris <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
Tested-by: Guenter Roeck <[email-masked]>
Reviewed-by: David Gow <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]
Closes: https://lore.kernel.org/lkml/[email-masked]/
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/irq/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig
index 1da5e9d9da719..08088b8e95ae9 100644
--- a/kernel/irq/Kconfig
+++ b/kernel/irq/Kconfig
@@ -148,6 +148,7 @@ config IRQ_KUNIT_TEST
 	bool "KUnit tests for IRQ management APIs" if !KUNIT_ALL_TESTS
 	depends on KUNIT=y
 	default KUNIT_ALL_TESTS
+	select IRQ_DOMAIN
 	imply SMP
 	help
 	  This option enables KUnit tests for the IRQ subsystem API. These are
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:54:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368984; cv=none; b=PR5Lk5rg3keLEncj7KqShNQw8pCE47H9mB6tn1ATt4dBK7KOG9K79+8syvCiTR+bBUpNzVBP1RSPkNCiYX5/UGQp+7cVblM71oq7MMxWgXiFnBfHJyY1bpADF4/dedzLu299mz8Lq1cUsywKg9XFTK6qo/MNYTBAg80T3IrnOzI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368984; c=relaxed/simple;
	bh=X2Zvvt+HTTOQNaYSVwqeH7nX3WWCNNKxkM8K9u0TnSE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=HfUGyvT6JTcMashuMaTJg+79bBLCEvCoTJg065d6H4VGiiF71UAsi74JLctkNvzg7NANEjS65ADw+NYyV/AamNBYrc/KhzkvxpEIkmwJ/KeJ9E5TFztXSQRiLBKZ2bGUiMR63a5GkkAyaiURgVn32l6uy29eiJ0AXBHZ6UgOW94=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gJrPSUpF; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	David Gow <[email-masked]>,
	Thomas Gleixner <[email-masked]>,
	Guenter Roeck <[email-masked]>,
	Brian Norris <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 086/563] genirq/test: Fix depth tests on architectures with NOREQUEST by default.
Date: Mon, 13 Oct 2025 16:39:07 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Gow <[email-masked]>

[ Upstream commit c9163915a93d40e32c4e4aeb942c0adcb190d72e ]

The new irq KUnit tests fail on some architectures (notably PowerPC and
32-bit ARM), as the request_irq() call fails due to the ARCH_IRQ_INIT_FLAGS
containing IRQ_NOREQUEST, yielding the following errors:

[10:17:45]     # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:88
[10:17:45]     Expected ret == 0, but
[10:17:45]         ret == -22 (0xffffffffffffffea)
[10:17:45]     # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:90
[10:17:45]     Expected desc->depth == 0, but
[10:17:45]         desc->depth == 1 (0x1)
[10:17:45]     # irq_free_disabled_test: EXPECTATION FAILED at kernel/irq/irq_test.c:93
[10:17:45]     Expected desc->depth == 1, but
[10:17:45]         desc->depth == 2 (0x2)

By clearing IRQ_NOREQUEST from the interrupt descriptor, these tests now
pass on ARM and PowerPC.

Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts")
Signed-off-by: David Gow <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
Tested-by: Guenter Roeck <[email-masked]>
Tested-by: Brian Norris <[email-masked]>
Reviewed-by: Brian Norris <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/irq/irq_test.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/kernel/irq/irq_test.c b/kernel/irq/irq_test.c
index a75abebed7f24..e220e7b2fc187 100644
--- a/kernel/irq/irq_test.c
+++ b/kernel/irq/irq_test.c
@@ -54,6 +54,9 @@ static void irq_disable_depth_test(struct kunit *test)
 	desc = irq_to_desc(virq);
 	KUNIT_ASSERT_PTR_NE(test, desc, NULL);
 
+	/* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */
+	irq_settings_clr_norequest(desc);
+
 	ret = request_irq(virq, noop_handler, 0, "test_irq", NULL);
 	KUNIT_EXPECT_EQ(test, ret, 0);
 
@@ -81,6 +84,9 @@ static void irq_free_disabled_test(struct kunit *test)
 	desc = irq_to_desc(virq);
 	KUNIT_ASSERT_PTR_NE(test, desc, NULL);
 
+	/* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */
+	irq_settings_clr_norequest(desc);
+
 	ret = request_irq(virq, noop_handler, 0, "test_irq", NULL);
 	KUNIT_EXPECT_EQ(test, ret, 0);
 
@@ -120,6 +126,9 @@ static void irq_shutdown_depth_test(struct kunit *test)
 	desc = irq_to_desc(virq);
 	KUNIT_ASSERT_PTR_NE(test, desc, NULL);
 
+	/* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */
+	irq_settings_clr_norequest(desc);
+
 	data = irq_desc_get_irq_data(desc);
 	KUNIT_ASSERT_PTR_NE(test, data, NULL);
 
@@ -180,6 +189,9 @@ static void irq_cpuhotplug_test(struct kunit *test)
 	desc = irq_to_desc(virq);
 	KUNIT_ASSERT_PTR_NE(test, desc, NULL);
 
+	/* On some architectures, IRQs are NOREQUEST | NOPROBE by default. */
+	irq_settings_clr_norequest(desc);
+
 	data = irq_desc_get_irq_data(desc);
 	KUNIT_ASSERT_PTR_NE(test, data, NULL);
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:35:32 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368967; cv=none; b=RwAsu8vQoD1g9eLyHEh7SbE3fMRKXDqrbduPYs0/UzggzB4ckc1o9U4uS7MnEnJfrBUkApATGupH0fw4YT5o4wlY8+c49ERolKFBGXhUz+DyfrHTXpsEGpozR//YfzrzlRPbkCuKP9LvEotLs2IL6I9vk5oYXV7EQKjiR1KhK5s=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368967; c=relaxed/simple;
	bh=hary/BSstPWp+DnTpc7Don5W0EK4LdlhGRSZvg7B+Ec=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=iJM6353CLet1aCtjVPfTiGtgobahMKYyzZVRR6cRCLYU0lHjMvz7iUcDjN5tUdYoHF8YckqRecyimDxJl/Lotbvh9TOcjracIuTLvk/9Fgo12jjvj5qy6iE5VECpZ3NG8BjmiBC7jIJxjkOOL6SCaILg5To2vIMWnhb2onnWyt4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=g879muXv; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Andrei Lalaev <[email-masked]>,
	Lee Jones <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 081/563] leds: leds-lp55xx: Use correct address for memory programming
Date: Mon, 13 Oct 2025 16:39:02 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrei Lalaev <[email-masked]>

[ Upstream commit d6058316d16ee0d1861c0550051b2492efb54b79 ]

Memory programming doesn't work for devices without page support.
For example, LP5562 has 3 engines but doesn't support pages,
the start address is changed depending on engine number.
According to datasheet [1], the PROG MEM register addresses for each
engine are as follows:

  Engine 1: 0x10
  Engine 2: 0x30
  Engine 3: 0x50

However, the current implementation incorrectly calculates the address
of PROG MEM register using the engine index starting from 1:

  prog_mem_base = 0x10
  LP55xx_BYTES_PER_PAGE = 0x20

  Engine 1: 0x10 + 0x20 * 1 = 0x30
  Engine 2: 0x10 + 0x20 * 2 = 0x50
  Engine 3: 0x10 + 0x20 * 3 = 0x70

This results in writing to the wrong engine memory, causing pattern
programming to fail.

To correct it, the engine index should be decreased:
  Engine 1: 0x10 + 0x20 * 0 = 0x10
  Engine 2: 0x10 + 0x20 * 1 = 0x30
  Engine 3: 0x10 + 0x20 * 2 = 0x50

1 - https://www.ti.com/lit/ds/symlink/lp5562.pdf

Fixes: 31379a57cf2f ("leds: leds-lp55xx: Generalize update_program_memory function")
Signed-off-by: Andrei Lalaev <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Lee Jones <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/leds/leds-lp55xx-common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c
index e71456a56ab8d..fd447eb7eb15e 100644
--- a/drivers/leds/leds-lp55xx-common.c
+++ b/drivers/leds/leds-lp55xx-common.c
@@ -212,7 +212,7 @@ int lp55xx_update_program_memory(struct lp55xx_chip *chip,
 	 * For LED chip that support page, PAGE is already set in load_engine.
 	 */
 	if (!cfg->pages_per_engine)
-		start_addr += LP55xx_BYTES_PER_PAGE * idx;
+		start_addr += LP55xx_BYTES_PER_PAGE * (idx - 1);
 
 	for (page = 0; page < program_length / LP55xx_BYTES_PER_PAGE; page++) {
 		/* Write to the next page each 32 bytes (if supported) */
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:37:06 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368964; cv=none; b=YsA6v3IRgY/OSBJhxkvxKezsGAWxlOgIrDq/JaXtywX68cGEa8STAGUroXG1jG7Tw2ej7MCuN+K6E04p1HZbTzmpLEaQ2nAcpVEJHaO3XjPs90SiZkp+9om7Kl2qQxvKkj3GmttN9AnK6ztuXeA+ChFzM3dGJHu7VUN40fHPPkk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368964; c=relaxed/simple;
	bh=hRZgqEv8OJYKRvlCgje4fPESnNCqflQbe0EVTnB3QKM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=swzqwi8ACVZAtd/Hz2cpxQchhRBxd6IBUjsweO6/ZX7x+YYfs8Vb2eaRS8FSuYnKy0ktsPqYZKFTmjrqBz4LG3BaQDDImaUBLDBeIDArBWR5nA0MDLhC9LsRNXXDly6lwgqNQw6fBh1pZkSJU6XzGr/qvd3SryVwWmBpfxUQ0qY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=oHLzq0Sk; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Benjamin Berg <[email-masked]>,
	=?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 080/563] selftests/nolibc: fix EXPECT_NZ macro
Date: Mon, 13 Oct 2025 16:39:01 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Benjamin Berg <[email-masked]>

[ Upstream commit 6d33ce3634f99e0c6c9ce9fc111261f2c411cb48 ]

The expect non-zero macro was incorrect and never used. Fix its
definition.

Fixes: 362aecb2d8cfa ("selftests/nolibc: add basic infrastructure to ease creation of nolibc tests")
Signed-off-by: Benjamin Berg <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Thomas Weißschuh <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/nolibc/nolibc-test.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c
index cc4d730ac4656..d074878eb2341 100644
--- a/tools/testing/selftests/nolibc/nolibc-test.c
+++ b/tools/testing/selftests/nolibc/nolibc-test.c
@@ -196,8 +196,8 @@ int expect_zr(int expr, int llen)
 }

-#define EXPECT_NZ(cond, expr, val)			\
-	do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0)
+#define EXPECT_NZ(cond, expr)				\
+	do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0)
 
 static __attribute__((unused))
 int expect_nz(int expr, int llen)
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:35:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368956; cv=none; b=FPrsFBnyFLwJz6g2d25L8sZuhIcNkUJD65AtLHKqfiUdQlEOJCyzyAftPTerXnuKTpLG/gNWEZr/QztiFNFllhHM8ybsl018/I4VFMJAuJ/RbDZUp74OxuiHLOwD/3+tggxMFvZJxvgXJvo/GYmiroxQi4bcbo5wkS8K7DGdd0U=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368956; c=relaxed/simple;
	bh=dMs3zjubW0TKTUTbJUsa2otpMvGP79ZJ+1rwlqh/zkA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=S4TztwZWeX8C2dWEbT3vgOyXHEM/ifH4j9YKe/YYFZv7Bps4Bkt4jqjg7esiEmwHRDX98sxCQ/Y2ZC+dnsCvWRv5liqVeVifUbMPsC8VQ/IyiIT5WD88wvm2Ppwf1QKDbi5yQd9wiW/e6UAFmMEDC9dN4kT0pfOoEM/Q3Vw8Zx8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Hm42WFue; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	Sudeep Holla <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 077/563] regulator: scmi: Use int type to store negative error codes
Date: Mon, 13 Oct 2025 16:38:58 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ]

Change the 'ret' variable from u32 to int to store negative error codes or
zero returned by of_property_read_u32().

Storing the negative error codes in unsigned type, doesn't cause an issue
at runtime but it's ugly as pants. Additionally, assigning negative error
codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
flag is enabled.

No effect on runtime.

Signed-off-by: Qianfeng Rong <[email-masked]>
Reviewed-by: Sudeep Holla <[email-masked]>
Fixes: 0fbeae70ee7c ("regulator: add SCMI driver")
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/regulator/scmi-regulator.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c
index 9df726f10ad12..6d609c42e4793 100644
--- a/drivers/regulator/scmi-regulator.c
+++ b/drivers/regulator/scmi-regulator.c
@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev,
 					  struct device_node *np,
 					  struct scmi_regulator_info *rinfo)
 {
-	u32 dom, ret;
+	u32 dom;
+	int ret;
 
 	ret = of_property_read_u32(np, "reg", &dom);
 	if (ret)
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:48:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368941; cv=none; b=Vwx71RAEoC8hphPEVBHDlhIS4+Vm7Qvc/gxyyGtououbMABXADZBkxpuKbZOQ6BH+2vMsfNUi9Gc7sgfUoCaYampeWs+64+n9l+poNHslFYJWD2bJtW8VYuTbUH6K62BkLoTTKvjKFDg5ix1aSFcJREyz3ZzcjYhgcXZYR1BrxM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368941; c=relaxed/simple;
	bh=9uevbsVNZ76wjDms8QhqtojU3hbRInaB1AOYbG35RrQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=UbJbBg+1q12Bpo8OD8iPZFyvYrr82aECGluK8iaHeUGCJm9jlDY/f/3Q8PGkgaimX658R6mleOlb0uuDbrh1GRMCVW6AsfqT4SwvcXDSfvEcUSwvSRc+vX/jnytKniLUl7eTjrSJdgdMa63ib8FYdHHLr95rygXEMGpyaViBCHg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=N7CYmWR/; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Da Xue <[email-masked]>,
	Linus Walleij <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 072/563] pinctrl: meson-gxl: add missing i2c_d pinmux
Date: Mon, 13 Oct 2025 16:38:53 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Da Xue <[email-masked]>

[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]

Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.

Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.

Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
Signed-off-by: Da Xue <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Linus Walleij <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
index 9171de657f978..a75762e4d2641 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[]	= { GPIODV_28 };
 static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 };
 static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 };
 
+static const unsigned int i2c_sck_d_pins[]	= { GPIOX_11 };
+static const unsigned int i2c_sda_d_pins[]	= { GPIOX_10 };
+
 static const unsigned int eth_mdio_pins[]	= { GPIOZ_0 };
 static const unsigned int eth_mdc_pins[]	= { GPIOZ_1 };
 static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 };
@@ -411,6 +414,8 @@ static const struct meson_pmx_group meson_gxl_periphs_groups[] = {
 	GPIO_GROUP(GPIO_TEST_N),
 
 	/* Bank X */
+	GROUP(i2c_sda_d,	5,	5),
+	GROUP(i2c_sck_d,	5,	4),
 	GROUP(sdio_d0,		5,	31),
 	GROUP(sdio_d1,		5,	30),
 	GROUP(sdio_d2,		5,	29),
@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = {
 	"i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19",
 };
 
+static const char * const i2c_d_groups[] = {
+	"i2c_sck_d", "i2c_sda_d",
+};
+
 static const char * const eth_groups[] = {
 	"eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv",
 	"eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3",
@@ -777,6 +786,7 @@ static const struct meson_pmx_func meson_gxl_periphs_functions[] = {
 	FUNCTION(i2c_a),
 	FUNCTION(i2c_b),
 	FUNCTION(i2c_c),
+	FUNCTION(i2c_d),
 	FUNCTION(eth),
 	FUNCTION(pwm_a),
 	FUNCTION(pwm_b),
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:36:42 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368936; cv=none; b=SxBs1FlokS78rL+ohiroFjjXO60vlFnigkDeLbfLDlDqXCgYJveCwRtdkiEaS6AmgpBqx+mZyUqXPHRppw3ZTy4MKx72rFPgy66/nMivmlbKTOhFazn8ncvoqZWe8MCTX5LnduxmnTZOoDIxTIMYzegoyU31cF9XVxan90KlXKo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368936; c=relaxed/simple;
	bh=lSo3+/Tl4u93n7hhFsdozMZfk6fFTE/wb9eUxZUC4cY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=P5MBYYLuJJWQzV4m/rwYNADwtvlf6DqEFRiTlGQ+JHEwbR3ZXP8IqE8FeqiQ57dxKALXqUJ5GbyxWBq4OEGe6AlP2AcEs7BcV0tmXqCs/siifHLJVWQwDLu8WkKkGEADvdQ21TchBgy/ZlWCd5Yr+VT8GpltRaeKGdcTJSNuXQQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zEMbuZwg; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Sneh Mankad <[email-masked]>,
	Bjorn Andersson <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 071/563] soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
Date: Mon, 13 Oct 2025 16:38:52 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sneh Mankad <[email-masked]>

[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]

Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a
transaction completes. Previously this bit was only cleared when
a wake TCS was borrowed as an AMC TCS but not for dedicated
AMC TCS. Leaving this bit set for AMC TCS and entering deeper low
power modes can generate a false completion IRQ.

Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER
bit upon receiving a completion IRQ.

Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS")
Signed-off-by: Sneh Mankad <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Bjorn Andersson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/soc/qcom/rpmh-rsc.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
index fdab2b1067dbb..c6f7d5c9c493d 100644
--- a/drivers/soc/qcom/rpmh-rsc.c
+++ b/drivers/soc/qcom/rpmh-rsc.c
@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
 
 		trace_rpmh_tx_done(drv, i, req);
 
-		/*
-		 * If wake tcs was re-purposed for sending active
-		 * votes, clear AMC trigger & enable modes and
+		/* Clear AMC trigger & enable modes and
 		 * disable interrupt for this TCS
 		 */
-		if (!drv->tcs[ACTIVE_TCS].num_tcs)
-			__tcs_set_trigger(drv, i, false);
+		__tcs_set_trigger(drv, i, false);
 skip:
 		/* Reclaim the TCS */
 		write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0);
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:49:56 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368933; cv=none; b=MYgxMPCNia1u9lCypprnxvLjDOEpabYYW+z3tWJp99kgt+gjiLPg+TXdX/AAnWqToeH4J7JGcMcTqldHElxRVriPEzKhnjy5NiG/MGn4vAThnF1Zq8xo8SZK2ohuZWEok1c5/1tFfoXVSBGrqng3oA7JFkNL3lnjS2XXVZVi5vs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368933; c=relaxed/simple;
	bh=oYxUhQUUcjNiwjXApbcV3NRTY+h28YZfPAV7xwlEg8Y=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=F3/iV6DylHhXxuVy9GDOdVV7+9BQ77LoKCiOryhIh9fkv1zjaQ8QRaRgJfKbPvpM2vljkQ1j2N3HGbxjztVWto32GO7EMPjXojWUdV8Htln8LsDPeafA5MVNCagXuz5wxf3UD+hQoS17nOvZMuW7TBQxOI61qqQWs90Ot9xvzXU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=b9lq5CzC; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Vlastimil Babka <[email-masked]>,
	Daniel Gomez <[email-masked]>,
	Nicolas Schier <[email-masked]>,
	Nathan Chancellor <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 070/563] scripts/misc-check: update export checks for EXPORT_SYMBOL_FOR_MODULES()
Date: Mon, 13 Oct 2025 16:38:51 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vlastimil Babka <[email-masked]>

[ Upstream commit 0354e81b7bd629f9c3379c9524e988ebc504fa25 ]

The module export checks are looking for EXPORT_SYMBOL_GPL_FOR_MODULES()
which was renamed to EXPORT_SYMBOL_FOR_MODULES(). Update the checks.

Fixes: 6d3c3ca4c77e ("module: Rename EXPORT_SYMBOL_GPL_FOR_MODULES to EXPORT_SYMBOL_FOR_MODULES")
Signed-off-by: Vlastimil Babka <[email-masked]>
Reviewed-by: Daniel Gomez <[email-masked]>
Reviewed-by: Nicolas Schier <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Nathan Chancellor <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 scripts/misc-check | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/misc-check b/scripts/misc-check
index 84f08da17b2c0..40e5a4b01ff47 100755
--- a/scripts/misc-check
+++ b/scripts/misc-check
@@ -45,7 +45,7 @@ check_tracked_ignored_files () {
 # does not automatically fix it.
 check_missing_include_linux_export_h () {
 
-	git -C "${srctree:-.}" grep --files-with-matches -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_GPL_FOR_MODULES)\(.*\)' \
+	git -C "${srctree:-.}" grep --files-with-matches -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_FOR_MODULES)\(.*\)' \
 	    -- '*.[ch]' :^tools/ :^include/linux/export.h |
 	xargs -r git -C "${srctree:-.}" grep --files-without-match '#include[[:space:]]*<linux/export\.h>' |
 	xargs -r printf "%s: warning: EXPORT_SYMBOL() is used, but #include <linux/export.h> is missing\n" >&2
@@ -58,7 +58,7 @@ check_unnecessary_include_linux_export_h () {
 
 	git -C "${srctree:-.}" grep --files-with-matches '#include[[:space:]]*<linux/export\.h>' \
 	    -- '*.[c]' :^tools/ |
-	xargs -r git -C "${srctree:-.}" grep --files-without-match -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_GPL_FOR_MODULES)\(.*\)' |
+	xargs -r git -C "${srctree:-.}" grep --files-without-match -E 'EXPORT_SYMBOL((_NS)?(_GPL)?|_FOR_MODULES)\(.*\)' |
 	xargs -r printf "%s: warning: EXPORT_SYMBOL() is not used, but #include <linux/export.h> is present\n" >&2
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:36:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368930; cv=none; b=OFjKtwwy5E/Fll5L6e+Nq4GlxA4mJqYGjgjY8BUDP7667tPXdWJMksmrR0kySlc7aIbZvdUt+ktrsTF8PLtzlnLf0r5MyGsABpNlbFzoY3X9aWAIllfVZWeuHZMuIZC0fN5yc3aOIhq6gOvvvPqH7ritghVHXYofHEsaE2jj/Es=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368930; c=relaxed/simple;
	bh=xr7vP+jSfK6pT9J/+yVYGZ0nrOrfHFnZ5PB9Egam4aA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Qni3a0ZbNhSDIhBbeC+ucVpEgsTeK7r3S97A3OycXARRO9IeJf6vcrq8Fa6OodcFOiQ3OmjRhws+uBjiz6ZRkS6TDg72+3NgewZR04YoxAQAg7WphjAJCONBZ+6V5XPZDAM479PdD4E2CxPoQuHPjkgy8CADltq9NM0hESdZovo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IViqpjlb; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Han Gao <[email-masked]>,
	Thomas Gleixner <[email-masked]>,
	Inochi Amaoto <[email-masked]>,
	Chen Wang <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 069/563] irqchip/sg2042-msi: Fix broken affinity setting
Date: Mon, 13 Oct 2025 16:38:50 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Inochi Amaoto <[email-masked]>

[ Upstream commit 9d8c41816bac518b4824f83b346ae30a1be83f68 ]

When using NVME on SG2044, the NVME drvier always complains about "I/O tag
XXX (XXX) QID XX timeout, completion polled", which is caused by the broken
affinity setting mechanism of the sg2042-msi driver.

The PLIC driver can only the set the affinity when enabled, but the
sg2042-msi driver invokes the affinity setter in disabled state, which
causes the change to be lost.

Cure this by implementing the irq_startup()/shutdown() callbacks, which
allow to startup (enabled) the underlying PLIC first.

Fixes: e96b93a97c90 ("irqchip/sg2042-msi: Add the Sophgo SG2044 MSI interrupt controller")
Reported-by: Han Gao <[email-masked]>
Suggested-by: Thomas Gleixner <[email-masked]>
Signed-off-by: Inochi Amaoto <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
Tested-by: Chen Wang <[email-masked]> # Pioneerbox
Reviewed-by: Chen Wang <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/irqchip/irq-sg2042-msi.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/irqchip/irq-sg2042-msi.c b/drivers/irqchip/irq-sg2042-msi.c
index bcfddc51bc6a1..2fd4d94f9bd76 100644
--- a/drivers/irqchip/irq-sg2042-msi.c
+++ b/drivers/irqchip/irq-sg2042-msi.c
@@ -85,6 +85,8 @@ static void sg2042_msi_irq_compose_msi_msg(struct irq_data *d, struct msi_msg *m
 
 static const struct irq_chip sg2042_msi_middle_irq_chip = {
 	.name			= "SG2042 MSI",
+	.irq_startup		= irq_chip_startup_parent,
+	.irq_shutdown		= irq_chip_shutdown_parent,
 	.irq_ack		= sg2042_msi_irq_ack,
 	.irq_mask		= irq_chip_mask_parent,
 	.irq_unmask		= irq_chip_unmask_parent,
@@ -114,6 +116,8 @@ static void sg2044_msi_irq_compose_msi_msg(struct irq_data *d, struct msi_msg *m
 
 static struct irq_chip sg2044_msi_middle_irq_chip = {
 	.name			= "SG2044 MSI",
+	.irq_startup		= irq_chip_startup_parent,
+	.irq_shutdown		= irq_chip_shutdown_parent,
 	.irq_ack		= sg2044_msi_irq_ack,
 	.irq_mask		= irq_chip_mask_parent,
 	.irq_unmask		= irq_chip_unmask_parent,
@@ -185,8 +189,10 @@ static const struct irq_domain_ops sg204x_msi_middle_domain_ops = {
 	.select	= msi_lib_irq_domain_select,
 };
 
-#define SG2042_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS |	\
-				   MSI_FLAG_USE_DEF_CHIP_OPS)
+#define SG2042_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS |		\
+				   MSI_FLAG_USE_DEF_CHIP_OPS |		\
+				   MSI_FLAG_PCI_MSI_MASK_PARENT |	\
+				   MSI_FLAG_PCI_MSI_STARTUP_PARENT)
 
 #define SG2042_MSI_FLAGS_SUPPORTED MSI_GENERIC_FLAGS_MASK
 
@@ -200,10 +206,12 @@ static const struct msi_parent_ops sg2042_msi_parent_ops = {
 	.init_dev_msi_info	= msi_lib_init_dev_msi_info,
 };
 
-#define SG2044_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS |	\
-				   MSI_FLAG_USE_DEF_CHIP_OPS)
+#define SG2044_MSI_FLAGS_REQUIRED (MSI_FLAG_USE_DEF_DOM_OPS |		\
+				   MSI_FLAG_USE_DEF_CHIP_OPS |		\
+				   MSI_FLAG_PCI_MSI_MASK_PARENT |	\
+				   MSI_FLAG_PCI_MSI_STARTUP_PARENT)
 
-#define SG2044_MSI_FLAGS_SUPPORTED (MSI_GENERIC_FLAGS_MASK |	\
+#define SG2044_MSI_FLAGS_SUPPORTED (MSI_GENERIC_FLAGS_MASK |		\
 				    MSI_FLAG_PCI_MSIX)
 
 static const struct msi_parent_ops sg2044_msi_parent_ops = {
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:36:38 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368924; cv=none; b=c7mm1C5c4Vgv7O4mpo4DksfeEAYQR2ZS07CUg2buBK0O+socpF04958lZOhPKG8WygzOpuGHyQ2c8h+QRipTWbIKTvwEpRgSCO7HsiHEJi945nafMM7iqs7IiWlVgtwp+eu8I005rGQl3pOWc092v0vjzOyTBeBZ6vgp6W+o0G4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368924; c=relaxed/simple;
	bh=Ydgg+yZKId6TwdwmpgGdkVuTt7XuK65Wi89xuN9MsM8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=EavRWy4ke3vhU8BuSNvBQK/vjvPlY/t+F99UWUXNjqSygfb166wAIcCIJwHs77l0ym7PKR7qiRoZl4FgZptUjjMV93O98IVzFpu98P3n95WnwLkQQnVXqSsrUrywBVsNwzgl0EfTOmNcK0Ui28ECRzfYk3QVDdlkwSrnKV8k3x8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=kBq8sq4H; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Thomas Gleixner <[email-masked]>,
	Inochi Amaoto <[email-masked]>,
	Chen Wang <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 067/563] genirq: Add irq_chip_(startup/shutdown)_parent()
Date: Mon, 13 Oct 2025 16:38:48 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Inochi Amaoto <[email-masked]>

[ Upstream commit 7a721a2fee2bce01af26699a87739db8ca8ea3c8 ]

As the MSI controller on SG2044 uses PLIC as the underlying interrupt
controller, it needs to call irq_enable() and irq_disable() to
startup/shutdown interrupts. Otherwise, the MSI interrupt can not be
startup correctly and will not respond any incoming interrupt.

Introduce irq_chip_startup_parent() and irq_chip_shutdown_parent() to allow
the interrupt controller to call the irq_startup()/irq_shutdown() callbacks
of the parent interrupt chip.

In case the irq_startup()/irq_shutdown() callbacks are not implemented for
the parent interrupt chip, this will fallback to irq_chip_enable_parent()
or irq_chip_disable_parent().

Suggested-by: Thomas Gleixner <[email-masked]>
Signed-off-by: Inochi Amaoto <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
Tested-by: Chen Wang <[email-masked]> # Pioneerbox
Reviewed-by: Chen Wang <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]
Link: https://lore.kernel.org/lkml/[email-masked]/
Stable-dep-of: 9d8c41816bac ("irqchip/sg2042-msi: Fix broken affinity setting")
Signed-off-by: Sasha Levin <[email-masked]>
---
 include/linux/irq.h |  2 ++
 kernel/irq/chip.c   | 37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/include/linux/irq.h b/include/linux/irq.h
index 1d6b606a81efe..890e1371f5d4c 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -669,6 +669,8 @@ extern int irq_chip_set_parent_state(struct irq_data *data,
 extern int irq_chip_get_parent_state(struct irq_data *data,
 				     enum irqchip_irq_state which,
 				     bool *state);
+extern void irq_chip_shutdown_parent(struct irq_data *data);
+extern unsigned int irq_chip_startup_parent(struct irq_data *data);
 extern void irq_chip_enable_parent(struct irq_data *data);
 extern void irq_chip_disable_parent(struct irq_data *data);
 extern void irq_chip_ack_parent(struct irq_data *data);
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 0d0276378c707..3ffa0d80ddd19 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -1259,6 +1259,43 @@ int irq_chip_get_parent_state(struct irq_data *data,
 }
 EXPORT_SYMBOL_GPL(irq_chip_get_parent_state);
 
+/**
+ * irq_chip_shutdown_parent - Shutdown the parent interrupt
+ * @data:	Pointer to interrupt specific data
+ *
+ * Invokes the irq_shutdown() callback of the parent if available or falls
+ * back to irq_chip_disable_parent().
+ */
+void irq_chip_shutdown_parent(struct irq_data *data)
+{
+	struct irq_data *parent = data->parent_data;
+
+	if (parent->chip->irq_shutdown)
+		parent->chip->irq_shutdown(parent);
+	else
+		irq_chip_disable_parent(data);
+}
+EXPORT_SYMBOL_GPL(irq_chip_shutdown_parent);
+
+/**
+ * irq_chip_startup_parent - Startup the parent interrupt
+ * @data:	Pointer to interrupt specific data
+ *
+ * Invokes the irq_startup() callback of the parent if available or falls
+ * back to irq_chip_enable_parent().
+ */
+unsigned int irq_chip_startup_parent(struct irq_data *data)
+{
+	struct irq_data *parent = data->parent_data;
+
+	if (parent->chip->irq_startup)
+		return parent->chip->irq_startup(parent);
+
+	irq_chip_enable_parent(data);
+	return 0;
+}
+EXPORT_SYMBOL_GPL(irq_chip_startup_parent);
+
 /**
  * irq_chip_enable_parent - Enable the parent interrupt (defaults to unmask if
  * NULL)
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:36:37 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368921; cv=none; b=aJfo8uNCuK+EwlwuvYB+f4Y9VzB5UBn/Q1r4m8qnYZv44ycI1IFnOY/mpr4sDtDD2/V+Op19ZvPVd/tcbmcMIjX1teUfKigsYHTsnaA9VLsqmBNDt7lQi19Cg/HSaWv8KCel7UFeGltMp5F7mK3vw84MwNVeJDktQZnVXQTqb3k=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368921; c=relaxed/simple;
	bh=EOT4pMTZtlTB5/F2PJFedtne0e/FJfiYKoobpnrMG84=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=U0184IMBWWaZqHm72YVa3c+Jr6+cniLJU1kqwf6OuNYbbTWtivjHhZqMpPgafjCNUqar60VF3rI1asyA2aG5oajjjQ0lfZ0mLXfF2R+Bju9SZDO0nMkLU3z1jryYh5lD0BmInZ+z2bwoJ5mBbSWotaaLmPj0keXfakAzi7J5UfE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XTK5Z+F8; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Huisong Li <[email-masked]>,
	"Rafael J. Wysocki" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 066/563] ACPI: processor: idle: Fix memory leak when register cpuidle device failed
Date: Mon, 13 Oct 2025 16:38:47 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Huisong Li <[email-masked]>

[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]

The cpuidle device's memory is leaked when cpuidle device registration
fails in acpi_processor_power_init().  Free it as appropriate.

Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
Signed-off-by: Huisong Li <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
[ rjw: Changed the order of the new statements, added empty line after if () ]
[ rjw: Changelog edits ]
Signed-off-by: Rafael J. Wysocki <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/acpi/processor_idle.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 2c2dc559e0f8d..d0fc045a8d310 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -1405,6 +1405,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)
 		if (retval) {
 			if (acpi_processor_registered == 0)
 				cpuidle_unregister_driver(&acpi_idle_driver);
+
+			per_cpu(acpi_cpuidle_device, pr->id) = NULL;
+			kfree(dev);
 			return retval;
 		}
 		acpi_processor_registered++;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:46:24 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368919; cv=none; b=MANxph/lsILAEY+FbwjpMvF12RDIKwQvBnLhaZE1ZsFVZLoe2RSwkg1kBUNSX50OseTzSS6kfHR2pMp9h2iN4hC/6RrbOiEk3xSd5r2sS5VS1Yg/akjh5YhyfYfkkr7jF4A1fB4GIpD7KM5bnoVGYykWt5pb1N778nbNtkNlbU4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368919; c=relaxed/simple;
	bh=9qAQ8pHxaQefcElbyFqbotNBK0TBSrP/fzM3SWkwoiM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=WXbNG/2Ov6JMBNRWpoxrMy1y45Bbbn6+fYRydON7ItPVYQKbpWAaU00L23yes4waKSOIsxTs3BgZUA40DO4vIPgPfboAfLOZ/XegL7w5V06vxOWo+FvvMG+BZxe/E22Qm2mcJPCU6aWsl0lfPBfZ2aS1ceCWDqtAqNxZnPY5KcI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=kSwXOf1d; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Tao Chen <[email-masked]>,
	Andrii Nakryiko <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 065/563] bpf: Remove preempt_disable in bpf_try_get_buffers
Date: Mon, 13 Oct 2025 16:38:46 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tao Chen <[email-masked]>

[ Upstream commit 4223bf833c8495e40ae2886acbc0ecbe88fa6306 ]

Now BPF program will run with migration disabled, so it is safe
to access this_cpu_inc_return(bpf_bprintf_nest_level).

Fixes: d9c9e4db186a ("bpf: Factorize bpf_trace_printk and bpf_seq_printf")
Signed-off-by: Tao Chen <[email-masked]>
Signed-off-by: Andrii Nakryiko <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/bpf/helpers.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 8af62cb243d9e..9c750a6a895bf 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -774,11 +774,9 @@ int bpf_try_get_buffers(struct bpf_bprintf_buffers **bufs)
 {
 	int nest_level;
 
-	preempt_disable();
 	nest_level = this_cpu_inc_return(bpf_bprintf_nest_level);
 	if (WARN_ON_ONCE(nest_level > MAX_BPRINTF_NEST_LEVEL)) {
 		this_cpu_dec(bpf_bprintf_nest_level);
-		preempt_enable();
 		return -EBUSY;
 	}
 	*bufs = this_cpu_ptr(&bpf_bprintf_bufs[nest_level - 1]);
@@ -791,7 +789,6 @@ void bpf_put_buffers(void)
 	if (WARN_ON_ONCE(this_cpu_read(bpf_bprintf_nest_level) == 0))
 		return;
 	this_cpu_dec(bpf_bprintf_nest_level);
-	preempt_enable();
 }
 
 void bpf_bprintf_cleanup(struct bpf_bprintf_data *data)
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:45:29 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368916; cv=none; b=RKUemlF5+SePdDgN4cwH2EKoSaxmja4lLCOselbmdZHl33Y9yAXMAab8gDzrov8RnC4rvvJef1aoVsac7KZbj6ZhqIj9QT/zUK2eT8tXJ9M1tOtqMr+hq2gl3wKgtDfZgBHkDBptQ9ppgMtbQ7sZN8bPBQJFr2sbvdoB3NjSzEE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368916; c=relaxed/simple;
	bh=MvsJh+uhTHGC3WrOsMHx8/cXqitLtHfwlEMvd2hLC+Y=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=tBA77V8YEUPvweTeRwJqcN7tiTgBYSLWnichHEXIrCdeIcj00sDusKaaQ/G2xc18cr9RXXb+mibbcvYlU40/EwLxtqwqyb9nxjDqX2VOcKvlKSK7q0H2yxFuz/kIbmuiCHjkurnjakU0wdAxQCC6K+Wv9HLd5rk5A44+CyroNgM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=HLkPUsZI; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Joy Zou <[email-masked]>,
	Peng Fan <[email-masked]>,
	Frank Li <[email-masked]>,
	Shawn Guo <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 064/563] arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid
Date: Mon, 13 Oct 2025 16:38:45 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Joy Zou <[email-masked]>

[ Upstream commit 6fdaf3b1839c861931db0dd11747c056a76b68f9 ]

According to the imx95 RM, the lpuart7 rx and tx DMA's srcid are 88 and 87,
and the lpuart8 rx and tx DMA's srcid are 90 and 89. So correct them.

Fixes: 915fd2e127e8 ("arm64: dts: imx95: add edma[1..3] nodes")
Signed-off-by: Joy Zou <[email-masked]>
Signed-off-by: Peng Fan <[email-masked]>
Reviewed-by: Frank Li <[email-masked]>
Signed-off-by: Shawn Guo <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/freescale/imx95.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi
index 8296888bce594..4521da02d1695 100644
--- a/arch/arm64/boot/dts/freescale/imx95.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx95.dtsi
@@ -913,7 +913,7 @@ lpuart7: serial@42690000 {
 				interrupts = <GIC_SPI 68 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&scmi_clk IMX95_CLK_LPUART7>;
 				clock-names = "ipg";
-				dmas = <&edma2 26 0 FSL_EDMA_RX>, <&edma2 25 0 0>;
+				dmas = <&edma2 88 0 FSL_EDMA_RX>, <&edma2 87 0 0>;
 				dma-names = "rx", "tx";
 				status = "disabled";
 			};
@@ -925,7 +925,7 @@ lpuart8: serial@426a0000 {
 				interrupts = <GIC_SPI 69 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&scmi_clk IMX95_CLK_LPUART8>;
 				clock-names = "ipg";
-				dmas = <&edma2 28 0 FSL_EDMA_RX>, <&edma2 27 0 0>;
+				dmas = <&edma2 90 0 FSL_EDMA_RX>, <&edma2 89 0 0>;
 				dma-names = "rx", "tx";
 				status = "disabled";
 			};
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:36:33 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368910; cv=none; b=PB11IiZ2XwWCmDKTgZ8VzDg+iVzsjOge0Ax2CsHltThw9ZPRzGLb81y0i2S/gNbx7Q4f2b0vgHqHQkWEMnAk15sivcU9tnGdN0qtJwps8oz2kQfeI9NV8Jk92xlydYMpi+bXRI00mLos/cksY0oL/y+WZVA5voRtAytnvdvJP98=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368910; c=relaxed/simple;
	bh=faKAE1hs4jgVnROFOfG3E5co0iJJ+gQ/EqfsP0Uqzpo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=aTKdeNA2qaZ/zNrTX5waOyY6NEgoyu6Q+BQ/lUuw8JXN9ojHjz3+FJwj00MCcmQwQQjxlpLFifZ3SP9OJzZhpptN78y6l0uz2CW7s+OKvuy2xJSoWF3cct981K/BM6rYBFaO1pOMyhJstioD+c/b86TUmUDVd/xPZA1XQwCew8k=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=iUBhrSOK; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Annette Kobou <[email-masked]>,
	Frieder Schrempf <[email-masked]>,
	Shawn Guo <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 062/563] arm64: dts: imx93-kontron: Fix GPIO for panel regulator
Date: Mon, 13 Oct 2025 16:38:43 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Annette Kobou <[email-masked]>

[ Upstream commit f3e011388dd08d15e0414e3b6b974f946305e7af ]

The regulator uses the wrong GPIO. Fix this.

Signed-off-by: Annette Kobou <[email-masked]>
Signed-off-by: Frieder Schrempf <[email-masked]>
Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board")
Signed-off-by: Shawn Guo <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../boot/dts/freescale/imx93-kontron-bl-osm-s.dts    | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
index 89e97c604bd3e..9a9e5d0daf3ba 100644
--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
@@ -33,7 +33,9 @@ pwm-beeper {
 
 	reg_vcc_panel: regulator-vcc-panel {
 		compatible = "regulator-fixed";
-		gpio = <&gpio4 3 GPIO_ACTIVE_HIGH>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinctrl_reg_vcc_panel>;
+		gpio = <&gpio2 21 GPIO_ACTIVE_HIGH>;
 		enable-active-high;
 		regulator-max-microvolt = <3300000>;
 		regulator-min-microvolt = <3300000>;
@@ -161,3 +163,11 @@ &usdhc2 {
 	vmmc-supply = <&reg_vdd_3v3>;
 	status = "okay";
 };
+
+&iomuxc {
+	pinctrl_reg_vcc_panel: regvccpanelgrp {
+		fsl,pins = <
+			MX93_PAD_GPIO_IO21__GPIO2_IO21		0x31e /* PWM_2 */
+		>;
+	};
+};
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:43:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369001; cv=none; b=OqaSucYhVvBs5OlnGepLHb+hFX4Zd+xYpZd92/Bs0zd/ALWSvsG8WATEaZW5hvYRetn5lMCm7w7aY6pZHuXIi7tBb2Wma9Qc/tJk1Oy1gH+mQdBT8AyVDFma4Yj8UjI72noDKFCksFbFe/awZGKcJ04KQOrMXbynMut/d3SXEfw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369001; c=relaxed/simple;
	bh=lDtncysfP5pmZhFjFdHn61F+RAWvjV3oFJevv4IwwRs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=rJloXaloA+YOo1eqsYC0x8zfWarcdJ13gDYsa1bEETAsS5GMXaUzaumc9kErgqE4gfCI/LlGS16qDnggV/4wZZ/aN2x1DKp2NBHZ0VyNbrWifA+8h6bt+qKY5ms1aTmiAbuaenByLmPiPnJX3158t7LrwVhsEtG7Pfq8ZrZ6AsQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=W2dG+vJq; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Mykyta Yatsenko <[email-masked]>,
	Daniel Borkmann <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 060/563] libbpf: Export bpf_object__prepare symbol
Date: Mon, 13 Oct 2025 16:38:41 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mykyta Yatsenko <[email-masked]>

[ Upstream commit 2693227c1150d58bf82ef45a394a554373be5286 ]

Add missing LIBBPF_API macro for bpf_object__prepare function to enable
its export. libbpf.map had bpf_object__prepare already listed.

Fixes: 1315c28ed809 ("libbpf: Split bpf object load into prepare/load")
Signed-off-by: Mykyta Yatsenko <[email-masked]>
Signed-off-by: Daniel Borkmann <[email-masked]>
Acked-by: Daniel Borkmann <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/lib/bpf/libbpf.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/lib/bpf/libbpf.h b/tools/lib/bpf/libbpf.h
index 455a957cb702c..2b86e21190d37 100644
--- a/tools/lib/bpf/libbpf.h
+++ b/tools/lib/bpf/libbpf.h
@@ -252,7 +252,7 @@ bpf_object__open_mem(const void *obj_buf, size_t obj_buf_sz,
  * @return 0, on success; negative error code, otherwise, error code is
  * stored in errno
  */
-int bpf_object__prepare(struct bpf_object *obj);
+LIBBPF_API int bpf_object__prepare(struct bpf_object *obj);
 
 /**
  * @brief **bpf_object__load()** loads BPF object into kernel.
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:37:48 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368998; cv=none; b=od/+TaDueNCgChMgJXibBZSpoVDualbshSYJGO4YY7LD6lQKA7Izx4mBNpQc/Whino3RkaC3aarnBnEVSYWzpjhXyu8+3v5zhl8mv7xzIjNBIeUvNLvWRYsP4g67N/0+M6GtUNT6Z0irHCJ/W9XLXtlJWPFlLmTLMl93ptfkf5k=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368998; c=relaxed/simple;
	bh=GqKtMhfozIA5p3ZSodqo5dLGvMShBajsIFnBiy5CLvI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=S5KVlns1WfRZwyTUAOlXQdzGK1UKlV5tc2vOByzy21DvqZcUd0h7py5Lf+kz/ctLBD8NOIIrKvMJCIrbJfQ2x8LbrUs1f/yC3QHH26EWhaF5pSdu1UNIakyzCEAgFdDcWY1eMllHsgiJiONe658XKRY8mZrmM5TUfOIOc1QZEDk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=fPkoFucz; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Marek Vasut <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 059/563] arm64: dts: renesas: sparrow-hawk: Set VDDQ18_25_AVB voltage on EVTB1
Date: Mon, 13 Oct 2025 16:38:40 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marek Vasut <[email-masked]>

[ Upstream commit 7d1e3aa2826a22f68f1850c31ac96348272fa356 ]

The Retronix R-Car V4H Sparrow Hawk EVTB1 uses 1V8 IO voltage supply
for VDDQ18_25_AVB power rail. Update the AVB0 pinmux to reflect the
change in IO voltage. Since the VDDQ18_25_AVB power rail is shared,
all four AVB0, AVB1, AVB2, TSN0 PFC/GPIO POC[7..4] registers have to
be configured the same way. As the EVTA1 boards are from a limited run
and generally not available, update the DT to make it compatible with
EVTB1 IO voltage settings.

Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support")
Signed-off-by: Marek Vasut <[email-masked]>
Reviewed-by: Geert Uytterhoeven <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
index 18411dfb524fd..2c1ab75e4d910 100644
--- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
+++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
@@ -556,6 +556,10 @@ pins-mii {
 			drive-strength = <21>;
 		};
 
+		pins-vddq18-25-avb {
+			pins = "PIN_VDDQ_AVB0", "PIN_VDDQ_AVB1", "PIN_VDDQ_AVB2", "PIN_VDDQ_TSN0";
+			power-source = <1800>;
+		};
 	};
 
 	/* Page 28 / CANFD_IF */
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:37:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368995; cv=none; b=rf8aLHY/wF4/yzFy+lyv0ygoYYWBV7MUPsLVXJbqUmTXI80/cm7nTcVPIYfXamgTWVCjoYvzAsnRCFC/cewMLCocye3JSeI/u5DUrHkOAi69GA0vLOP3qm20ox0j5221bnUmMb8r2tt3d5UxOTynacFjlcCvm332xXQdtsWwjTo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368995; c=relaxed/simple;
	bh=pPOPGvUKMGz44dYGFNQ8RH42dV2zL5ooMSuTprjkcoI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=BgxEjHZG/pYEp67E5P72LambfRm795tUbibNkSpbwROyWbK1FtWVtc9mmvOLg2xXd3OrY4PMEmdzYzsyiwbGIX2uXx66EFPV52If4bKvYGcqGKasc8HINWMji9hlIlfjuHKv7lmDHbrBEl2E/LD/ILO4JylQ2u+0F64xUnE2vgA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=BGAGyAjZ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Marek Vasut <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 058/563] arm64: dts: renesas: sparrow-hawk: Invert microSD voltage selector on EVTB1
Date: Mon, 13 Oct 2025 16:38:39 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marek Vasut <[email-masked]>

[ Upstream commit ae95807b00e1639b3f6ab94eb2cd887266e4f766 ]

Invert the polarity of microSD voltage selector on Retronix R-Car V4H
Sparrow Hawk board. The voltage selector was not populated on prototype
EVTA1 boards, and is implemented slightly different on EVTB1 boards. As
the EVTA1 boards are from a limited run and generally not available,
update the DT to make it compatible with EVTB1 microSD voltage selector.

Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support")
Signed-off-by: Marek Vasut <[email-masked]>
Reviewed-by: Geert Uytterhoeven <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
index 9ba23129e65ec..18411dfb524fd 100644
--- a/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
+++ b/arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dts
@@ -185,7 +185,7 @@ vcc_sdhi: regulator-vcc-sdhi {
 		regulator-max-microvolt = <3300000>;
 		gpios = <&gpio8 13 GPIO_ACTIVE_HIGH>;
 		gpios-states = <1>;
-		states = <3300000 0>, <1800000 1>;
+		states = <1800000 0>, <3300000 1>;
 	};
 };
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:43:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368970; cv=none; b=uxDp8mzQKuI8JCVKtEWPd1FaXAPCAOn914YciOAz5eHot3OZZt5nd7hruLtFOEwYvrFsp7hwQHoqLX23lz+tXBfMbPvhVebPuV6e/86IkDGEUb6V7+g1kNubQSoGX6hy7oO6qxgpqlE2kOmv8XB+qMrv+uVwkPnexUCdhyOHGc8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368970; c=relaxed/simple;
	bh=7vG8GzFqcGsxt/z17VI6Vqpr4g8CSJ8yAL/6byEA+QA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Y1yHFVjzvFTNLRXhwIRIYuvgS750SClibYY05iU2ZeaHwTq1nc6jqAvU4kOmCiJG0R5G7HdcT9ZVWNu2RC5lv6mXlyrdZP7UXNO5Udo6D5ZB9xCkk7wuL4noLSiMTqZWqhpqJFKIAn6/JSG7+OU0gwUjtaEUNH3yZie72yoexFo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=LbPaja2g; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ilya Leoshkevich <[email-masked]>,
	Daniel Borkmann <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 055/563] s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
Date: Mon, 13 Oct 2025 16:38:36 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ilya Leoshkevich <[email-masked]>

[ Upstream commit c861a6b147137d10b5ff88a2c492ba376cd1b8b0 ]

The tailcall_bpf2bpf_hierarchy_1 test hangs on s390. Its call graph is
as follows:

  entry()
    subprog_tail()
      bpf_tail_call_static(0) -> entry + tail_call_start
    subprog_tail()
      bpf_tail_call_static(0) -> entry + tail_call_start

entry() copies its tail call counter to the subprog_tail()'s frame,
which then increments it. However, the incremented result is discarded,
leading to an astronomically large number of tail calls.

Fix by writing the incremented counter back to the entry()'s frame.

Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()")
Signed-off-by: Ilya Leoshkevich <[email-masked]>
Signed-off-by: Daniel Borkmann <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/s390/net/bpf_jit_comp.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index bfac1ddf3447b..ccb83ac3e6f32 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -1793,13 +1793,6 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 
 		/*
 		 * Copy the tail call counter to where the callee expects it.
-		 *
-		 * Note 1: The callee can increment the tail call counter, but
-		 * we do not load it back, since the x86 JIT does not do this
-		 * either.
-		 *
-		 * Note 2: We assume that the verifier does not let us call the
-		 * main program, which clears the tail call counter on entry.
 		 */
 
 		if (insn->src_reg == BPF_PSEUDO_CALL)
@@ -1833,6 +1826,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 		call_r1(jit);
 		/* lgr %b0,%r2: load return value into %b0 */
 		EMIT4(0xb9040000, BPF_REG_0, REG_2);
+
+		/*
+		 * Copy the potentially updated tail call counter back.
+		 */
+
+		if (insn->src_reg == BPF_PSEUDO_CALL)
+			/*
+			 * mvc frame_off+tail_call_cnt(%r15),
+			 *     tail_call_cnt(4,%r15)
+			 */
+			_EMIT6(0xd203f000 | (jit->frame_off +
+					     offsetof(struct prog_frame,
+						      tail_call_cnt)),
+			       0xf000 | offsetof(struct prog_frame,
+						 tail_call_cnt));
+
 		break;
 	}
 	case BPF_JMP | BPF_TAIL_CALL: {
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:34:44 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368907; cv=none; b=W5VnUJC/unkt7rRWfV0NikOH/7OJ69rcXRPOj5OIV66lAcgNFDFxt9aWSy+dfbbmj2pwB1ikhL3D1ipYLVKVWeLZTdnxvU/qepNuHf3PF+qP9hakYwpfelKTWnj0mC0h0LAgykcqV3jhwWjonb+nOEj5NBPTt3zjoxPDxTLTOII=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368907; c=relaxed/simple;
	bh=6Cs1Hq6QHP5yql1kRWFg5af8qB0vqt51cl4sTBDVP0I=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Ans0/7xKjk3Io1Khb4+xuC5N3Y3mori7I/9mA7fvwLITXwOcD9ylBrNMABWzDN5VfO3xhYnlvqqa+zLB1D9LyA0uj3rSsZZUIskFGHbWNdLdf6sj24zDF5nUYZvERukNy02YUYSHr2GGqBggsQDzaMpmkOQX7eTNW3IRQDu7GUw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=E3Y2fnMh; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Fenglin Wu <[email-masked]>,
	Konrad Dybcio <[email-masked]>,
	Lee Jones <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 053/563] leds: flash: leds-qcom-flash: Update torch current clamp setting
Date: Mon, 13 Oct 2025 16:38:34 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Fenglin Wu <[email-masked]>

[ Upstream commit 5974e8f6c3e47ab097c3dd8ece7324d1f88fe739 ]

There is a register to clamp the flash current per LED channel when
safety timer is disabled. It needs to be updated according to the
maximum torch LED current setting to ensure the torch current won't
be clamped unexpectedly.

Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs")
Signed-off-by: Fenglin Wu <[email-masked]>
Reviewed-by: Konrad Dybcio <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Lee Jones <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/leds/flash/leds-qcom-flash.c | 62 ++++++++++++++++------------
 1 file changed, 36 insertions(+), 26 deletions(-)

diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c
index 89cf5120f5d55..db7c2c743adc7 100644
--- a/drivers/leds/flash/leds-qcom-flash.c
+++ b/drivers/leds/flash/leds-qcom-flash.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/bitfield.h>
@@ -114,36 +114,39 @@ enum {
 	REG_THERM_THRSH1,
 	REG_THERM_THRSH2,
 	REG_THERM_THRSH3,
+	REG_TORCH_CLAMP,
 	REG_MAX_COUNT,
 };
 
 static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = {
-	REG_FIELD(0x08, 0, 7),			/* status1	*/
-	REG_FIELD(0x09, 0, 7),                  /* status2	*/
-	REG_FIELD(0x0a, 0, 7),                  /* status3	*/
-	REG_FIELD_ID(0x40, 0, 7, 3, 1),         /* chan_timer	*/
-	REG_FIELD_ID(0x43, 0, 6, 3, 1),         /* itarget	*/
-	REG_FIELD(0x46, 7, 7),                  /* module_en	*/
-	REG_FIELD(0x47, 0, 5),                  /* iresolution	*/
-	REG_FIELD_ID(0x49, 0, 2, 3, 1),         /* chan_strobe	*/
-	REG_FIELD(0x4c, 0, 2),                  /* chan_en	*/
-	REG_FIELD(0x56, 0, 2),			/* therm_thrsh1 */
-	REG_FIELD(0x57, 0, 2),			/* therm_thrsh2 */
-	REG_FIELD(0x58, 0, 2),			/* therm_thrsh3 */
+	[REG_STATUS1]		= REG_FIELD(0x08, 0, 7),
+	[REG_STATUS2]		= REG_FIELD(0x09, 0, 7),
+	[REG_STATUS3]		= REG_FIELD(0x0a, 0, 7),
+	[REG_CHAN_TIMER]	= REG_FIELD_ID(0x40, 0, 7, 3, 1),
+	[REG_ITARGET]		= REG_FIELD_ID(0x43, 0, 6, 3, 1),
+	[REG_MODULE_EN]		= REG_FIELD(0x46, 7, 7),
+	[REG_IRESOLUTION]	= REG_FIELD(0x47, 0, 5),
+	[REG_CHAN_STROBE]	= REG_FIELD_ID(0x49, 0, 2, 3, 1),
+	[REG_CHAN_EN]		= REG_FIELD(0x4c, 0, 2),
+	[REG_THERM_THRSH1]	= REG_FIELD(0x56, 0, 2),
+	[REG_THERM_THRSH2]	= REG_FIELD(0x57, 0, 2),
+	[REG_THERM_THRSH3]	= REG_FIELD(0x58, 0, 2),
+	[REG_TORCH_CLAMP]	= REG_FIELD(0xec, 0, 6),
 };
 
 static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = {
-	REG_FIELD(0x06, 0, 7),			/* status1	*/
-	REG_FIELD(0x07, 0, 6),			/* status2	*/
-	REG_FIELD(0x09, 0, 7),			/* status3	*/
-	REG_FIELD_ID(0x3e, 0, 7, 4, 1),		/* chan_timer	*/
-	REG_FIELD_ID(0x42, 0, 6, 4, 1),		/* itarget	*/
-	REG_FIELD(0x46, 7, 7),			/* module_en	*/
-	REG_FIELD(0x49, 0, 3),			/* iresolution	*/
-	REG_FIELD_ID(0x4a, 0, 6, 4, 1),		/* chan_strobe	*/
-	REG_FIELD(0x4e, 0, 3),			/* chan_en	*/
-	REG_FIELD(0x7a, 0, 2),			/* therm_thrsh1 */
-	REG_FIELD(0x78, 0, 2),			/* therm_thrsh2 */
+	[REG_STATUS1]		= REG_FIELD(0x06, 0, 7),
+	[REG_STATUS2]		= REG_FIELD(0x07, 0, 6),
+	[REG_STATUS3]		= REG_FIELD(0x09, 0, 7),
+	[REG_CHAN_TIMER]	= REG_FIELD_ID(0x3e, 0, 7, 4, 1),
+	[REG_ITARGET]		= REG_FIELD_ID(0x42, 0, 6, 4, 1),
+	[REG_MODULE_EN]		= REG_FIELD(0x46, 7, 7),
+	[REG_IRESOLUTION]	= REG_FIELD(0x49, 0, 3),
+	[REG_CHAN_STROBE]	= REG_FIELD_ID(0x4a, 0, 6, 4, 1),
+	[REG_CHAN_EN]		= REG_FIELD(0x4e, 0, 3),
+	[REG_THERM_THRSH1]	= REG_FIELD(0x7a, 0, 2),
+	[REG_THERM_THRSH2]	= REG_FIELD(0x78, 0, 2),
+	[REG_TORCH_CLAMP]	= REG_FIELD(0xed, 0, 6),
 };
 
 struct qcom_flash_data {
@@ -156,6 +159,7 @@ struct qcom_flash_data {
 	u8			max_channels;
 	u8			chan_en_bits;
 	u8			revision;
+	u8			torch_clamp;
 };
 
 struct qcom_flash_led {
@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev,
 	u32 current_ua, timeout_us;
 	u32 channels[4];
 	int i, rc, count;
+	u8 torch_clamp;
 
 	count = fwnode_property_count_u32(node, "led-sources");
 	if (count <= 0) {
@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev,
 	current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count);
 	led->max_torch_current_ma = current_ua / UA_PER_MA;
 
+	torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA;
+	if (torch_clamp != 0)
+		torch_clamp--;
+
+	flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp);
+
 	if (fwnode_property_present(node, "flash-max-microamp")) {
 		flash->led_cdev.flags |= LED_DEV_CAP_FLASH;
 
@@ -917,8 +928,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev)
 		flash_data->leds_count++;
 	}
 
-	return 0;
-
+	return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp);
 release:
 	while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count)
 		v4l2_flash_release(flash_data->v4l2_flash[flash_data->leds_count--]);
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:45:57 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368884; cv=none; b=e6J95nSeqLm7wxQTcnAnReb3fPGDosguLzavnOlqZ4q2qaJ+K9Qg3hOgDqoLS1HVvAICswx6BUnSvawhEzckkA1H4sysAua+QgCN0E3iylOW1HZijCZ4ABtC9Huh3esFfNK+eVkFMw/DmoSyS23WI1vvTAQaokrZJmbUdyfCNQU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368884; c=relaxed/simple;
	bh=S4oqsQrLNpzi0BKw1vDQLiTmN0aJotZ+QAOPRtH7V98=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=oRyrM9LCgdT7fmfDfe0puK7dPwKQxUC5sMORzcT7GDgkSHhw8E+yzFHQ7fdVc0ALQouQbPxcJbCRgT6tKNbdPXQrpOOyp4ORMu+grcc0JIX4/aKIPpooJMwU6oR7ixteWau8nCMRErPeH33IBDU7kqR7zBIr9TpNTNv9xor6vPc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vU0EiU3M; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 051/563] ARM: dts: renesas: porter: Fix CAN pin group
Date: Mon, 13 Oct 2025 16:38:32 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email-masked]>

[ Upstream commit 287066b295051729fb08c3cff12ae17c6fe66133 ]

According to the schematics, the CAN transceiver is connected to pins
GP7_3 and GP7_4, which correspond to CAN0 data group B.

Fixes: 0768fbad7fba1d27 ("ARM: shmobile: porter: add CAN0 DT support")
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Link: https://lore.kernel.org/70ad9[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm/boot/dts/renesas/r8a7791-porter.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
index f518eadd8b9cd..81b3c5d74e9b3 100644
--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts
+++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
@@ -289,7 +289,7 @@ vin0_pins: vin0 {
 	};
 
 	can0_pins: can0 {
-		groups = "can0_data";
+		groups = "can0_data_b";
 		function = "can0";
 	};
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:34:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368879; cv=none; b=a6hPAvf83mfZIXIIN7vVvami0LDx/ZER84KDdLOqPEN3SBctWrVSt5TF4zToF8VHYsAfaHE5E9QsjkOTPQMO3AqnJdS5Xi+P8nMo2RVIKptgtWLOgiZlWPYQE8dRxE9iVJfyadIaX+gtfGOkQ+8hbg7KIi24Av0s2+1S52LJEnc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368879; c=relaxed/simple;
	bh=BHtwnrP4GXEJbgsRepWwY0n2Z0P0DqGml6RaDxf1HVY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Vu2Aby2kszD/PFUv5gdo6S/Gd8JISihfZ0ki6++QkMds7Q3MJhPoaiEci8gdp1NeRGxYeu5SRoCAXsGco5+ceSoC0hlrSJTZ/Fuvb25bDbtG2CVJyaktqsFBmundk2TRF1+6ORdFiOl5/+wDxW+313YJ/AKTYV+ZlvgDocY2yKc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=RJOKketb; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yureka Lilian <[email-masked]>,
	Andrii Nakryiko <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 049/563] libbpf: Fix reuse of DEVMAP
Date: Mon, 13 Oct 2025 16:38:30 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yureka Lilian <[email-masked]>

[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ]

Previously, re-using pinned DEVMAP maps would always fail, because
get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set,
but BPF_F_RDONLY_PROG being set on a map during creation is invalid.

Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
get_map_info when checking for compatibility with an existing DEVMAP.

The same problem is handled in a third-party ebpf library:
- https://github.com/cilium/ebpf/issues/925
- https://github.com/cilium/ebpf/pull/930

Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF")
Signed-off-by: Yureka Lilian <[email-masked]>
Signed-off-by: Andrii Nakryiko <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/lib/bpf/libbpf.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 8f5a81b672e1b..fe4fc5438678c 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -5093,6 +5093,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
 		return false;
 	}
 
+	/*
+	 * bpf_get_map_info_by_fd() for DEVMAP will always return flags with
+	 * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time.
+	 * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
+	 * bpf_get_map_info_by_fd() when checking for compatibility with an
+	 * existing DEVMAP.
+	 */
+	if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH)
+		map_info.map_flags &= ~BPF_F_RDONLY_PROG;
+
 	return (map_info.type == map->def.type &&
 		map_info.key_size == map->def.key_size &&
 		map_info.value_size == map->def.value_size &&
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:50:09 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368876; cv=none; b=TBCK6E/RJezdyemEYks2mE88YMKvPRIDnkx6a+MOxrR6PxcenoHHpC1G3bPqU91sjsrJv1doT+hX4JJJLOcAUo9tyjYD+9usJ5L+nwOgpxxDgautz3ig5AaWgcLEM91hYswW1SSF8Fc7eZURt9dkyfuOIGMPi9bY5kM7SGkrdas=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368876; c=relaxed/simple;
	bh=0uXpZAzZz/GL1Dnph+DCV5or2eNoyCoujEy1EMIUWrs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Ph5gOq1Bip4D6SMbsejvUM4X8wgDx2endNsYYTRD+OzKHk0eXpmu8YlamZ+Rj8J+zlapJKVz7aQNSdZ4erfmARWU1L2j+e1X3jBWbcgAcGN0vYOzJxieeHMXszJvR6Jn1Q+Nx2Ifm96BUbxNASkefM7kNxbj8bpYPCKnyoWaoBo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=NzGgvhhT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Tao Chen <[email-masked]>,
	Andrii Nakryiko <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 048/563] bpf: Remove migrate_disable in kprobe_multi_link_prog_run
Date: Mon, 13 Oct 2025 16:38:29 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tao Chen <[email-masked]>

[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ]

Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run
called all the way from graph tracer, which disables preemption in
function_graph_enter_regs, as Jiri and Yonghong suggested, there is no
need to use migrate_disable. As a result, some overhead may will be reduced.
And add cant_sleep check for __this_cpu_inc_return.

Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
Signed-off-by: Tao Chen <[email-masked]>
Signed-off-by: Andrii Nakryiko <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/trace/bpf_trace.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 3ae52978cae61..606007c387c52 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2728,20 +2728,25 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link,
 	struct pt_regs *regs;
 	int err;
 
+	/*
+	 * graph tracer framework ensures we won't migrate, so there is no need
+	 * to use migrate_disable for bpf_prog_run again. The check here just for
+	 * __this_cpu_inc_return.
+	 */
+	cant_sleep();
+
 	if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {
 		bpf_prog_inc_misses_counter(link->link.prog);
 		err = 1;
 		goto out;
 	}
 
-	migrate_disable();
 	rcu_read_lock();
 	regs = ftrace_partial_regs(fregs, bpf_kprobe_multi_pt_regs_ptr());
 	old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx);
 	err = bpf_prog_run(link->link.prog, regs);
 	bpf_reset_run_ctx(old_run_ctx);
 	rcu_read_unlock();
-	migrate_enable();
 
  out:
 	__this_cpu_dec(bpf_prog_active);
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:36:03 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368864; cv=none; b=G61LrzTo16RsjMHFQHIyjwLdpvWZ0GUzjXs3AUhV9qxYB4A2fJAKEdKbywcfvu/MNI7/skYp/XjypF00MQAP1mA9iuKWb88/0bEHNqw+qTSFqbfbNBsYL9gtlRoM50btY6j2U4oe2YYJv/sqIqgtaJG32R1gNYUMXQsMB7BXLX0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368864; c=relaxed/simple;
	bh=6CKmgAoG5Gno3El2rMEmzJBkvQmrpXjewvjXEeITqeY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=eyuLtgKOVXY17uY1gBwsRlxnaiHTtHZmf/53slXwELEPYTXpBOHz5mDkUA/fQoE0zyjNrWkwkW77EciZIzEDYtajpYw5XrhQTrwsPKm9zGtGV5JoteC3EZxieu9WCQfjxSwtdii6pDaQdBYRNULrPT7HHbnYBW7C1MzwG7EQzes=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=e/GJTWLo; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Amery Hung <[email-masked]>,
	Andrii Nakryiko <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 045/563] selftests/bpf: Copy test_kmods when installing selftest
Date: Mon, 13 Oct 2025 16:38:26 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Amery Hung <[email-masked]>

[ Upstream commit 07866544e410e4c895a729971e4164861b41fad5 ]

Commit d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into
common directory") consolidated the Makefile of test_kmods. However,
since it removed test_kmods from TEST_GEN_PROGS_EXTENDED, the kernel
modules required by bpf selftests are now missing from kselftest_install
when "make install". Fix it by adding test_kmod to TEST_GEN_FILES.

Fixes: d6212d82bf26 ("selftests/bpf: Consolidate kernel modules into common directory")
Signed-off-by: Amery Hung <[email-masked]>
Signed-off-by: Andrii Nakryiko <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/bpf/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 4863106034dfb..77794efc020ea 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -137,7 +137,7 @@ TEST_GEN_PROGS_EXTENDED = \
 	xdping \
 	xskxceiver
 
-TEST_GEN_FILES += liburandom_read.so urandom_read sign-file uprobe_multi
+TEST_GEN_FILES += $(TEST_KMODS) liburandom_read.so urandom_read sign-file uprobe_multi
 
 ifneq ($(V),1)
 submake_extras := feature_display=0
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:46:08 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368858; cv=none; b=ioJMNuuiBoRV8BK5YbaUEr8e7JkhCKYBrYuBXgYIdXbs786jIoM6U+tpy9jT7PrUxa1/btF/6j57GfvPXfc4BlDjKEqbW3A54re9JQGugYCgx7MfbnkRfdGQXHwNjdyNOjBkGGtFgh+zDEKodDROumtdDictHtTne7s5Q3PdbaI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368858; c=relaxed/simple;
	bh=hwY54i3RCqc+ATS+4xc65xsXbEGLSC7z2ZUWLLdVxB4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pe60op4UebWe4qkSFcffRqyNv71Pf6Mrk00YLekqQXCJgEvEF0vWq0mrIGzfLf+x7wRgkzh1RizD17QgemHQRRpd0sCVxTMo2TbeYh6JYQ/5IOB0CYguQErXAltQWcToyAGDYfZOHDa553KpSIkclk0FYD+Fi1FpKF9TnacpDP4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uG0V4zMO; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yonghong Song <[email-masked]>,
	Paul Chaignon <[email-masked]>,
	Andrii Nakryiko <[email-masked]>,
	Eduard Zingerman <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 043/563] bpf: Tidy verifier bug message
Date: Mon, 13 Oct 2025 16:38:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paul Chaignon <[email-masked]>

[ Upstream commit c93c59baa5ab57e94b874000cec56e26611b7a23 ]

Yonghong noticed that error messages for potential verifier bugs often
have a '(1)' at the end. This is happening because verifier_bug_if(cond,
env, fmt, args...) prints "(" #cond ")\n" as part of the message and
verifier_bug() is defined as:

  #define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args)

Hence, verifier_bug() always ends up displaying '(1)'. This small patch
fixes it by having verifier_bug_if conditionally call verifier_bug
instead of the other way around.

Fixes: 1cb0f56d9618 ("bpf: WARN_ONCE on verifier bugs")
Reported-by: Yonghong Song <[email-masked]>
Signed-off-by: Paul Chaignon <[email-masked]>
Signed-off-by: Andrii Nakryiko <[email-masked]>
Tested-by: Eduard Zingerman <[email-masked]>
Acked-by: Yonghong Song <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 include/linux/bpf_verifier.h | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index 94defa405c85e..fe9a841fdf0cf 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -875,13 +875,15 @@ __printf(3, 4) void verbose_linfo(struct bpf_verifier_env *env,
 #define verifier_bug_if(cond, env, fmt, args...)						\
 	({											\
 		bool __cond = (cond);								\
-		if (unlikely(__cond)) {								\
-			BPF_WARN_ONCE(1, "verifier bug: " fmt "(" #cond ")\n", ##args);		\
-			bpf_log(&env->log, "verifier bug: " fmt "(" #cond ")\n", ##args);	\
-		}										\
+		if (unlikely(__cond))								\
+			verifier_bug(env, fmt " (" #cond ")", ##args);				\
 		(__cond);									\
 	})
-#define verifier_bug(env, fmt, args...) verifier_bug_if(1, env, fmt, ##args)
+#define verifier_bug(env, fmt, args...)								\
+	({											\
+		BPF_WARN_ONCE(1, "verifier bug: " fmt "\n", ##args);				\
+		bpf_log(&env->log, "verifier bug: " fmt "\n", ##args);				\
+	})
 
 static inline struct bpf_func_state *cur_func(struct bpf_verifier_env *env)
 {
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:42:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368855; cv=none; b=ti/dY7Oc66t0Cn1jBOZ7QKlXPHb+0M91tqhFW07ciXYVpx7kEdu/gDJARc/YiE4LV+Pbgsy6T2dNvKr1lsn/1vc/GiatuQ3JdlbAI82RmgvXspMC2Te1P8dLyUN20C32u2sf079NhCu5SpqO1QQUOuZJAY6rMbchWccU9T1bZ4c=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368855; c=relaxed/simple;
	bh=rybxzKl8BT4pyilMUqlznvGy47J0zG1sSWjs2/J3wVk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=O01pGc0GH+wV96W1g4sCDvfkI117EgZqwwweQegfTnCPvk358BWKcFdsldVSAhkzhnWhhw74eEjo09KkJohnEZa2BnRKZQqvMVDanYeCLTM2Kelz5enoaxLZzXuuSYHHD+SGTmrrw2k+dFIlWKrYl4emz2q2GUJYSrUaHUYS2kU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=G0DjP2at; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Biju Das <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 042/563] arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
Date: Mon, 13 Oct 2025 16:38:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Biju Das <[email-masked]>

[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ]

On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we
are deleting a wrong and nonexistent node.  Fixing the wrong node would
invoke a dtb warning message, as channel0 is a required property.
Disable CAN-FD channel0 instead of deleting the node.

Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1")
Signed-off-by: Biju Das <[email-masked]>
Reviewed-by: Geert Uytterhoeven <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
index 345b779e4f601..f3d7eff0d2f2a 100644
--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
@@ -48,7 +48,10 @@ sound_card {
 #if (SW_SCIF_CAN || SW_RSPI_CAN)
 &canfd {
 	pinctrl-0 = <&can1_pins>;
-	/delete-node/ channel@0;
+
+	channel0 {
+		status = "disabled";
+	};
 };
 #else
 &canfd {
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:49:47 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368849; cv=none; b=DB0IK5oYYblIOAGEyg7bwhjb3y4az1S1VzqOxK33fXIzBPiK6o2NDNeMYEIJLV4ypb9dpKqljOUx+z8++3CjpVsx2YCHINfhWBxDTR6KgXj0N+uZbP+71sR8v5jJUXiS7WXTw9jQmnc/wAP2SkXYveBQO1unxsrHcM0BtJt+o5g=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368849; c=relaxed/simple;
	bh=xgZc4SUlQs9NIf+LqOsRwgkbkyUAIYFw8tWkNtUBVXE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=nusopwRLIN5CZ30kgk2QjHMardlW+y6F2iGUfcYDnJAnRhCu5k1rjvekf+hvkLL+xhn/IQ3Wm93VUOO31gV2QUgEZ3sEYy37SfHVCvlp8wCNelYVz8phGpDefrTWauvWSFiwd1vkOTCzdfz8Xza5zqKoUzh+1IcWqD4qY/neRgA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JW5Cc+kf; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qu Wenruo <[email-masked]>,
	David Sterba <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 040/563] btrfs: fix symbolic link reading when bs > ps
Date: Mon, 13 Oct 2025 16:38:21 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qu Wenruo <[email-masked]>

[ Upstream commit 67378b754608a3524d125bfa5744508a49fe48be ]

[BUG DURING BS > PS TEST]
When running the following script on a btrfs whose block size is larger
than page size, e.g. 8K block size and 4K page size, it will trigger a
kernel BUG:

  # mkfs.btrfs -s 8k $dev
  # mount $dev $mnt
  # mkdir $mnt/dir
  # ln -s dir $mnt/link
  # ls $mnt/link

The call trace looks like this:

  BTRFS warning (device dm-2): support for block size 8192 with page size 4096 is experimental, some features may be missing
  BTRFS info (device dm-2): checking UUID tree
  BTRFS info (device dm-2): enabling ssd optimizations
  BTRFS info (device dm-2): enabling free space tree
  ------------[ cut here ]------------
  kernel BUG at /home/adam/linux/include/linux/highmem.h:275!
  Oops: invalid opcode: 0000 [#1] SMP
  CPU: 8 UID: 0 PID: 667 Comm: ls Tainted: G           OE       6.17.0-rc4-custom+ #283 PREEMPT(full)
  Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022
  RIP: 0010:zero_user_segments.constprop.0+0xdc/0xe0 [btrfs]
  Call Trace:
   <TASK>
   btrfs_get_extent.cold+0x85/0x101 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f]
   btrfs_do_readpage+0x244/0x750 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f]
   btrfs_read_folio+0x9c/0x100 [btrfs 7453c70c03e631c8d8bfdd4264fa62d3e238da6f]
   filemap_read_folio+0x37/0xe0
   do_read_cache_folio+0x94/0x3e0
   __page_get_link.isra.0+0x20/0x90
   page_get_link+0x16/0x40
   step_into+0x69b/0x830
   path_lookupat+0xa7/0x170
   filename_lookup+0xf7/0x200
   ? set_ptes.isra.0+0x36/0x70
   vfs_statx+0x7a/0x160
   do_statx+0x63/0xa0
   __x64_sys_statx+0x90/0xe0
   do_syscall_64+0x82/0xae0
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
   </TASK>

Please note bs > ps support is still under development and the
enablement patch is not even in btrfs development branch.

[CAUSE]
Btrfs reuses its data folio read path to handle symbolic links, as the
symbolic link target is stored as an inline data extent.

But for newly created inodes, btrfs only set the minimal order if the
target inode is a regular file.

Thus for above newly created symbolic link, it doesn't properly respect
the minimal folio order, and triggered the above crash.

[FIX]
Call btrfs_set_inode_mapping_order() unconditionally inside
btrfs_create_new_inode().

For symbolic links this will fix the crash as now the folio will meet
the minimal order.

For regular files this brings no change.

For directory/bdev/char and all the other types of inodes, they won't
go through the data read path, thus no effect either.

Fixes: cc38d178ff33 ("btrfs: enable large data folio support under CONFIG_BTRFS_EXPERIMENTAL")
Signed-off-by: Qu Wenruo <[email-masked]>
Signed-off-by: David Sterba <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/btrfs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 18db1053cdf08..cd8a09e3d1dc0 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6479,6 +6479,7 @@ int btrfs_create_new_inode(struct btrfs_trans_handle *trans,
 	if (!args->subvol)
 		btrfs_inherit_iflags(BTRFS_I(inode), BTRFS_I(dir));
 
+	btrfs_set_inode_mapping_order(BTRFS_I(inode));
 	if (S_ISREG(inode->i_mode)) {
 		if (btrfs_test_opt(fs_info, NODATASUM))
 			BTRFS_I(inode)->flags |= BTRFS_INODE_NODATASUM;
@@ -6486,7 +6487,6 @@ int btrfs_create_new_inode(struct btrfs_trans_handle *trans,
 			BTRFS_I(inode)->flags |= BTRFS_INODE_NODATACOW |
 				BTRFS_INODE_NODATASUM;
 		btrfs_update_inode_mapping_flags(BTRFS_I(inode));
-		btrfs_set_inode_mapping_order(BTRFS_I(inode));
 	}
 
 	ret = btrfs_insert_inode_locked(inode);
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:53:23 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368843; cv=none; b=YStO0Psb1rqpUDwoiRtjNDQ3EKdTeAaFoC582G4Zwgfp4DCsYDY1mIqx22AaM4Ukf4vHQ4hRtvWPL9ubIhDZmD0Lfm4ZE0eAyTis1hNpU1JkDPS4jLiuHPqdua7pcIEo62AWXOBfUfq4d0PXRwhUxEr2CQXHOUuUthrnO0qUbSg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368843; c=relaxed/simple;
	bh=3ve1aNDhU3E7gM3f275jDnn4pKvq4xZ2xj68eTfIXzw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=W3cD6knPCw81ujQ/cNPdWpxbPzqzpx7cNZ1HUr11/Nxfr7kaYrWVxW7jMOF/IPXzC54mQCjMAGPrEnBbHx1+/O2DAv0E/4BMer47ILa90RsXrwcV0HKCMVJ8Uc8KoLY4HMpCwCO5yF9tTo/iZUo0YOb/fl1HsgHMBmMCoWZgfDo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XxBbn7da; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chen Ridong <[email-masked]>,
	Waiman Long <[email-masked]>,
	Tejun Heo <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 038/563] cpuset: fix failure to enable isolated partition when containing isolcpus
Date: Mon, 13 Oct 2025 16:38:19 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chen Ridong <[email-masked]>

[ Upstream commit 216217ebee16afc4d79c3e86a736d87175c18e68 ]

The 'isolcpus' parameter specified at boot time can be assigned to an
isolated partition. While it is valid put the 'isolcpus' in an isolated
partition, attempting to change a member cpuset to an isolated partition
will fail if the cpuset contains any 'isolcpus'.

For example, the system boots with 'isolcpus=9', and the following
configuration works correctly:

  # cd /sys/fs/cgroup/
  # mkdir test
  # echo 1 > test/cpuset.cpus
  # echo isolated > test/cpuset.cpus.partition
  # cat test/cpuset.cpus.partition
  isolated
  # echo 9 > test/cpuset.cpus
  # cat test/cpuset.cpus.partition
  isolated
  # cat test/cpuset.cpus
  9

However, the following steps to convert a member cpuset to an isolated
partition will fail:

  # cd /sys/fs/cgroup/
  # mkdir test
  # echo 9 > test/cpuset.cpus
  # echo isolated > test/cpuset.cpus.partition
  # cat test/cpuset.cpus.partition
  isolated invalid (partition config conflicts with housekeeping setup)

The issue occurs because the new partition state (new_prs) is used for
validation against housekeeping constraints before it has been properly
updated. To resolve this, move the assignment of new_prs before the
housekeeping validation check when enabling a root partition.

Fixes: 4a74e418881f ("cgroup/cpuset: Check partition conflict with housekeeping setup")
Signed-off-by: Chen Ridong <[email-masked]>
Reviewed-by: Waiman Long <[email-masked]>
Signed-off-by: Tejun Heo <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/cgroup/cpuset.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 27adb04df675d..fef93032fe7e4 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -1716,6 +1716,7 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
 		xcpus = tmp->delmask;
 		if (compute_effective_exclusive_cpumask(cs, xcpus, NULL))
 			WARN_ON_ONCE(!cpumask_empty(cs->exclusive_cpus));
+		new_prs = (cmd == partcmd_enable) ? PRS_ROOT : PRS_ISOLATED;
 
 		/*
 		 * Enabling partition root is not allowed if its
@@ -1748,7 +1749,6 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
 
 		deleting = true;
 		subparts_delta++;
-		new_prs = (cmd == partcmd_enable) ? PRS_ROOT : PRS_ISOLATED;
 	} else if (cmd == partcmd_disable) {
 		/*
 		 * May need to add cpus back to parent's effective_cpus
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:45:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368840; cv=none; b=bX9G4Jj9ROyhaCaxX6z6Qr8rHu8gwf9qeHAtZQjLW5R6+uKY7kwDVXIaHTL1UOgFr7ps1gKjaO2hyY2Uz0oeIJWtNZswtIsR2jWJZXhaqfiNsIpwSc+rhplF2QYapP7ZkxP6hojNKhEtcIw58WkDtOtV5zlZ7aJFEBgXBx3JvR8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368840; c=relaxed/simple;
	bh=m+wnRGZsN87rK7yo9c0I1zc16PLcDtwIehZoHXbACC8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=oMkSKkYGddW8Rj9yErIXFycsz94QKJ/OM3xB57YtFfT1kemUjAQ/7HWV741tODZTo8RqiY/yEF3k81H9Q1zl6pMtLKE0c+HxcMuwYBCtUmZrz+9DZqpzvapNkdL00dbJSvcSSunbM5fN1bknoZTGnmBa3V9x1pN6etNqHs/9jfY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=n5HhqORE; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Randy Dunlap <[email-masked]>,
	Paul Moore <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 037/563] lsm: CONFIG_LSM can depend on CONFIG_SECURITY
Date: Mon, 13 Oct 2025 16:38:18 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Randy Dunlap <[email-masked]>

[ Upstream commit 54d94c422fed9575b74167333c1757847a4e6899 ]

When CONFIG_SECURITY is not set, CONFIG_LSM (builtin_lsm_order) does
not need to be visible and settable since builtin_lsm_order is defined in
security.o, which is only built when CONFIG_SECURITY=y.

So make CONFIG_LSM depend on CONFIG_SECURITY.

Fixes: 13e735c0e953 ("LSM: Introduce CONFIG_LSM")
Signed-off-by: Randy Dunlap <[email-masked]>
[PM: subj tweak]
Signed-off-by: Paul Moore <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 security/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/security/Kconfig b/security/Kconfig
index 4816fc74f81eb..285f284dfcac4 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -269,6 +269,7 @@ endchoice
 
 config LSM
 	string "Ordered list of enabled LSMs"
+	depends on SECURITY
 	default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,ipe,bpf" if DEFAULT_SECURITY_SMACK
 	default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,ipe,bpf" if DEFAULT_SECURITY_APPARMOR
 	default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,ipe,bpf" if DEFAULT_SECURITY_TOMOYO
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:35:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368838; cv=none; b=QBqI2+oAIq4r44r408Z69GRtbIMTA0aDmxwR77EysMW+Ci6s39/fzYy56Xz8WR06D40g/4U8NkToC/BKecXU3llDSYjb3mRP7jNSmzdB8zmZszH/4R2G1Dkz+phKVuinDwanbGtlOF6Bs3sJnE3VYbaM3H9Cugj8qrOGq0Xq6Wk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368838; c=relaxed/simple;
	bh=+H6cHARicJvXyndzq5LyIx+fbQ/WhCuX1XZZqzCTIHo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=WpCXu1GwBQX3CaCJ+xhAzcV8Esr9kCrAQi9xSuLJbeWEWcAwp8ZUoJNVGMFfC/0jv6qzfY+3R1Eom/ZoMbLb3N1GmKufJiCI0IfZrAbTFjiEbH1s/yKc2x9dJKAbugZantA5ttsTz2RoTGjIyZuYzj6Eqe0NE/NQHjmvKFe8D1M=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YCzK8Mqq; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	"Peter Zijlstra (Intel)" <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	K Prateek Nayak <[email-masked]>,
	Valentin Schneider <[email-masked]>,
	Shrikanth Hegde <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 036/563] sched/fair: Get rid of sched_domains_curr_level hack for tl->cpumask()
Date: Mon, 13 Oct 2025 16:38:17 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Zijlstra <[email-masked]>

[ Upstream commit 661f951e371cc134ea31c84238dbdc9a898b8403 ]

Leon [1] and Vinicius [2] noted a topology_span_sane() warning during
their testing starting from v6.16-rc1. Debug that followed pointed to
the tl->mask() for the NODE domain being incorrectly resolved to that of
the highest NUMA domain.

tl->mask() for NODE is set to the sd_numa_mask() which depends on the
global "sched_domains_curr_level" hack. "sched_domains_curr_level" is
set to the "tl->numa_level" during tl traversal in build_sched_domains()
calling sd_init() but was not reset before topology_span_sane().

Since "tl->numa_level" still reflected the old value from
build_sched_domains(), topology_span_sane() for the NODE domain trips
when the span of the last NUMA domain overlaps.

Instead of replicating the "sched_domains_curr_level" hack, get rid of
it entirely and instead, pass the entire "sched_domain_topology_level"
object to tl->cpumask() function to prevent such mishap in the future.

sd_numa_mask() now directly references "tl->numa_level" instead of
relying on the global "sched_domains_curr_level" hack to index into
sched_domains_numa_masks[].

The original warning was reproducible on the following NUMA topology
reported by Leon:

    $ sudo numactl -H
    available: 5 nodes (0-4)
    node 0 cpus: 0 1
    node 0 size: 2927 MB
    node 0 free: 1603 MB
    node 1 cpus: 2 3
    node 1 size: 3023 MB
    node 1 free: 3008 MB
    node 2 cpus: 4 5
    node 2 size: 3023 MB
    node 2 free: 3007 MB
    node 3 cpus: 6 7
    node 3 size: 3023 MB
    node 3 free: 3002 MB
    node 4 cpus: 8 9
    node 4 size: 3022 MB
    node 4 free: 2718 MB
    node distances:
    node   0   1   2   3   4
      0:  10  39  38  37  36
      1:  39  10  38  37  36
      2:  38  38  10  37  36
      3:  37  37  37  10  36
      4:  36  36  36  36  10

The above topology can be mimicked using the following QEMU cmd that was
used to reproduce the warning and test the fix:

     sudo qemu-system-x86_64 -enable-kvm -cpu host \
     -m 20G -smp cpus=10,sockets=10 -machine q35 \
     -object memory-backend-ram,size=4G,id=m0 \
     -object memory-backend-ram,size=4G,id=m1 \
     -object memory-backend-ram,size=4G,id=m2 \
     -object memory-backend-ram,size=4G,id=m3 \
     -object memory-backend-ram,size=4G,id=m4 \
     -numa node,cpus=0-1,memdev=m0,nodeid=0 \
     -numa node,cpus=2-3,memdev=m1,nodeid=1 \
     -numa node,cpus=4-5,memdev=m2,nodeid=2 \
     -numa node,cpus=6-7,memdev=m3,nodeid=3 \
     -numa node,cpus=8-9,memdev=m4,nodeid=4 \
     -numa dist,src=0,dst=1,val=39 \
     -numa dist,src=0,dst=2,val=38 \
     -numa dist,src=0,dst=3,val=37 \
     -numa dist,src=0,dst=4,val=36 \
     -numa dist,src=1,dst=0,val=39 \
     -numa dist,src=1,dst=2,val=38 \
     -numa dist,src=1,dst=3,val=37 \
     -numa dist,src=1,dst=4,val=36 \
     -numa dist,src=2,dst=0,val=38 \
     -numa dist,src=2,dst=1,val=38 \
     -numa dist,src=2,dst=3,val=37 \
     -numa dist,src=2,dst=4,val=36 \
     -numa dist,src=3,dst=0,val=37 \
     -numa dist,src=3,dst=1,val=37 \
     -numa dist,src=3,dst=2,val=37 \
     -numa dist,src=3,dst=4,val=36 \
     -numa dist,src=4,dst=0,val=36 \
     -numa dist,src=4,dst=1,val=36 \
     -numa dist,src=4,dst=2,val=36 \
     -numa dist,src=4,dst=3,val=36 \
     ...

  [ prateek: Moved common functions to include/linux/sched/topology.h,
    reuse the common bits for s390 and ppc, commit message ]

Closes: https://lore.kernel.org/lkml/20250610110701.GA256154@unreal/ [1]
Fixes: ccf74128d66c ("sched/topology: Assert non-NUMA topology masks don't (partially) overlap") # ce29a7da84cd, f55dac1dafb3
Signed-off-by: Peter Zijlstra (Intel) <[email-masked]>
Reported-by: Leon Romanovsky <[email-masked]>
Signed-off-by: K Prateek Nayak <[email-masked]>
Signed-off-by: Peter Zijlstra (Intel) <[email-masked]>
Reviewed-by: Valentin Schneider <[email-masked]>
Reviewed-by: Shrikanth Hegde <[email-masked]>
Tested-by: Valentin Schneider <[email-masked]> # x86
Tested-by: Shrikanth Hegde <[email-masked]> # powerpc
Link: https://lore.kernel.org/lkml/a3[email-masked]/ [2]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/powerpc/Kconfig                |  4 ++++
 arch/powerpc/include/asm/topology.h |  2 ++
 arch/powerpc/kernel/smp.c           | 27 +++++++++++----------------
 arch/s390/kernel/topology.c         | 20 +++++++-------------
 arch/x86/kernel/smpboot.c           |  8 ++++----
 include/linux/sched/topology.h      | 28 +++++++++++++++++++++++++++-
 include/linux/topology.h            |  2 +-
 kernel/sched/topology.c             | 28 ++++++++++------------------
 8 files changed, 66 insertions(+), 53 deletions(-)

diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 93402a1d9c9fc..e51a595a06228 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -971,6 +971,10 @@ config SCHED_SMT
 	  when dealing with POWER5 cpus at a cost of slightly increased
 	  overhead in some places. If unsure say N here.
 
+config SCHED_MC
+	def_bool y
+	depends on SMP
+
 config PPC_DENORMALISATION
 	bool "PowerPC denormalisation exception handling"
 	depends on PPC_BOOK3S_64
diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
index da15b5efe8071..f19ca44512d1e 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -131,6 +131,8 @@ static inline int cpu_to_coregroup_id(int cpu)
 #ifdef CONFIG_SMP
 #include <asm/cputable.h>
 
+struct cpumask *cpu_coregroup_mask(int cpu);
+
 #ifdef CONFIG_PPC64
 #include <asm/smp.h>
 
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index f59e4b9cc2074..68edb66c2964b 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -1028,19 +1028,19 @@ static int powerpc_shared_proc_flags(void)
  * We can't just pass cpu_l2_cache_mask() directly because
  * returns a non-const pointer and the compiler barfs on that.
  */
-static const struct cpumask *shared_cache_mask(int cpu)
+static const struct cpumask *tl_cache_mask(struct sched_domain_topology_level *tl, int cpu)
 {
 	return per_cpu(cpu_l2_cache_map, cpu);
 }
 
 #ifdef CONFIG_SCHED_SMT
-static const struct cpumask *smallcore_smt_mask(int cpu)
+static const struct cpumask *tl_smallcore_smt_mask(struct sched_domain_topology_level *tl, int cpu)
 {
 	return cpu_smallcore_mask(cpu);
 }
 #endif
 
-static struct cpumask *cpu_coregroup_mask(int cpu)
+struct cpumask *cpu_coregroup_mask(int cpu)
 {
 	return per_cpu(cpu_coregroup_map, cpu);
 }
@@ -1054,11 +1054,6 @@ static bool has_coregroup_support(void)
 	return coregroup_enabled;
 }
 
-static const struct cpumask *cpu_mc_mask(int cpu)
-{
-	return cpu_coregroup_mask(cpu);
-}
-
 static int __init init_big_cores(void)
 {
 	int cpu;
@@ -1448,7 +1443,7 @@ static bool update_mask_by_l2(int cpu, cpumask_var_t *mask)
 		return false;
 	}
 
-	cpumask_and(*mask, cpu_online_mask, cpu_cpu_mask(cpu));
+	cpumask_and(*mask, cpu_online_mask, cpu_node_mask(cpu));
 
 	/* Update l2-cache mask with all the CPUs that are part of submask */
 	or_cpumasks_related(cpu, cpu, submask_fn, cpu_l2_cache_mask);
@@ -1538,7 +1533,7 @@ static void update_coregroup_mask(int cpu, cpumask_var_t *mask)
 		return;
 	}
 
-	cpumask_and(*mask, cpu_online_mask, cpu_cpu_mask(cpu));
+	cpumask_and(*mask, cpu_online_mask, cpu_node_mask(cpu));
 
 	/* Update coregroup mask with all the CPUs that are part of submask */
 	or_cpumasks_related(cpu, cpu, submask_fn, cpu_coregroup_mask);
@@ -1601,7 +1596,7 @@ static void add_cpu_to_masks(int cpu)
 
 	/* If chip_id is -1; limit the cpu_core_mask to within PKG */
 	if (chip_id == -1)
-		cpumask_and(mask, mask, cpu_cpu_mask(cpu));
+		cpumask_and(mask, mask, cpu_node_mask(cpu));
 
 	for_each_cpu(i, mask) {
 		if (chip_id == cpu_to_chip_id(i)) {
@@ -1701,22 +1696,22 @@ static void __init build_sched_topology(void)
 	if (has_big_cores) {
 		pr_info("Big cores detected but using small core scheduling\n");
 		powerpc_topology[i++] =
-			SDTL_INIT(smallcore_smt_mask, powerpc_smt_flags, SMT);
+			SDTL_INIT(tl_smallcore_smt_mask, powerpc_smt_flags, SMT);
 	} else {
-		powerpc_topology[i++] = SDTL_INIT(cpu_smt_mask, powerpc_smt_flags, SMT);
+		powerpc_topology[i++] = SDTL_INIT(tl_smt_mask, powerpc_smt_flags, SMT);
 	}
 #endif
 	if (shared_caches) {
 		powerpc_topology[i++] =
-			SDTL_INIT(shared_cache_mask, powerpc_shared_cache_flags, CACHE);
+			SDTL_INIT(tl_cache_mask, powerpc_shared_cache_flags, CACHE);
 	}
 
 	if (has_coregroup_support()) {
 		powerpc_topology[i++] =
-			SDTL_INIT(cpu_mc_mask, powerpc_shared_proc_flags, MC);
+			SDTL_INIT(tl_mc_mask, powerpc_shared_proc_flags, MC);
 	}
 
-	powerpc_topology[i++] = SDTL_INIT(cpu_cpu_mask, powerpc_shared_proc_flags, PKG);
+	powerpc_topology[i++] = SDTL_INIT(tl_pkg_mask, powerpc_shared_proc_flags, PKG);
 
 	/* There must be one trailing NULL entry left.  */
 	BUG_ON(i >= ARRAY_SIZE(powerpc_topology) - 1);
diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
index 46569b8e47dde..1594c80e9bc4d 100644
--- a/arch/s390/kernel/topology.c
+++ b/arch/s390/kernel/topology.c
@@ -509,33 +509,27 @@ int topology_cpu_init(struct cpu *cpu)
 	return rc;
 }
 
-static const struct cpumask *cpu_thread_mask(int cpu)
-{
-	return &cpu_topology[cpu].thread_mask;
-}
-
-
 const struct cpumask *cpu_coregroup_mask(int cpu)
 {
 	return &cpu_topology[cpu].core_mask;
 }
 
-static const struct cpumask *cpu_book_mask(int cpu)
+static const struct cpumask *tl_book_mask(struct sched_domain_topology_level *tl, int cpu)
 {
 	return &cpu_topology[cpu].book_mask;
 }
 
-static const struct cpumask *cpu_drawer_mask(int cpu)
+static const struct cpumask *tl_drawer_mask(struct sched_domain_topology_level *tl, int cpu)
 {
 	return &cpu_topology[cpu].drawer_mask;
 }
 
 static struct sched_domain_topology_level s390_topology[] = {
-	SDTL_INIT(cpu_thread_mask, cpu_smt_flags, SMT),
-	SDTL_INIT(cpu_coregroup_mask, cpu_core_flags, MC),
-	SDTL_INIT(cpu_book_mask, NULL, BOOK),
-	SDTL_INIT(cpu_drawer_mask, NULL, DRAWER),
-	SDTL_INIT(cpu_cpu_mask, NULL, PKG),
+	SDTL_INIT(tl_smt_mask, cpu_smt_flags, SMT),
+	SDTL_INIT(tl_mc_mask, cpu_core_flags, MC),
+	SDTL_INIT(tl_book_mask, NULL, BOOK),
+	SDTL_INIT(tl_drawer_mask, NULL, DRAWER),
+	SDTL_INIT(tl_pkg_mask, NULL, PKG),
 	{ NULL, },
 };
 
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 33e166f6ab122..eb289abece237 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -479,14 +479,14 @@ static int x86_cluster_flags(void)
 static bool x86_has_numa_in_package;
 
 static struct sched_domain_topology_level x86_topology[] = {
-	SDTL_INIT(cpu_smt_mask, cpu_smt_flags, SMT),
+	SDTL_INIT(tl_smt_mask, cpu_smt_flags, SMT),
 #ifdef CONFIG_SCHED_CLUSTER
-	SDTL_INIT(cpu_clustergroup_mask, x86_cluster_flags, CLS),
+	SDTL_INIT(tl_cls_mask, x86_cluster_flags, CLS),
 #endif
 #ifdef CONFIG_SCHED_MC
-	SDTL_INIT(cpu_coregroup_mask, x86_core_flags, MC),
+	SDTL_INIT(tl_mc_mask, x86_core_flags, MC),
 #endif
-	SDTL_INIT(cpu_cpu_mask, x86_sched_itmt_flags, PKG),
+	SDTL_INIT(tl_pkg_mask, x86_sched_itmt_flags, PKG),
 	{ NULL },
 };
 
diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h
index 5263746b63e8c..a3a24e115d446 100644
--- a/include/linux/sched/topology.h
+++ b/include/linux/sched/topology.h
@@ -30,11 +30,19 @@ struct sd_flag_debug {
 };
 extern const struct sd_flag_debug sd_flag_debug[];
 
+struct sched_domain_topology_level;
+
 #ifdef CONFIG_SCHED_SMT
 static inline int cpu_smt_flags(void)
 {
 	return SD_SHARE_CPUCAPACITY | SD_SHARE_LLC;
 }
+
+static inline const
+struct cpumask *tl_smt_mask(struct sched_domain_topology_level *tl, int cpu)
+{
+	return cpu_smt_mask(cpu);
+}
 #endif
 
 #ifdef CONFIG_SCHED_CLUSTER
@@ -42,6 +50,12 @@ static inline int cpu_cluster_flags(void)
 {
 	return SD_CLUSTER | SD_SHARE_LLC;
 }
+
+static inline const
+struct cpumask *tl_cls_mask(struct sched_domain_topology_level *tl, int cpu)
+{
+	return cpu_clustergroup_mask(cpu);
+}
 #endif
 
 #ifdef CONFIG_SCHED_MC
@@ -49,8 +63,20 @@ static inline int cpu_core_flags(void)
 {
 	return SD_SHARE_LLC;
 }
+
+static inline const
+struct cpumask *tl_mc_mask(struct sched_domain_topology_level *tl, int cpu)
+{
+	return cpu_coregroup_mask(cpu);
+}
 #endif
 
+static inline const
+struct cpumask *tl_pkg_mask(struct sched_domain_topology_level *tl, int cpu)
+{
+	return cpu_node_mask(cpu);
+}
+
 #ifdef CONFIG_NUMA
 static inline int cpu_numa_flags(void)
 {
@@ -172,7 +198,7 @@ bool cpus_equal_capacity(int this_cpu, int that_cpu);
 bool cpus_share_cache(int this_cpu, int that_cpu);
 bool cpus_share_resources(int this_cpu, int that_cpu);
 
-typedef const struct cpumask *(*sched_domain_mask_f)(int cpu);
+typedef const struct cpumask *(*sched_domain_mask_f)(struct sched_domain_topology_level *tl, int cpu);
 typedef int (*sched_domain_flags_f)(void);
 
 struct sd_data {
diff --git a/include/linux/topology.h b/include/linux/topology.h
index 33b7fda97d390..6575af39fd10f 100644
--- a/include/linux/topology.h
+++ b/include/linux/topology.h
@@ -260,7 +260,7 @@ static inline bool topology_is_primary_thread(unsigned int cpu)
 
 #endif
 
-static inline const struct cpumask *cpu_cpu_mask(int cpu)
+static inline const struct cpumask *cpu_node_mask(int cpu)
 {
 	return cpumask_of_node(cpu_to_node(cpu));
 }
diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index 6e2f54169e66c..36d4f9f063516 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -1591,7 +1591,6 @@ static void claim_allocations(int cpu, struct sched_domain *sd)
 enum numa_topology_type sched_numa_topology_type;
 
 static int			sched_domains_numa_levels;
-static int			sched_domains_curr_level;
 
 int				sched_max_numa_distance;
 static int			*sched_domains_numa_distance;
@@ -1632,14 +1631,7 @@ sd_init(struct sched_domain_topology_level *tl,
 	int sd_id, sd_weight, sd_flags = 0;
 	struct cpumask *sd_span;
 
-#ifdef CONFIG_NUMA
-	/*
-	 * Ugly hack to pass state to sd_numa_mask()...
-	 */
-	sched_domains_curr_level = tl->numa_level;
-#endif
-
-	sd_weight = cpumask_weight(tl->mask(cpu));
+	sd_weight = cpumask_weight(tl->mask(tl, cpu));
 
 	if (tl->sd_flags)
 		sd_flags = (*tl->sd_flags)();
@@ -1677,7 +1669,7 @@ sd_init(struct sched_domain_topology_level *tl,
 	};
 
 	sd_span = sched_domain_span(sd);
-	cpumask_and(sd_span, cpu_map, tl->mask(cpu));
+	cpumask_and(sd_span, cpu_map, tl->mask(tl, cpu));
 	sd_id = cpumask_first(sd_span);
 
 	sd->flags |= asym_cpu_capacity_classify(sd_span, cpu_map);
@@ -1737,17 +1729,17 @@ sd_init(struct sched_domain_topology_level *tl,
  */
 static struct sched_domain_topology_level default_topology[] = {
 #ifdef CONFIG_SCHED_SMT
-	SDTL_INIT(cpu_smt_mask, cpu_smt_flags, SMT),
+	SDTL_INIT(tl_smt_mask, cpu_smt_flags, SMT),
 #endif
 
 #ifdef CONFIG_SCHED_CLUSTER
-	SDTL_INIT(cpu_clustergroup_mask, cpu_cluster_flags, CLS),
+	SDTL_INIT(tl_cls_mask, cpu_cluster_flags, CLS),
 #endif
 
 #ifdef CONFIG_SCHED_MC
-	SDTL_INIT(cpu_coregroup_mask, cpu_core_flags, MC),
+	SDTL_INIT(tl_mc_mask, cpu_core_flags, MC),
 #endif
-	SDTL_INIT(cpu_cpu_mask, NULL, PKG),
+	SDTL_INIT(tl_pkg_mask, NULL, PKG),
 	{ NULL, },
 };
 
@@ -1769,9 +1761,9 @@ void __init set_sched_topology(struct sched_domain_topology_level *tl)
 
 #ifdef CONFIG_NUMA
 
-static const struct cpumask *sd_numa_mask(int cpu)
+static const struct cpumask *sd_numa_mask(struct sched_domain_topology_level *tl, int cpu)
 {
-	return sched_domains_numa_masks[sched_domains_curr_level][cpu_to_node(cpu)];
+	return sched_domains_numa_masks[tl->numa_level][cpu_to_node(cpu)];
 }
 
 static void sched_numa_warn(const char *str)
@@ -2413,7 +2405,7 @@ static bool topology_span_sane(const struct cpumask *cpu_map)
 		 * breaks the linking done for an earlier span.
 		 */
 		for_each_cpu(cpu, cpu_map) {
-			const struct cpumask *tl_cpu_mask = tl->mask(cpu);
+			const struct cpumask *tl_cpu_mask = tl->mask(tl, cpu);
 			int id;
 
 			/* lowest bit set in this mask is used as a unique id */
@@ -2421,7 +2413,7 @@ static bool topology_span_sane(const struct cpumask *cpu_map)
 
 			if (cpumask_test_cpu(id, id_seen)) {
 				/* First CPU has already been seen, ensure identical spans */
-				if (!cpumask_equal(tl->mask(id), tl_cpu_mask))
+				if (!cpumask_equal(tl->mask(tl, id), tl_cpu_mask))
 					return false;
 			} else {
 				/* First CPU hasn't been seen before, ensure it's a completely new span */
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:35:47 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368829; cv=none; b=SDTEDZced8d5+ahYIPZoZpet1OM1d0GFGUDKWCL+0h6qh5oICg1PoiUKOLXYGdoE3xF9QFKYhrorL4TKAbT+72WOSurJSmBNgeXtkGZvJkaci1230UaPTvL6EEpuEG+Lln5yPrNgqwfCCJQCk3mVpLHubXERLutpaqaTn+fl67I=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368829; c=relaxed/simple;
	bh=U5Sa7W3wntIUXwBEIvxwAI9pVrePJioZoT4ci+wcrFs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=dHwZlVLs6LdVb4POSadtKiJOEgjv+F00VYK8WRnyv7Rpun7wkqsfAurRhgnUS45f55WtujVpw2vEUUb+Fuw3lzViQ5991txR+EAqeRAhf7Xo0zzydpqexJgMNbrB0K5TdPv2iq/8SuCpilvk8gvMQ2dBy2giqgqjlJOydAXXOe8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=y3lC8d1n; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Uros Bizjak <[email-masked]>,
	"Borislav Petkov (AMD)" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 034/563] x86/vdso: Fix output operand size of RDPID
Date: Mon, 13 Oct 2025 16:38:15 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Uros Bizjak <[email-masked]>

[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]

RDPID instruction outputs to a word-sized register (64-bit on x86_64 and
32-bit on x86_32). Use an unsigned long variable to store the correct size.

LSL outputs to 32-bit register, use %k operand prefix to always print the
32-bit name of the register.

Use RDPID insn mnemonic while at it as the minimum binutils version of
2.30 supports it.

  [ bp: Merge two patches touching the same function into a single one. ]

Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number")
Signed-off-by: Uros Bizjak <[email-masked]>
Signed-off-by: Borislav Petkov (AMD) <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/x86/include/asm/segment.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
index 77d8f49b92bdd..f59ae7186940a 100644
--- a/arch/x86/include/asm/segment.h
+++ b/arch/x86/include/asm/segment.h
@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)
 
 static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
 {
-	unsigned int p;
+	unsigned long p;
 
 	/*
 	 * Load CPU and node number from the GDT.  LSL is faster than RDTSCP
@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
 	 *
 	 * If RDPID is available, use it.
 	 */
-	alternative_io ("lsl %[seg],%[p]",
-			".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */
+	alternative_io ("lsl %[seg],%k[p]",
+			"rdpid %[p]",
 			X86_FEATURE_RDPID,
-			[p] "=a" (p), [seg] "r" (__CPUNODE_SEG));
+			[p] "=r" (p), [seg] "r" (__CPUNODE_SEG));
 
 	if (cpu)
 		*cpu = (p & VDSO_CPUNODE_MASK);
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:35:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368826; cv=none; b=h8kLECMt77yvVy2h43TVqZbbvSp5kvlnUdm+zs9MVLxAlizcjNYeNI34Y3lIwYY9r02lVHTFWivNTrK8XwmROYuExVX1bQCFmTK50dD6Uw1MJhlLYKmF/Im382INZF+osn3xwOc61cpJnSYs+CAdDKCIGJBBVAvQPJeuKcxqgbU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368826; c=relaxed/simple;
	bh=NbmYe5dihMq1aZnnpexAVIbIXPxe4erTlThoiGKhfv8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=N8Uzr5x0l4JQCurOJjEC8G5SBSovxZDvZrOSytbDCZq2Gag3N1QkKhtXFyWu5OempgmPdOam6Wwp9H/pguDMkeWwMvYGaWRa+EqD2swuLzjxGtzvaFqiBEufktIEANDfAabgTTbyyy9bcIX1LhFNPel8upneSWF6z/c6BSjwbDw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gDJK5PJN; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dapeng Mi <[email-masked]>,
	"Peter Zijlstra (Intel)" <[email-masked]>,
	Kan Liang <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 033/563] perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error
Date: Mon, 13 Oct 2025 16:38:14 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dapeng Mi <[email-masked]>

[ Upstream commit 43796f30507802d93ead2dc44fc9637f34671a89 ]

When running perf_fuzzer on PTL, sometimes the below "unchecked MSR
 access error" is seen when accessing IA32_PMC_x_CFG_B MSRs.

[   55.611268] unchecked MSR access error: WRMSR to 0x1986 (tried to write 0x0000000200000001) at rIP: 0xffffffffac564b28 (native_write_msr+0x8/0x30)
[   55.611280] Call Trace:
[   55.611282]  <TASK>
[   55.611284]  ? intel_pmu_config_acr+0x87/0x160
[   55.611289]  intel_pmu_enable_acr+0x6d/0x80
[   55.611291]  intel_pmu_enable_event+0xce/0x460
[   55.611293]  x86_pmu_start+0x78/0xb0
[   55.611297]  x86_pmu_enable+0x218/0x3a0
[   55.611300]  ? x86_pmu_enable+0x121/0x3a0
[   55.611302]  perf_pmu_enable+0x40/0x50
[   55.611307]  ctx_resched+0x19d/0x220
[   55.611309]  __perf_install_in_context+0x284/0x2f0
[   55.611311]  ? __pfx_remote_function+0x10/0x10
[   55.611314]  remote_function+0x52/0x70
[   55.611317]  ? __pfx_remote_function+0x10/0x10
[   55.611319]  generic_exec_single+0x84/0x150
[   55.611323]  smp_call_function_single+0xc5/0x1a0
[   55.611326]  ? __pfx_remote_function+0x10/0x10
[   55.611329]  perf_install_in_context+0xd1/0x1e0
[   55.611331]  ? __pfx___perf_install_in_context+0x10/0x10
[   55.611333]  __do_sys_perf_event_open+0xa76/0x1040
[   55.611336]  __x64_sys_perf_event_open+0x26/0x30
[   55.611337]  x64_sys_call+0x1d8e/0x20c0
[   55.611339]  do_syscall_64+0x4f/0x120
[   55.611343]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

On PTL, GP counter 0 and 1 doesn't support auto counter reload feature,
thus it would trigger a #GP when trying to write 1 on bit 0 of CFG_B MSR
which requires to enable auto counter reload on GP counter 0.

The root cause of causing this issue is the check for auto counter
reload (ACR) counter mask from user space is incorrect in
intel_pmu_acr_late_setup() helper. It leads to an invalid ACR counter
mask from user space could be set into hw.config1 and then written into
CFG_B MSRs and trigger the MSR access warning.

e.g., User may create a perf event with ACR counter mask (config2=0xcb),
and there is only 1 event created, so "cpuc->n_events" is 1.

The correct check condition should be "i + idx >= cpuc->n_events"
instead of "i + idx > cpuc->n_events" (it looks a typo). Otherwise,
the counter mask would traverse twice and an invalid "cpuc->assign[1]"
bit (bit 0) is set into hw.config1 and cause MSR accessing error.

Besides, also check if the ACR counter mask corresponding events are
ACR events. If not, filter out these counter mask. If a event is not a
ACR event, it could be scheduled to an HW counter which doesn't support
ACR. It's invalid to add their counter index in ACR counter mask.

Furthermore, remove the WARN_ON_ONCE() since it's easily triggered as
user could set any invalid ACR counter mask and the warning message
could mislead users.

Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload")
Signed-off-by: Dapeng Mi <[email-masked]>
Signed-off-by: Peter Zijlstra (Intel) <[email-masked]>
Reviewed-by: Kan Liang <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/x86/events/intel/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index c2fb729c270ec..15da60cf69f20 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -2997,7 +2997,8 @@ static void intel_pmu_acr_late_setup(struct cpu_hw_events *cpuc)
 			if (event->group_leader != leader->group_leader)
 				break;
 			for_each_set_bit(idx, (unsigned long *)&event->attr.config2, X86_PMC_IDX_MAX) {
-				if (WARN_ON_ONCE(i + idx > cpuc->n_events))
+				if (i + idx >= cpuc->n_events ||
+				    !is_acr_event_group(cpuc->event_list[i + idx]))
 					return;
 				__set_bit(cpuc->assign[i + idx], (unsigned long *)&event->hw.config1);
 			}
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:35:33 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368823; cv=none; b=rx6oeSK58ETPcU01oLlLbJZ58QRwZhWFrX7lifZYkjaHwgOQshCl/d46f4HMvABLxperRZ3R1LmuGdU3RgXq3YiMsP4tbZy3Zd0skqkXsnzyPEQJeqJjOoXj6UjP/D+pZunS/pxeIZ6uLewWiuS4yvDW2Ch033p6LEfjzzoKGkQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368823; c=relaxed/simple;
	bh=dr/lMuXVn4mBwHaOQnRSege9anHnTsicA2QP0gZAfY4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=EJGI41GXqPe82VnQNFSS/HR6hbKg6+MB8jHaRImXlw85ve0yIqTMNsoh6hxEWQtzn5bBDu/uchu+M6yb+pKpUO4av1Y3dnbnXn/COh2tIkr18ZvEowF0BmeFbSqj3WgvDKg280FhiM86U1vv6JwdKutW5kyXxNtWVXIxesC0tYs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=CtdKlqos; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dapeng Mi <[email-masked]>,
	"Peter Zijlstra (Intel)" <[email-masked]>,
	Kan Liang <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 032/563] perf/x86/intel: Use early_initcall() to hook bts_init()
Date: Mon, 13 Oct 2025 16:38:13 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dapeng Mi <[email-masked]>

[ Upstream commit d9cf9c6884d21e01483c4e17479d27636ea4bb50 ]

After the commit 'd971342d38bf ("perf/x86/intel: Decouple BTS
 initialization from PEBS initialization")' is introduced, x86_pmu.bts
would initialized in bts_init() which is hooked by arch_initcall().

Whereas init_hw_perf_events() is hooked by early_initcall(). Once the
core PMU is initialized, nmi watchdog initialization is called
immediately before bts_init() is called. It leads to the BTS buffer is
not really initialized since bts_init() is not called and x86_pmu.bts is
still false at that time. Worse, BTS buffer would never be initialized
then unless all core PMU events are freed and reserve_ds_buffers()
is called again.

Thus aligning with init_hw_perf_events(), use early_initcall() to hook
bts_init() to ensure x86_pmu.bts is initialized before nmi watchdog
initialization.

Fixes: d971342d38bf ("perf/x86/intel: Decouple BTS initialization from PEBS initialization")
Signed-off-by: Dapeng Mi <[email-masked]>
Signed-off-by: Peter Zijlstra (Intel) <[email-masked]>
Reviewed-by: Kan Liang <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/x86/events/intel/bts.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
index 61da6b8a3d519..cbac54cb3a9ec 100644
--- a/arch/x86/events/intel/bts.c
+++ b/arch/x86/events/intel/bts.c
@@ -643,4 +643,4 @@ static __init int bts_init(void)
 
 	return perf_pmu_register(&bts_pmu, "intel_bts", -1);
 }
-arch_initcall(bts_init);
+early_initcall(bts_init);
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:35:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368820; cv=none; b=gvgDfFjelJ1vw87KXchxPE2gw1bF8J/zMMIaWyHHyfu3nie0hW/iedzAjFsmK9Z2IYGfmbj24l/VXbflXHMBGUUHz7ADFdFcQC2aTbtVfkD2JZnngNLAYfLf2ZK03ryT7pQWYge3COr+ekFADbv/JwZPtN/GugzpgcR1GEmB9Lc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368820; c=relaxed/simple;
	bh=cCKL/GpQBM/yzaZZiRKviiESUFDZ8AGR6HX6jAJx7HE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DMZv0Oyu5pVm3oKNR9lAsVljef9kbNipAVD3eWvszK41g4OCgHDhHg9oqigsVQyWLW7J2b4B0SeWtwCUnSZiBwjwfCbCtl+9i6SmaWxlmw+/FyEJlb6g5zWwMJiTXfYwgDWdchhXKjVFdzyPBJzXYG2000dwfj891w0+E0WP2H8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=L+Gdag3x; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jose Jesus Ambriz Meza <[email-masked]>,
	"Chia-Lin Kao (AceLan)" <[email-masked]>,
	Qiuxu Zhuo <[email-masked]>,
	Tony Luck <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 031/563] EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
Date: Mon, 13 Oct 2025 16:38:12 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qiuxu Zhuo <[email-masked]>

[ Upstream commit 2e6fe1bbefd9c059c3787d1c620fe67343a94dff ]

When loading the i10nm_edac driver on some Intel Granite Rapids servers,
a call trace may appear as follows:

  UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16
  shift exponent -66 is negative
  ...
  __ubsan_handle_shift_out_of_bounds+0x1e3/0x390
  skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common]
  i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac]
  skx_register_mci+0x159/0x220 [skx_edac_common]
  i10nm_init+0xcb0/0x1ff0 [i10nm_edac]
  ...

This occurs because some BIOS may disable a memory controller if there
aren't any memory DIMMs populated on this memory controller. The DIMMMTR
register of this disabled memory controller contains the invalid value
~0, resulting in the call trace above.

Fix this call trace by skipping DIMM enumeration on a disabled memory
controller.

Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support")
Reported-by: Jose Jesus Ambriz Meza <[email-masked]>
Reported-by: Chia-Lin Kao (AceLan) <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]/
Signed-off-by: Qiuxu Zhuo <[email-masked]>
Signed-off-by: Tony Luck <[email-masked]>
Tested-by: Chia-Lin Kao (AceLan) <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/edac/i10nm_base.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
index bf4171ac191d3..9d00f247f4e0e 100644
--- a/drivers/edac/i10nm_base.c
+++ b/drivers/edac/i10nm_base.c
@@ -1057,6 +1057,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan)
 	return !!GET_BITFIELD(mcmtr, 2, 2);
 }
 
+static bool i10nm_channel_disabled(struct skx_imc *imc, int chan)
+{
+	u32 mcmtr = I10NM_GET_MCMTR(imc, chan);
+
+	edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr);
+
+	return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18));
+}
+
 static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
 				 struct res_config *cfg)
 {
@@ -1070,6 +1079,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
 		if (!imc->mbase)
 			continue;
 
+		if (i10nm_channel_disabled(imc, i)) {
+			edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i);
+			continue;
+		}
+
 		ndimms = 0;
 
 		if (res_cfg->type != GNR)
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:33:25 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368817; cv=none; b=l9LneuE6W7C/kV7Wc9vYtfJajT15MwPVQfWc3z0SZjScSV+Ao6j7zxWtNscLtvkG7pBnzLIKaTFt801zGLtHOmyUtCghfh3dsprgToxneM9UYvaSHMY518WR7KG1UqV6MaIlxNR0pg+4cOXiKvXUw/5PE8d6ZdHklO8AVCIq0Lc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368817; c=relaxed/simple;
	bh=5D7wV/7h+x8oEfOvP7j4kvDbVdexIozBgutQXx/iaCA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=rsd0CIUPKv2q9jgiSbMQ+Gtl0OGXxCNHVK9gwdUaKiIQZpPR0vEe/LSDA/WPymQJJQctN32IlUT76hkb0wd6VLXVfgjEepmI41RUSL9XfmacRIz2sONnvQc5V5lrNrEHfEEqIjG1m0c9oytvaoYxzs+LGIZmjUa4o3e9Rm0PVdM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=sUPIT+7d; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9156C116B1;
	Mon, 13 Oct 2025 15:20:16 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760368817;
	bh=5D7wV/7h+x8oEfOvP7j4kvDbVdexIozBgutQXx/iaCA=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=sUPIT+7d9VTuszgx34Z0a4Oqa+jcwtTCUdnHitGo/Jd/LCKwoPhsVx50D+cJXjfz6
	 R594FWqhUUb+x/ado0lAVWHERekjN/ghol7oKa2YzxI2PrqxlBbq2zWOpkg9l9sf2s
	 wSgxud2lZbXP8hgmD6q4v73pif/vNrydn9kU8RUI=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Namjae Jeon <[email-masked]>,
	Steve French <[email-masked]>,
	Tom Talpey <[email-masked]>,
	[email-masked],
	[email-masked],
	[email-masked],
	Stefan Metzmacher <[email-masked]>,
	Steve French <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 030/563] smb: server: fix IRD/ORD negotiation with the client
Date: Mon, 13 Oct 2025 16:38:11 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Metzmacher <[email-masked]>

[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ]

Already do real negotiation in smb_direct_handle_connect_request()
where we see the requested initiator_depth and responder_resources
from the client.

We should detect legacy iwarp clients using MPA v1
with the custom IRD/ORD negotiation.

We need to send the custom IRD/ORD in big endian,
but we need to try to let clients with broken requests
using little endian (older cifs.ko) to work.

Note the reason why this uses u8 for
initiator_depth and responder_resources is
that the rdma layer also uses it.

Acked-by: Namjae Jeon <[email-masked]>
Cc: Steve French <[email-masked]>
Cc: Tom Talpey <[email-masked]>
Cc: [email-masked]
Cc: [email-masked]
Cc: [email-masked]
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Signed-off-by: Stefan Metzmacher <[email-masked]>
Signed-off-by: Steve French <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++-----
 1 file changed, 85 insertions(+), 14 deletions(-)

diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index 74dfb6496095d..e1f659d3b4cf5 100644
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -153,6 +153,10 @@ struct smb_direct_transport {
 	struct work_struct	disconnect_work;
 
 	bool			negotiation_requested;
+
+	bool			legacy_iwarp;
+	u8			initiator_depth;
+	u8			responder_resources;
 };
 
 #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))
@@ -347,6 +351,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
 	t->cm_id = cm_id;
 	cm_id->context = t;
 
+	t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH;
+	t->responder_resources = 1;
+
 	t->status = SMB_DIRECT_CS_NEW;
 	init_waitqueue_head(&t->wait_status);
 
@@ -1676,21 +1683,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t,
 static int smb_direct_accept_client(struct smb_direct_transport *t)
 {
 	struct rdma_conn_param conn_param;
-	struct ib_port_immutable port_immutable;
-	u32 ird_ord_hdr[2];
+	__be32 ird_ord_hdr[2];
 	int ret;
 
+	/*
+	 * smb_direct_handle_connect_request()
+	 * already negotiated t->initiator_depth
+	 * and t->responder_resources
+	 */
 	memset(&conn_param, 0, sizeof(conn_param));
-	conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom,
-					   SMB_DIRECT_CM_INITIATOR_DEPTH);
-	conn_param.responder_resources = 0;
-
-	t->cm_id->device->ops.get_port_immutable(t->cm_id->device,
-						 t->cm_id->port_num,
-						 &port_immutable);
-	if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) {
-		ird_ord_hdr[0] = conn_param.responder_resources;
-		ird_ord_hdr[1] = 1;
+	conn_param.initiator_depth = t->initiator_depth;
+	conn_param.responder_resources = t->responder_resources;
+
+	if (t->legacy_iwarp) {
+		ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources);
+		ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth);
 		conn_param.private_data = ird_ord_hdr;
 		conn_param.private_data_len = sizeof(ird_ord_hdr);
 	} else {
@@ -2081,10 +2088,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs)
 	return true;
 }
 
-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
+static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id,
+					     struct rdma_cm_event *event)
 {
 	struct smb_direct_transport *t;
 	struct task_struct *handler;
+	u8 peer_initiator_depth;
+	u8 peer_responder_resources;
 	int ret;
 
 	if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) {
@@ -2098,6 +2108,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
 	if (!t)
 		return -ENOMEM;
 
+	peer_initiator_depth = event->param.conn.initiator_depth;
+	peer_responder_resources = event->param.conn.responder_resources;
+	if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) &&
+	    event->param.conn.private_data_len == 8) {
+		/*
+		 * Legacy clients with only iWarp MPA v1 support
+		 * need a private blob in order to negotiate
+		 * the IRD/ORD values.
+		 */
+		const __be32 *ird_ord_hdr = event->param.conn.private_data;
+		u32 ird32 = be32_to_cpu(ird_ord_hdr[0]);
+		u32 ord32 = be32_to_cpu(ird_ord_hdr[1]);
+
+		/*
+		 * cifs.ko sends the legacy IRD/ORD negotiation
+		 * event if iWarp MPA v2 was used.
+		 *
+		 * Here we check that the values match and only
+		 * mark the client as legacy if they don't match.
+		 */
+		if ((u32)event->param.conn.initiator_depth != ird32 ||
+		    (u32)event->param.conn.responder_resources != ord32) {
+			/*
+			 * There are broken clients (old cifs.ko)
+			 * using little endian and also
+			 * struct rdma_conn_param only uses u8
+			 * for initiator_depth and responder_resources,
+			 * so we truncate the value to U8_MAX.
+			 *
+			 * smb_direct_accept_client() will then
+			 * do the real negotiation in order to
+			 * select the minimum between client and
+			 * server.
+			 */
+			ird32 = min_t(u32, ird32, U8_MAX);
+			ord32 = min_t(u32, ord32, U8_MAX);
+
+			t->legacy_iwarp = true;
+			peer_initiator_depth = (u8)ird32;
+			peer_responder_resources = (u8)ord32;
+		}
+	}
+
+	/*
+	 * First set what the we as server are able to support
+	 */
+	t->initiator_depth = min_t(u8, t->initiator_depth,
+				   new_cm_id->device->attrs.max_qp_rd_atom);
+
+	/*
+	 * negotiate the value by using the minimum
+	 * between client and server if the client provided
+	 * non 0 values.
+	 */
+	if (peer_initiator_depth != 0)
+		t->initiator_depth = min_t(u8, t->initiator_depth,
+					   peer_initiator_depth);
+	if (peer_responder_resources != 0)
+		t->responder_resources = min_t(u8, t->responder_resources,
+					       peer_responder_resources);
+
 	ret = smb_direct_connect(t);
 	if (ret)
 		goto out_err;
@@ -2122,7 +2193,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id,
 {
 	switch (event->event) {
 	case RDMA_CM_EVENT_CONNECT_REQUEST: {
-		int ret = smb_direct_handle_connect_request(cm_id);
+		int ret = smb_direct_handle_connect_request(cm_id, event);
 
 		if (ret) {
 			pr_err("Can't create transport: %d\n", ret);
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:35:23 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368814; cv=none; b=AL6E9A16urHxMuacGiVW7vHlWtkTdfbvf6kdKn1oevPsABqmPGfh+zkgqlXgTl9X8VQOs1/D0qUc2iciojyBHiE2KIrH8cPD6YvR57iAa3l2naEqAPm3zT+RUlrrtEFvJu82Qe/7ycsXHsd6cF5dbs4gbRV4MvBd39bvI56xzQ8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368814; c=relaxed/simple;
	bh=1vrKaH44AweLcBL+9pBJtfcnS9Da5XIaJJpsMFwt0j8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=rfUuzhMJtrmp7Nyr+wm5cTHTjUx39Hvp3uEwojjra3PpWEVRdi5ydIynMMv8RUYI7ffjiMQDsJoCCB3E2CR1DZ6L6Je/coJMDVQd49hh7ViZaSja2n5pJ744gn/SOV+8F9KAq7aRQbX3Lpth0cxqJc9i2GGLZcMYvZ3AW3T05lU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zSOtl9cs; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id B8EDBC4CEFE;
	Mon, 13 Oct 2025 15:20:13 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760368814;
	bh=1vrKaH44AweLcBL+9pBJtfcnS9Da5XIaJJpsMFwt0j8=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=zSOtl9csinpwQQlkkZuLhU8HwgLnXMQcbSrXPrdQHJtWuA5KvNIusukFtIDN6pAxX
	 hZ4OQEcICBwDfAHWZwDRh6sOzdryzTsKx6fOx2T7eg/rtDKbDm4Ozr/bAmto6jJDmm
	 QJveyniplU6qYsazdyf6neKhlomfvlMVNjkC7+LI=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Steve French <[email-masked]>,
	Tom Talpey <[email-masked]>,
	Long Li <[email-masked]>,
	Namjae Jeon <[email-masked]>,
	[email-masked],
	[email-masked],
	[email-masked],
	Stefan Metzmacher <[email-masked]>,
	Steve French <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 029/563] smb: client: fix sending the iwrap custom IRD/ORD negotiation messages
Date: Mon, 13 Oct 2025 16:38:10 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Metzmacher <[email-masked]>

[ Upstream commit ef71f1e046489c77a2f7d012edc762fba0a7aadc ]

Do a real negotiation and check the servers initiator_depth and
responder_resources.

This should use big endian in order to be useful.
I have captures of windows clients showing this.

The fact that we used little endian up to now
means that we sent very large numbers and the
negotiation with the server truncated them to the
server limits.

Note the reason why this uses u8 for
initiator_depth and responder_resources is
that the rdma layer also uses it.

The inconsitency regarding the initiator_depth
and responder_resources values being reversed
for iwarp devices in RDMA_CM_EVENT_ESTABLISHED
should also be fixed later, but for now we should
fix it.

Cc: Steve French <[email-masked]>
Cc: Tom Talpey <[email-masked]>
Cc: Long Li <[email-masked]>
Acked-by: Namjae Jeon <[email-masked]>
Cc: [email-masked]
Cc: [email-masked]
Cc: [email-masked]
Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration")
Signed-off-by: Stefan Metzmacher <[email-masked]>
Signed-off-by: Steve French <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/smb/client/smbdirect.c | 110 ++++++++++++++++++++++++++++++++++----
 fs/smb/client/smbdirect.h |   4 +-
 2 files changed, 103 insertions(+), 11 deletions(-)

diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
index e0fce5033004c..6480945c24592 100644
--- a/fs/smb/client/smbdirect.c
+++ b/fs/smb/client/smbdirect.c
@@ -179,6 +179,8 @@ static int smbd_conn_upcall(
 	struct smbd_connection *info = id->context;
 	struct smbdirect_socket *sc = &info->socket;
 	const char *event_name = rdma_event_msg(event->event);
+	u8 peer_initiator_depth;
+	u8 peer_responder_resources;
 
 	log_rdma_event(INFO, "event=%s status=%d\n",
 		event_name, event->status);
@@ -204,6 +206,85 @@ static int smbd_conn_upcall(
 
 	case RDMA_CM_EVENT_ESTABLISHED:
 		log_rdma_event(INFO, "connected event=%s\n", event_name);
+
+		/*
+		 * Here we work around an inconsistency between
+		 * iWarp and other devices (at least rxe and irdma using RoCEv2)
+		 */
+		if (rdma_protocol_iwarp(id->device, id->port_num)) {
+			/*
+			 * iWarp devices report the peer's values
+			 * with the perspective of the peer here.
+			 * Tested with siw and irdma (in iwarp mode)
+			 * We need to change to our perspective here,
+			 * so we need to switch the values.
+			 */
+			peer_initiator_depth = event->param.conn.responder_resources;
+			peer_responder_resources = event->param.conn.initiator_depth;
+		} else {
+			/*
+			 * Non iWarp devices report the peer's values
+			 * already changed to our perspective here.
+			 * Tested with rxe and irdma (in roce mode).
+			 */
+			peer_initiator_depth = event->param.conn.initiator_depth;
+			peer_responder_resources = event->param.conn.responder_resources;
+		}
+		if (rdma_protocol_iwarp(id->device, id->port_num) &&
+		    event->param.conn.private_data_len == 8) {
+			/*
+			 * Legacy clients with only iWarp MPA v1 support
+			 * need a private blob in order to negotiate
+			 * the IRD/ORD values.
+			 */
+			const __be32 *ird_ord_hdr = event->param.conn.private_data;
+			u32 ird32 = be32_to_cpu(ird_ord_hdr[0]);
+			u32 ord32 = be32_to_cpu(ird_ord_hdr[1]);
+
+			/*
+			 * cifs.ko sends the legacy IRD/ORD negotiation
+			 * event if iWarp MPA v2 was used.
+			 *
+			 * Here we check that the values match and only
+			 * mark the client as legacy if they don't match.
+			 */
+			if ((u32)event->param.conn.initiator_depth != ird32 ||
+			    (u32)event->param.conn.responder_resources != ord32) {
+				/*
+				 * There are broken clients (old cifs.ko)
+				 * using little endian and also
+				 * struct rdma_conn_param only uses u8
+				 * for initiator_depth and responder_resources,
+				 * so we truncate the value to U8_MAX.
+				 *
+				 * smb_direct_accept_client() will then
+				 * do the real negotiation in order to
+				 * select the minimum between client and
+				 * server.
+				 */
+				ird32 = min_t(u32, ird32, U8_MAX);
+				ord32 = min_t(u32, ord32, U8_MAX);
+
+				info->legacy_iwarp = true;
+				peer_initiator_depth = (u8)ird32;
+				peer_responder_resources = (u8)ord32;
+			}
+		}
+
+		/*
+		 * negotiate the value by using the minimum
+		 * between client and server if the client provided
+		 * non 0 values.
+		 */
+		if (peer_initiator_depth != 0)
+			info->initiator_depth =
+					min_t(u8, info->initiator_depth,
+					      peer_initiator_depth);
+		if (peer_responder_resources != 0)
+			info->responder_resources =
+					min_t(u8, info->responder_resources,
+					      peer_responder_resources);
+
 		sc->status = SMBDIRECT_SOCKET_CONNECTED;
 		wake_up_interruptible(&info->status_wait);
 		break;
@@ -1551,7 +1632,7 @@ static struct smbd_connection *_smbd_get_connection(
 	struct ib_qp_init_attr qp_attr;
 	struct sockaddr_in *addr_in = (struct sockaddr_in *) dstaddr;
 	struct ib_port_immutable port_immutable;
-	u32 ird_ord_hdr[2];
+	__be32 ird_ord_hdr[2];
 
 	info = kzalloc(sizeof(struct smbd_connection), GFP_KERNEL);
 	if (!info)
@@ -1559,6 +1640,9 @@ static struct smbd_connection *_smbd_get_connection(
 	sc = &info->socket;
 	sp = &sc->parameters;
 
+	info->initiator_depth = 1;
+	info->responder_resources = SMBD_CM_RESPONDER_RESOURCES;
+
 	sc->status = SMBDIRECT_SOCKET_CONNECTING;
 	rc = smbd_ia_open(info, dstaddr, port);
 	if (rc) {
@@ -1639,22 +1723,22 @@ static struct smbd_connection *_smbd_get_connection(
 	}
 	sc->ib.qp = sc->rdma.cm_id->qp;
 
-	memset(&conn_param, 0, sizeof(conn_param));
-	conn_param.initiator_depth = 0;
-
-	conn_param.responder_resources =
-		min(sc->ib.dev->attrs.max_qp_rd_atom,
-		    SMBD_CM_RESPONDER_RESOURCES);
-	info->responder_resources = conn_param.responder_resources;
+	info->responder_resources =
+		min_t(u8, info->responder_resources,
+		      sc->ib.dev->attrs.max_qp_rd_atom);
 	log_rdma_mr(INFO, "responder_resources=%d\n",
 		info->responder_resources);
 
+	memset(&conn_param, 0, sizeof(conn_param));
+	conn_param.initiator_depth = info->initiator_depth;
+	conn_param.responder_resources = info->responder_resources;
+
 	/* Need to send IRD/ORD in private data for iWARP */
 	sc->ib.dev->ops.get_port_immutable(
 		sc->ib.dev, sc->rdma.cm_id->port_num, &port_immutable);
 	if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) {
-		ird_ord_hdr[0] = info->responder_resources;
-		ird_ord_hdr[1] = 1;
+		ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources);
+		ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth);
 		conn_param.private_data = ird_ord_hdr;
 		conn_param.private_data_len = sizeof(ird_ord_hdr);
 	} else {
@@ -2121,6 +2205,12 @@ static int allocate_mr_list(struct smbd_connection *info)
 	atomic_set(&info->mr_used_count, 0);
 	init_waitqueue_head(&info->wait_for_mr_cleanup);
 	INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work);
+
+	if (info->responder_resources == 0) {
+		log_rdma_mr(ERR, "responder_resources negotiated as 0\n");
+		return -EINVAL;
+	}
+
 	/* Allocate more MRs (2x) than hardware responder_resources */
 	for (i = 0; i < info->responder_resources * 2; i++) {
 		smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL);
diff --git a/fs/smb/client/smbdirect.h b/fs/smb/client/smbdirect.h
index e45aa9ddd71da..4ca9b2b2c57f9 100644
--- a/fs/smb/client/smbdirect.h
+++ b/fs/smb/client/smbdirect.h
@@ -67,7 +67,9 @@ struct smbd_connection {
 
 	/* Memory registrations */
 	/* Maximum number of RDMA read/write outstanding on this connection */
-	int responder_resources;
+	bool legacy_iwarp;
+	u8 initiator_depth;
+	u8 responder_resources;
 	/* Maximum number of pages in a single RDMA write/read on this connection */
 	int max_frmr_depth;
 	/*
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:33:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368811; cv=none; b=Uj2gsspii1saRJc2LM41DAyCL8jzpK4Z/pJDE+Wlt9lrDsds1s7au0BzOkjEdtqSUxo0Qyo1ORqCzXNyuJnZwNQnvv6QFdDa9wdcsnk3sh1uCctNzy61Te4cdnypaczg8rCPrzyf9qTbbrgEDmgH98YckFlhvwigqe/W0FX66+w=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368811; c=relaxed/simple;
	bh=QJWwb4Ea9qc8xgBrNMqeH4qS3gk14DKiJfL+HnRsVJQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=kTrt1nNSBbV7IGB8tV8fVzcvH16yFRprXpioTirK3cr7Hij8ZnfZUfNmus7pWJnJSCl+3tz/Xy7nem9oLV4fmsZ2ciRagbeUq4qGfafFaIjX6ddMz3BdiJdgTm3HRz6SD3WKgkWcY0I0PHBLhgXa1dHjpd991qrGH80y/FvW3Rk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Rnamcnx/; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Hongbo Li <[email-masked]>,
	Chao Yu <[email-masked]>,
	Gao Xiang <[email-masked]>,
	Sasha Levin <[email-masked]>,
	[email-masked]
Subject: [PATCH 6.17 028/563] erofs: avoid reading more for fragment maps
Date: Mon, 13 Oct 2025 16:38:09 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gao Xiang <[email-masked]>

[ Upstream commit 334c0e493c2aa3e843a80bb9f3862bb50360cb36 ]

Since all real encoded extents (directly handled by the decompression
subsystem) have a sane, limited maximum decoded length
(Z_EROFS_PCLUSTER_MAX_DSIZE), and the read-more policy is only applied
if needed.

However, it makes no sense to read more for non-encoded maps, such as
fragment extents, since such extents can be huge (up to i_size) and
there is no benefit to reading more at this layer.

For normal images, it does not really matter, but for crafted images
generated by syzbot, excessively large fragment extents can cause
read-more to run for an overly long time.

Reported-and-tested-by: [email-masked]
Closes: https://lore.kernel.org/r/[email-masked]
Fixes: b44686c8391b ("erofs: fix large fragment handling")
Fixes: b15b2e307c3a ("erofs: support on-disk compressed fragments data")
Reviewed-by: Hongbo Li <[email-masked]>
Reviewed-by: Chao Yu <[email-masked]>
Signed-off-by: Gao Xiang <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/erofs/zdata.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index 2d73297003d25..625b8ae8f67f0 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -1835,7 +1835,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_frontend *f,
 		map->m_la = end;
 		err = z_erofs_map_blocks_iter(inode, map,
 					      EROFS_GET_BLOCKS_READMORE);
-		if (err)
+		if (err || !(map->m_flags & EROFS_MAP_ENCODED))
 			return;
 
 		/* expand ra for the trailing edge if readahead */
@@ -1847,7 +1847,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_frontend *f,
 		end = round_up(end, PAGE_SIZE);
 	} else {
 		end = round_up(map->m_la, PAGE_SIZE);
-		if (!map->m_llen)
+		if (!(map->m_flags & EROFS_MAP_ENCODED) || !map->m_llen)
 			return;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:33:13 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368808; cv=none; b=c/tC6qxlDG9IU/IeJ2mJevw6n7VaQ3WPWvavLuRS1bN1LT9xOz82rClyTrWszAsYWTM5innt54YCH6Yb6M9cr5hKv7LOUa9faAD8SwzO6XIbnrg4vNxt+h66xH7SArupc/vk1A3AoQTN6zfaiw2pmzotQoNIlIymeB7zYXOSTNw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368808; c=relaxed/simple;
	bh=5DVo6RTVb7rUWbFHOCGCG94JSSkun/FGjY4iQVnzEI4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Ea7vlFCxBPG34qzPEsEzulRKrIfeAczOwW2/Ke8FhGDT508TbhsbtMq635vLESem9ghjj/VQXJcpmYxs7k3IgVQ7KWBPRyKyRbpj5k5/3cQLq3uLnliOF3t4tNI3V2DNDaKHsGWyVkzRE7gnDZ9jTqs+i7O4OoOji44Wa2jYK4A=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=eCDceMMw; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Leo Yan <[email-masked]>,
	Will Deacon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 027/563] perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
Date: Mon, 13 Oct 2025 16:38:08 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leo Yan <[email-masked]>

[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]

Cast nr_pages to unsigned long to avoid overflow when handling large
AUX buffer sizes (>= 2 GiB).

Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
Signed-off-by: Leo Yan <[email-masked]>
Signed-off-by: Will Deacon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/perf/arm_spe_pmu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
index 369e77ad5f13f..8f14cb324e018 100644
--- a/drivers/perf/arm_spe_pmu.c
+++ b/drivers/perf/arm_spe_pmu.c
@@ -97,7 +97,8 @@ struct arm_spe_pmu {
 #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu))
 
 /* Convert a free-running index from perf into an SPE buffer offset */
-#define PERF_IDX2OFF(idx, buf)	((idx) % ((buf)->nr_pages << PAGE_SHIFT))
+#define PERF_IDX2OFF(idx, buf) \
+	((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
 
 /* Keep track of our dynamic hotplug state */
 static enum cpuhp_state arm_spe_pmu_online;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:47:25 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368805; cv=none; b=I7Dxc7VrW4TRjkt9+2LHmuZEEdLO1HhYhqg2BqXa2k8v4TND3XQLSOd6uENaOVBogSieBRxIBLWV+ihWGIq1TzvUeIZJwg/u8W3ZgIMuRbg81OgkRTa5AzexlXRipO7zsF9oGidmmUIsGWbsaiaeHJcqavQIS0vTuo2JcDcJx60=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368805; c=relaxed/simple;
	bh=F165bJ/dnjxEp5lQ6/mutWHgsdONEdUQt0VhkXQNqPw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=KiP+suWzsy4v/wRnbNeCNfNokXqLB6uUavtZjGNkreFyAvbjEKNFoD1PU4Nf/KqMmbLdSH4mhIp2FslmF9WTJUENNJ/aFd4lXM9q9cqHoU33Y0UwcPhj67uzc0LeS1xVYXnB7VE2cb+/ao7LnckciGAH6OlX31cNhOd9wZYfPJY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Ig1Ss4GI; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Leo Yan <[email-masked]>,
	Will Deacon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 026/563] coresight: trbe: Prevent overflow in PERF_IDX2OFF()
Date: Mon, 13 Oct 2025 16:38:07 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leo Yan <[email-masked]>

[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ]

Cast nr_pages to unsigned long to avoid overflow when handling large
AUX buffer sizes (>= 2 GiB).

Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
Signed-off-by: Leo Yan <[email-masked]>
Signed-off-by: Will Deacon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-trbe.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
index 8267dd1a2130d..8f426f94e32a1 100644
--- a/drivers/hwtracing/coresight/coresight-trbe.c
+++ b/drivers/hwtracing/coresight/coresight-trbe.c
@@ -23,7 +23,8 @@
 #include "coresight-self-hosted-trace.h"
 #include "coresight-trbe.h"
 
-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
+#define PERF_IDX2OFF(idx, buf) \
+	((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
 
 /*
  * A padding packet that will help the user space tools
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:36:30 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368902; cv=none; b=eRgUVLKS7WWfnPnhXABpJXTuRcUFVOat3eQb4OziwZHeh0/e+DzsYPW9uMwwPvx+0KlWA6DXMmrEjeWvDxbMZmFnS/CFpmUfQijcIw16xHjNCOjFpoobJoYhf2se8olL4/w95Pwrp7c4dXQIxcQX/XCWQqJda9+qfTgSvgzULHw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368902; c=relaxed/simple;
	bh=w98oeeMkDEuXw17CJVzT+4PDqY6Ww3MssXmdZtHsGS4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=OmBfrNxR4CWGzTJ21Zdr/Uy8Krgq5OCKkLUooMn6AY9EYFX3khTbarhD485BH8a+twryJopdH17h3T2FFRo3OKvmp7KFnCYrndclvzgCgcZDtof6QX218qAzAH27yKEb/kW5FTxM4YQpNqbXB6ClBq9xKdkPUJh0iPv1OEI/tpo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hm5/HKPT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alexandre Ghiti <[email-masked]>,
	Chunyan Zhang <[email-masked]>,
	Nutty Liu <[email-masked]>,
	Paul Walmsley <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 025/563] raid6: riscv: Clean up unused header file inclusion
Date: Mon, 13 Oct 2025 16:38:06 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chunyan Zhang <[email-masked]>

[ Upstream commit f8a03516a530cc36bc9015c84ba7540ee3e8d7bd ]

These two C files don't reference things defined in simd.h or types.h
so remove these redundant #inclusions.

Fixes: 6093faaf9593 ("raid6: Add RISC-V SIMD syndrome and recovery calculations")
Reviewed-by: Alexandre Ghiti <[email-masked]>
Signed-off-by: Chunyan Zhang <[email-masked]>
Reviewed-by: Nutty Liu <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Paul Walmsley <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 lib/raid6/recov_rvv.c | 2 --
 lib/raid6/rvv.c       | 3 ---
 2 files changed, 5 deletions(-)

diff --git a/lib/raid6/recov_rvv.c b/lib/raid6/recov_rvv.c
index 5d54c4b437df7..5f779719c3d34 100644
--- a/lib/raid6/recov_rvv.c
+++ b/lib/raid6/recov_rvv.c
@@ -4,9 +4,7 @@
  * Author: Chunyan Zhang <[email-masked]>
  */
 
-#include <asm/simd.h>
 #include <asm/vector.h>
-#include <crypto/internal/simd.h>
 #include <linux/raid/pq.h>
 
 static int rvv_has_vector(void)
diff --git a/lib/raid6/rvv.c b/lib/raid6/rvv.c
index 7d82efa5b14f9..b193ea176d5d3 100644
--- a/lib/raid6/rvv.c
+++ b/lib/raid6/rvv.c
@@ -9,11 +9,8 @@
  *	Copyright 2002-2004 H. Peter Anvin
  */
 
-#include <asm/simd.h>
 #include <asm/vector.h>
-#include <crypto/internal/simd.h>
 #include <linux/raid/pq.h>
-#include <linux/types.h>
 #include "rvv.h"
 
 #define NSIZE	(riscv_v_vsize / 32) /* NSIZE = vlenb */
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:54:26 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368893; cv=none; b=iGZoXWgVl8wYnhgsY5uCw9OUry4HnAj9Sht4LtB+Pxzpgftm/IIiXrQv9KOEkZAd2hmYZtJBZWK7NO6d5Fdtxc0ZZNtIAvGFUVw3lnzVp14GYG6tbSHCJPojQ+fjM34WEIBorYsONi6qtvIGsrVSX1za3ZjD46AbxdjjCfZsBRY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368893; c=relaxed/simple;
	bh=mjAP/N458hWYcDH900Msvl9kOP4HvlsrXHgGAX/pFJ8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=h+Gf4yyv2BxhlClXLNTyhA7BHf9zUKrUBoX0gbodS0vIwxV9ZD+yJPeVhfw4lN7EXnhK7SlDU/1XpDnRkr2aMitx0DUKDb0sH4vta/ZJSyPo/jPAHGHLdUvO03yATbgojWNJaFUmaJfoFctSCEnK9x9aq4AeB63av+Jkxs5X1Wk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=qehkJ0Sd; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Naveen N Rao <[email-masked]>,
	Joe Lawrence <[email-masked]>,
	Madhavan Srinivasan <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 022/563] powerpc/ftrace: ensure ftrace record ops are always set for NOPs
Date: Mon, 13 Oct 2025 16:38:03 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Joe Lawrence <[email-masked]>

[ Upstream commit 5337609a314828aa2474ac359db615f475c4a4d2 ]

When an ftrace call site is converted to a NOP, its corresponding
dyn_ftrace record should have its ftrace_ops pointer set to
ftrace_nop_ops.

Correct the powerpc implementation to ensure the
ftrace_rec_set_nop_ops() helper is called on all successful NOP
initialization paths. This ensures all ftrace records are consistent
before being handled by the ftrace core.

Fixes: eec37961a56a ("powerpc64/ftrace: Move ftrace sequence out of line")
Suggested-by: Naveen N Rao <[email-masked]>
Signed-off-by: Joe Lawrence <[email-masked]>
Acked-by: Naveen N Rao (AMD) <[email-masked]>
Signed-off-by: Madhavan Srinivasan <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/powerpc/kernel/trace/ftrace.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/kernel/trace/ftrace.c b/arch/powerpc/kernel/trace/ftrace.c
index 6dca92d5a6e82..841d077e28251 100644
--- a/arch/powerpc/kernel/trace/ftrace.c
+++ b/arch/powerpc/kernel/trace/ftrace.c
@@ -488,8 +488,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec)
 		return ret;
 
 	/* Set up out-of-line stub */
-	if (IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE))
-		return ftrace_init_ool_stub(mod, rec);
+	if (IS_ENABLED(CONFIG_PPC_FTRACE_OUT_OF_LINE)) {
+		ret = ftrace_init_ool_stub(mod, rec);
+		goto out;
+	}
 
 	/* Nop-out the ftrace location */
 	new = ppc_inst(PPC_RAW_NOP());
@@ -520,6 +522,10 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec)
 		return -EINVAL;
 	}
 
+out:
+	if (!ret)
+		ret = ftrace_rec_set_nop_ops(rec);
+
 	return ret;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:47:23 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368887; cv=none; b=Oul+DghtGv21L+gaH0O3d3gj7Q81zP1wI9P64+1ySmGZgYZMWW3fL9ThGNt+MMNf8mWs3B2y0FY8i0tiDG98LneM/xtuLvuVQx0/gDi27igVEvwtTGVy9V2TrEZukiQAu2sft71bd7S3AVwStTKgwHyN/TxTYskLmjfID4cIn4A=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368887; c=relaxed/simple;
	bh=twvoxi7SeblshpbjzrbcxtL3omHW1jRtCKH3NvAfbXw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Pf/2z83i+vaq4ANp4dmL1Oe22Nb/xFDtJpsoaQjzEcux5SECVhL1qi7yTUffDNZgGI6fhoHinGoDrmLCyU+QP2gBloCh/68b5sZAn0eWzyai7GOmutvWUi0x1qTJws4uGR5jEiK8HU5G1y2kQi8ErBg9pTmhoaDgaURnmnN/REg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XASV/aup; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Christophe Leroy <[email-masked]>,
	Madhavan Srinivasan <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 020/563] powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler
Date: Mon, 13 Oct 2025 16:38:01 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christophe Leroy <[email-masked]>

[ Upstream commit d9e46de4bf5c5f987075afd5f240bb2a8a5d71ed ]

Commit ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in
DTLB misses") removed the test that needed the valeur in SPRN_EPN but
failed to remove the read.

Remove it.

And remove related comments, including the very same comment
in InstructionTLBMiss that should have been removed by
commit 33c527522f39 ("powerpc/8xx: Inconditionally use task PGDIR in
ITLB misses").

Also update the comment about absence of a second level table which
has been handled implicitely since commit 5ddb75cee5af ("powerpc/8xx:
remove tests on PGDIR entry validity").

Fixes: ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in DTLB misses")
Signed-off-by: Christophe Leroy <[email-masked]>
Signed-off-by: Madhavan Srinivasan <[email-masked]>
Link: https://patch.msgid.link/5811c8d1[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/powerpc/kernel/head_8xx.S | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
index 56c5ebe21b99a..613606400ee99 100644
--- a/arch/powerpc/kernel/head_8xx.S
+++ b/arch/powerpc/kernel/head_8xx.S
@@ -162,7 +162,7 @@ instruction_counter:
  * For the MPC8xx, this is a software tablewalk to load the instruction
  * TLB.  The task switch loads the M_TWB register with the pointer to the first
  * level table.
- * If we discover there is no second level table (value is zero) or if there
+ * If there is no second level table (value is zero) or if there
  * is an invalid pte, we load that into the TLB, which causes another fault
  * into the TLB Error interrupt where we can handle such problems.
  * We have to use the MD_xxx registers for the tablewalk because the
@@ -183,9 +183,6 @@ instruction_counter:
 	mtspr	SPRN_SPRG_SCRATCH2, r10
 	mtspr	SPRN_M_TW, r11
 
-	/* If we are faulting a kernel address, we have to use the
-	 * kernel page tables.
-	 */
 	mfspr	r10, SPRN_SRR0	/* Get effective address of fault */
 	INVALIDATE_ADJACENT_PAGES_CPU15(r10, r11)
 	mtspr	SPRN_MD_EPN, r10
@@ -228,10 +225,6 @@ instruction_counter:
 	mtspr	SPRN_SPRG_SCRATCH2, r10
 	mtspr	SPRN_M_TW, r11
 
-	/* If we are faulting a kernel address, we have to use the
-	 * kernel page tables.
-	 */
-	mfspr	r10, SPRN_MD_EPN
 	mfspr	r10, SPRN_M_TWB	/* Get level 1 table */
 	lwz	r11, (swapper_pg_dir-PAGE_OFFSET)@l(r10)	/* Get level 1 entry */
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:50:49 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368803; cv=none; b=ptYzgx4STVKZAG4UJyGad0sT4CgpJLUUBDe+AC8OXXUSu9VDTQDjMnXaLmzr87LU8ou2bDmezEvTt5w9IAz6/UUqF/vUveX3gQyKSziNEHlsabpTREpbYzUUBP+bifLSR2Z+7mREdlOh+Xwvnv3FOYfo/ZT3gT3LjTSxk++0KNk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368803; c=relaxed/simple;
	bh=uaMocS3TzhOzds5M8AzkxT1h10qJPjcAEvhPX/SAjC8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=hlJAn/lGRYEdaTGsBlGZd50GizEJ24BzDduB2D17XEAJmcGChlbnpZEDoFZrTKy2xxz8Kd6FboWTr0RzuiPQNYPhwdHmYQFpeLBsuScRoZRbxBzHKj7wG5NVAcZ98uMyMYFv/jOZPI14aduHE9tb6zJw9uNzYmKyOv8avMCFSl0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=wQvS8AFD; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Andreas Gruenbacher <[email-masked]>,
	Andrew Price <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 017/563] gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS
Date: Mon, 13 Oct 2025 16:37:58 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andreas Gruenbacher <[email-masked]>

[ Upstream commit bddb53b776fb7ce81dfba7c24884d9f2c0c68e50 ]

Get rid of the GLF_INVALIDATE_IN_PROGRESS flag: it was originally used
to indicate to add_to_queue() that the ->go_sync() and ->go_invalid()
operations were in progress, but as we have established in commit "gfs2:
Fix LM_FLAG_TRY* logic in add_to_queue", add_to_queue() has no need to
know.

Commit d99724c3c36a describes a race in which GLF_INVALIDATE_IN_PROGRESS
is used to serialize two processes which are both in do_xmote() at the
same time.  That analysis is wrong: the serialization happens via the
GLF_LOCK flag, which ensures that at most one glock operation can be
active at any time.

Fixes: d99724c3c36a ("gfs2: Close timing window with GLF_INVALIDATE_IN_PROGRESS")
Signed-off-by: Andreas Gruenbacher <[email-masked]>
Reviewed-by: Andrew Price <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/gfs2/glock.c      | 16 +---------------
 fs/gfs2/incore.h     |  1 -
 fs/gfs2/trace_gfs2.h |  1 -
 3 files changed, 1 insertion(+), 17 deletions(-)

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 93aae10d78f30..68e943e13dd53 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -703,17 +703,6 @@ __acquires(&gl->gl_lockref.lock)
 	lck_flags &= (LM_FLAG_TRY | LM_FLAG_TRY_1CB | LM_FLAG_NOEXP);
 	GLOCK_BUG_ON(gl, gl->gl_state == target);
 	GLOCK_BUG_ON(gl, gl->gl_state == gl->gl_target);
-	if ((target == LM_ST_UNLOCKED || target == LM_ST_DEFERRED) &&
-	    glops->go_inval) {
-		/*
-		 * If another process is already doing the invalidate, let that
-		 * finish first.  The glock state machine will get back to this
-		 * holder again later.
-		 */
-		if (test_and_set_bit(GLF_INVALIDATE_IN_PROGRESS,
-				     &gl->gl_flags))
-			return;
-	}
 	if (!glops->go_inval || !glops->go_sync)
 		goto skip_inval;
 
@@ -732,7 +721,7 @@ __acquires(&gl->gl_lockref.lock)
 		goto skip_inval;
 	}
 
-	if (test_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags)) {
+	if (target == LM_ST_UNLOCKED || target == LM_ST_DEFERRED) {
 		/*
 		 * The call to go_sync should have cleared out the ail list.
 		 * If there are still items, we have a problem. We ought to
@@ -747,7 +736,6 @@ __acquires(&gl->gl_lockref.lock)
 			gfs2_dump_glock(NULL, gl, true);
 		}
 		glops->go_inval(gl, target == LM_ST_DEFERRED ? 0 : DIO_METADATA);
-		clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags);
 	}
 	spin_lock(&gl->gl_lockref.lock);
 
@@ -2313,8 +2301,6 @@ static const char *gflags2str(char *buf, const struct gfs2_glock *gl)
 		*p++ = 'y';
 	if (test_bit(GLF_LFLUSH, gflags))
 		*p++ = 'f';
-	if (test_bit(GLF_INVALIDATE_IN_PROGRESS, gflags))
-		*p++ = 'i';
 	if (test_bit(GLF_PENDING_REPLY, gflags))
 		*p++ = 'R';
 	if (test_bit(GLF_HAVE_REPLY, gflags))
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index d4ad82f47eeea..c390f208654c1 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -319,7 +319,6 @@ enum {
 	GLF_DEMOTE_IN_PROGRESS		= 5,
 	GLF_DIRTY			= 6,
 	GLF_LFLUSH			= 7,
-	GLF_INVALIDATE_IN_PROGRESS	= 8,
 	GLF_HAVE_REPLY			= 9,
 	GLF_INITIAL			= 10,
 	GLF_HAVE_FROZEN_REPLY		= 11,
diff --git a/fs/gfs2/trace_gfs2.h b/fs/gfs2/trace_gfs2.h
index 26036ffc3f338..1c2507a273180 100644
--- a/fs/gfs2/trace_gfs2.h
+++ b/fs/gfs2/trace_gfs2.h
@@ -52,7 +52,6 @@
 	{(1UL << GLF_DEMOTE_IN_PROGRESS),	"p" },		\
 	{(1UL << GLF_DIRTY),			"y" },		\
 	{(1UL << GLF_LFLUSH),			"f" },		\
-	{(1UL << GLF_INVALIDATE_IN_PROGRESS),	"i" },		\
 	{(1UL << GLF_PENDING_REPLY),		"R" },		\
 	{(1UL << GLF_HAVE_REPLY),		"r" },		\
 	{(1UL << GLF_INITIAL),			"a" },		\
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:36:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368905; cv=none; b=UosRmXR5eU3cBZrpN7zybOVMwzcTKzqU95Wpo4lFLUU9pnraZwDjF2f5r9NVVLu/pNnjfAvlG5LKHX7TfcZpP/SlBFDF5gEGFs6fk+CJYlA/5E/VT03lS9DLhHUeirZ9E0r5EZ97gBhC94w2rrBhdDHGEd6XOx7vMfcUlMxEKw8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368905; c=relaxed/simple;
	bh=dDDXF/h97/zpLyo2LT7ElsZI8HNnIaFgbRvChfIEn9c=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=g273i8+MtKBAvSopwCkYEcSV5m/0P642e9kIPczK6R2xaxiBd9YN+wZNZeMvpqSOJs5lWOjG24geIB9boI51UhMcDuB7BAC/PHoZphmk2AeLGttiPdPBJD2ZLJ1hfEArzon/erhWXKE/uV0BQCWJYityveJ70IZBOV0flaDfAyo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QrogzfDe; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Andreas Gruenbacher <[email-masked]>,
	Andrew Price <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 016/563] gfs2: Remove duplicate check in do_xmote
Date: Mon, 13 Oct 2025 16:37:57 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andreas Gruenbacher <[email-masked]>

[ Upstream commit 9b54770b68ae793a3a8d378be4cda2bb7be6c8cc ]

In do_xmote(), remove the duplicate check for the ->go_sync and
->go_inval glock operations.  They are either both defined, or none of
them are.

Signed-off-by: Andreas Gruenbacher <[email-masked]>
Reviewed-by: Andrew Price <[email-masked]>
Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS")
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/gfs2/glock.c | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 5edf125b39fe3..93aae10d78f30 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -714,25 +714,24 @@ __acquires(&gl->gl_lockref.lock)
 				     &gl->gl_flags))
 			return;
 	}
-	if (!glops->go_inval && !glops->go_sync)
+	if (!glops->go_inval || !glops->go_sync)
 		goto skip_inval;
 
 	spin_unlock(&gl->gl_lockref.lock);
-	if (glops->go_sync) {
-		ret = glops->go_sync(gl);
-		/* If we had a problem syncing (due to io errors or whatever,
-		 * we should not invalidate the metadata or tell dlm to
-		 * release the glock to other nodes.
-		 */
-		if (ret) {
-			if (cmpxchg(&sdp->sd_log_error, 0, ret)) {
-				fs_err(sdp, "Error %d syncing glock\n", ret);
-				gfs2_dump_glock(NULL, gl, true);
-			}
-			spin_lock(&gl->gl_lockref.lock);
-			goto skip_inval;
+	ret = glops->go_sync(gl);
+	/* If we had a problem syncing (due to io errors or whatever,
+	 * we should not invalidate the metadata or tell dlm to
+	 * release the glock to other nodes.
+	 */
+	if (ret) {
+		if (cmpxchg(&sdp->sd_log_error, 0, ret)) {
+			fs_err(sdp, "Error %d syncing glock\n", ret);
+			gfs2_dump_glock(NULL, gl, true);
 		}
+		spin_lock(&gl->gl_lockref.lock);
+		goto skip_inval;
 	}
+
 	if (test_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags)) {
 		/*
 		 * The call to go_sync should have cleared out the ail list.
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:42:27 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368773; cv=none; b=rN3hxTuxyytqn+NrCh3tyi6ANOJLAG4c45/mJVbIGxQCGqTjqx9rnd/r03Gy5x1Qph3U4FEmbnwXqqCDtkAjQ6P6bOKWQLcOhsAF6Fb7wqiQYD6P6gh93bfjfgCmRC1pfy4oEP3hXuN96VTfvoGcbaX72CeYLt2qt2HO9J/pLEA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368773; c=relaxed/simple;
	bh=4Tg3aHe1Se+rBKzhbyDSt0pmq/Ji2DNLQsf26OQubYk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=rxged//LeoUcG6OwDqKhygRsphoNGGpfLrzduSV5xLRYHPsBqcA0R7X991pTvBZ6cmMMu80bYOsnr/aWpv14uwGQkU9ZnKzY3sZWRNmyPKQRmB3fUoKskewuHqJ4pJR+JrKMJ+c2vcLi2LtJG7QkWGqqORu2mBIa/jPuAW25gU8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FYFGKlCA; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Andreas Gruenbacher <[email-masked]>,
	Andrew Price <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 015/563] gfs2: Fix LM_FLAG_TRY* logic in add_to_queue
Date: Mon, 13 Oct 2025 16:37:56 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andreas Gruenbacher <[email-masked]>

[ Upstream commit 0c23e24164d83086e75581b0cf930f4e161636d6 ]

The logic in add_to_queue() for determining whether a LM_FLAG_TRY or
LM_FLAG_TRY_1CB holder should be queued does not make any sense: we are
interested in wether or not the new operation will block behind an
existing or future holder in the queue, but the current code checks for
ongoing locking or ->go_inval() operations, which has little to do with
that.

Replace that code with something more sensible, remove the incorrect
add_to_queue() function annotations, remove the similarly misguided
do_error(gl, 0) call in do_xmote(), and add a missing comment to the
same call in do_promote().

Signed-off-by: Andreas Gruenbacher <[email-masked]>
Reviewed-by: Andrew Price <[email-masked]>
Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS")
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/gfs2/glock.c | 47 ++++++++++++++++++++++++-----------------------
 1 file changed, 24 insertions(+), 23 deletions(-)

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 45dd73bb884fd..5edf125b39fe3 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -502,7 +502,7 @@ static bool do_promote(struct gfs2_glock *gl)
 			 */
 			if (list_is_first(&gh->gh_list, &gl->gl_holders))
 				return false;
-			do_error(gl, 0);
+			do_error(gl, 0); /* Fail queued try locks */
 			break;
 		}
 		set_bit(HIF_HOLDER, &gh->gh_iflags);
@@ -713,7 +713,6 @@ __acquires(&gl->gl_lockref.lock)
 		if (test_and_set_bit(GLF_INVALIDATE_IN_PROGRESS,
 				     &gl->gl_flags))
 			return;
-		do_error(gl, 0); /* Fail queued try locks */
 	}
 	if (!glops->go_inval && !glops->go_sync)
 		goto skip_inval;
@@ -1454,6 +1453,24 @@ void gfs2_print_dbg(struct seq_file *seq, const char *fmt, ...)
 	va_end(args);
 }
 
+static bool gfs2_should_queue_trylock(struct gfs2_glock *gl,
+				      struct gfs2_holder *gh)
+{
+	struct gfs2_holder *current_gh, *gh2;
+
+	current_gh = find_first_holder(gl);
+	if (current_gh && !may_grant(gl, current_gh, gh))
+		return false;
+
+	list_for_each_entry(gh2, &gl->gl_holders, gh_list) {
+		if (test_bit(HIF_HOLDER, &gh2->gh_iflags))
+			continue;
+		if (!(gh2->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)))
+			return false;
+	}
+	return true;
+}
+
 static inline bool pid_is_meaningful(const struct gfs2_holder *gh)
 {
         if (!(gh->gh_flags & GL_NOPID))
@@ -1472,27 +1489,20 @@ static inline bool pid_is_meaningful(const struct gfs2_holder *gh)
  */
 
 static inline void add_to_queue(struct gfs2_holder *gh)
-__releases(&gl->gl_lockref.lock)
-__acquires(&gl->gl_lockref.lock)
 {
 	struct gfs2_glock *gl = gh->gh_gl;
 	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
 	struct gfs2_holder *gh2;
-	int try_futile = 0;
 
 	GLOCK_BUG_ON(gl, gh->gh_owner_pid == NULL);
 	if (test_and_set_bit(HIF_WAIT, &gh->gh_iflags))
 		GLOCK_BUG_ON(gl, true);
 
-	if (gh->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)) {
-		if (test_bit(GLF_LOCK, &gl->gl_flags)) {
-			struct gfs2_holder *current_gh;
-
-			current_gh = find_first_holder(gl);
-			try_futile = !may_grant(gl, current_gh, gh);
-		}
-		if (test_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags))
-			goto fail;
+	if ((gh->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB)) &&
+	    !gfs2_should_queue_trylock(gl, gh)) {
+		gh->gh_error = GLR_TRYFAILED;
+		gfs2_holder_wake(gh);
+		return;
 	}
 
 	list_for_each_entry(gh2, &gl->gl_holders, gh_list) {
@@ -1504,15 +1514,6 @@ __acquires(&gl->gl_lockref.lock)
 			continue;
 		goto trap_recursive;
 	}
-	list_for_each_entry(gh2, &gl->gl_holders, gh_list) {
-		if (try_futile &&
-		    !(gh2->gh_flags & (LM_FLAG_TRY | LM_FLAG_TRY_1CB))) {
-fail:
-			gh->gh_error = GLR_TRYFAILED;
-			gfs2_holder_wake(gh);
-			return;
-		}
-	}
 	trace_gfs2_glock_queue(gh, 1);
 	gfs2_glstats_inc(gl, GFS2_LKS_QCOUNT);
 	gfs2_sbstats_inc(gl, GFS2_LKS_QCOUNT);
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:54:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368770; cv=none; b=Gj4t7aJy5iKCHuhwrBq/C7P3no80eAu0ZLab42RZUR5kq7skTVoRvsouZP8x0XXoTeR/4LhBDgi9Ft+hCSLp3qEPIRczP64/W/yvvdFkSi6wYQ5ige480S4rKucqS2NQkWmV5pKfX/D+AwMpvPByFspWg1Kl6p4JxBJ0DHmpWgI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368770; c=relaxed/simple;
	bh=vtwrphwyBd50HsY121Vq6gzr9zXUh3hUD+043e2YwqA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=BVpyo11v1dfap+zkmzR6S9nHsaWxzZwIhP6PH5pXt3E/ERTCmgepacn0wQXJUPbXU4ni21J0eencutVi+sAf01a5etOQTQQjvy0ck9Z87aPG9OgKfFS+DJCB+NT3Zospy3BhQCNnUFsu+h8dLqkNoLFiK9azJZh7JG+FBMs3YzM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=SgtdVo4a; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Andreas Gruenbacher <[email-masked]>,
	Andrew Price <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 014/563] gfs2: Further sanitize lock_dlm.c
Date: Mon, 13 Oct 2025 16:37:55 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andreas Gruenbacher <[email-masked]>

[ Upstream commit fd70ab7155c4b92a9747d42c02791a0793ab9c66 ]

The gl_req field and GLF_BLOCKING flag are only relevant to gdlm_lock(),
its callback gdlm_ast(), and their helpers, so set and clear them inside
lock_dlm.c.

Also, the LM_FLAG_ANY flag is relevant to gdlm_lock(), but do_xmote()
doesn't pass that flag down to gdlm_lock() as it should.  Fix that by
passing down all the flags.

In addition, document the effect of the LM_FLAG_ANY flag on locks held
in EX mode locally.

Signed-off-by: Andreas Gruenbacher <[email-masked]>
Reviewed-by: Andrew Price <[email-masked]>
Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS")
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/gfs2/glock.c    |  6 ------
 fs/gfs2/glock.h    |  4 ++++
 fs/gfs2/lock_dlm.c | 26 ++++++++++++++++++--------
 3 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 3d5cf9c24d78b..45dd73bb884fd 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -715,12 +715,6 @@ __acquires(&gl->gl_lockref.lock)
 			return;
 		do_error(gl, 0); /* Fail queued try locks */
 	}
-	gl->gl_req = target;
-	set_bit(GLF_BLOCKING, &gl->gl_flags);
-	if ((gl->gl_req == LM_ST_UNLOCKED) ||
-	    (gl->gl_state == LM_ST_EXCLUSIVE) ||
-	    (lck_flags & (LM_FLAG_TRY|LM_FLAG_TRY_1CB)))
-		clear_bit(GLF_BLOCKING, &gl->gl_flags);
 	if (!glops->go_inval && !glops->go_sync)
 		goto skip_inval;
 
diff --git a/fs/gfs2/glock.h b/fs/gfs2/glock.h
index 9339a3bff6eeb..d041b922b45e3 100644
--- a/fs/gfs2/glock.h
+++ b/fs/gfs2/glock.h
@@ -68,6 +68,10 @@ enum {
  * also be granted in SHARED.  The preferred state is whichever is compatible
  * with other granted locks, or the specified state if no other locks exist.
  *
+ * In addition, when a lock is already held in EX mode locally, a SHARED or
+ * DEFERRED mode request with the LM_FLAG_ANY flag set will be granted.
+ * (The LM_FLAG_ANY flag is only use for SHARED mode requests currently.)
+ *
  * LM_FLAG_NODE_SCOPE
  * This holder agrees to share the lock within this node. In other words,
  * the glock is held in EX mode according to DLM, but local holders on the
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index cee5d199d2d87..5daaeaaaf18dd 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -58,6 +58,7 @@ static inline void gfs2_update_stats(struct gfs2_lkstats *s, unsigned index,
 /**
  * gfs2_update_reply_times - Update locking statistics
  * @gl: The glock to update
+ * @blocking: The operation may have been blocking
  *
  * This assumes that gl->gl_dstamp has been set earlier.
  *
@@ -72,12 +73,12 @@ static inline void gfs2_update_stats(struct gfs2_lkstats *s, unsigned index,
  * TRY_1CB flags are set are classified as non-blocking. All
  * other DLM requests are counted as (potentially) blocking.
  */
-static inline void gfs2_update_reply_times(struct gfs2_glock *gl)
+static inline void gfs2_update_reply_times(struct gfs2_glock *gl,
+					   bool blocking)
 {
 	struct gfs2_pcpu_lkstats *lks;
 	const unsigned gltype = gl->gl_name.ln_type;
-	unsigned index = test_bit(GLF_BLOCKING, &gl->gl_flags) ?
-			 GFS2_LKS_SRTTB : GFS2_LKS_SRTT;
+	unsigned index = blocking ? GFS2_LKS_SRTTB : GFS2_LKS_SRTT;
 	s64 rtt;
 
 	preempt_disable();
@@ -119,14 +120,18 @@ static inline void gfs2_update_request_times(struct gfs2_glock *gl)
 static void gdlm_ast(void *arg)
 {
 	struct gfs2_glock *gl = arg;
+	bool blocking;
 	unsigned ret;
 
+	blocking = test_bit(GLF_BLOCKING, &gl->gl_flags);
+	gfs2_update_reply_times(gl, blocking);
+	clear_bit(GLF_BLOCKING, &gl->gl_flags);
+
 	/* If the glock is dead, we only react to a dlm_unlock() reply. */
 	if (__lockref_is_dead(&gl->gl_lockref) &&
 	    gl->gl_lksb.sb_status != -DLM_EUNLOCK)
 		return;
 
-	gfs2_update_reply_times(gl);
 	BUG_ON(gl->gl_lksb.sb_flags & DLM_SBF_DEMOTED);
 
 	if ((gl->gl_lksb.sb_flags & DLM_SBF_VALNOTVALID) && gl->gl_lksb.sb_lvbptr)
@@ -241,7 +246,7 @@ static bool down_conversion(int cur, int req)
 }
 
 static u32 make_flags(struct gfs2_glock *gl, const unsigned int gfs_flags,
-		      const int cur, const int req)
+		      const int req, bool blocking)
 {
 	u32 lkf = 0;
 
@@ -274,7 +279,7 @@ static u32 make_flags(struct gfs2_glock *gl, const unsigned int gfs_flags,
 		 * "upward" lock conversions or else DLM will reject the
 		 * request as invalid.
 		 */
-		if (!down_conversion(cur, req))
+		if (blocking)
 			lkf |= DLM_LKF_QUECVT;
 	}
 
@@ -294,14 +299,20 @@ static int gdlm_lock(struct gfs2_glock *gl, unsigned int req_state,
 		     unsigned int flags)
 {
 	struct lm_lockstruct *ls = &gl->gl_name.ln_sbd->sd_lockstruct;
+	bool blocking;
 	int cur, req;
 	u32 lkf;
 	char strname[GDLM_STRNAME_BYTES] = "";
 	int error;
 
+	gl->gl_req = req_state;
 	cur = make_mode(gl->gl_name.ln_sbd, gl->gl_state);
 	req = make_mode(gl->gl_name.ln_sbd, req_state);
-	lkf = make_flags(gl, flags, cur, req);
+	blocking = !down_conversion(cur, req) &&
+		   !(flags & (LM_FLAG_TRY|LM_FLAG_TRY_1CB));
+	lkf = make_flags(gl, flags, req, blocking);
+	if (blocking)
+		set_bit(GLF_BLOCKING, &gl->gl_flags);
 	gfs2_glstats_inc(gl, GFS2_LKS_DCOUNT);
 	gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT);
 	if (test_bit(GLF_INITIAL, &gl->gl_flags)) {
@@ -341,7 +352,6 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
 		return;
 	}
 
-	clear_bit(GLF_BLOCKING, &gl->gl_flags);
 	gfs2_glstats_inc(gl, GFS2_LKS_DCOUNT);
 	gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT);
 	gfs2_update_request_times(gl);
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:47:42 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368768; cv=none; b=Qt+uFPwZ2nCB42Fs7VE6WCw7a7seg2jfuSQowoSWu//gp83zHIwX2RopH7T5q78Dro+8+T27yhRAQVtZL7mIcb/guuiaOgVqthCgmDM8YFB58G3wiRcSYSAN3Y6muRBcoG1h1uGhhMlfiaphJj0kzG0aD8xV3pt79YVD646afXY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368768; c=relaxed/simple;
	bh=GmaWP9eZHmsu1as+u2ulSIRMIQFEqWXfYqrDvvpMYR4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=awvMQWLrVWykCgDvGmMYTA+ExHy897FNi+OuF+Inc42ubA7UzULQ7MegPPdwUMSpcSXSbJ4x/V5PFKaT8bxKZPu73lUvsCpIHUltdq3a/e/Py3P/Crtv9GdGgF5URN4Azi94X7D+TI6EtHUKJAoep9OMj08wzAoF34P95J3eADw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gdtJh8vN; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Colin Ian King <[email-masked]>,
	Andreas Gruenbacher <[email-masked]>,
	Andrew Price <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 013/563] gfs2: Remove space before newline
Date: Mon, 13 Oct 2025 16:37:54 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Colin Ian King <[email-masked]>

[ Upstream commit aa94ad9ab230d08741e6630a20fd1296b52c1009 ]

There is an extraneous space before a newline in a fs_err message.
Remove it

Signed-off-by: Colin Ian King <[email-masked]>
Signed-off-by: Andreas Gruenbacher <[email-masked]>
Reviewed-by: Andrew Price <[email-masked]>
Stable-dep-of: bddb53b776fb ("gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS")
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/gfs2/glock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index edb105f9da059..3d5cf9c24d78b 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -733,7 +733,7 @@ __acquires(&gl->gl_lockref.lock)
 		 */
 		if (ret) {
 			if (cmpxchg(&sdp->sd_log_error, 0, ret)) {
-				fs_err(sdp, "Error %d syncing glock \n", ret);
+				fs_err(sdp, "Error %d syncing glock\n", ret);
 				gfs2_dump_glock(NULL, gl, true);
 			}
 			spin_lock(&gl->gl_lockref.lock);
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:34:48 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368762; cv=none; b=cZ0CwhTVDamc/KOp4QGn9qxMus2+/QlP7OsDOSAyI/iQ8oPDAQxQM6KEOryWdyp7H2x902hdvqXd5hs4kgQ+tuuRKCqbOWuyLbnyVKefr52F7SOiibdiKyXkwuidydxL50KygL3pTqO+zV9AwcZ9ZFOI3SdOkDKw6LatM3sRAiQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368762; c=relaxed/simple;
	bh=pMjmY0G7m8vt1gr4ybXZgi3S/f9ThC9v5hK5DHWakso=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=KtpZm9vn3yQRS7MorpKxrbnu/wA16jOcD1M20+oaodNCC+ZpEOH0ECDwes/U3DNTq6/9oPAICV5qxRJn/aiglOEoFFjgt2IbTCShIKbbC+s9JgKYzOlp2W6guwtTC4ymBx+yBDkmFYVBhOdak6cMrB99neqX1nSPsVBozwU73A0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rY56E2yA; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Kang Chen <[email-masked]>,
	Viacheslav Dubeyko <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 011/563] hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
Date: Mon, 13 Oct 2025 16:37:52 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kang Chen <[email-masked]>

[ Upstream commit bea3e1d4467bcf292c8e54f080353d556d355e26 ]

BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186
Read of size 2 at addr ffff8880289ef218 by task syz.6.248/14290

CPU: 0 UID: 0 PID: 14290 Comm: syz.6.248 Not tainted 6.16.4 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xca/0x5f0 mm/kasan/report.c:482
 kasan_report+0xca/0x100 mm/kasan/report.c:595
 hfsplus_uni2asc+0xa71/0xb90 fs/hfsplus/unicode.c:186
 hfsplus_listxattr+0x5b6/0xbd0 fs/hfsplus/xattr.c:738
 vfs_listxattr+0xbe/0x140 fs/xattr.c:493
 listxattr+0xee/0x190 fs/xattr.c:924
 filename_listxattr fs/xattr.c:958 [inline]
 path_listxattrat+0x143/0x360 fs/xattr.c:988
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcb/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe0e9fae16d
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe0eae67f98 EFLAGS: 00000246 ORIG_RAX: 00000000000000c3
RAX: ffffffffffffffda RBX: 00007fe0ea205fa0 RCX: 00007fe0e9fae16d
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000
RBP: 00007fe0ea0480f0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe0ea206038 R14: 00007fe0ea205fa0 R15: 00007fe0eae48000
 </TASK>

Allocated by task 14290:
 kasan_save_stack+0x24/0x50 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __do_kmalloc_node mm/slub.c:4333 [inline]
 __kmalloc_noprof+0x219/0x540 mm/slub.c:4345
 kmalloc_noprof include/linux/slab.h:909 [inline]
 hfsplus_find_init+0x95/0x1f0 fs/hfsplus/bfind.c:21
 hfsplus_listxattr+0x331/0xbd0 fs/hfsplus/xattr.c:697
 vfs_listxattr+0xbe/0x140 fs/xattr.c:493
 listxattr+0xee/0x190 fs/xattr.c:924
 filename_listxattr fs/xattr.c:958 [inline]
 path_listxattrat+0x143/0x360 fs/xattr.c:988
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcb/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

When hfsplus_uni2asc is called from hfsplus_listxattr,
it actually passes in a struct hfsplus_attr_unistr*.
The size of the corresponding structure is different from that of hfsplus_unistr,
so the previous fix (94458781aee6) is insufficient.
The pointer on the unicode buffer is still going beyond the allocated memory.

This patch introduces two warpper functions hfsplus_uni2asc_xattr_str and
hfsplus_uni2asc_str to process two unicode buffers,
struct hfsplus_attr_unistr* and struct hfsplus_unistr* respectively.
When ustrlen value is bigger than the allocated memory size,
the ustrlen value is limited to an safe size.

Fixes: 94458781aee6 ("hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()")
Signed-off-by: Kang Chen <[email-masked]>
Reviewed-by: Viacheslav Dubeyko <[email-masked]>
Signed-off-by: Viacheslav Dubeyko <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Viacheslav Dubeyko <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/hfsplus/dir.c        |  2 +-
 fs/hfsplus/hfsplus_fs.h |  8 ++++++--
 fs/hfsplus/unicode.c    | 24 +++++++++++++++++++-----
 fs/hfsplus/xattr.c      |  6 +++---
 4 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
index 876bbb80fb4dc..1b3e27a0d5e03 100644
--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -204,7 +204,7 @@ static int hfsplus_readdir(struct file *file, struct dir_context *ctx)
 			fd.entrylength);
 		type = be16_to_cpu(entry.type);
 		len = NLS_MAX_CHARSET_SIZE * HFSPLUS_MAX_STRLEN;
-		err = hfsplus_uni2asc(sb, &fd.key->cat.name, strbuf, &len);
+		err = hfsplus_uni2asc_str(sb, &fd.key->cat.name, strbuf, &len);
 		if (err)
 			goto out;
 		if (type == HFSPLUS_FOLDER) {
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index 96a5c24813dd6..2311e4be4e865 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -521,8 +521,12 @@ int hfsplus_strcasecmp(const struct hfsplus_unistr *s1,
 		       const struct hfsplus_unistr *s2);
 int hfsplus_strcmp(const struct hfsplus_unistr *s1,
 		   const struct hfsplus_unistr *s2);
-int hfsplus_uni2asc(struct super_block *sb, const struct hfsplus_unistr *ustr,
-		    char *astr, int *len_p);
+int hfsplus_uni2asc_str(struct super_block *sb,
+			const struct hfsplus_unistr *ustr, char *astr,
+			int *len_p);
+int hfsplus_uni2asc_xattr_str(struct super_block *sb,
+			      const struct hfsplus_attr_unistr *ustr,
+			      char *astr, int *len_p);
 int hfsplus_asc2uni(struct super_block *sb, struct hfsplus_unistr *ustr,
 		    int max_unistr_len, const char *astr, int len);
 int hfsplus_hash_dentry(const struct dentry *dentry, struct qstr *str);
diff --git a/fs/hfsplus/unicode.c b/fs/hfsplus/unicode.c
index 36b6cf2a3abba..862ba27f1628a 100644
--- a/fs/hfsplus/unicode.c
+++ b/fs/hfsplus/unicode.c
@@ -119,9 +119,8 @@ static u16 *hfsplus_compose_lookup(u16 *p, u16 cc)
 	return NULL;
 }
 
-int hfsplus_uni2asc(struct super_block *sb,
-		const struct hfsplus_unistr *ustr,
-		char *astr, int *len_p)
+static int hfsplus_uni2asc(struct super_block *sb, const struct hfsplus_unistr *ustr,
+		    int max_len, char *astr, int *len_p)
 {
 	const hfsplus_unichr *ip;
 	struct nls_table *nls = HFSPLUS_SB(sb)->nls;
@@ -134,8 +133,8 @@ int hfsplus_uni2asc(struct super_block *sb,
 	ip = ustr->unicode;
 
 	ustrlen = be16_to_cpu(ustr->length);
-	if (ustrlen > HFSPLUS_MAX_STRLEN) {
-		ustrlen = HFSPLUS_MAX_STRLEN;
+	if (ustrlen > max_len) {
+		ustrlen = max_len;
 		pr_err("invalid length %u has been corrected to %d\n",
 			be16_to_cpu(ustr->length), ustrlen);
 	}
@@ -256,6 +255,21 @@ int hfsplus_uni2asc(struct super_block *sb,
 	return res;
 }
 
+inline int hfsplus_uni2asc_str(struct super_block *sb,
+			       const struct hfsplus_unistr *ustr, char *astr,
+			       int *len_p)
+{
+	return hfsplus_uni2asc(sb, ustr, HFSPLUS_MAX_STRLEN, astr, len_p);
+}
+
+inline int hfsplus_uni2asc_xattr_str(struct super_block *sb,
+				     const struct hfsplus_attr_unistr *ustr,
+				     char *astr, int *len_p)
+{
+	return hfsplus_uni2asc(sb, (const struct hfsplus_unistr *)ustr,
+			       HFSPLUS_ATTR_MAX_STRLEN, astr, len_p);
+}
+
 /*
  * Convert one or more ASCII characters into a single unicode character.
  * Returns the number of ASCII characters corresponding to the unicode char.
diff --git a/fs/hfsplus/xattr.c b/fs/hfsplus/xattr.c
index 18dc3d254d218..c951fa9835aa1 100644
--- a/fs/hfsplus/xattr.c
+++ b/fs/hfsplus/xattr.c
@@ -735,9 +735,9 @@ ssize_t hfsplus_listxattr(struct dentry *dentry, char *buffer, size_t size)
 			goto end_listxattr;
 
 		xattr_name_len = NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN;
-		if (hfsplus_uni2asc(inode->i_sb,
-			(const struct hfsplus_unistr *)&fd.key->attr.key_name,
-					strbuf, &xattr_name_len)) {
+		if (hfsplus_uni2asc_xattr_str(inode->i_sb,
+					      &fd.key->attr.key_name, strbuf,
+					      &xattr_name_len)) {
 			pr_err("unicode conversion failed\n");
 			res = -EIO;
 			goto end_listxattr;
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:48:22 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368759; cv=none; b=OI8N0Z/PnY+3b3x8EoJ+q60baQXqIPjKSjyNbZckB6RUe0lQygxxNYsgLBJTOJ84wQppJJploOM2uPGY692/AycDveozjMx+HeFEgaeGAlu5IyLFL5HekSaQzsC5EpBwJOvjjV1U4Dtg/iYaKgF+f14fpvv8afIBEQlQ1v/8w2M=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368759; c=relaxed/simple;
	bh=W8vlfNt3o0qKQWL6hrZeJikf/6Y1JmTeCNRrJtoICh0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=cp4CSA9uUUe0oYXQzz+lpL0Kf2pZwwg6nHmSUFoQRq+FG7IBCZu3A2B1jwd0kbxw2J4eo1z1u2FoLdYwrmOA05NM6fQRR6pTYoxy6x+I4/M5PyyPkOfdo3G4j6yJSr24xRZULb8811hAEJ48FuTNgHikjCYh1om0j4A4Ee3x9HQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JrwmS5gl; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <[email-masked]>,
	Mark Brown <[email-masked]>,
	Will Deacon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 010/563] kselftest/arm64/gcs: Correctly check return value when disabling GCS
Date: Mon, 13 Oct 2025 16:37:51 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Weißschuh <[email-masked]>

[ Upstream commit 740cdafd0d998903c1faeee921028a8a78698be5 ]

The return value was not assigned to 'ret', so the check afterwards
does not do anything.

Fixes: 3d37d4307e0f ("kselftest/arm64: Add very basic GCS test program")
Signed-off-by: Thomas Weißschuh <[email-masked]>
Reviewed-by: Mark Brown <[email-masked]>
Signed-off-by: Will Deacon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/arm64/gcs/basic-gcs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/arm64/gcs/basic-gcs.c b/tools/testing/selftests/arm64/gcs/basic-gcs.c
index 54f9c888249d7..100d2a983155f 100644
--- a/tools/testing/selftests/arm64/gcs/basic-gcs.c
+++ b/tools/testing/selftests/arm64/gcs/basic-gcs.c
@@ -410,7 +410,7 @@ int main(void)
 	}
 
 	/* One last test: disable GCS, we can do this one time */
-	my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0);
+	ret = my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0);
 	if (ret != 0)
 		ksft_print_msg("Failed to disable GCS: %d\n", ret);
 
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:55:12 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368796; cv=none; b=WuU9m8gN85QM1Mpcbr0COmsSKDMoDAymxGr8F5jghyUhryhXWlBPNzquFaVpDu5t8jZTb9rHvK9JFN892lzqL/8i3/WrAF0yb7SrSX/28CowEj6EDKpevvI0ieNbXXwg3EUVJY56NRL7vCIt0yRR/JqX7rDLCPEP+3aewzesNoE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368796; c=relaxed/simple;
	bh=Oyfhjdus775yPi73PPBpJ7JD3XHNJ3ctSI163Qs4CQM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ArcKzXmcKbNEU4pybkdiK0PCtAgupfH4tPxjmb93v7y0765M84mAd1Jn1X6cHfhL1DHRJQu/rVr4WADOg//y63vz5QIoOAWnBHKlbWRC7GuKWUeBdqi/iajkKKuAhi9ynvaIB0A4QntDCvLEwcYl6y2pvfjJctNOrEUgkrqzHHk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dKllbNkc; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Bala-Vignesh-Reddy <[email-masked]>,
	Anshuman Khandual <[email-masked]>,
	Mark Brown <[email-masked]>,
	Will Deacon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 009/563] selftests: arm64: Fix -Waddress warning in tpidr2 test
Date: Mon, 13 Oct 2025 16:37:50 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bala-Vignesh-Reddy <[email-masked]>

[ Upstream commit 50af02425afc72b1b47c4a0a0b9c9bdaa1a1b347 ]

Thanks to -Waddress, the compiler warns that the ksft_test_result()
invocations in the arm64 tpidr2 selftest are always true. Oops.

Fix the test by, err, actually running the test functions.

Fixes: 6d80cb73131d ("kselftest/arm64: Convert tpidr2 test to use kselftest.h")
Signed-off-by: Bala-Vignesh-Reddy <[email-masked]>
Reviewed-by: Anshuman Khandual <[email-masked]>
Reviewed-by: Mark Brown <[email-masked]>
Signed-off-by: Will Deacon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/arm64/abi/tpidr2.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/arm64/abi/tpidr2.c b/tools/testing/selftests/arm64/abi/tpidr2.c
index f58a9f89b952c..4c89ab0f10101 100644
--- a/tools/testing/selftests/arm64/abi/tpidr2.c
+++ b/tools/testing/selftests/arm64/abi/tpidr2.c
@@ -227,10 +227,10 @@ int main(int argc, char **argv)
 	ret = open("/proc/sys/abi/sme_default_vector_length", O_RDONLY, 0);
 	if (ret >= 0) {
 		ksft_test_result(default_value(), "default_value\n");
-		ksft_test_result(write_read, "write_read\n");
-		ksft_test_result(write_sleep_read, "write_sleep_read\n");
-		ksft_test_result(write_fork_read, "write_fork_read\n");
-		ksft_test_result(write_clone_read, "write_clone_read\n");
+		ksft_test_result(write_read(), "write_read\n");
+		ksft_test_result(write_sleep_read(), "write_sleep_read\n");
+		ksft_test_result(write_fork_read(), "write_fork_read\n");
+		ksft_test_result(write_clone_read(), "write_clone_read\n");
 
 	} else {
 		ksft_print_msg("SME support not present\n");
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:42:43 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368794; cv=none; b=uoQVxR9hsm4e4cfsTQ9ifjJvmd52fVdRZwA7BJAoixRd7fONFGBdzeAbrnrXIrGR6wS3lqxWVg6RBkwxCS2wCqvp9w60N4LgSld6RIhe8bC3QJd8ZJ/6MovlFRDVOQEJW6VLjHEO02WktxbCYodfDZ9ZeyXXhXEkRSB4TQh+JLs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368794; c=relaxed/simple;
	bh=nI/CkcEdsK6nJucUQpVJrMmclH+VuuPOrtUXebgrhK8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ntpUMfekz1rre/ZknnmUHQtZySc8FzivOPMfhSROlPl+dNqhQeBarRubvoLar9WahGu1FTnwKFgM0fE8flmI2LRT+msWQHGUDn+0jJSwht7LckkX48ek89qOcathM7Gk2ONFVyP8Puir8Pfr5JD1/c/3AqbnIHTKPDe9xfCaKcc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=MIiVlCoz; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Bala-Vignesh-Reddy <[email-masked]>,
	Mark Brown <[email-masked]>,
	Will Deacon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 008/563] selftests: arm64: Check fread return value in exec_target
Date: Mon, 13 Oct 2025 16:37:49 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bala-Vignesh-Reddy <[email-masked]>

[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]

Fix -Wunused-result warning generated when compiled with gcc 13.3.0,
by checking fread's return value and handling errors, preventing
potential failures when reading from stdin.

Fixes compiler warning:
warning: ignoring return value of 'fread' declared with attribute
'warn_unused_result' [-Wunused-result]

Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys")

Signed-off-by: Bala-Vignesh-Reddy <[email-masked]>
Reviewed-by: Mark Brown <[email-masked]>
Signed-off-by: Will Deacon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c
index 4435600ca400d..e597861b26d6b 100644
--- a/tools/testing/selftests/arm64/pauth/exec_target.c
+++ b/tools/testing/selftests/arm64/pauth/exec_target.c
@@ -13,7 +13,12 @@ int main(void)
 	unsigned long hwcaps;
 	size_t val;
 
-	fread(&val, sizeof(size_t), 1, stdin);
+	size_t size = fread(&val, sizeof(size_t), 1, stdin);
+
+	if (size != 1) {
+		fprintf(stderr, "Could not read input from stdin\n");
+		return EXIT_FAILURE;
+	}
 
 	/* don't try to execute illegal (unimplemented) instructions) caller
 	 * should have checked this and keep worker simple
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:42:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368791; cv=none; b=NW7IpuQyz1Opj9aHEQk7qGrrGtG8+c0Jyr12xM+JvlT2+2eooD4QSQx0mY6RPQll14sipXdNSvFIVCGrZrRYHtZvZj1MB2ZtqMwR6F2YDmHzfmCkVZfTPLEKMnLMm98vsgN0eDu+1Ls4IU/SxzX1gAakoisCKh0FUWoVx4rLDj0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368791; c=relaxed/simple;
	bh=tNUxtZEcdVv45pd7JZJNJmMk2UjJMc2H9cl6Pex0kng=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ebaH1H/MhOIBpy8dxVtKbzPtUCOFwvQCgtm8WpPzOr/yONIxLvIfozOSHT+IVh7TsMtSXkqpJjbZxpHyzizS+2AQW0BZL9t7lNOMeg3nRjABbbhlgvyCDrOTNnYg9zNGAdeey0VXgn8EAgta+3BCz9VAXW9kWAvAqIB3mLTsdlY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=pW98pbmq; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Masahiro Yamada <[email-masked]>,
	Nicolas Schier <[email-masked]>,
	Kienan Stewart <[email-masked]>,
	Madhavan Srinivasan <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 007/563] kbuild: Add missing $(objtree) prefix to powerpc crtsavres.o artifact
Date: Mon, 13 Oct 2025 16:37:48 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kienan Stewart <[email-masked]>

[ Upstream commit 46104a7d3ccd2acfe508e661393add0615c27a22 ]

In the upstream commit 214c0eea43b2ea66bcd6467ea57e47ce8874191b
("kbuild: add $(objtree)/ prefix to some in-kernel build artifacts")
artifacts required for building out-of-tree kernel modules had
$(objtree) prepended to them to prepare for building in other
directories.

When building external modules for powerpc,
arch/powerpc/lib/crtsavres.o is required for certain
configurations. This artifact is missing the prepended $(objtree).

Fixes: 13b25489b6f8 ("kbuild: change working directory to external module directory with M=")
Acked-by: Masahiro Yamada <[email-masked]>
Reviewed-by: Nicolas Schier <[email-masked]>
Tested-by: Nicolas Schier <[email-masked]>
Signed-off-by: Kienan Stewart <[email-masked]>
Signed-off-by: Madhavan Srinivasan <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/powerpc/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 9753fb87217c3..a58b1029592ce 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -58,7 +58,7 @@ ifeq ($(CONFIG_PPC64)$(CONFIG_LD_IS_BFD),yy)
 # There is a corresponding test in arch/powerpc/lib/Makefile
 KBUILD_LDFLAGS_MODULE += --save-restore-funcs
 else
-KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o
+KBUILD_LDFLAGS_MODULE += $(objtree)/arch/powerpc/lib/crtsavres.o
 endif
 
 ifdef CONFIG_CPU_LITTLE_ENDIAN
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:54:14 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368785; cv=none; b=GiDgBKe5nswSE/aB+jbaJoVqKvQjTlzuasWke2a0On9hhhgCcWO+EwLNitm7I83h45z4hqTGUehvgukN0GAAlB7na7puNz2Qcd/G2gWTpF7+DGvFy+maa4s8juCLF/NbLTHIM/nELzrqB/ZRCRYh921r53MOHKRPG4iraWJTrgI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368785; c=relaxed/simple;
	bh=Xpq9UeU9QgM1qK3TsT/SPSDudQAJBEb76BIj3SxavoU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=qt1MA5Q27DBwLLi4URi3wb94NzuPhKq9C/0kVXdMVwLm2SGFjz07BuH9vXWXBgr8pK0raC2CXnqwm9Phh/9WNaatciG1LCwBTFczFh4I4oV5vxTN585whkpHkmvWvwFPIx4ySnbxLKsEMlEhdglX66m/G/DX+mQnrwfN/dzx7Ro=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gtvnPF+D; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Peter Zijlstra <[email-masked]>,
	Nathan Chancellor <[email-masked]>,
	Thomas Gleixner <[email-masked]>,
	Linus Torvalds <[email-masked]>,
	Sasha Levin <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>
Subject: [PATCH 6.17 005/563] Fix CC_HAS_ASM_GOTO_OUTPUT on non-x86 architectures
Date: Mon, 13 Oct 2025 16:37:46 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Linus Torvalds <[email-masked]>

[ Upstream commit fde0ab43b9a30d08817adc5402b69fec83a61cb8 ]

There's a silly problem with the CC_HAS_ASM_GOTO_OUTPUT test: even with
a working compiler it will fail on some architectures simply because it
uses the mnemonic "jmp" for testing the inline asm.

And as reported by Geert, not all architectures use that mnemonic, so
the test fails spuriously on such platforms (including arm and riscv,
but also several other architectures).

This issue avoided any obvious test failures because the build still
works thanks to falling back on the old non-asm-goto code, which just
generates worse code.

Just use an empty asm statement instead.

Reported-and-tested-by: Geert Uytterhoeven <[email-masked]>
Suggested-by: Peter Zijlstra <[email-masked]>
Fixes: e2ffa15b9baa ("kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17")
Cc: Nathan Chancellor <[email-masked]>
Cc: Thomas Gleixner <[email-masked]>
Signed-off-by: Linus Torvalds <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 init/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/init/Kconfig b/init/Kconfig
index e5d6d798994ae..87c868f86a060 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -102,7 +102,7 @@ config CC_HAS_ASM_GOTO_OUTPUT
 	# Detect basic support
 	depends on $(success,echo 'int foo(int x) { asm goto ("": "=r"(x) ::: bar); return x; bar: return 0; }' | $(CC) -x c - -c -o /dev/null)
 	# Detect clang (< v17) scoped label issues
-	depends on $(success,echo 'void b(void **);void* c(void);int f(void){{asm goto("jmp %l0"::::l0);return 0;l0:return 1;}void *x __attribute__((cleanup(b)))=c();{asm goto("jmp %l0"::::l1);return 2;l1:return 3;}}' | $(CC) -x c - -c -o /dev/null)
+	depends on $(success,echo 'void b(void **);void* c(void);int f(void){{asm goto(""::::l0);return 0;l0:return 1;}void *x __attribute__((cleanup(b)))=c();{asm goto(""::::l1);return 2;l1:return 3;}}' | $(CC) -x c - -c -o /dev/null)
 
 config CC_HAS_ASM_GOTO_TIED_OUTPUT
 	depends on CC_HAS_ASM_GOTO_OUTPUT
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:40:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368779; cv=none; b=G1bCqNsUej6q5hAtmZvcPwp9bIWZIieef3iIpv0VODq3Uj63GuiPFocY7lLEjH1zdfiyY3+kjCaqssJvUszf2Emk0qFrud2nImVlkJZzojrk5BisHlIcfNG4vn5Bln1gS89ouDYcDwpkXcqZxwgdmTZ6C1No9emDhgJFn68+K98=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368779; c=relaxed/simple;
	bh=dORXQrDYKByMbWopKelZ+Q7bu8pxt7/XB18UYYhlp0U=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=os5BBHWHltWdbq4uishG0HSAoqGeDGD7M6E9QgjJMLS8/5qeg+YL8rvfMsH9PRpV1pBDFAKQ3X4o4o4tisCN78AFH0D3taN7pivOJa5NzTWmwwMthrFdPR3FgN/hQzmCCdzilAUCkrr6QcC0THYWbgzsxEwf6ovjR5jQLFARTzk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=iScOys8c; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Geert Uytterhoeven <[email-masked]>,
	Martin Wilck <[email-masked]>,
	David Disseldorp <[email-masked]>,
	Christian Brauner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 003/563] init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
Date: Mon, 13 Oct 2025 16:37:44 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email-masked]>

[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ]

INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and
init/initramfs_test.c.  Hence add a dependency on BLK_DEV_INITRD, to
prevent asking the user about this feature when configuring a kernel
without initramfs support.

Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option")
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Reviewed-by: Martin Wilck <[email-masked]>
Reviewed-by: David Disseldorp <[email-masked]>
Signed-off-by: Christian Brauner <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 init/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/init/Kconfig b/init/Kconfig
index ecddb94db8dc0..e5d6d798994ae 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1504,6 +1504,7 @@ config BOOT_CONFIG_EMBED_FILE
 
 config INITRAMFS_PRESERVE_MTIME
 	bool "Preserve cpio archive mtimes in initramfs"
+	depends on BLK_DEV_INITRD
 	default y
 	help
 	  Each entry in an initramfs cpio archive carries an mtime value. When
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:54:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368776; cv=none; b=JlzHBiKMhEuGTZifXP7/YOlNZF7I9KC3IxwIOKS8jeibsSUjv3nFwacboX+URBJRRQpIy6M3GI2R/X6Ek+Rq7WaNVVTc2Wj4ZwsotFH3duSZy6G7TSO7AEkJj9MV4Nqap5i3oGyuIA8koVdIcTiW0UZf57eR5QUajYUWAPR+eK0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368776; c=relaxed/simple;
	bh=wuS2QM4fmYhe1GgCMB/vPqu+8KISjuB7oP+yhKkY4Ug=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=F0m1+HHgpkvFQCu3fdTZojj8mvqam1JhSdCIBPmlyWEE5Sri0ggWI+4m0YhWXUPtToLWPCr7XilLXfgiZv32stlJlYu5J5Dq+yrHQV6IKknDn8X/TukNvwnU3UEkIohDzB/T+wIHHGhIAr2/U2HpWsxuH+rPEBMMVgSBsDBbDqQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zFDVuVl7; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jeff Layton <[email-masked]>,
	Christian Brauner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 002/563] filelock: add FL_RECLAIM to show_fl_flags() macro
Date: Mon, 13 Oct 2025 16:37:43 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jeff Layton <[email-masked]>

[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]

Show the FL_RECLAIM flag symbolically in tracepoints.

Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims")
Signed-off-by: Jeff Layton <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Christian Brauner <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 include/trace/events/filelock.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h
index b8d1e00a7982c..2dfeb158e848a 100644
--- a/include/trace/events/filelock.h
+++ b/include/trace/events/filelock.h
@@ -27,7 +27,8 @@
 		{ FL_SLEEP,		"FL_SLEEP" },			\
 		{ FL_DOWNGRADE_PENDING,	"FL_DOWNGRADE_PENDING" },	\
 		{ FL_UNLOCK_PENDING,	"FL_UNLOCK_PENDING" },		\
-		{ FL_OFDLCK,		"FL_OFDLCK" })
+		{ FL_OFDLCK,		"FL_OFDLCK" },			\
+		{ FL_RECLAIM,		"FL_RECLAIM"})
 
 #define show_fl_type(val)				\
 	__print_symbolic(val,				\
-- 
2.51.0

From - Mon Oct 13 15:56:01 2025
Delivery-date: Mon, 13 Oct 2025 15:44:23 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368756; cv=none; b=K1OWV5YvBpnFLwiGDQ0+tbMeOvjjDqQ6Kztk3Sj76i2c8kdIUDBiRCfGJCKmgDZbRAVXpdAjfisDLnflRdAq6dsOB35ydQQ/UpoYpYWLb0iyWZpPwMPoxlUGEWN2BKHUUMuwvnfP853mG8KchxsgiMokjfxWq1XsF4OoJdz54DQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368756; c=relaxed/simple;
	bh=OLf2O4yw11047mCotEOLN0Pfyy46wZhLqNlbiU8QwuA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=FubA8ALQgoijdwGT0Db7VGgDTFMmEhX61iB6RhkITizo3TUwGO4qXgI/VLS3g1OlxkwcSzHqSRV4UORAyzbqwB9hLoI2TZ+m6ip4v5ZGcCJPO9Fxv+hIzqYKbGLOlK9pKmDCn4+2BVGuuR14EjMLUrGPOUfstDtnS68etDgW0rI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lAsqUWev; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34057C4CEE7;
	Mon, 13 Oct 2025 15:19:15 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760368755;
	bh=OLf2O4yw11047mCotEOLN0Pfyy46wZhLqNlbiU8QwuA=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=lAsqUWevEbdb1/aMwpA5SWZ3ff3oT5j6m4p1kMH5SQ3E2H9tmLTcCTYYrokEZS+Mg
	 uW2R2QXCdNOvWCDKNbLUN0nlxJEfJac+PdGnR2wG1zapnhhRk/RPPXwD0LtCIa5twX
	 teCGSOX3ekIZmDqQFUb2HTxW2jQtGaTaknaEGfyA=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Simon Schuster <[email-masked]>,
	"Guo Ren (Alibaba Damo Academy)" <[email-masked]>,
	David Hildenbrand <[email-masked]>,
	Arnd Bergmann <[email-masked]>,
	Christian Brauner <[email-masked]>,
	Sasha Levin <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>
Subject: [PATCH 6.17 001/563] arch: copy_thread: pass clone_flags as u64
Date: Mon, 13 Oct 2025 16:37:42 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Simon Schuster <[email-masked]>

[ Upstream commit bbc46b23af5bb934cd1cf066ef4342cee457a24e ]

With the introduction of clone3 in commit 7f192e3cd316 ("fork: add
clone3") the effective bit width of clone_flags on all architectures was
increased from 32-bit to 64-bit, with a new type of u64 for the flags.
However, for most consumers of clone_flags the interface was not
changed from the previous type of unsigned long.

While this works fine as long as none of the new 64-bit flag bits
(CLONE_CLEAR_SIGHAND and CLONE_INTO_CGROUP) are evaluated, this is still
undesirable in terms of the principle of least surprise.

Thus, this commit fixes all relevant interfaces of the copy_thread
function that is called from copy_process to consistently pass
clone_flags as u64, so that no truncation to 32-bit integers occurs on
32-bit architectures.

Signed-off-by: Simon Schuster <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Fixes: c5febea0956fd387 ("fork: Pass struct kernel_clone_args into copy_thread")
Acked-by: Guo Ren (Alibaba Damo Academy) <[email-masked]>
Acked-by: Andreas Larsson <[email-masked]> # sparc
Acked-by: David Hildenbrand <[email-masked]>
Acked-by: Geert Uytterhoeven <[email-masked]> # m68k
Reviewed-by: Arnd Bergmann <[email-masked]>
Signed-off-by: Christian Brauner <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/alpha/kernel/process.c      | 2 +-
 arch/arc/kernel/process.c        | 2 +-
 arch/arm/kernel/process.c        | 2 +-
 arch/arm64/kernel/process.c      | 2 +-
 arch/csky/kernel/process.c       | 2 +-
 arch/hexagon/kernel/process.c    | 2 +-
 arch/loongarch/kernel/process.c  | 2 +-
 arch/m68k/kernel/process.c       | 2 +-
 arch/microblaze/kernel/process.c | 2 +-
 arch/mips/kernel/process.c       | 2 +-
 arch/nios2/kernel/process.c      | 2 +-
 arch/openrisc/kernel/process.c   | 2 +-
 arch/parisc/kernel/process.c     | 2 +-
 arch/powerpc/kernel/process.c    | 2 +-
 arch/riscv/kernel/process.c      | 2 +-
 arch/s390/kernel/process.c       | 2 +-
 arch/sh/kernel/process_32.c      | 2 +-
 arch/sparc/kernel/process_32.c   | 2 +-
 arch/sparc/kernel/process_64.c   | 2 +-
 arch/um/kernel/process.c         | 2 +-
 arch/x86/include/asm/fpu/sched.h | 2 +-
 arch/x86/include/asm/shstk.h     | 4 ++--
 arch/x86/kernel/fpu/core.c       | 2 +-
 arch/x86/kernel/process.c        | 2 +-
 arch/x86/kernel/shstk.c          | 2 +-
 arch/xtensa/kernel/process.c     | 2 +-
 26 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index 582d96548385d..06522451f018f 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -231,7 +231,7 @@ flush_thread(void)
  */
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long usp = args->stack;
 	unsigned long tls = args->tls;
 	extern void ret_from_fork(void);
diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
index 186ceab661eb0..8166d09087130 100644
--- a/arch/arc/kernel/process.c
+++ b/arch/arc/kernel/process.c
@@ -166,7 +166,7 @@ asmlinkage void ret_from_fork(void);
  */
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long usp = args->stack;
 	unsigned long tls = args->tls;
 	struct pt_regs *c_regs;        /* child's pt_regs */
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index e16ed102960cb..d7aa95225c70b 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -234,7 +234,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
 
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long stack_start = args->stack;
 	unsigned long tls = args->tls;
 	struct thread_info *thread = task_thread_info(p);
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index 96482a1412c6a..fba7ca102a8c4 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -409,7 +409,7 @@ asmlinkage void ret_from_fork(void) asm("ret_from_fork");
 
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long stack_start = args->stack;
 	unsigned long tls = args->tls;
 	struct pt_regs *childregs = task_pt_regs(p);
diff --git a/arch/csky/kernel/process.c b/arch/csky/kernel/process.c
index 0c6e4b17fe00f..a7a90340042a5 100644
--- a/arch/csky/kernel/process.c
+++ b/arch/csky/kernel/process.c
@@ -32,7 +32,7 @@ void flush_thread(void){}
 
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long usp = args->stack;
 	unsigned long tls = args->tls;
 	struct switch_stack *childstack;
diff --git a/arch/hexagon/kernel/process.c b/arch/hexagon/kernel/process.c
index 2a77bfd756945..15b4992bfa298 100644
--- a/arch/hexagon/kernel/process.c
+++ b/arch/hexagon/kernel/process.c
@@ -52,7 +52,7 @@ void arch_cpu_idle(void)
  */
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long usp = args->stack;
 	unsigned long tls = args->tls;
 	struct thread_info *ti = task_thread_info(p);
diff --git a/arch/loongarch/kernel/process.c b/arch/loongarch/kernel/process.c
index 3582f591bab28..efd9edf65603c 100644
--- a/arch/loongarch/kernel/process.c
+++ b/arch/loongarch/kernel/process.c
@@ -167,7 +167,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 	unsigned long childksp;
 	unsigned long tls = args->tls;
 	unsigned long usp = args->stack;
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	struct pt_regs *childregs, *regs = current_pt_regs();
 
 	childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE;
diff --git a/arch/m68k/kernel/process.c b/arch/m68k/kernel/process.c
index fda7eac23f872..f5a07a70e9385 100644
--- a/arch/m68k/kernel/process.c
+++ b/arch/m68k/kernel/process.c
@@ -141,7 +141,7 @@ asmlinkage int m68k_clone3(struct pt_regs *regs)
 
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long usp = args->stack;
 	unsigned long tls = args->tls;
 	struct fork_frame {
diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c
index 56342e11442d2..6cbf642d7b801 100644
--- a/arch/microblaze/kernel/process.c
+++ b/arch/microblaze/kernel/process.c
@@ -54,7 +54,7 @@ void flush_thread(void)
 
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long usp = args->stack;
 	unsigned long tls = args->tls;
 	struct pt_regs *childregs = task_pt_regs(p);
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 02aa6a04a21da..29191fa1801e2 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -107,7 +107,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
  */
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long usp = args->stack;
 	unsigned long tls = args->tls;
 	struct thread_info *ti = task_thread_info(p);
diff --git a/arch/nios2/kernel/process.c b/arch/nios2/kernel/process.c
index f84021303f6a8..151404139085c 100644
--- a/arch/nios2/kernel/process.c
+++ b/arch/nios2/kernel/process.c
@@ -101,7 +101,7 @@ void flush_thread(void)
 
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long usp = args->stack;
 	unsigned long tls = args->tls;
 	struct pt_regs *childregs = task_pt_regs(p);
diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c
index eef99fee2110c..73ffb9fa3118b 100644
--- a/arch/openrisc/kernel/process.c
+++ b/arch/openrisc/kernel/process.c
@@ -165,7 +165,7 @@ extern asmlinkage void ret_from_fork(void);
 int
 copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long usp = args->stack;
 	unsigned long tls = args->tls;
 	struct pt_regs *userregs;
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index ed93bd8c15453..e64ab5d2a40d6 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -201,7 +201,7 @@ arch_initcall(parisc_idle_init);
 int
 copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long usp = args->stack;
 	unsigned long tls = args->tls;
 	struct pt_regs *cregs = &(p->thread.regs);
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 855e098865032..eb23966ac0a9f 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1805,7 +1805,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 			f = ret_from_kernel_user_thread;
 		} else {
 			struct pt_regs *regs = current_pt_regs();
-			unsigned long clone_flags = args->flags;
+			u64 clone_flags = args->flags;
 			unsigned long usp = args->stack;
 
 			/* Copy registers */
diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
index a0a40889d79a5..31a392993cb45 100644
--- a/arch/riscv/kernel/process.c
+++ b/arch/riscv/kernel/process.c
@@ -223,7 +223,7 @@ asmlinkage void ret_from_fork_user(struct pt_regs *regs)
 
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long usp = args->stack;
 	unsigned long tls = args->tls;
 	struct pt_regs *childregs = task_pt_regs(p);
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index f55f09cda6f88..b107dbca4ed7d 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -106,7 +106,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
 
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long new_stackp = args->stack;
 	unsigned long tls = args->tls;
 	struct fake_frame
diff --git a/arch/sh/kernel/process_32.c b/arch/sh/kernel/process_32.c
index 92b6649d49295..62f753a85b89c 100644
--- a/arch/sh/kernel/process_32.c
+++ b/arch/sh/kernel/process_32.c
@@ -89,7 +89,7 @@ asmlinkage void ret_from_kernel_thread(void);
 
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long usp = args->stack;
 	unsigned long tls = args->tls;
 	struct thread_info *ti = task_thread_info(p);
diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
index 9c7c662cb5659..5a28c0e91bf15 100644
--- a/arch/sparc/kernel/process_32.c
+++ b/arch/sparc/kernel/process_32.c
@@ -260,7 +260,7 @@ extern void ret_from_kernel_thread(void);
 
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long sp = args->stack;
 	unsigned long tls = args->tls;
 	struct thread_info *ti = task_thread_info(p);
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index 529adfecd58ca..25781923788a0 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -567,7 +567,7 @@ void fault_in_user_windows(struct pt_regs *regs)
  */
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long sp = args->stack;
 	unsigned long tls = args->tls;
 	struct thread_info *t = task_thread_info(p);
diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
index 1be644de9e41e..9c9c66dc45f05 100644
--- a/arch/um/kernel/process.c
+++ b/arch/um/kernel/process.c
@@ -143,7 +143,7 @@ static void fork_handler(void)
 
 int copy_thread(struct task_struct * p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long sp = args->stack;
 	unsigned long tls = args->tls;
 	void (*handler)(void);
diff --git a/arch/x86/include/asm/fpu/sched.h b/arch/x86/include/asm/fpu/sched.h
index c060549c6c940..89004f4ca208d 100644
--- a/arch/x86/include/asm/fpu/sched.h
+++ b/arch/x86/include/asm/fpu/sched.h
@@ -11,7 +11,7 @@
 
 extern void save_fpregs_to_fpstate(struct fpu *fpu);
 extern void fpu__drop(struct task_struct *tsk);
-extern int  fpu_clone(struct task_struct *dst, unsigned long clone_flags, bool minimal,
+extern int  fpu_clone(struct task_struct *dst, u64 clone_flags, bool minimal,
 		      unsigned long shstk_addr);
 extern void fpu_flush_thread(void);
 
diff --git a/arch/x86/include/asm/shstk.h b/arch/x86/include/asm/shstk.h
index ba6f2fe438488..0f50e01259430 100644
--- a/arch/x86/include/asm/shstk.h
+++ b/arch/x86/include/asm/shstk.h
@@ -16,7 +16,7 @@ struct thread_shstk {
 
 long shstk_prctl(struct task_struct *task, int option, unsigned long arg2);
 void reset_thread_features(void);
-unsigned long shstk_alloc_thread_stack(struct task_struct *p, unsigned long clone_flags,
+unsigned long shstk_alloc_thread_stack(struct task_struct *p, u64 clone_flags,
 				       unsigned long stack_size);
 void shstk_free(struct task_struct *p);
 int setup_signal_shadow_stack(struct ksignal *ksig);
@@ -28,7 +28,7 @@ static inline long shstk_prctl(struct task_struct *task, int option,
 			       unsigned long arg2) { return -EINVAL; }
 static inline void reset_thread_features(void) {}
 static inline unsigned long shstk_alloc_thread_stack(struct task_struct *p,
-						     unsigned long clone_flags,
+						     u64 clone_flags,
 						     unsigned long stack_size) { return 0; }
 static inline void shstk_free(struct task_struct *p) {}
 static inline int setup_signal_shadow_stack(struct ksignal *ksig) { return 0; }
diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
index aefd412a23dc2..1f71cc135e9ad 100644
--- a/arch/x86/kernel/fpu/core.c
+++ b/arch/x86/kernel/fpu/core.c
@@ -631,7 +631,7 @@ static int update_fpu_shstk(struct task_struct *dst, unsigned long ssp)
 }
 
 /* Clone current's FPU state on fork */
-int fpu_clone(struct task_struct *dst, unsigned long clone_flags, bool minimal,
+int fpu_clone(struct task_struct *dst, u64 clone_flags, bool minimal,
 	      unsigned long ssp)
 {
 	/*
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 1b7960cf6eb0c..e3a3987b0c4fb 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -159,7 +159,7 @@ __visible void ret_from_fork(struct task_struct *prev, struct pt_regs *regs,
 
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long sp = args->stack;
 	unsigned long tls = args->tls;
 	struct inactive_task_frame *frame;
diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c
index 2ddf23387c7ef..5eba6c5a67757 100644
--- a/arch/x86/kernel/shstk.c
+++ b/arch/x86/kernel/shstk.c
@@ -191,7 +191,7 @@ void reset_thread_features(void)
 	current->thread.features_locked = 0;
 }
 
-unsigned long shstk_alloc_thread_stack(struct task_struct *tsk, unsigned long clone_flags,
+unsigned long shstk_alloc_thread_stack(struct task_struct *tsk, u64 clone_flags,
 				       unsigned long stack_size)
 {
 	struct thread_shstk *shstk = &tsk->thread.shstk;
diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
index 7bd66677f7b6d..94d43f44be131 100644
--- a/arch/xtensa/kernel/process.c
+++ b/arch/xtensa/kernel/process.c
@@ -267,7 +267,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
 
 int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
 {
-	unsigned long clone_flags = args->flags;
+	u64 clone_flags = args->flags;
 	unsigned long usp_thread_fn = args->stack;
 	unsigned long tls = args->tls;
 	struct pt_regs *childregs = task_pt_regs(p);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:56:23 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369769; cv=none; b=d5XqHrJR0bqS5/TLmHpA6N97My/kYhCphbug66DKzcmNkaPL6mK4N0XUw5MApNgdz0TGufhLp24k5aMm8QoO0TMissJIPUXmY2o9vNaaY4LzVP/vaRRT0tM1+ycM+S/d/V7Fa6RN3QbapzNkDdV57wSWzQDvTHvufU0ouKRiPWY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369769; c=relaxed/simple;
	bh=ebzcmgxTGLMvVqTwX7UIy9nRl2YvK0Zek3B6BD943kA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=SJV97+/FBkG8TJ+CD/SvSE5BlfHcGW2mqsH3LtaNSOFt0uXvycKGmOCZN751NKlfpsnv4A/1zT3xlz1AqjBjQqkYdkbVk5qZiKxUXXiBfU2sk1EXcfplH4NHNU9PKPw3XukfaGHOhvDbp+Vlda5G1xrSWZ9OXxh5c/eiGx1glGI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DnSbfkmT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhi-Jun You <[email-masked]>,
	Felix Fietkau <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 361/563] wifi: mt76: mt7915: fix mt7981 pre-calibration
Date: Mon, 13 Oct 2025 16:43:42 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhi-Jun You <[email-masked]>

[ Upstream commit 2b660ee10a0c25b209d7fda3c41b821b75dd85d9 ]

In vendor driver, size of group cal and dpd cal for mt7981 includes 6G
although the chip doesn't support it.

mt76 doesn't take this into account which results in reading from the
incorrect offset.

For devices with precal, this would lead to lower bitrate.

Fix this by aligning groupcal size with vendor driver and switch to
freq_list_v2 in mt7915_dpd_freq_idx in order to get the correct offset.

Below are iwinfo of the test device with two clients connected
(iPhone 16, Intel AX210).
Before :
	Mode: Master  Channel: 36 (5.180 GHz)  HT Mode: HE80
	Center Channel 1: 42 2: unknown
	Tx-Power: 23 dBm  Link Quality: 43/70
	Signal: -67 dBm  Noise: -92 dBm
	Bit Rate: 612.4 MBit/s
	Encryption: WPA3 SAE (CCMP)
	Type: nl80211  HW Mode(s): 802.11ac/ax/n
	Hardware: embedded [MediaTek MT7981]

After:
	Mode: Master  Channel: 36 (5.180 GHz)  HT Mode: HE80
	Center Channel 1: 42 2: unknown
	Tx-Power: 23 dBm  Link Quality: 43/70
	Signal: -67 dBm  Noise: -92 dBm
	Bit Rate: 900.6 MBit/s
	Encryption: WPA3 SAE (CCMP)
	Type: nl80211  HW Mode(s): 802.11ac/ax/n
	Hardware: embedded [MediaTek MT7981]

Tested-on: mt7981 20240823

Fixes: 19a954edec63 ("wifi: mt76: mt7915: add mt7986, mt7916 and mt7981 pre-calibration")
Signed-off-by: Zhi-Jun You <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Felix Fietkau <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../wireless/mediatek/mt76/mt7915/eeprom.h    |  6 ++--
 .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 29 +++++--------------
 2 files changed, 10 insertions(+), 25 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
index 31aec0f40232a..73611c9d26e15 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
@@ -50,9 +50,9 @@ enum mt7915_eeprom_field {
 #define MT_EE_CAL_GROUP_SIZE_7975		(54 * MT_EE_CAL_UNIT + 16)
 #define MT_EE_CAL_GROUP_SIZE_7976		(94 * MT_EE_CAL_UNIT + 16)
 #define MT_EE_CAL_GROUP_SIZE_7916_6G		(94 * MT_EE_CAL_UNIT + 16)
+#define MT_EE_CAL_GROUP_SIZE_7981		(144 * MT_EE_CAL_UNIT + 16)
 #define MT_EE_CAL_DPD_SIZE_V1			(54 * MT_EE_CAL_UNIT)
 #define MT_EE_CAL_DPD_SIZE_V2			(300 * MT_EE_CAL_UNIT)
-#define MT_EE_CAL_DPD_SIZE_V2_7981		(102 * MT_EE_CAL_UNIT)	/* no 6g dpd data */
 
 #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
 #define MT_EE_WIFI_CONF0_RX_PATH		GENMASK(5, 3)
@@ -180,6 +180,8 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
 		val = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val);
 		return (val == MT_EE_V2_BAND_SEL_6GHZ) ? MT_EE_CAL_GROUP_SIZE_7916_6G :
 							 MT_EE_CAL_GROUP_SIZE_7916;
+	} else if (is_mt7981(&dev->mt76)) {
+		return MT_EE_CAL_GROUP_SIZE_7981;
 	} else if (mt7915_check_adie(dev, false)) {
 		return MT_EE_CAL_GROUP_SIZE_7976;
 	} else {
@@ -192,8 +194,6 @@ mt7915_get_cal_dpd_size(struct mt7915_dev *dev)
 {
 	if (is_mt7915(&dev->mt76))
 		return MT_EE_CAL_DPD_SIZE_V1;
-	else if (is_mt7981(&dev->mt76))
-		return MT_EE_CAL_DPD_SIZE_V2_7981;
 	else
 		return MT_EE_CAL_DPD_SIZE_V2;
 }
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 2928e75b23976..c1fdd3c4f1ba6 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -3052,30 +3052,15 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
 		/* 5G BW160 */
 		5250, 5570, 5815
 	};
-	static const u16 freq_list_v2_7981[] = {
-		/* 5G BW20 */
-		5180, 5200, 5220, 5240,
-		5260, 5280, 5300, 5320,
-		5500, 5520, 5540, 5560,
-		5580, 5600, 5620, 5640,
-		5660, 5680, 5700, 5720,
-		5745, 5765, 5785, 5805,
-		5825, 5845, 5865, 5885,
-		/* 5G BW160 */
-		5250, 5570, 5815
-	};
-	const u16 *freq_list = freq_list_v1;
-	int n_freqs = ARRAY_SIZE(freq_list_v1);
-	int idx;
+	const u16 *freq_list;
+	int idx, n_freqs;
 
 	if (!is_mt7915(&dev->mt76)) {
-		if (is_mt7981(&dev->mt76)) {
-			freq_list = freq_list_v2_7981;
-			n_freqs = ARRAY_SIZE(freq_list_v2_7981);
-		} else {
-			freq_list = freq_list_v2;
-			n_freqs = ARRAY_SIZE(freq_list_v2);
-		}
+		freq_list = freq_list_v2;
+		n_freqs = ARRAY_SIZE(freq_list_v2);
+	} else {
+		freq_list = freq_list_v1;
+		n_freqs = ARRAY_SIZE(freq_list_v1);
 	}
 
 	if (freq < 4000) {
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:56:15 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369753; cv=none; b=in54qveYe83+gE8bLyvtlxpZvaipidtnY3e8c6lEU/YbMEh4K5ekrWZ10SndBU9Hc2jykcIkbX1dIulekqSInuKTly76dObj4NQeez/eq6W9BeHqO9gcPy+FY8d/N+hFGQFSzh+4ShfdHhOBGMe4D3GdIFWWyMikt/P65sGkA5M=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369753; c=relaxed/simple;
	bh=OK2xlydCewkHyPZRm7yRz7EMnYU4hWxAM91BbxhSvY4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=SzT9DveFEMND3GY72WexhXVgb5r+VVPvsFdO0w/nu2OJaxb3eFUHkN9o3/IGLyOGk37A9MsVm5D++n7DuOFahc3haAoeTpkwhM2nAI1UtfiJBcm4JlbNqtrdHi9FSiJXonL+yoYZbLLy70QlVTb7w3Jx5DHGmaPg4LbPe04X3Us=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2lxwuReT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Lorenzo Bianconi <[email-masked]>,
	Felix Fietkau <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 357/563] wifi: mt76: mt7996: Check phy before init msta_link in mt7996_mac_sta_add_links()
Date: Mon, 13 Oct 2025 16:43:38 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lorenzo Bianconi <[email-masked]>

[ Upstream commit fe5fffadc6c77c56f122cf1042dc830f59e904bf ]

In order to avoid a possible NULL pointer dereference in
mt7996_mac_sta_init_link routine, move the phy pointer check before
running mt7996_mac_sta_init_link() in mt7996_mac_sta_add_links routine.

Fixes: dd82a9e02c054 ("wifi: mt76: mt7996: Rely on mt7996_sta_link in sta_add/sta_remove callbacks")
Signed-off-by: Lorenzo Bianconi <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Felix Fietkau <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/mediatek/mt76/mt7996/main.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index 81391db535866..d01b5778da20e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -1080,16 +1080,17 @@ mt7996_mac_sta_add_links(struct mt7996_dev *dev, struct ieee80211_vif *vif,
 			goto error_unlink;
 		}
 
-		err = mt7996_mac_sta_init_link(dev, link_conf, link_sta, link,
-					       link_id);
-		if (err)
-			goto error_unlink;
-
 		mphy = mt76_vif_link_phy(&link->mt76);
 		if (!mphy) {
 			err = -EINVAL;
 			goto error_unlink;
 		}
+
+		err = mt7996_mac_sta_init_link(dev, link_conf, link_sta, link,
+					       link_id);
+		if (err)
+			goto error_unlink;
+
 		mphy->num_sta++;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:56:25 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369112; cv=none; b=WSc1Z3d9DRj8wlyNoq/WTDviHi7yunm2uT7Uaddl4nA37TCvz/QIwT2KXzjckc29mmGmDMl5a5s8u37dUggrRWGyyCZ/RDSkiI/6fhPlBMnc/MrnQkkdyaIpHXGOdCmMd+M7oErWzL2bn8ijN6IdgnbRCxYz9U4rMLsy4IrBmog=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369112; c=relaxed/simple;
	bh=1saZZx9D8VCoXBCUAkuIu6tIftiZ0IjciToJ4WfgJlA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=CRIzRrs5Q9FepDMs/jYi5l/XUcNkPevbZ94xPPF4sH70PAOcR2A/tHekoHMcI8UInryx1akjFr1ELeOHg4nbj/ldKQmrExkLdvCPD4wI0wpM+pkDVSldRvWgbzaTY0gkzVk8eJ5fA0NPGBIXiYhrVkiQkByp7NzB9c+iLRUuYuc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gGbTlpQv; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yu Kuai <[email-masked]>,
	Nilay Shroff <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 125/563] blk-mq: remove useless checkings in blk_mq_update_nr_requests()
Date: Mon, 13 Oct 2025 16:39:46 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yu Kuai <[email-masked]>

[ Upstream commit 8bd7195fea6d9662aa3b32498a3828bfd9b63185 ]

1) queue_requests_store() is the only caller of
blk_mq_update_nr_requests(), where queue is already freezed, no need to
check mq_freeze_depth;
2) q->tag_set must be set for request based device, and queue_is_mq() is
already checked in blk_mq_queue_attr_visible(), no need to check
q->tag_set.

Signed-off-by: Yu Kuai <[email-masked]>
Reviewed-by: Nilay Shroff <[email-masked]>
Signed-off-by: Jens Axboe <[email-masked]>
Stable-dep-of: b86433721f46 ("blk-mq: fix potential deadlock while nr_requests grown")
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/blk-mq.c | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index 19b50110376c6..f5e713224d819 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -4929,21 +4929,14 @@ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr)
 {
 	struct blk_mq_tag_set *set = q->tag_set;
 	struct blk_mq_hw_ctx *hctx;
-	int ret;
+	int ret = 0;
 	unsigned long i;
 
-	if (WARN_ON_ONCE(!q->mq_freeze_depth))
-		return -EINVAL;
-
-	if (!set)
-		return -EINVAL;
-
 	if (q->nr_requests == nr)
 		return 0;
 
 	blk_mq_quiesce_queue(q);
 
-	ret = 0;
 	queue_for_each_hw_ctx(q, hctx, i) {
 		if (!hctx->tags)
 			continue;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:35:19 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367972; cv=none; b=a/K3EynnVzJqrCdd/ZXGbGJJKPepiceO/vMrsT/Ue3Qz9g2drUMll9JcHACSSJlCe+GYC18x/D2ti8rze95tdSBSqXhEd487sU/dvgeBZkFV1yCpMmtqhinzjxNWRNuuMXHNn7NWNTUoahRNb0XbbT+DYjPyRrIeCISufRws4CI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367972; c=relaxed/simple;
	bh=4DMW8scgEedPTWtu+QATTS8NWfLGZk8P00aHNWOaQx4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pmjR+m4s2ckYc6fRmzavyn5sge73gASD7Vvma4b5elFjqS3xI+O4m3ongDWVvSjATv3k0wEDes1lVNs4fV8do+Kpt6w5wh8UOcG7p1XQaZCCbESGU+Z0THKJTi41Z3SAJOPZT3+YoBwI9pUZ7IhirdotQH9WWb+U5ClAdZ8ZPbA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=U5BxKayU; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Miaoqian Lin <[email-masked]>
Subject: [PATCH 6.6 196/196] usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
Date: Mon, 13 Oct 2025 16:46:27 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miaoqian Lin <[email-masked]>

commit e9c206324eeb213957a567a9d066bdeb355c7491 upstream.

The cdnsp-pci driver uses pcim_enable_device() to enable a PCI device,
which means the device will be automatically disabled on driver detach
through the managed device framework. The manual pci_disable_device()
call in the error path is therefore redundant.

Found via static anlaysis and this is similar to commit 99ca0b57e49f
("thermal: intel: int340x: processor: Fix warning during module unload").

Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
Cc: [email-masked]
Signed-off-by: Miaoqian Lin <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/usb/cdns3/cdnsp-pci.c |    5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

--- a/drivers/usb/cdns3/cdnsp-pci.c
+++ b/drivers/usb/cdns3/cdnsp-pci.c
@@ -90,7 +90,7 @@ static int cdnsp_pci_probe(struct pci_de
 		cdnsp = kzalloc(sizeof(*cdnsp), GFP_KERNEL);
 		if (!cdnsp) {
 			ret = -ENOMEM;
-			goto disable_pci;
+			goto put_pci;
 		}
 	}
 
@@ -173,9 +173,6 @@ free_cdnsp:
 	if (!pci_is_enabled(func))
 		kfree(cdnsp);
 
-disable_pci:
-	pci_disable_device(pdev);
-
 put_pci:
 	pci_dev_put(func);

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:21:08 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367969; cv=none; b=EcwJ7l7kaltlixx9be9YOnLJXfqmQs2/HMjwuIbyDWsCAYd9Yh7VLbXPw4+H7dkW+5CnbF0Si3rTTHuWd/iunPxrbeAwq/0BZl0B0Zj4HHqvvIJ25QlljavFoj1lXwPsUCYbV6/obpDEC4gtXLT/XYtZdkgThaeckCpVBGmIwqQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367969; c=relaxed/simple;
	bh=jittC6M3nQBmKfyy0mahcwapLAezloDM6BTHkX+BHHs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=gk8FizyDUfwyVVniYEIW0np8KhjBvuF03Iga/MlrYir3sY60ltv1O7UJilSn/17HoTG2y9ItVG2teKdr+e7CaW6F5OIwLAq0dGjORQ/Wma/NLyGn8019ugDRPNN/diNkhzbnBJmMwt88p8rch5m1TmMv9Dqdae4BBDSbC0MlPZA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vihwUrEa; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Rob Clark <[email-masked]>,
	Konrad Dybcio <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Bjorn Andersson <[email-masked]>
Subject: [PATCH 6.6 195/196] arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode
Date: Mon, 13 Oct 2025 16:46:26 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Konrad Dybcio <[email-masked]>

commit 27f94b71532203b079537180924023a5f636fca1 upstream.

2290 was found in the field to also require this quirk, as long &
high-bandwidth workloads (e.g. USB ethernet) are consistently able to
crash the controller otherwise.

The same change has been made for a number of SoCs in [1], but QCM2290
somehow escaped the list (even though the very closely related SM6115
was there).

Upon a controller crash, the log would read:

xhci-hcd.12.auto: xHCI host not responding to stop endpoint command
xhci-hcd.12.auto: xHCI host controller not responding, assume dead
xhci-hcd.12.auto: HC died; cleaning up

Add snps,parkmode-disable-ss-quirk to the DWC3 instance in order to
prevent the aforementioned breakage.

[1] https://lore.kernel.org/all/[email-masked]/

Cc: [email-masked]
Reported-by: Rob Clark <[email-masked]>
Fixes: a64a0192b70c ("arm64: dts: qcom: Add initial QCM2290 device tree")
Signed-off-by: Konrad Dybcio <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Bjorn Andersson <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 arch/arm64/boot/dts/qcom/qcm2290.dtsi |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/arm64/boot/dts/qcom/qcm2290.dtsi
+++ b/arch/arm64/boot/dts/qcom/qcm2290.dtsi
@@ -1107,6 +1107,7 @@
 				snps,has-lpm-erratum;
 				snps,hird-threshold = /bits/ 8 <0x10>;
 				snps,usb3_lpm_capable;
+				snps,parkmode-disable-ss-quirk;
 				maximum-speed = "super-speed";
 				dr_mode = "otg";
 			};

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:25:09 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367968; cv=none; b=BZo6lNVAPf5hH/gqTbfS1dsH1VewaVORqO6JKmxMbQICeHust2kU3VaaOJNvvjczfCMQd+trkR2Eq0GHG5l/fvrB7yydI2CcYR7Fx9NQx5WxL7XcHPmtc08VbNPj2cTCgMrF70MuIiVzrwIty8z3YFV1BM+BXG17ee/Rrorrhdk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367968; c=relaxed/simple;
	bh=+rbnb3fNZo4A+dQk2O9tQjIkQgAgqtkOxwPs2QgSHWA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Z7jdgMCsMpA5YM2FEcL0BoI3DxDhb5oGVY2Di2nRlCizbnfq9+EHHHEptIm3FFFunIbR64/w9ZG1XM9b7pI3WrrmPfmn492TTuJdKeyRBZffcDBj9aiPm3J+KvIAu6AN/wviHrMZHo70EkrSjqSd/ejNTSixZnW+137CBaLaa0E=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Mh8C1I5z; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Heikki Krogerus <[email-masked]>,
	Neal Gompa <[email-masked]>,
	Sven Peter <[email-masked]>
Subject: [PATCH 6.6 194/196] usb: typec: tipd: Clear interrupts first
Date: Mon, 13 Oct 2025 16:46:25 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sven Peter <[email-masked]>

commit be5ae730ffa6fd774a00a4705c1e11e078b08ca1 upstream.

Right now the interrupt handler first reads all updated status registers
and only then clears the interrupts. It's possible that a duplicate
interrupt for a changed register or plug state comes in after the
interrupts have been processed but before they have been cleared:

* plug is inserted, TPS_REG_INT_PLUG_EVENT is set
* TPS_REG_INT_EVENT1 is read
* tps6598x_handle_plug_event() has run and registered the plug
* plug is removed again, TPS_REG_INT_PLUG_EVENT is set (again)
* TPS_REG_INT_CLEAR1 is written, TPS_REG_INT_PLUG_EVENT is cleared

We then have no plug connected and no pending interrupt but the tipd
core still thinks there is a plug. It's possible to trigger this with
e.g. a slightly broken Type-C to USB A converter.

Fix this by first clearing the interrupts and only then reading the
updated registers.

Fixes: 45188f27b3d0 ("usb: typec: tipd: Add support for Apple CD321X")
Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
Cc: [email-masked]
Reviewed-by: Heikki Krogerus <[email-masked]>
Reviewed-by: Neal Gompa <[email-masked]>
Signed-off-by: Sven Peter <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/usb/typec/tipd/core.c |   24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

--- a/drivers/usb/typec/tipd/core.c
+++ b/drivers/usb/typec/tipd/core.c
@@ -488,24 +488,23 @@ static irqreturn_t cd321x_interrupt(int
 	if (!event)
 		goto err_unlock;
 
+	tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event);
+
 	if (!tps6598x_read_status(tps, &status))
-		goto err_clear_ints;
+		goto err_unlock;
 
 	if (event & APPLE_CD_REG_INT_POWER_STATUS_UPDATE)
 		if (!tps6598x_read_power_status(tps))
-			goto err_clear_ints;
+			goto err_unlock;
 
 	if (event & APPLE_CD_REG_INT_DATA_STATUS_UPDATE)
 		if (!tps6598x_read_data_status(tps))
-			goto err_clear_ints;
+			goto err_unlock;
 
 	/* Handle plug insert or removal */
 	if (event & APPLE_CD_REG_INT_PLUG_EVENT)
 		tps6598x_handle_plug_event(tps, status);
 
-err_clear_ints:
-	tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event);
-
 err_unlock:
 	mutex_unlock(&tps->lock);
 
@@ -552,25 +551,24 @@ static irqreturn_t tps6598x_interrupt(in
 	if (!(event1[0] | event1[1] | event2[0] | event2[1]))
 		goto err_unlock;
 
+	tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, intev_len);
+	tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, intev_len);
+
 	if (!tps6598x_read_status(tps, &status))
-		goto err_clear_ints;
+		goto err_unlock;
 
 	if ((event1[0] | event2[0]) & TPS_REG_INT_POWER_STATUS_UPDATE)
 		if (!tps6598x_read_power_status(tps))
-			goto err_clear_ints;
+			goto err_unlock;
 
 	if ((event1[0] | event2[0]) & TPS_REG_INT_DATA_STATUS_UPDATE)
 		if (!tps6598x_read_data_status(tps))
-			goto err_clear_ints;
+			goto err_unlock;
 
 	/* Handle plug insert or removal */
 	if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT)
 		tps6598x_handle_plug_event(tps, status);
 
-err_clear_ints:
-	tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, intev_len);
-	tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, intev_len);
-
 err_unlock:
 	mutex_unlock(&tps->lock);

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:25:08 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367963; cv=none; b=cGhC//fAifxMjJqAWHMf3f89qI3SERwJnh36f2jqZZsoo2v97oKlMMp/5jLujGTHeolmhCoYgVJs8CbnkS8SHs8b6k+KzBO7TcogzOsVOLA0V79/SxJLAuQLzjSiKoRjexcCrmEwOvokt/El3lq1zZhpC/3MtenqYu0qdMnX1Ec=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367963; c=relaxed/simple;
	bh=C1mdMzvcXmfSV1i9OYR7bgg1fCRyJb8dTR8tPXTTU34=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=uhS5dlgZbvvx9MCqOSIrBfJyIxw5d1Jl+LQzdqmVMPAIKz2KkXzDSAk2nDoPsAPFHzj50q91Zs9wGfX014vAE4/k9IQSeMpRuJjIc9LyCWNleEYNveO8zsazN/b/dEHN35Z0jJlRC58mZA5rXBFjYf+iLzeYy+lON3L8OCq9glM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2NTYuhBi; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Hubert=20Wi=C5=9Bniewski?= <[email-masked]>,
	Marek Szyprowski <[email-masked]>,
	Oleksij Rempel <[email-masked]>,
	Paolo Abeni <[email-masked]>
Subject: [PATCH 6.6 193/196] net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
Date: Mon, 13 Oct 2025 16:46:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Oleksij Rempel <[email-masked]>

commit 3d3c4cd5c62f24bb3cb4511b7a95df707635e00a upstream.

Prevent USB runtime PM (autosuspend) for AX88772* in bind.

usbnet enables runtime PM (autosuspend) by default, so disabling it via
the usb_driver flag is ineffective. On AX88772B, autosuspend shows no
measurable power saving with current driver (no link partner, admin
up/down). The ~0.453 W -> ~0.248 W drop on v6.1 comes from phylib powering
the PHY off on admin-down, not from USB autosuspend.

The real hazard is that with runtime PM enabled, ndo_open() (under RTNL)
may synchronously trigger autoresume (usb_autopm_get_interface()) into
asix_resume() while the USB PM lock is held. Resume paths then invoke
phylink/phylib and MDIO, which also expect RTNL, leading to possible
deadlocks or PM lock vs MDIO wake issues.

To avoid this, keep the device runtime-PM active by taking a usage
reference in ax88772_bind() and dropping it in unbind(). A non-zero PM
usage count blocks runtime suspend regardless of userspace policy
(.../power/control - pm_runtime_allow/forbid), making this approach
robust against sysfs overrides.

Holding a runtime-PM usage ref does not affect system-wide suspend;
system sleep/resume callbacks continue to run as before.

Fixes: 4a2c7217cd5a ("net: usb: asix: ax88772: manage PHY PM from MAC")
Reported-by: Hubert Wiśniewski <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]
Tested-by: Hubert Wiśniewski <[email-masked]>
Reported-by: Marek Szyprowski <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]
Cc: [email-masked]
Signed-off-by: Oleksij Rempel <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Paolo Abeni <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/net/usb/asix_devices.c |   29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -625,6 +625,21 @@ static void ax88772_suspend(struct usbne
 		   asix_read_medium_status(dev, 1));
 }
 
+/* Notes on PM callbacks and locking context:
+ *
+ * - asix_suspend()/asix_resume() are invoked for both runtime PM and
+ *   system-wide suspend/resume. For struct usb_driver the ->resume()
+ *   callback does not receive pm_message_t, so the resume type cannot
+ *   be distinguished here.
+ *
+ * - The MAC driver must hold RTNL when calling phylink interfaces such as
+ *   phylink_suspend()/resume(). Those calls will also perform MDIO I/O.
+ *
+ * - Taking RTNL and doing MDIO from a runtime-PM resume callback (while
+ *   the USB PM lock is held) is fragile. Since autosuspend brings no
+ *   measurable power saving here, we block it by holding a PM usage
+ *   reference in ax88772_bind().
+ */
 static int asix_suspend(struct usb_interface *intf, pm_message_t message)
 {
 	struct usbnet *dev = usb_get_intfdata(intf);
@@ -919,6 +934,13 @@ static int ax88772_bind(struct usbnet *d
 	if (ret)
 		goto initphy_err;
 
+	/* Keep this interface runtime-PM active by taking a usage ref.
+	 * Prevents runtime suspend while bound and avoids resume paths
+	 * that could deadlock (autoresume under RTNL while USB PM lock
+	 * is held, phylink/MDIO wants RTNL).
+	 */
+	pm_runtime_get_noresume(&intf->dev);
+
 	return 0;
 
 initphy_err:
@@ -948,6 +970,8 @@ static void ax88772_unbind(struct usbnet
 	phylink_destroy(priv->phylink);
 	ax88772_mdio_unregister(priv);
 	asix_rx_fixup_common_free(dev->driver_priv);
+	/* Drop the PM usage ref taken in bind() */
+	pm_runtime_put(&intf->dev);
 }
 
 static void ax88178_unbind(struct usbnet *dev, struct usb_interface *intf)
@@ -1600,6 +1624,11 @@ static struct usb_driver asix_driver = {
 	.resume =	asix_resume,
 	.reset_resume =	asix_resume,
 	.disconnect =	usbnet_disconnect,
+	/* usbnet enables autosuspend by default (supports_autosuspend=1).
+	 * We keep runtime-PM active for AX88772* by taking a PM usage
+	 * reference in ax88772_bind() (pm_runtime_get_noresume()) and
+	 * dropping it in unbind(), which effectively blocks autosuspend.
+	 */
 	.supports_autosuspend = 1,
 	.disable_hub_initiated_lpm = 1,
 };

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:21:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367958; cv=none; b=ZlCw3AKLznP+zlwYto74WZEau2TQVnUU+I9pNzvEEz9rsW7mSs9yRwaFFptlXGIa4HPQ0Yj3a2BRJhdbEHP0k+Hv0ec2calKrcUtUkZqA9XQDrykTGO+//nUEVIuE7bIyoOelHPqTndEvsBVmWoc+K3uJUaLb30EvRMkqHqi2HE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367958; c=relaxed/simple;
	bh=h3RcrkUnV2HYi000SegIAWOGeTuioxaiCXmew4U1eLo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=R8RH9Bou5TcdIJegX/IABY1uVYuD3FURwvDZvEmS3ur4XAA0ml8U4ebjzwZU2zrqhPvGPuAeLPpRnNDJEUOc05gWXB6qubgUwzZ2WGlr/DvdWqebJco6e7/l38Tcg4hPTNh+K+bhjjbzX9s1eblChpgSsFaYzYYdQ+lCejJmJ/s=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Dz6QE3/K; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Salah Triki <[email-masked]>,
	Ioana Ciornei <[email-masked]>,
	Christophe Leroy <[email-masked]>
Subject: [PATCH 6.6 192/196] bus: fsl-mc: Check return value of platform_get_resource()
Date: Mon, 13 Oct 2025 16:46:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Salah Triki <[email-masked]>

commit 25f526507b8ccc6ac3a43bc094d09b1f9b0b90ae upstream.

platform_get_resource() returns NULL in case of failure, so check its
return value and propagate the error in order to prevent NULL pointer
dereference.

Fixes: 6305166c8771 ("bus: fsl-mc: Add ACPI support for fsl-mc")
Cc: [email-masked]
Signed-off-by: Salah Triki <[email-masked]>
Acked-by: Ioana Ciornei <[email-masked]>
Link: https://lore.kernel.org/r/aKwuK6TRr5XNYQ8u@pc
Signed-off-by: Christophe Leroy <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/bus/fsl-mc/fsl-mc-bus.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
@@ -1103,6 +1103,9 @@ static int fsl_mc_bus_probe(struct platf
 	 * Get physical address of MC portal for the root DPRC:
 	 */
 	plat_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!plat_res)
+		return -EINVAL;
+
 	mc_portal_phys_addr = plat_res->start;
 	mc_portal_size = resource_size(plat_res);
 	mc_portal_base_phys_addr = mc_portal_phys_addr & ~0x3ffffff;

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:34:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367953; cv=none; b=TefwK2CWX4svfYq8zqMsdFvI5nN9J2jSC9Wi11Uc6bFN4jf3Fa38L9Dm+UQRHW7DoNz9Qtnl5WNuXQb+1ls4Id52IwhFlcCVRLAhXMEp+8zZpGQ6XyAK6UKyRfi6eudfqF5PxL7T6pVU5nAVpfBEGAVeVUApv4D60/gQ38mNPGw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367953; c=relaxed/simple;
	bh=tnsnb3z1DNXaM4MPl/3ygYKUiEKD/RA3nL4W3l5g+8Q=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=mLJraIWOQ6I7UBi0V+HDsCsO7xYCXvoqW255FWEidQqHUrx8gKKAAeg1VNrGLwyiE5pYD6adbGtIDA5RU/3XVkpiB4XE/b1Ap+Kfs1ILjwjoSGCnzagWW9bSWiOQ0T+YCrXeB070TtOIvTRcUnaQrCBMVFb7T68D5yujA7KtUzI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=GxXDXNv7; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Neil Armstrong <[email-masked]>,
	Bartosz Golaszewski <[email-masked]>,
	Linus Walleij <[email-masked]>
Subject: [PATCH 6.6 191/196] pinctrl: check the return value of pinmux_ops::get_function_name()
Date: Mon, 13 Oct 2025 16:46:22 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bartosz Golaszewski <[email-masked]>

commit 4002ee98c022d671ecc1e4a84029e9ae7d8a5603 upstream.

While the API contract in docs doesn't specify it explicitly, the
generic implementation of the get_function_name() callback from struct
pinmux_ops - pinmux_generic_get_function_name() - can fail and return
NULL. This is already checked in pinmux_check_ops() so add a similar
check in pinmux_func_name_to_selector() instead of passing the returned
pointer right down to strcmp() where the NULL can get dereferenced. This
is normal operation when adding new pinfunctions.

Cc: [email-masked]
Tested-by: Neil Armstrong <[email-masked]>
Signed-off-by: Bartosz Golaszewski <[email-masked]>
Signed-off-by: Linus Walleij <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/pinctrl/pinmux.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/pinctrl/pinmux.c
+++ b/drivers/pinctrl/pinmux.c
@@ -339,7 +339,7 @@ static int pinmux_func_name_to_selector(
 	while (selector < nfuncs) {
 		const char *fname = ops->get_function_name(pctldev, selector);
 
-		if (!strcmp(function, fname))
+		if (fname && !strcmp(function, fname))
 			return selector;
 
 		selector++;

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:54:59 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367950; cv=none; b=NUuGTa3zizTnXs4GNYMems4zLblARsLmT3Bi12ewopjF95ymNubB5A/QR63abZ17z0zCvIlu6jY3s8S0RFeeqmerC2nQLs7fz9ciaeM1ltcR0JDsuH8x7ROEto3NAfZ9A/nM789yT6RvnwMYGvH8Wyo185PsyOj7CwExbVTCk1U=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367950; c=relaxed/simple;
	bh=8s0fcy/6+U5VhB/vZ0N7gAbJsYg4cJKfcfBglFt4dSY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=VtZsQ5G0PEbTigBLqTAA37lZoAOoqS2xCkUaXm02sD6DvJRSLLiMwkGHQ4DjKhf6CywJEBDwB3kytqmsTTR2/6lOKmWES/CfQ+wDA+EDv0vJfniJ5ySdmbglzPySRNIU3jvdYrp9J6ig6yfX/f9kPQL71FncxKMqfKnb84sHp7Y=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=VmArcWpv; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhen Ni <[email-masked]>,
	Mathieu Poirier <[email-masked]>
Subject: [PATCH 6.6 190/196] remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()
Date: Mon, 13 Oct 2025 16:46:21 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhen Ni <[email-masked]>

commit d41e075b077142bb9ae5df40b9ddf9fd7821a811 upstream.

pru_rproc_set_ctable() accessed rproc->priv before the IS_ERR_OR_NULL
check, which could lead to a null pointer dereference. Move the pru
assignment, ensuring we never dereference a NULL rproc pointer.

Fixes: 102853400321 ("remoteproc: pru: Add pru_rproc_set_ctable() function")
Cc: [email-masked]
Signed-off-by: Zhen Ni <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Mathieu Poirier <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/remoteproc/pru_rproc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/remoteproc/pru_rproc.c
+++ b/drivers/remoteproc/pru_rproc.c
@@ -340,7 +340,7 @@ EXPORT_SYMBOL_GPL(pru_rproc_put);
  */
 int pru_rproc_set_ctable(struct rproc *rproc, enum pru_ctable_idx c, u32 addr)
 {
-	struct pru_rproc *pru = rproc->priv;
+	struct pru_rproc *pru;
 	unsigned int reg;
 	u32 mask, set;
 	u16 idx;
@@ -352,6 +352,7 @@ int pru_rproc_set_ctable(struct rproc *r
 	if (!rproc->dev.parent || !is_pru_rproc(rproc->dev.parent))
 		return -ENODEV;
 
+	pru = rproc->priv;
 	/* pointer is 16 bit and index is 8-bit so mask out the rest */
 	idx_mask = (c >= PRU_C28) ? 0xFFFF : 0xFF;

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:55:13 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367947; cv=none; b=nscDywjeIAZRLX0aliP4CSZ26iHNs7XBMZC1o6mXMNUd3ZnoCyDEWTdpxeKMNibPusQ1W+eVztK+Gkl9qciY7TD9t3Vb0mIi9jaCdch76BeYbcPwfrWmuxxV4ECruZQLs7J1pYOWLI7u1Rn/CP4uGmrRFaBW4l4ZTf1/yLQTlJA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367947; c=relaxed/simple;
	bh=BXdePOZK4l0gKWc57ac8RDlYEyyouEJAVXqPwi2Jjk4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Zqe0Lo8m2TqeOnLLUcCC2laVh85PUmluunYMxdLke/BNwfF1OfzzcempbHPYRTNo8srGfcENLiLtVY2rIPEzarq2PhcFr9AjjNAVElK0Nr03qNKEzwvvoF3f2R7Z8yvnJBMd/sZHhn1PJzzkNTAhP79ovwMmHzvdHSAaVgoocjA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ABdnJmGd; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Lei Lu <[email-masked]>,
	Chuck Lever <[email-masked]>
Subject: [PATCH 6.6 189/196] sunrpc: fix null pointer dereference on zero-length checksum
Date: Mon, 13 Oct 2025 16:46:20 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lei Lu <[email-masked]>

commit 6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42 upstream.

In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes
checksum.data to be set to NULL. This triggers a NPD when accessing
checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that
the value of checksum.len is not less than XDR_UNIT.

Fixes: 0653028e8f1c ("SUNRPC: Convert gss_verify_header() to use xdr_stream")
Cc: [email-masked]
Signed-off-by: Lei Lu <[email-masked]>
Signed-off-by: Chuck Lever <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 net/sunrpc/auth_gss/svcauth_gss.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -724,7 +724,7 @@ svcauth_gss_verify_header(struct svc_rqs
 		rqstp->rq_auth_stat = rpc_autherr_badverf;
 		return SVC_DENIED;
 	}
-	if (flavor != RPC_AUTH_GSS) {
+	if (flavor != RPC_AUTH_GSS || checksum.len < XDR_UNIT) {
 		rqstp->rq_auth_stat = rpc_autherr_badverf;
 		return SVC_DENIED;
 	}

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:34:00 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367944; cv=none; b=q01+5N5ZuZKjPJzSoMzEdCaVX9MO4sLmZUW5GTO7dsXxYWjUniZettazYEHd+RVGCByp0xBkuiYjT3PSHNL3o7bnWbwZZwDhcet6qVz+H6GnSmznvRmnesjBqpzUpkiXff1yACL3p9xnR4furxGIUVPvTScqH5Km9hDNWnMBXxw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367944; c=relaxed/simple;
	bh=v2UOH0b8afPAFa9/Q+1i7ytvCXaqR/xEtWV0yPqpbOI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=YYQv+wGNTtDc1rxxNDVCDw6E4NqQZQAkftXsKjD+Nx5YEyWTrFHXzEc7zEyg4rWICfz+d7B4Ka35wwDyKHqNQF6D6uHv46lfys4+OBDBda81LwYijmTzHdV6D7HK4xRq7ga6jAcRbh3ziPAkeyE5EBXMAbtIMQQzXld9eYFIhmE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=K0EQFhRJ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhen Ni <[email-masked]>,
	Dmitry Torokhov <[email-masked]>
Subject: [PATCH 6.6 188/196] Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
Date: Mon, 13 Oct 2025 16:46:19 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhen Ni <[email-masked]>

commit d3366a04770eea807f2826cbdb96934dd8c9bf79 upstream.

Struct ff_effect_compat is embedded twice inside
uinput_ff_upload_compat, contains internal padding. In particular, there
is a hole after struct ff_replay to satisfy alignment requirements for
the following union member. Without clearing the structure,
copy_to_user() may leak stack data to userspace.

Initialize ff_up_compat to zero before filling valid fields.

Fixes: 2d56f3a32c0e ("Input: refactor evdev 32bit compat to be shareable with uinput")
Cc: [email-masked]
Signed-off-by: Zhen Ni <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Dmitry Torokhov <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/input/misc/uinput.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -775,6 +775,7 @@ static int uinput_ff_upload_to_user(char
 	if (in_compat_syscall()) {
 		struct uinput_ff_upload_compat ff_up_compat;
 
+		memset(&ff_up_compat, 0, sizeof(ff_up_compat));
 		ff_up_compat.request_id = ff_up->request_id;
 		ff_up_compat.retval = ff_up->retval;
 		/*

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:31:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367941; cv=none; b=D9RCGW1ck8YZ2jUJenQ5BdREUB69AsBKUsvw/dfdPdShxiMHH4yAv8yJRAWXbi2duFaB0g7iVHzY2OOP729I4JXp7bbHNzlfC+D8oYoUlL6aAUYne+vKeAshddkmznbwPvySL3TJFZk11CPJQbFR34drWTYs6FLPz83p1IzktBo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367941; c=relaxed/simple;
	bh=0V0xMzXaVvXekCX6NWKY3J8uXk5AIAkISogZwryd4Fc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=mj/cXKOFr5XxpK4WY4Om3OLZqhwqxaxNRU70TzG3PfSYuL1sF5x7MucEzuDoKQmn0bEzyJVv1Xv2DoT5PPBwsR78EjGWpUc3LrvbuzE10dRUVrTjUfoGARv+vq3djpqyj1OHW46OLBbNQm4ChW2v93oaayK4hgHxJYGUZz2aQd0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yhk3hVhP; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Marek Vasut <[email-masked]>,
	Dmitry Torokhov <[email-masked]>
Subject: [PATCH 6.6 187/196] Input: atmel_mxt_ts - allow reset GPIO to sleep
Date: Mon, 13 Oct 2025 16:46:18 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marek Vasut <[email-masked]>

commit c7866ee0a9ddd9789faadf58cdac6abd7aabf045 upstream.

The reset GPIO is not toggled in any critical section where it couldn't
sleep, allow the reset GPIO to sleep. This allows the driver to operate
reset GPIOs connected to I2C GPIO expanders.

Signed-off-by: Marek Vasut <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Cc: [email-masked]
Signed-off-by: Dmitry Torokhov <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/input/touchscreen/atmel_mxt_ts.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -3324,7 +3324,7 @@ static int mxt_probe(struct i2c_client *
 	if (data->reset_gpio) {
 		/* Wait a while and then de-assert the RESET GPIO line */
 		msleep(MXT_RESET_GPIO_TIME);
-		gpiod_set_value(data->reset_gpio, 0);
+		gpiod_set_value_cansleep(data->reset_gpio, 0);
 		msleep(MXT_RESET_INVALID_CHG);
 	}

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:25:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367939; cv=none; b=mQGhbRUKbd6w2ziVOMi92zp1k64/QHObDGjfzOx+sS431UCqpr6ErDxfADd8fID5eDkScmIgVnq8nUTzPgHrOZAEdBIBqZ5LbMF/97V1zGW2QhM+66awjuVS1bYg0EfO9N450L3RGvU98AaGkl+UqXudXC2fHwbHRgmVedPnQOo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367939; c=relaxed/simple;
	bh=PMrVlJLDRpaJlDUhJWMFRsZ5becqYUC9W8nnRSL7DKE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=INvPYr4Vt4UFdkXhl4MzHTYhof5AmqbExC2OKRjBla5B0NDJwG83SizetukivvmRJmBoMCCrhJQGkm7nYdTQ0IwvTp+Y4EHHKgLfFKKwtcZt9E5u6UzUIa6n/kJFHQmJX69+bittMjAU0A/q6b92ykMMpPuwj8Ex//uGM6MEVtc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IfrzS9YG; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Ekansh Gupta <[email-masked]>,
	Ling Xu <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Srinivas Kandagatla <[email-masked]>
Subject: [PATCH 6.6 186/196] misc: fastrpc: Skip reference for DMA handles
Date: Mon, 13 Oct 2025 16:46:17 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ling Xu <[email-masked]>

commit 10df039834f84a297c72ec962c0f9b7c8c5ca31a upstream.

If multiple dma handles are passed with same fd over a remote call
the kernel driver takes a reference and expects that put for the
map will be called as many times to free the map. But DSP only
updates the fd one time in the fd list when the DSP refcount
goes to zero and hence kernel make put call only once for the
fd. This can cause SMMU fault issue as the same fd can be used
in future for some other call.

Fixes: 35a82b87135d ("misc: fastrpc: Add dma handle implementation")
Cc: [email-masked]
Co-developed-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ling Xu <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Srinivas Kandagatla <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/misc/fastrpc.c |   45 +++++++++++++++++++++++++++------------------
 1 file changed, 27 insertions(+), 18 deletions(-)

--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -362,9 +362,8 @@ static int fastrpc_map_get(struct fastrp

 static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd,
-			    struct fastrpc_map **ppmap, bool take_ref)
+			    struct fastrpc_map **ppmap)
 {
-	struct fastrpc_session_ctx *sess = fl->sctx;
 	struct fastrpc_map *map = NULL;
 	struct dma_buf *buf;
 	int ret = -ENOENT;
@@ -378,15 +377,6 @@ static int fastrpc_map_lookup(struct fas
 		if (map->fd != fd || map->buf != buf)
 			continue;
 
-		if (take_ref) {
-			ret = fastrpc_map_get(map);
-			if (ret) {
-				dev_dbg(sess->dev, "%s: Failed to get map fd=%d ret=%d\n",
-					__func__, fd, ret);
-				break;
-			}
-		}
-
 		*ppmap = map;
 		ret = 0;
 		break;
@@ -756,7 +746,7 @@ static const struct dma_buf_ops fastrpc_
 	.release = fastrpc_release,
 };
 
-static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
+static int fastrpc_map_attach(struct fastrpc_user *fl, int fd,
 			      u64 len, u32 attr, struct fastrpc_map **ppmap)
 {
 	struct fastrpc_session_ctx *sess = fl->sctx;
@@ -764,9 +754,6 @@ static int fastrpc_map_create(struct fas
 	struct sg_table *table;
 	int err = 0;
 
-	if (!fastrpc_map_lookup(fl, fd, ppmap, true))
-		return 0;
-
 	map = kzalloc(sizeof(*map), GFP_KERNEL);
 	if (!map)
 		return -ENOMEM;
@@ -843,6 +830,24 @@ get_err:
 	return err;
 }
 
+static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
+			      u64 len, u32 attr, struct fastrpc_map **ppmap)
+{
+	struct fastrpc_session_ctx *sess = fl->sctx;
+	int err = 0;
+
+	if (!fastrpc_map_lookup(fl, fd, ppmap)) {
+		if (!fastrpc_map_get(*ppmap))
+			return 0;
+		dev_dbg(sess->dev, "%s: Failed to get map fd=%d\n",
+			__func__, fd);
+	}
+
+	err = fastrpc_map_attach(fl, fd, len, attr, ppmap);
+
+	return err;
+}
+
 /*
  * Fastrpc payload buffer with metadata looks like:
  *
@@ -915,8 +920,12 @@ static int fastrpc_create_maps(struct fa
 		    ctx->args[i].length == 0)
 			continue;
 
-		err = fastrpc_map_create(ctx->fl, ctx->args[i].fd,
-			 ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
+		if (i < ctx->nbufs)
+			err = fastrpc_map_create(ctx->fl, ctx->args[i].fd,
+				 ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
+		else
+			err = fastrpc_map_attach(ctx->fl, ctx->args[i].fd,
+				 ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
 		if (err) {
 			dev_err(dev, "Error Creating map %d\n", err);
 			return -EINVAL;
@@ -1103,7 +1112,7 @@ cleanup_fdlist:
 	for (i = 0; i < FASTRPC_MAX_FDLIST; i++) {
 		if (!fdlist[i])
 			break;
-		if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap, false))
+		if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap))
 			fastrpc_map_put(mmap);
 	}

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:33:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367936; cv=none; b=GzeiENpG0m4QvzeAyQYQBG6f1NYQTQwBu2OWqBZ59uX93al3EIV1ESltVeKifgajCO6CqdtI3BK8ppmduhpkH54YEPOMY3IXY0GiWXXE/ZN64t6pc5fI1mrUPVyjwqGr97+RBy0hjU7AjahRzrP8/aqQbzSB/cHz3Vzef77rNMU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367936; c=relaxed/simple;
	bh=5HR/iwMS+zG5GwjepctXO5JQ4r2GqXxvtEcVPcE+i/Q=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=kvb5jnwp7YzjrP1rG0xlgZKjKwkqCi/ZVgMZRVDgqN1rrQvglrPTN5gMqLQNLP6uENdPM0l3s8BtOer4bwoY/+flm42YuyQh7Zw9jVblLNW9Xfb5tSoPKosXfVrNYw+GOjbQES//yIaB5aWUNoIEz3J5W0U/5v8zkd0GgIBwV+w=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QuajIONj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Ekansh Gupta <[email-masked]>,
	Ling Xu <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Srinivas Kandagatla <[email-masked]>
Subject: [PATCH 6.6 185/196] misc: fastrpc: fix possible map leak in fastrpc_put_args
Date: Mon, 13 Oct 2025 16:46:16 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ling Xu <[email-masked]>

commit da1ba64176e0138f2bfa96f9e43e8c3640d01e1e upstream.

copy_to_user() failure would cause an early return without cleaning up
the fdlist, which has been updated by the DSP. This could lead to map
leak. Fix this by redirecting to a cleanup path on failure, ensuring
that all mapped buffers are properly released before returning.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: [email-masked]
Co-developed-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ling Xu <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Srinivas Kandagatla <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/misc/fastrpc.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1072,6 +1072,7 @@ static int fastrpc_put_args(struct fastr
 	struct fastrpc_phy_page *pages;
 	u64 *fdlist;
 	int i, inbufs, outbufs, handles;
+	int ret = 0;
 
 	inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);
 	outbufs = REMOTE_SCALARS_OUTBUFS(ctx->sc);
@@ -1087,14 +1088,17 @@ static int fastrpc_put_args(struct fastr
 			u64 len = rpra[i].buf.len;
 
 			if (!kernel) {
-				if (copy_to_user((void __user *)dst, src, len))
-					return -EFAULT;
+				if (copy_to_user((void __user *)dst, src, len)) {
+					ret = -EFAULT;
+					goto cleanup_fdlist;
+				}
 			} else {
 				memcpy(dst, src, len);
 			}
 		}
 	}
 
+cleanup_fdlist:
 	/* Clean up fdlist which is updated by DSP */
 	for (i = 0; i < FASTRPC_MAX_FDLIST; i++) {
 		if (!fdlist[i])
@@ -1103,7 +1107,7 @@ static int fastrpc_put_args(struct fastr
 			fastrpc_map_put(mmap);
 	}
 
-	return 0;
+	return ret;
 }
 
 static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx,

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:20:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367933; cv=none; b=YoH7dOadwaPkbLsMxRmC0pJXyzO7GGQDL3MMqHCJuTGAqf9bwzwG3mE1IRJtnRbc7Fr2JvVd1k6JsdTU1Vf8wnVneH1eBCzjDMcQWVBmNVZD1lpVz7bO5lHnW1LApBiu/KUmbN2UK+z7nh15TQnlcpypkuzxXSfkiBP59iznS+I=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367933; c=relaxed/simple;
	bh=7MOgHc4vFfhuoRmtguRU+eaYPGaUgnLquWQSIoqXXec=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=NlRcAcwQwbAIcvMyftNmtlP/G621QUK2zd3hgqtyaCvETZeB5Wk0Xde5X9rlY1VpJCwkkujDTXz0Dp2qifqZVpYMldLV4H192YVameRVpYtB5koRXUscesd4l5Ycy/aIs5X6ZfzUIEutAtyaTX7DZKNO9drCyjvNTz961ceJh8w=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XF2hhxyU; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Ekansh Gupta <[email-masked]>,
	Ling Xu <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Srinivas Kandagatla <[email-masked]>
Subject: [PATCH 6.6 184/196] misc: fastrpc: Fix fastrpc_map_lookup operation
Date: Mon, 13 Oct 2025 16:46:15 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ling Xu <[email-masked]>

commit 9031626ade38b092b72638dfe0c6ffce8d8acd43 upstream.

Fastrpc driver creates maps for user allocated fd buffers. Before
creating a new map, the map list is checked for any already existing
maps using map fd. Checking with just map fd is not sufficient as the
user can pass offsetted buffer with less size when the map is created
and then a larger size the next time which could result in memory
issues. Check for dma_buf object also when looking up for the map.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: [email-masked]
Co-developed-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ling Xu <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Srinivas Kandagatla <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/misc/fastrpc.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -366,11 +366,16 @@ static int fastrpc_map_lookup(struct fas
 {
 	struct fastrpc_session_ctx *sess = fl->sctx;
 	struct fastrpc_map *map = NULL;
+	struct dma_buf *buf;
 	int ret = -ENOENT;
 
+	buf = dma_buf_get(fd);
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);
+
 	spin_lock(&fl->lock);
 	list_for_each_entry(map, &fl->maps, node) {
-		if (map->fd != fd)
+		if (map->fd != fd || map->buf != buf)
 			continue;
 
 		if (take_ref) {

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:24:58 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367930; cv=none; b=hHJ/fh3bTclHimirjfma8tOKOOPwn7A2tt/UN+6zIIQPEPjmE10nGdnkJl/zffB4Lkz302bEScJVwgZj4SxTys4Zjenk0ymwPIqoAMWIIVWqe3gSc6eHh82X0+RsaPtYRgU9sprSlSrQQQcAy036Hvz+jEaNPPMRQ1SPGnBBw2s=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367930; c=relaxed/simple;
	bh=FZP9Ysg9Jrf3N1uDpouGJvH28kYv0DFuzHFU6t9feBI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=cEkRWCt6oqkjgdJd0nQ9ycwf7Ew67bycvAXRLoq6bjM02+jR/PiMHJ/M3hCKTa6Cne0StRySzChzoG/ClQW5Z4iIAon3lBr8iMlf2ln4/nz5ObYn+wdwL126n1wPCbT03hWf8e/zYKDRtWh1ScWplKfbhwxqeHJXP6m0QlYtm8w=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hdD0+FHI; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Guangshuo Li <[email-masked]>,
	Alison Schofield <[email-masked]>,
	Ira Weiny <[email-masked]>,
	Dave Jiang <[email-masked]>
Subject: [PATCH 6.6 183/196] nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
Date: Mon, 13 Oct 2025 16:46:14 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guangshuo Li <[email-masked]>

commit a9e6aa994917ee602798bbb03180a194b37865bb upstream.

devm_kcalloc() may fail. ndtest_probe() allocates three DMA address
arrays (dcr_dma, label_dma, dimm_dma) and later unconditionally uses
them in ndtest_nvdimm_init(), which can lead to a NULL pointer
dereference under low-memory conditions.

Check all three allocations and return -ENOMEM if any allocation fails,
jumping to the common error path. Do not emit an extra error message
since the allocator already warns on allocation failure.

Fixes: 9399ab61ad82 ("ndtest: Add dimms to the two buses")
Cc: [email-masked]
Signed-off-by: Guangshuo Li <[email-masked]>
Reviewed-by: Alison Schofield <[email-masked]>
Reviewed-by: Ira Weiny <[email-masked]>
Reviewed-by: Dave Jiang <[email-masked]>
Signed-off-by: Ira Weiny <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 tools/testing/nvdimm/test/ndtest.c |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

--- a/tools/testing/nvdimm/test/ndtest.c
+++ b/tools/testing/nvdimm/test/ndtest.c
@@ -845,11 +845,22 @@ static int ndtest_probe(struct platform_
 
 	p->dcr_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR,
 				 sizeof(dma_addr_t), GFP_KERNEL);
+	if (!p->dcr_dma) {
+		rc = -ENOMEM;
+		goto err;
+	}
 	p->label_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR,
 				   sizeof(dma_addr_t), GFP_KERNEL);
+	if (!p->label_dma) {
+		rc = -ENOMEM;
+		goto err;
+	}
 	p->dimm_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR,
 				  sizeof(dma_addr_t), GFP_KERNEL);
-
+	if (!p->dimm_dma) {
+		rc = -ENOMEM;
+		goto err;
+	}
 	rc = ndtest_nvdimm_init(p);
 	if (rc)
 		goto err;

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:46:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367927; cv=none; b=Iqxpx4az9oT7wtw9jViuoC1QT/bUqN0/wjVHtspmO41+NgAAdvqke2OJFmjSO/yugcDob5NwbYhM0MOmRKY+3Vq7My1KHCVv6qdlC9qs5hYtIlvaatn0Vyppnisgwc5mKEr3Vy2wkNqWzx/N6kd1485L0Mhh9FPfzQUsgtczjLg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367927; c=relaxed/simple;
	bh=bJzs2ckmW33whH9kuMSAKQKf/zJBF459J1Mm2JW739U=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=FiFNgq30JOTcbcu6HB3tRZ5gNC4VHIFfGUIZFZzVH2iQVLS4zgq9kRAL6TYg55itdR3/vRKFsmuBVg8ctk0D4XbsRhiRfMyg4FUapt0xbviARwoTqO9d2U5+LBsnh2FdHFxxN1IpA0yDW7of34O9v6IH8CQDaQuOD2OQqtb/8s4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WBKQosEw; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 029CFC4CEE7;
	Mon, 13 Oct 2025 15:05:27 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760367927;
	bh=bJzs2ckmW33whH9kuMSAKQKf/zJBF459J1Mm2JW739U=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=WBKQosEwEJYhYFAgFlvlrMD9Qm+n3Nv+LX0KEkmVWAbYjcI0n2ElATuKeSJg/gguN
	 vT5bKWY55hMaK0CIPD/bBwFOwXZQaEwP3RbOyY/tkGpVMtL4tjatXtRV6DY0hVISDz
	 lIe+Hq9PkkDJxxTouSFXI2mNyijBCcc0UNzlNzqk=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yang Shi <[email-masked]>,
	Carl Worth <[email-masked]>,
	"Christoph Lameter (Ampere)" <[email-masked]>,
	Catalin Marinas <[email-masked]>,
	David Hildenbrand <[email-masked]>,
	Oscar Salvador <[email-masked]>,
	Anshuman Khandual <[email-masked]>,
	Dev Jain <[email-masked]>,
	Muchun Song <[email-masked]>,
	Will Deacon <[email-masked]>,
	Andrew Morton <[email-masked]>
Subject: [PATCH 6.6 182/196] mm: hugetlb: avoid soft lockup when mprotect to large memory area
Date: Mon, 13 Oct 2025 16:46:13 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yang Shi <[email-masked]>

commit f52ce0ea90c83a28904c7cc203a70e6434adfecb upstream.

When calling mprotect() to a large hugetlb memory area in our customer's
workload (~300GB hugetlb memory), soft lockup was observed:

watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916]

CPU: 98 PID: 126916 Comm: t2_new_sysv Kdump: loaded Not tainted 6.17-rc7
Hardware name: GIGACOMPUTING R2A3-T40-AAV1/Jefferson CIO, BIOS 5.4.4.1 07/15/2025
pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : mte_clear_page_tags+0x14/0x24
lr : mte_sync_tags+0x1c0/0x240
sp : ffff80003150bb80
x29: ffff80003150bb80 x28: ffff00739e9705a8 x27: 0000ffd2d6a00000
x26: 0000ff8e4bc00000 x25: 00e80046cde00f45 x24: 0000000000022458
x23: 0000000000000000 x22: 0000000000000004 x21: 000000011b380000
x20: ffff000000000000 x19: 000000011b379f40 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc875e0aa5e2c
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : fffffc01ce7a5c00 x4 : 00000000046cde00 x3 : fffffc0000000000
x2 : 0000000000000004 x1 : 0000000000000040 x0 : ffff0046cde7c000

Call trace:
  mte_clear_page_tags+0x14/0x24
  set_huge_pte_at+0x25c/0x280
  hugetlb_change_protection+0x220/0x430
  change_protection+0x5c/0x8c
  mprotect_fixup+0x10c/0x294
  do_mprotect_pkey.constprop.0+0x2e0/0x3d4
  __arm64_sys_mprotect+0x24/0x44
  invoke_syscall+0x50/0x160
  el0_svc_common+0x48/0x144
  do_el0_svc+0x30/0xe0
  el0_svc+0x30/0xf0
  el0t_64_sync_handler+0xc4/0x148
  el0t_64_sync+0x1a4/0x1a8

Soft lockup is not triggered with THP or base page because there is
cond_resched() called for each PMD size.

Although the soft lockup was triggered by MTE, it should be not MTE
specific.  The other processing which takes long time in the loop may
trigger soft lockup too.

So add cond_resched() for hugetlb to avoid soft lockup.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: 8f860591ffb2 ("[PATCH] Enable mprotect on huge pages")
Signed-off-by: Yang Shi <[email-masked]>
Tested-by: Carl Worth <[email-masked]>
Reviewed-by: Christoph Lameter (Ampere) <[email-masked]>
Reviewed-by: Catalin Marinas <[email-masked]>
Acked-by: David Hildenbrand <[email-masked]>
Acked-by: Oscar Salvador <[email-masked]>
Reviewed-by: Anshuman Khandual <[email-masked]>
Reviewed-by: Dev Jain <[email-masked]>
Cc: Muchun Song <[email-masked]>
Cc: Will Deacon <[email-masked]>
Cc: <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 mm/hugetlb.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -6693,6 +6693,8 @@ long hugetlb_change_protection(struct vm
 						psize);
 		}
 		spin_unlock(ptl);
+
+		cond_resched();
 	}
 	/*
 	 * Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:52:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367992; cv=none; b=Z8Y7w+ap1M9JElSpDfIjIyphCol31SZtZHIm6JzywOBMEDSxJQITDwT4DtkO2nGWhRu1Etgr9r5iLpAlY7QjJPrOhXJdUsJq1K1BLtHePrQZjG0qD9CbdqxExXnFN21k/KZqd7e/hzi272taDxfqBYecvv6yhu9ePMZOkfn+AyA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367992; c=relaxed/simple;
	bh=Q4tKpZwpTphpKn4U5sUfd+SDG6a45WYExkMqEsHrvNU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pqIViHk76mC9azt9682Y7GLlsLPSzCaBi7F/djKEhpdyXnvaoU/RLfAB36bQB+xdu818wIcSwSa3/gKcdfIdUkn6gd2bKSIk+XYOxipA4LpmmLL9zi6NzhxB/D/27Q1XB4cp3pFS/iYyX3vCo8xH/9lqi3pMWaysk+Z7gNf+8DE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=l75nrp8a; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Jan Kara <[email-masked]>,
	Zhang Yi <[email-masked]>,
	Theodore Tso <[email-masked]>
Subject: [PATCH 6.6 181/196] ext4: fix checks for orphan inodes
Date: Mon, 13 Oct 2025 16:46:12 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jan Kara <[email-masked]>

commit acf943e9768ec9d9be80982ca0ebc4bfd6b7631e upstream.

When orphan file feature is enabled, inode can be tracked as orphan
either in the standard orphan list or in the orphan file. The first can
be tested by checking ei->i_orphan list head, the second is recorded by
EXT4_STATE_ORPHAN_FILE inode state flag. There are several places where
we want to check whether inode is tracked as orphan and only some of
them properly check for both possibilities. Luckily the consequences are
mostly minor, the worst that can happen is that we track an inode as
orphan although we don't need to and e2fsck then complains (resulting in
occasional ext4/307 xfstest failures). Fix the problem by introducing a
helper for checking whether an inode is tracked as orphan and use it in
appropriate places.

Fixes: 4a79a98c7b19 ("ext4: Improve scalability of ext4 orphan file handling")
Cc: [email-masked]
Signed-off-by: Jan Kara <[email-masked]>
Reviewed-by: Zhang Yi <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Theodore Ts'o <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 fs/ext4/ext4.h   |   10 ++++++++++
 fs/ext4/file.c   |    2 +-
 fs/ext4/inode.c  |    2 +-
 fs/ext4/orphan.c |    6 +-----
 fs/ext4/super.c  |    4 ++--
 5 files changed, 15 insertions(+), 9 deletions(-)

--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1961,6 +1961,16 @@ static inline bool ext4_verity_in_progre
 #define NEXT_ORPHAN(inode) EXT4_I(inode)->i_dtime
 
 /*
+ * Check whether the inode is tracked as orphan (either in orphan file or
+ * orphan list).
+ */
+static inline bool ext4_inode_orphan_tracked(struct inode *inode)
+{
+	return ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) ||
+		!list_empty(&EXT4_I(inode)->i_orphan);
+}
+
+/*
  * Codes for operating systems
  */
 #define EXT4_OS_LINUX		0
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -354,7 +354,7 @@ static void ext4_inode_extension_cleanup
 	 * to cleanup the orphan list in ext4_handle_inode_extension(). Do it
 	 * now.
 	 */
-	if (!list_empty(&EXT4_I(inode)->i_orphan) && inode->i_nlink) {
+	if (ext4_inode_orphan_tracked(inode) && inode->i_nlink) {
 		handle_t *handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
 
 		if (IS_ERR(handle)) {
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4370,7 +4370,7 @@ static int ext4_fill_raw_inode(struct in
 		 * old inodes get re-used with the upper 16 bits of the
 		 * uid/gid intact.
 		 */
-		if (ei->i_dtime && list_empty(&ei->i_orphan)) {
+		if (ei->i_dtime && !ext4_inode_orphan_tracked(inode)) {
 			raw_inode->i_uid_high = 0;
 			raw_inode->i_gid_high = 0;
 		} else {
--- a/fs/ext4/orphan.c
+++ b/fs/ext4/orphan.c
@@ -109,11 +109,7 @@ int ext4_orphan_add(handle_t *handle, st
 
 	WARN_ON_ONCE(!(inode->i_state & (I_NEW | I_FREEING)) &&
 		     !inode_is_locked(inode));
-	/*
-	 * Inode orphaned in orphan file or in orphan list?
-	 */
-	if (ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) ||
-	    !list_empty(&EXT4_I(inode)->i_orphan))
+	if (ext4_inode_orphan_tracked(inode))
 		return 0;
 
 	/*
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1464,9 +1464,9 @@ static void ext4_free_in_core_inode(stru
 
 static void ext4_destroy_inode(struct inode *inode)
 {
-	if (!list_empty(&(EXT4_I(inode)->i_orphan))) {
+	if (ext4_inode_orphan_tracked(inode)) {
 		ext4_msg(inode->i_sb, KERN_ERR,
-			 "Inode %lu (%p): orphan list check failed!",
+			 "Inode %lu (%p): inode tracked as orphan!",
 			 inode->i_ino, EXT4_I(inode));
 		print_hex_dump(KERN_INFO, "", DUMP_PREFIX_ADDRESS, 16, 4,
 				EXT4_I(inode), sizeof(struct ext4_inode_info),

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:33:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367989; cv=none; b=n/tcUTVvmLd+mtfBJ5bDQ4YWwPrDzzokMYtNc4uaxwmo3kBGU60/GF/RdYXcK1xXEqu9E1+hPDHfO1PgMCqOANr7ISS0T/mAM/8mStulgK54br7KNtfMXk+rRppKDkPEaLaz8ys/rd598Hv13scLnknO6VBt391LQjgtuAnNlYg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367989; c=relaxed/simple;
	bh=9yfLDeOZuJ+B+e8UF2Z5xP/+Y9rmpOWy4E6EhTholps=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=tIVKLaHE8+GFqWZNSuLOeNEbpPwu7oz2fSUnwO0gxcw27xsziYWHvfZDm2A6CInjfiU6DWKh3FB1noyCTlNI5raN2TCJ+07nzBz3EbIbG1XTxqsqy0gvJiWj2bN8lJdnWxSLhLayjCWWfjuJrY7yKbHHyGlbB7RjNYIaDXtBEPM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lKelp33v; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Matvey Kovalev <[email-masked]>,
	Namjae Jeon <[email-masked]>,
	Steve French <[email-masked]>
Subject: [PATCH 6.6 180/196] ksmbd: fix error code overwriting in smb2_get_info_filesystem()
Date: Mon, 13 Oct 2025 16:46:11 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Matvey Kovalev <[email-masked]>

commit 88daf2f448aad05a2e6df738d66fe8b0cf85cee0 upstream.

If client doesn't negotiate with SMB3.1.1 POSIX Extensions,
then proper error code won't be returned due to overwriting.

Return error immediately.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: e2f34481b24db ("cifsd: add server-side procedures for SMB3")
Cc: [email-masked]
Signed-off-by: Matvey Kovalev <[email-masked]>
Acked-by: Namjae Jeon <[email-masked]>
Signed-off-by: Steve French <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 fs/smb/server/smb2pdu.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -5596,7 +5596,8 @@ static int smb2_get_info_filesystem(stru
 
 		if (!work->tcon->posix_extensions) {
 			pr_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n");
-			rc = -EOPNOTSUPP;
+			path_put(&path);
+			return -EOPNOTSUPP;
 		} else {
 			info = (struct filesystem_posix_info *)(rsp->Buffer);
 			info->OptimalTransferSize = cpu_to_le32(stfs.f_bsize);

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:46:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367987; cv=none; b=cIJOz7ikC/FJKk/QrRjkfXAwXMR64y2bGSzQrIsDbLPelAyQyJZziSdNAzFe9nmRynEsd+9uekWhBYPJgfOMbwm/iyDFNgEaDG8DVnxFqlao1ckpG4dryOrHNT7kaBAuzLQOCaWZ4hPfIIvaYfwKI8UaFSjWPan3WMEWH/ZhgMM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367987; c=relaxed/simple;
	bh=wtUFZ3dIXdIZSr2LYfeiPx49pVoBeeenTvOWn1c1V7E=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=hhH+JmgBbz4IvhXYZkTx7TzyzmW7SwRVLRtU2PlJZkUjsNDW7PDyJTshfRkNWjArZ4wFxJb0kQoZMwT9ZfA9Wi+BbKvX/N/8/7F95lsgPJ3qsGeicKC2PttqzR+JFx/zoCWCDEh7cxfxtVPSugSWTQIgcNnSlo9Xomd7OwQCEFE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=d9ltX55I; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Youling Tang <[email-masked]>,
	Huacai Chen <[email-masked]>
Subject: [PATCH 6.6 179/196] LoongArch: Automatically disable kaslr if boot from kexec_file
Date: Mon, 13 Oct 2025 16:46:10 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Youling Tang <[email-masked]>

commit c8168b4faf1d62cbb320a3e518ad31cdd567cb05 upstream.

Automatically disable kaslr when the kernel loads from kexec_file.

kexec_file loads the secondary kernel image to a non-linked address,
inherently providing KASLR-like randomization.

However, on LoongArch where System RAM may be non-contiguous, enabling
KASLR for the second kernel may relocate it to an invalid memory region
and cause a boot failure. Thus, we disable KASLR when "kexec_file" is
detected in the command line.

To ensure compatibility with older kernels loaded via kexec_file, this
patch should be backported to stable branches.

Cc: [email-masked]
Signed-off-by: Youling Tang <[email-masked]>
Signed-off-by: Huacai Chen <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 arch/loongarch/kernel/relocate.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/arch/loongarch/kernel/relocate.c
+++ b/arch/loongarch/kernel/relocate.c
@@ -124,6 +124,10 @@ static inline __init bool kaslr_disabled
 	if (str == boot_command_line || (str > boot_command_line && *(str - 1) == ' '))
 		return true;
 
+	str = strstr(boot_command_line, "kexec_file");
+	if (str == boot_command_line || (str > boot_command_line && *(str - 1) == ' '))
+		return true;
+
 	return false;
 }

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:25:42 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367984; cv=none; b=GMDt8TnLcd9ra8E8MXz+d4ne9tfVi5NM7iDNZ1xm2K+L9YNf+0NxSAtfpG9Vx4u9cTTUx2B50Y9ZUvFERVUW8nCbO3pnpQ5tZZ/dj3HVDriIII2ohdr6QPwtD/yibbgoF2l6zQDOHXjHnMZqmHOdfnoAeFuAW60BhnbnhhjHjzc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367984; c=relaxed/simple;
	bh=pWOsfcWoSbqH0xUXdZtA5u9LR0QjGTcp1Tjsq0TzBoo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=SjHUWTsBq18C4anFdRnT78sgY2963nh107IZo2Ck4IfKwESlc0oKLC6sZ+VAWzQPy3UZS35lXwCjsaRl0Kp+gt+voT18CLAmokW8910o8DzdALNuBOaWM+vBXuO1hCt1onse+LqSOhOMBVXttrnVuyPKYlnFF7H9oVG2NpksPL4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=v7keJjuP; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zheng Qixing <[email-masked]>,
	Mikulas Patocka <[email-masked]>
Subject: [PATCH 6.6 178/196] dm: fix NULL pointer dereference in __dm_suspend()
Date: Mon, 13 Oct 2025 16:46:09 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zheng Qixing <[email-masked]>

commit 8d33a030c566e1f105cd5bf27f37940b6367f3be upstream.

There is a race condition between dm device suspend and table load that
can lead to null pointer dereference. The issue occurs when suspend is
invoked before table load completes:

BUG: kernel NULL pointer dereference, address: 0000000000000054
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
RIP: 0010:blk_mq_wait_quiesce_done+0x0/0x50
Call Trace:
  <TASK>
  blk_mq_quiesce_queue+0x2c/0x50
  dm_stop_queue+0xd/0x20
  __dm_suspend+0x130/0x330
  dm_suspend+0x11a/0x180
  dev_suspend+0x27e/0x560
  ctl_ioctl+0x4cf/0x850
  dm_ctl_ioctl+0xd/0x20
  vfs_ioctl+0x1d/0x50
  __se_sys_ioctl+0x9b/0xc0
  __x64_sys_ioctl+0x19/0x30
  x64_sys_call+0x2c4a/0x4620
  do_syscall_64+0x9e/0x1b0

The issue can be triggered as below:

T1 						T2
dm_suspend					table_load
__dm_suspend					dm_setup_md_queue
						dm_mq_init_request_queue
						blk_mq_init_allocated_queue
						=> q->mq_ops = set->ops; (1)
dm_stop_queue / dm_wait_for_completion
=> q->tag_set NULL pointer!	(2)
						=> q->tag_set = set; (3)

Fix this by checking if a valid table (map) exists before performing
request-based suspend and waiting for target I/O. When map is NULL,
skip these table-dependent suspend steps.

Even when map is NULL, no I/O can reach any target because there is
no table loaded; I/O submitted in this state will fail early in the
DM layer. Skipping the table-dependent suspend logic in this case
is safe and avoids NULL pointer dereferences.

Fixes: c4576aed8d85 ("dm: fix request-based dm's use of dm_wait_for_completion")
Cc: [email-masked]
Signed-off-by: Zheng Qixing <[email-masked]>
Signed-off-by: Mikulas Patocka <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/md/dm.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2688,7 +2688,7 @@ static int __dm_suspend(struct mapped_de
 {
 	bool do_lockfs = suspend_flags & DM_SUSPEND_LOCKFS_FLAG;
 	bool noflush = suspend_flags & DM_SUSPEND_NOFLUSH_FLAG;
-	int r;
+	int r = 0;
 
 	lockdep_assert_held(&md->suspend_lock);
 
@@ -2740,7 +2740,7 @@ static int __dm_suspend(struct mapped_de
 	 * Stop md->queue before flushing md->wq in case request-based
 	 * dm defers requests to md->wq from md->queue.
 	 */
-	if (dm_request_based(md)) {
+	if (map && dm_request_based(md)) {
 		dm_stop_queue(md->queue);
 		set_bit(DMF_QUEUE_STOPPED, &md->flags);
 	}
@@ -2752,7 +2752,8 @@ static int __dm_suspend(struct mapped_de
 	 * We call dm_wait_for_completion to wait for all existing requests
 	 * to finish.
 	 */
-	r = dm_wait_for_completion(md, task_state);
+	if (map)
+		r = dm_wait_for_completion(md, task_state);
 	if (!r)
 		set_bit(dmf_suspended_flag, &md->flags);

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:45:27 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367981; cv=none; b=A5nn12I3aSpchjljLVBJHAseJ2bi4dLfon7XM/DQKhkPf48N2MJMnOCNsQcWJ0sME4QvPpgGdVnxr1qC1yHS2wJ1DPacHohiV1h6FPbcWD6MwRcMDagXrceolXZR9qy3tDyyuM5h5aAp7D20ceJd17q1pwngE+jfY2xSYBRiw7Y=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367981; c=relaxed/simple;
	bh=+GkBuIUVw9XziaXgu7LwyQ03f2sIS5nuzQRnJr/8vPc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=I8qPhfQzrvb2tMYUEhNXxIJ6Vm3uG/YppbfcViR6GiTXBsVoyojJ6ll/JicFGr1b1rk9J1fnj9GHeuTfJBfS6V81GbG4+INt8HCvXPBQ4ZzPOF/vTFRRD6DoClr25AxY91ypDJ9gikSBVm9HYM+/y1ZtN1rplNX1Njru5VXtnjA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=M1z87T0d; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zheng Qixing <[email-masked]>,
	Mikulas Patocka <[email-masked]>
Subject: [PATCH 6.6 177/196] dm: fix queue start/stop imbalance under suspend/load/resume races
Date: Mon, 13 Oct 2025 16:46:08 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zheng Qixing <[email-masked]>

commit 7f597c2cdb9d3263a6fce07c4fc0a9eaa8e8fc43 upstream.

When suspend and load run concurrently, before q->mq_ops is set in
blk_mq_init_allocated_queue(), __dm_suspend() skip dm_stop_queue(). As a
result, the queue's quiesce depth is not incremented.

Later, once table load has finished and __dm_resume() runs, which triggers
q->quiesce_depth ==0 warning in blk_mq_unquiesce_queue():
Call Trace:
 <TASK>
 dm_start_queue+0x16/0x20 [dm_mod]
 __dm_resume+0xac/0xb0 [dm_mod]
 dm_resume+0x12d/0x150 [dm_mod]
 do_resume+0x2c2/0x420 [dm_mod]
 dev_suspend+0x30/0x130 [dm_mod]
 ctl_ioctl+0x402/0x570 [dm_mod]
 dm_ctl_ioctl+0x23/0x30 [dm_mod]

Fix this by explicitly tracking whether the request queue was
stopped in __dm_suspend() via a new DMF_QUEUE_STOPPED flag.
Only call dm_start_queue() in __dm_resume() if the queue was
actually stopped.

Fixes: e70feb8b3e68 ("blk-mq: support concurrent queue quiesce/unquiesce")
Cc: [email-masked]
Signed-off-by: Zheng Qixing <[email-masked]>
Signed-off-by: Mikulas Patocka <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/md/dm-core.h |    1 +
 drivers/md/dm.c      |    8 +++++---
 2 files changed, 6 insertions(+), 3 deletions(-)

--- a/drivers/md/dm-core.h
+++ b/drivers/md/dm-core.h
@@ -161,6 +161,7 @@ struct mapped_device {
 #define DMF_SUSPENDED_INTERNALLY 7
 #define DMF_POST_SUSPENDING 8
 #define DMF_EMULATE_ZONE_APPEND 9
+#define DMF_QUEUE_STOPPED 10
 
 void disable_discard(struct mapped_device *md);
 void disable_write_zeroes(struct mapped_device *md);
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2740,8 +2740,10 @@ static int __dm_suspend(struct mapped_de
 	 * Stop md->queue before flushing md->wq in case request-based
 	 * dm defers requests to md->wq from md->queue.
 	 */
-	if (dm_request_based(md))
+	if (dm_request_based(md)) {
 		dm_stop_queue(md->queue);
+		set_bit(DMF_QUEUE_STOPPED, &md->flags);
+	}
 
 	flush_workqueue(md->wq);
 
@@ -2763,7 +2765,7 @@ static int __dm_suspend(struct mapped_de
 	if (r < 0) {
 		dm_queue_flush(md);
 
-		if (dm_request_based(md))
+		if (test_and_clear_bit(DMF_QUEUE_STOPPED, &md->flags))
 			dm_start_queue(md->queue);
 
 		unlock_fs(md);
@@ -2847,7 +2849,7 @@ static int __dm_resume(struct mapped_dev
 	 * so that mapping of targets can work correctly.
 	 * Request-based dm is queueing the deferred I/Os in its request_queue.
 	 */
-	if (dm_request_based(md))
+	if (test_and_clear_bit(DMF_QUEUE_STOPPED, &md->flags))
 		dm_start_queue(md->queue);
 
 	unlock_fs(md);

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:32:16 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367978; cv=none; b=taEVHSPxM9lUEsLQMyDz9DiE1vFz9O8bTaTsNtgpAY3B5wWwVWS/Yw8oKaX2zwsoCiIZIUCf/465ENBYGG3BM7g2e30BklyqQB0TeqWYkBmDAPpVvwEkzurXwzF0qc9pd+v9HEiuI9BwGhfFWAeKpOqdnC1zPsvXFq/w+77GtB8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367978; c=relaxed/simple;
	bh=Xg/V4XGWSZPZQPB4HNqA28Fzg4Fb1+lAesxqCfnAQRU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=AwKTC1j3vRQu/BdUFGTamBr46yQEiVFNkDepAHAEWOE2X4K3gBohFzzyL3rFPaW8FmJYTJ89WDYvnmi61PB3Iu1c7j43bKzriA81YAEjeb8V6bmdzPEZGGYyOFRxX+bcfVl+WY6u8srl4MKTmOqUrFEJ74eqyPdzNprvGRNDZgM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0fKDq6tQ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Bartosz Golaszewski <[email-masked]>,
	Linus Walleij <[email-masked]>,
	Lee Jones <[email-masked]>
Subject: [PATCH 6.6 176/196] mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
Date: Mon, 13 Oct 2025 16:46:07 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bartosz Golaszewski <[email-masked]>

commit 1efbee6852f1ff698a9981bd731308dd027189fb upstream.

Commit 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
removed the return value check from the call to gpiochip_add_data() (or
rather gpiochip_add() back then and later converted to devres) with no
explanation. This function however can still fail, so check the return
value and bail-out if it does.

Cc: [email-masked]
Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
Signed-off-by: Bartosz Golaszewski <[email-masked]>
Reviewed-by: Linus Walleij <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Lee Jones <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/mfd/vexpress-sysreg.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/mfd/vexpress-sysreg.c
+++ b/drivers/mfd/vexpress-sysreg.c
@@ -90,6 +90,7 @@ static int vexpress_sysreg_probe(struct
 	struct resource *mem;
 	void __iomem *base;
 	struct gpio_chip *mmc_gpio_chip;
+	int ret;
 
 	mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (!mem)
@@ -110,7 +111,10 @@ static int vexpress_sysreg_probe(struct
 	bgpio_init(mmc_gpio_chip, &pdev->dev, 0x4, base + SYS_MCI,
 			NULL, NULL, NULL, NULL, 0);
 	mmc_gpio_chip->ngpio = 2;
-	devm_gpiochip_add_data(&pdev->dev, mmc_gpio_chip, NULL);
+
+	ret = devm_gpiochip_add_data(&pdev->dev, mmc_gpio_chip, NULL);
+	if (ret)
+		return ret;
 
 	return devm_mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO,
 			vexpress_sysreg_cells,

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:44:04 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367975; cv=none; b=shm5FH4y52AvDahZV3af//WdJLxM8NvqUTP9iEVjYAKYb/xMz+pFU0vvN6O7u3dv3Cy1WUO687DmXEBMoqxchAd0RQY8pUp7dPW9IZz+L4WZLOzBi8RrOicrFXUalViZ/RxLRmi+eJ0Z4Uyyij21cf7Rjrbvgg31YWXMzEJWsVM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367975; c=relaxed/simple;
	bh=IMBsuHDDo5ZsSKPzUIWX6jU4YEQp7VCs8bqDPZbEN6A=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=RhmXhpNXp1m0x0pXk22HV0Cl14k7O0+8kKLcTKi8lBDxAPIBHcdIwv8CLa6Pc0gUL4twsZFSAB635gpkFYWXLwT4Q4Dw02bS96eN3VZ8fGHvPGOTz3kkaaOKa/DWUztLa2fUuOZtOsF6uHarLfJAsC9Gv03+/G7bnVS4NPIjzZ0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=UdaGTIhY; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Cosmin Tanislav <[email-masked]>,
	Biju Das <[email-masked]>,
	Lee Jones <[email-masked]>
Subject: [PATCH 6.6 175/196] mfd: rz-mtu3: Fix MTU5 NFCR register offset
Date: Mon, 13 Oct 2025 16:46:06 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Cosmin Tanislav <[email-masked]>

commit da32b0e82c523b76265ba1ad25d7ea74f0ece402 upstream.

The NFCR register for MTU5 is at 0x1a95 offset according to Datasheet
Page 725, Table 16.4. The address of all registers is offset by 0x1200,
making the proper address of MTU5 NFCR register be 0x895.

Cc: [email-masked]
Fixes: 654c293e1687 ("mfd: Add Renesas RZ/G2L MTU3a core driver")
Signed-off-by: Cosmin Tanislav <[email-masked]>
Reviewed-by: Biju Das <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Lee Jones <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/mfd/rz-mtu3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/rz-mtu3.c b/drivers/mfd/rz-mtu3.c
index f3dac4a29a83..9cdfef610398 100644
--- a/drivers/mfd/rz-mtu3.c
+++ b/drivers/mfd/rz-mtu3.c
@@ -32,7 +32,7 @@ static const unsigned long rz_mtu3_8bit_ch_reg_offs[][13] = {
 	[RZ_MTU3_CHAN_2] = MTU_8BIT_CH_1_2(0x204, 0x092, 0x205, 0x200, 0x20c, 0x201, 0x202),
 	[RZ_MTU3_CHAN_3] = MTU_8BIT_CH_3_4_6_7(0x008, 0x093, 0x02c, 0x000, 0x04c, 0x002, 0x004, 0x005, 0x038),
 	[RZ_MTU3_CHAN_4] = MTU_8BIT_CH_3_4_6_7(0x009, 0x094, 0x02d, 0x001, 0x04d, 0x003, 0x006, 0x007, 0x039),
-	[RZ_MTU3_CHAN_5] = MTU_8BIT_CH_5(0xab2, 0x1eb, 0xab4, 0xab6, 0xa84, 0xa85, 0xa86, 0xa94, 0xa95, 0xa96, 0xaa4, 0xaa5, 0xaa6),
+	[RZ_MTU3_CHAN_5] = MTU_8BIT_CH_5(0xab2, 0x895, 0xab4, 0xab6, 0xa84, 0xa85, 0xa86, 0xa94, 0xa95, 0xa96, 0xaa4, 0xaa5, 0xaa6),
 	[RZ_MTU3_CHAN_6] = MTU_8BIT_CH_3_4_6_7(0x808, 0x893, 0x82c, 0x800, 0x84c, 0x802, 0x804, 0x805, 0x838),
 	[RZ_MTU3_CHAN_7] = MTU_8BIT_CH_3_4_6_7(0x809, 0x894, 0x82d, 0x801, 0x84d, 0x803, 0x806, 0x807, 0x839),
 	[RZ_MTU3_CHAN_8] = MTU_8BIT_CH_8(0x404, 0x098, 0x400, 0x406, 0x401, 0x402, 0x403)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:32:48 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367956; cv=none; b=E9C2Izl1oi1P3CuGTGNVF0d8x8v2kwUXevQoUJ3ItJCOgPhtXWD9b9AOZJHGCu1CVPYGezjr9ndTVBql5yXzO2L37pBU0zlx3Sc93+5tq2uVX3Sczh6GG/4x/+gHil1A3Lsjuht75n39Xosm7jeqXAHjknjEeIFFk5ecFAQi4y0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367956; c=relaxed/simple;
	bh=ygVkbfJeL+VEiKj5mInrR8zVc5PqNTOBtiPJFTY5nas=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bg6n6jRZm6huqzac3n8nP9woHvUD/R8e+5fVsjnzur50VD77mlZ44bjfK1hGFKegpBDm969rkgVAStFBWXUejnL1q09Too+C6A/yHLrIh36+jAJ2RvuSndsVhCKlA0LTsEFCvnF6bb1674hjJLPH/XdMDVfkpq7JZUah1I4pM+Q=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Yrs0jc3L; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Deepak Sharma <[email-masked]>,
	Vadim Fedorenko <[email-masked]>,
	Paolo Abeni <[email-masked]>
Subject: [PATCH 6.6 174/196] net: nfc: nci: Add parameter validation for packet data
Date: Mon, 13 Oct 2025 16:46:05 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: syzkaller.appspot.com]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Deepak Sharma <[email-masked]>

commit 9c328f54741bd5465ca1dc717c84c04242fac2e1 upstream.

Syzbot reported an uninitialized value bug in nci_init_req, which was
introduced by commit 5aca7966d2a7 ("Merge tag
'perf-tools-fixes-for-v6.17-2025-09-16' of
git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools").

This bug arises due to very limited and poor input validation
that was done at nic_valid_size(). This validation only
validates the skb->len (directly reflects size provided at the
userspace interface) with the length provided in the buffer
itself (interpreted as NCI_HEADER). This leads to the processing
of memory content at the address assuming the correct layout
per what opcode requires there. This leads to the accesses to
buffer of `skb_buff->data` which is not assigned anything yet.

Following the same silent drop of packets of invalid sizes at
`nic_valid_size()`, add validation of the data in the respective
handlers and return error values in case of failure. Release
the skb if error values are returned from handlers in
`nci_nft_packet` and effectively do a silent drop

Possible TODO: because we silently drop the packets, the
call to `nci_request` will be waiting for completion of request
and will face timeouts. These timeouts can get excessively logged
in the dmesg. A proper handling of them may require to export
`nci_request_cancel` (or propagate error handling from the
nft packets handlers).

Reported-by: [email-masked]
Closes: https://syzkaller.appspot.com/bug?extid=740e04c2a93467a0f8c8
Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation")
Tested-by: [email-masked]
Cc: [email-masked]
Signed-off-by: Deepak Sharma <[email-masked]>
Reviewed-by: Vadim Fedorenko <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Paolo Abeni <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 net/nfc/nci/ntf.c |  135 +++++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 99 insertions(+), 36 deletions(-)

--- a/net/nfc/nci/ntf.c
+++ b/net/nfc/nci/ntf.c
@@ -27,11 +27,16 @@
 
 /* Handle NCI Notification packets */
 
-static void nci_core_reset_ntf_packet(struct nci_dev *ndev,
-				      const struct sk_buff *skb)
+static int nci_core_reset_ntf_packet(struct nci_dev *ndev,
+				     const struct sk_buff *skb)
 {
 	/* Handle NCI 2.x core reset notification */
-	const struct nci_core_reset_ntf *ntf = (void *)skb->data;
+	const struct nci_core_reset_ntf *ntf;
+
+	if (skb->len < sizeof(struct nci_core_reset_ntf))
+		return -EINVAL;
+
+	ntf = (struct nci_core_reset_ntf *)skb->data;
 
 	ndev->nci_ver = ntf->nci_ver;
 	pr_debug("nci_ver 0x%x, config_status 0x%x\n",
@@ -42,15 +47,22 @@ static void nci_core_reset_ntf_packet(st
 		__le32_to_cpu(ntf->manufact_specific_info);
 
 	nci_req_complete(ndev, NCI_STATUS_OK);
+
+	return 0;
 }
 
-static void nci_core_conn_credits_ntf_packet(struct nci_dev *ndev,
-					     struct sk_buff *skb)
+static int nci_core_conn_credits_ntf_packet(struct nci_dev *ndev,
+					    struct sk_buff *skb)
 {
-	struct nci_core_conn_credit_ntf *ntf = (void *) skb->data;
+	struct nci_core_conn_credit_ntf *ntf;
 	struct nci_conn_info *conn_info;
 	int i;
 
+	if (skb->len < sizeof(struct nci_core_conn_credit_ntf))
+		return -EINVAL;
+
+	ntf = (struct nci_core_conn_credit_ntf *)skb->data;
+
 	pr_debug("num_entries %d\n", ntf->num_entries);
 
 	if (ntf->num_entries > NCI_MAX_NUM_CONN)
@@ -68,7 +80,7 @@ static void nci_core_conn_credits_ntf_pa
 		conn_info = nci_get_conn_info_by_conn_id(ndev,
 							 ntf->conn_entries[i].conn_id);
 		if (!conn_info)
-			return;
+			return 0;
 
 		atomic_add(ntf->conn_entries[i].credits,
 			   &conn_info->credits_cnt);
@@ -77,12 +89,19 @@ static void nci_core_conn_credits_ntf_pa
 	/* trigger the next tx */
 	if (!skb_queue_empty(&ndev->tx_q))
 		queue_work(ndev->tx_wq, &ndev->tx_work);
+
+	return 0;
 }
 
-static void nci_core_generic_error_ntf_packet(struct nci_dev *ndev,
-					      const struct sk_buff *skb)
+static int nci_core_generic_error_ntf_packet(struct nci_dev *ndev,
+					     const struct sk_buff *skb)
 {
-	__u8 status = skb->data[0];
+	__u8 status;
+
+	if (skb->len < 1)
+		return -EINVAL;
+
+	status = skb->data[0];
 
 	pr_debug("status 0x%x\n", status);
 
@@ -91,12 +110,19 @@ static void nci_core_generic_error_ntf_p
 		   (the state remains the same) */
 		nci_req_complete(ndev, status);
 	}
+
+	return 0;
 }
 
-static void nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev,
-						struct sk_buff *skb)
+static int nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev,
+					       struct sk_buff *skb)
 {
-	struct nci_core_intf_error_ntf *ntf = (void *) skb->data;
+	struct nci_core_intf_error_ntf *ntf;
+
+	if (skb->len < sizeof(struct nci_core_intf_error_ntf))
+		return -EINVAL;
+
+	ntf = (struct nci_core_intf_error_ntf *)skb->data;
 
 	ntf->conn_id = nci_conn_id(&ntf->conn_id);
 
@@ -105,6 +131,8 @@ static void nci_core_conn_intf_error_ntf
 	/* complete the data exchange transaction, if exists */
 	if (test_bit(NCI_DATA_EXCHANGE, &ndev->flags))
 		nci_data_exchange_complete(ndev, NULL, ntf->conn_id, -EIO);
+
+	return 0;
 }
 
 static const __u8 *
@@ -329,13 +357,18 @@ void nci_clear_target_list(struct nci_de
 	ndev->n_targets = 0;
 }
 
-static void nci_rf_discover_ntf_packet(struct nci_dev *ndev,
-				       const struct sk_buff *skb)
+static int nci_rf_discover_ntf_packet(struct nci_dev *ndev,
+				      const struct sk_buff *skb)
 {
 	struct nci_rf_discover_ntf ntf;
-	const __u8 *data = skb->data;
+	const __u8 *data;
 	bool add_target = true;
 
+	if (skb->len < sizeof(struct nci_rf_discover_ntf))
+		return -EINVAL;
+
+	data = skb->data;
+
 	ntf.rf_discovery_id = *data++;
 	ntf.rf_protocol = *data++;
 	ntf.rf_tech_and_mode = *data++;
@@ -390,6 +423,8 @@ static void nci_rf_discover_ntf_packet(s
 		nfc_targets_found(ndev->nfc_dev, ndev->targets,
 				  ndev->n_targets);
 	}
+
+	return 0;
 }
 
 static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev,
@@ -531,14 +566,19 @@ static int nci_store_general_bytes_nfc_d
 	return NCI_STATUS_OK;
 }
 
-static void nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
-					     const struct sk_buff *skb)
+static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
+					    const struct sk_buff *skb)
 {
 	struct nci_conn_info *conn_info;
 	struct nci_rf_intf_activated_ntf ntf;
-	const __u8 *data = skb->data;
+	const __u8 *data;
 	int err = NCI_STATUS_OK;
 
+	if (skb->len < sizeof(struct nci_rf_intf_activated_ntf))
+		return -EINVAL;
+
+	data = skb->data;
+
 	ntf.rf_discovery_id = *data++;
 	ntf.rf_interface = *data++;
 	ntf.rf_protocol = *data++;
@@ -645,7 +685,7 @@ exit:
 	if (err == NCI_STATUS_OK) {
 		conn_info = ndev->rf_conn_info;
 		if (!conn_info)
-			return;
+			return 0;
 
 		conn_info->max_pkt_payload_len = ntf.max_data_pkt_payload_size;
 		conn_info->initial_num_credits = ntf.initial_num_credits;
@@ -691,19 +731,26 @@ listen:
 				pr_err("error when signaling tm activation\n");
 		}
 	}
+
+	return 0;
 }
 
-static void nci_rf_deactivate_ntf_packet(struct nci_dev *ndev,
-					 const struct sk_buff *skb)
+static int nci_rf_deactivate_ntf_packet(struct nci_dev *ndev,
+					const struct sk_buff *skb)
 {
 	const struct nci_conn_info *conn_info;
-	const struct nci_rf_deactivate_ntf *ntf = (void *)skb->data;
+	const struct nci_rf_deactivate_ntf *ntf;
+
+	if (skb->len < sizeof(struct nci_rf_deactivate_ntf))
+		return -EINVAL;
+
+	ntf = (struct nci_rf_deactivate_ntf *)skb->data;
 
 	pr_debug("entry, type 0x%x, reason 0x%x\n", ntf->type, ntf->reason);
 
 	conn_info = ndev->rf_conn_info;
 	if (!conn_info)
-		return;
+		return 0;
 
 	/* drop tx data queue */
 	skb_queue_purge(&ndev->tx_q);
@@ -735,14 +782,20 @@ static void nci_rf_deactivate_ntf_packet
 	}
 
 	nci_req_complete(ndev, NCI_STATUS_OK);
+
+	return 0;
 }
 
-static void nci_nfcee_discover_ntf_packet(struct nci_dev *ndev,
-					  const struct sk_buff *skb)
+static int nci_nfcee_discover_ntf_packet(struct nci_dev *ndev,
+					 const struct sk_buff *skb)
 {
 	u8 status = NCI_STATUS_OK;
-	const struct nci_nfcee_discover_ntf *nfcee_ntf =
-				(struct nci_nfcee_discover_ntf *)skb->data;
+	const struct nci_nfcee_discover_ntf *nfcee_ntf;
+
+	if (skb->len < sizeof(struct nci_nfcee_discover_ntf))
+		return -EINVAL;
+
+	nfcee_ntf = (struct nci_nfcee_discover_ntf *)skb->data;
 
 	/* NFCForum NCI 9.2.1 HCI Network Specific Handling
 	 * If the NFCC supports the HCI Network, it SHALL return one,
@@ -753,6 +806,8 @@ static void nci_nfcee_discover_ntf_packe
 	ndev->cur_params.id = nfcee_ntf->nfcee_id;
 
 	nci_req_complete(ndev, status);
+
+	return 0;
 }
 
 void nci_ntf_packet(struct nci_dev *ndev, struct sk_buff *skb)
@@ -779,35 +834,43 @@ void nci_ntf_packet(struct nci_dev *ndev
 
 	switch (ntf_opcode) {
 	case NCI_OP_CORE_RESET_NTF:
-		nci_core_reset_ntf_packet(ndev, skb);
+		if (nci_core_reset_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_CORE_CONN_CREDITS_NTF:
-		nci_core_conn_credits_ntf_packet(ndev, skb);
+		if (nci_core_conn_credits_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_CORE_GENERIC_ERROR_NTF:
-		nci_core_generic_error_ntf_packet(ndev, skb);
+		if (nci_core_generic_error_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_CORE_INTF_ERROR_NTF:
-		nci_core_conn_intf_error_ntf_packet(ndev, skb);
+		if (nci_core_conn_intf_error_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_RF_DISCOVER_NTF:
-		nci_rf_discover_ntf_packet(ndev, skb);
+		if (nci_rf_discover_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_RF_INTF_ACTIVATED_NTF:
-		nci_rf_intf_activated_ntf_packet(ndev, skb);
+		if (nci_rf_intf_activated_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_RF_DEACTIVATE_NTF:
-		nci_rf_deactivate_ntf_packet(ndev, skb);
+		if (nci_rf_deactivate_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_NFCEE_DISCOVER_NTF:
-		nci_nfcee_discover_ntf_packet(ndev, skb);
+		if (nci_nfcee_discover_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_RF_NFCEE_ACTION_NTF:

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:30:42 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367924; cv=none; b=QzNj9alpnyCSVvS8nOUADCm5gb4fhBIVx1ZlcPEbcypRPv5WzYrsdgZY2NFW455IP/yWHaiKSfziV1WTB9r/0Cyl6stTG4M6fYxSGYsAYqcX1nfhz0QYgdyigAVEG3DgOwfxli9B1HsqV4VJfFMDLB/fLwsltC1aLQ8xbx2nz58=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367924; c=relaxed/simple;
	bh=BHbupUf+uXWtUaex00Y1V7MTzorpfF4adpjGNJHO9xU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=UrWcumc+Rd4euvZcXWuJMbF4sdVmhdeHo+5t7jQNo6R5XGLqHTjYhYKwA+OYfl/ZFhMS32r3kAZQuYwggcvCYXlBKWWdfgDUI+n4NTf5pAciXS0hhQvJcdg7+HVSbysDgbaHdULYUwKYMbO7CMi+f/TqiGNoqNQahMTOsFh1tG8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XMz8BRD1; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Larshin Sergey <[email-masked]>,
	Jan Kara <[email-masked]>
Subject: [PATCH 6.6 173/196] fs: udf: fix OOB read in lengthAllocDescs handling
Date: Mon, 13 Oct 2025 16:46:04 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Larshin Sergey <[email-masked]>

commit 3bd5e45c2ce30e239d596becd5db720f7eb83c99 upstream.

When parsing Allocation Extent Descriptor, lengthAllocDescs comes from
on-disk data and must be validated against the block size. Crafted or
corrupted images may set lengthAllocDescs so that the total descriptor
length (sizeof(allocExtDesc) + lengthAllocDescs) exceeds the buffer,
leading udf_update_tag() to call crc_itu_t() on out-of-bounds memory and
trigger a KASAN use-after-free read.

BUG: KASAN: use-after-free in crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60
Read of size 1 at addr ffff888041e7d000 by task syz-executor317/5309

CPU: 0 UID: 0 PID: 5309 Comm: syz-executor317 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:488
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60
 udf_update_tag+0x70/0x6a0 fs/udf/misc.c:261
 udf_write_aext+0x4d8/0x7b0 fs/udf/inode.c:2179
 extent_trunc+0x2f7/0x4a0 fs/udf/truncate.c:46
 udf_truncate_tail_extent+0x527/0x7e0 fs/udf/truncate.c:106
 udf_release_file+0xc1/0x120 fs/udf/file.c:185
 __fput+0x23f/0x880 fs/file_table.c:431
 task_work_run+0x24f/0x310 kernel/task_work.c:239
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0xa2f/0x28e0 kernel/exit.c:939
 do_group_exit+0x207/0x2c0 kernel/exit.c:1088
 __do_sys_exit_group kernel/exit.c:1099 [inline]
 __se_sys_exit_group kernel/exit.c:1097 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097
 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

Validate the computed total length against epos->bh->b_size.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Reported-by: [email-masked]
Closes: https://syzkaller.appspot.com/bug?extid=8743fca924afed42f93e
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: [email-masked]
Signed-off-by: Larshin Sergey <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jan Kara <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 fs/udf/inode.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -2265,6 +2265,9 @@ int udf_current_aext(struct inode *inode
 		if (check_add_overflow(sizeof(struct allocExtDesc),
 				le32_to_cpu(header->lengthAllocDescs), &alen))
 			return -1;
+
+		if (alen > epos->bh->b_size)
+			return -1;
 	}
 
 	switch (iinfo->i_alloc_type) {

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:25:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367995; cv=none; b=HG0wH+L1sZG0kN6hO6c8Der+8jgsfNdeBblae69Fy+Kizt7gxzLqYHfuWqddPck7nf0W3cZy4l4PXz/ARfIfGJ/W2/WX7EoUSCAV6lm46RPFCR5bO2dn8JFGsIFpsZsCFxyc8id0uJk232fsilyDPW+B1kw2n09P2v3Nk6chtos=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367995; c=relaxed/simple;
	bh=RuP//OzXCBgB/hVa5fVydrygztCQA9vQQjTG5D0FI2Q=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=nMIj0RS50znHxJuqmcz08F/D92pYW5du3h3zU+ovRBxirwXZeUBTX6dAhfBxX8Nf1HeokXRBtWEtKFqcsGhkzivrdTPgvDiPL40em1ecuL8+CG3PRYvWeeYQi6Pusl1huuybXSndloPutMVRC/qrtEPOeW5ftrWz07PDCGzM824=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vG8wkjzt; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ranjani Sridharan <[email-masked]>,
	=?UTF-8?q?P=C3=A9ter=20Ujfalusi?= <[email-masked]>,
	Kai Vehmanen <[email-masked]>,
	Mark Brown <[email-masked]>
Subject: [PATCH 6.6 172/196] ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down
Date: Mon, 13 Oct 2025 16:46:03 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ranjani Sridharan <[email-masked]>

commit 59abe7bc7e7c70e9066b3e46874d1b7e6a13de14 upstream.

In the case of static pipelines, freeing the widgets in the pipelines
that were not suspended after freeing the scheduler widgets results in
errors because the secondary cores are powered off when the scheduler
widgets are freed. Fix this by tearing down the leftover pipelines before
powering off the secondary cores.

Cc: [email-masked]
Fixes: d7332c4a4f1a ("ASoC: SOF: ipc3-topology: Fix pipeline tear down logic")
Signed-off-by: Ranjani Sridharan <[email-masked]>
Reviewed-by: Péter Ujfalusi <[email-masked]>
Reviewed-by: Kai Vehmanen <[email-masked]>
Signed-off-by: Peter Ujfalusi <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 sound/soc/sof/ipc3-topology.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/sound/soc/sof/ipc3-topology.c
+++ b/sound/soc/sof/ipc3-topology.c
@@ -2394,11 +2394,6 @@ static int sof_ipc3_tear_down_all_pipeli
 	if (ret < 0)
 		return ret;
 
-	/* free all the scheduler widgets now */
-	ret = sof_ipc3_free_widgets_in_list(sdev, true, &dyn_widgets, verify);
-	if (ret < 0)
-		return ret;
-
 	/*
 	 * Tear down all pipelines associated with PCMs that did not get suspended
 	 * and unset the prepare flag so that they can be set up again during resume.
@@ -2414,6 +2409,11 @@ static int sof_ipc3_tear_down_all_pipeli
 		}
 	}
 
+	/* free all the scheduler widgets now. This will also power down the secondary cores */
+	ret = sof_ipc3_free_widgets_in_list(sdev, true, &dyn_widgets, verify);
+	if (ret < 0)
+		return ret;
+
 	list_for_each_entry(sroute, &sdev->route_list, list)
 		sroute->setup = false;

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:24:47 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367902; cv=none; b=eOjYF2WPOUJVU8Vq8xZVMHrNP9JwMK1fcTjvfR3p8FTjTZKfHeYjRhqfvG/w+HBdOAGLDitGsnGpfM7hSjiQkWS3TZJacXX2bdc9rLpKRl/XWOqdf+xDpzrmFwFMnD+xDma2YGJCQeZXXzoIyA+yDEq35nsRwup8tD44gRMhO4M=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367902; c=relaxed/simple;
	bh=KUB3z0fyrRhXMmQoTqljTaX/kpNgseNMTWODnPqviws=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=tldmi+7tr7jVnyTyNqgxvGRr9F4mVJoMSdUdzlZD86TNkoXU+YubriCO9icJgoEFtgfQcCnTNFJvSrnF8Rm6eb2G1MyuvTDgN5XWsw86lUL7IPmoT7IJ50fNRPqiT5mDXRbKVljVezsdOlXs/HXMyfO3h5GYu3DG1AD5WIdaDdE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=RXgUbWkm; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ma Ke <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Mark Brown <[email-masked]>
Subject: [PATCH 6.6 171/196] ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
Date: Mon, 13 Oct 2025 16:46:02 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ma Ke <[email-masked]>

commit 4e65bda8273c938039403144730923e77916a3d7 upstream.

wcd934x_codec_parse_data() contains a device reference count leak in
of_slim_get_device() where device_find_child() increases the reference
count of the device but this reference is not properly decreased in
the success path. Add put_device() in wcd934x_codec_parse_data() and
add devm_add_action_or_reset() in the probe function, which ensures
that the reference count of the device is correctly managed.

Memory leak in regmap_init_slimbus() as the allocated regmap is not
released when the device is removed. Using devm_regmap_init_slimbus()
instead of regmap_init_slimbus() to ensure automatic regmap cleanup on
device removal.

Calling path: of_slim_get_device() -> of_find_slim_device() ->
device_find_child(). As comment of device_find_child() says, 'NOTE:
you will need to drop the reference with put_device() after use.'.

Found by code review.

Cc: [email-masked]
Fixes: a61f3b4f476e ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec")
Signed-off-by: Ma Ke <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 sound/soc/codecs/wcd934x.c |   17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

--- a/sound/soc/codecs/wcd934x.c
+++ b/sound/soc/codecs/wcd934x.c
@@ -5858,6 +5858,13 @@ static const struct snd_soc_component_dr
 	.endianness = 1,
 };
 
+static void wcd934x_put_device_action(void *data)
+{
+	struct device *dev = data;
+
+	put_device(dev);
+}
+
 static int wcd934x_codec_parse_data(struct wcd934x_codec *wcd)
 {
 	struct device *dev = &wcd->sdev->dev;
@@ -5878,11 +5885,13 @@ static int wcd934x_codec_parse_data(stru
 	}
 
 	slim_get_logical_addr(wcd->sidev);
-	wcd->if_regmap = regmap_init_slimbus(wcd->sidev,
+	wcd->if_regmap = devm_regmap_init_slimbus(wcd->sidev,
 				  &wcd934x_ifc_regmap_config);
-	if (IS_ERR(wcd->if_regmap))
+	if (IS_ERR(wcd->if_regmap)) {
+		put_device(&wcd->sidev->dev);
 		return dev_err_probe(dev, PTR_ERR(wcd->if_regmap),
 				     "Failed to allocate ifc register map\n");
+	}
 
 	of_property_read_u32(dev->parent->of_node, "qcom,dmic-sample-rate",
 			     &wcd->dmic_sample_rate);
@@ -5926,6 +5935,10 @@ static int wcd934x_codec_probe(struct pl
 		return ret;
 	}
 
+	ret = devm_add_action_or_reset(dev, wcd934x_put_device_action, &wcd->sidev->dev);
+	if (ret)
+		return ret;
+
 	/* set default rate 9P6MHz */
 	regmap_update_bits(wcd->regmap, WCD934X_CODEC_RPM_CLK_MCLK_CFG,
 			   WCD934X_CODEC_RPM_CLK_MCLK_CFG_MCLK_MASK,

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:24:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367899; cv=none; b=Rk3zKpVvS9CNEYF5p8zSmMul4Y7W6Es2cMkBLmlYFYjJ0mL6AiebCtRUS5K/VQPp+jzW2/AH0Q9+uVlrqMVVbt3PW0WPeuoJFNE+Egg3ZraNGMchqYXvLR/n+vK+neFPLF2nEGPc/p5CwlVE7XS1AFZVS1mxQF9JVCPiF9vAY74=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367899; c=relaxed/simple;
	bh=d+zKkI9W57DB3Q5cmhki6kkebouUMP4b28DQCs3ylqg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=YbQdtxNQRioMCy2SJ7otX8xQxpsQ+0tZ+VWfdIz0F4eO6l3zG90Q/OXczdpWjHf2jznGJBlPIXDsNYOgUsoq0+K6oEbMcnD8E7HqKmHhboWdTnB4OJ+A5n5IsedODZUdMrtFUstH4qtUtZ/lPBdauF1b+lb34TH9hwIcDjSbvM0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yiUybSRO; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	John Starks <[email-masked]>,
	Naman Jain <[email-masked]>,
	Michael Kelley <[email-masked]>,
	Long Li <[email-masked]>,
	Tianyu Lan <[email-masked]>
Subject: [PATCH 6.6 170/196] uio_hv_generic: Let userspace take care of interrupt mask
Date: Mon, 13 Oct 2025 16:46:01 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Naman Jain <[email-masked]>

commit b15b7d2a1b09ef5428a8db260251897405a19496 upstream.

Remove the logic to set interrupt mask by default in uio_hv_generic
driver as the interrupt mask value is supposed to be controlled
completely by the user space. If the mask bit gets changed
by the driver, concurrently with user mode operating on the ring,
the mask bit may be set when it is supposed to be clear, and the
user-mode driver will miss an interrupt which will cause a hang.

For eg- when the driver sets inbound ring buffer interrupt mask to 1,
the host does not interrupt the guest on the UIO VMBus channel.
However, setting the mask does not prevent the host from putting a
message in the inbound ring buffer. So let’s assume that happens,
the host puts a message into the ring buffer but does not interrupt.

Subsequently, the user space code in the guest sets the inbound ring
buffer interrupt mask to 0, saying “Hey, I’m ready for interrupts”.
User space code then calls pread() to wait for an interrupt.
Then one of two things happens:

* The host never sends another message. So the pread() waits forever.
* The host does send another message. But because there’s already a
  message in the ring buffer, it doesn’t generate an interrupt.
  This is the correct behavior, because the host should only send an
  interrupt when the inbound ring buffer transitions from empty to
  not-empty. Adding an additional message to a ring buffer that is not
  empty is not supposed to generate an interrupt on the guest.
  Since the guest is waiting in pread() and not removing messages from
  the ring buffer, the pread() waits forever.

This could be easily reproduced in hv_fcopy_uio_daemon if we delay
setting interrupt mask to 0.

Similarly if hv_uio_channel_cb() sets the interrupt_mask to 1,
there’s a race condition. Once user space empties the inbound ring
buffer, but before user space sets interrupt_mask to 0, the host could
put another message in the ring buffer but it wouldn’t interrupt.
Then the next pread() would hang.

Fix these by removing all instances where interrupt_mask is changed,
while keeping the one in set_event() unchanged to enable userspace
control the interrupt mask by writing 0/1 to /dev/uioX.

Fixes: 95096f2fbd10 ("uio-hv-generic: new userspace i/o driver for VMBus")
Suggested-by: John Starks <[email-masked]>
Signed-off-by: Naman Jain <[email-masked]>
Cc: [email-masked]
Reviewed-by: Michael Kelley <[email-masked]>
Reviewed-by: Long Li <[email-masked]>
Reviewed-by: Tianyu Lan <[email-masked]>
Tested-by: Tianyu Lan <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/uio/uio_hv_generic.c |    7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

--- a/drivers/uio/uio_hv_generic.c
+++ b/drivers/uio/uio_hv_generic.c
@@ -96,7 +96,6 @@ static void hv_uio_channel_cb(void *cont
 	struct hv_device *hv_dev = chan->device_obj;
 	struct hv_uio_private_data *pdata = hv_get_drvdata(hv_dev);
 
-	chan->inbound.ring_buffer->interrupt_mask = 1;
 	virt_mb();
 
 	uio_event_notify(&pdata->info);
@@ -173,8 +172,6 @@ hv_uio_new_channel(struct vmbus_channel
 		return;
 	}
 
-	/* Disable interrupts on sub channel */
-	new_sc->inbound.ring_buffer->interrupt_mask = 1;
 	set_channel_read_mode(new_sc, HV_CALL_ISR);
 
 	ret = sysfs_create_bin_file(&new_sc->kobj, &ring_buffer_bin_attr);
@@ -218,9 +215,7 @@ hv_uio_open(struct uio_info *info, struc
 
 	ret = vmbus_connect_ring(dev->channel,
 				 hv_uio_channel_cb, dev->channel);
-	if (ret == 0)
-		dev->channel->inbound.ring_buffer->interrupt_mask = 1;
-	else
+	if (ret)
 		atomic_dec(&pdata->refcnt);
 
 	return ret;

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:20:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367896; cv=none; b=cM4aiJv6CI33ePKe2QCJGqLblVWDCDExUguu6kAZ6AwZ2LdxjX7Leqr5SIyw+JpxIUmpKBat9cd/vxkmhL2nnsrxPaAOBm0Wy3LIOTSfK2d4fvucEX36tkicqbcHp+dYY395JpdqZeZPpakWSHDxHyZr+YiIMlwCFA9YcCGwdno=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367896; c=relaxed/simple;
	bh=dZu26VoAE+LTUbZr45Yhr0w0OM//u3hzUqs/IHrYqho=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=AWdJx186Wj6e4nXG1130f0N+n4V+4KGJs9MAMrV0YOSviLAuXYEXZSTbMqPBMA8r/5pPcIWqPAX/YShI872v1oPmU40gIVpFvazMNgXlXBxboJ5uaaZCdYDULcqyT0ZhysYPB7bgOeeY068+pNHDQcnEoNmMum89nSsNFicfIag=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DTxMtqEl; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Phillip Lougher <[email-masked]>,
	[email-masked],
	Andrew Morton <[email-masked]>
Subject: [PATCH 6.6 169/196] Squashfs: fix uninit-value in squashfs_get_parent
Date: Mon, 13 Oct 2025 16:46:00 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Phillip Lougher <[email-masked]>

commit 74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf upstream.

Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug.

This is caused by open_by_handle_at() being called with a file handle
containing an invalid parent inode number.  In particular the inode number
is that of a symbolic link, rather than a directory.

Squashfs_get_parent() gets called with that symbolic link inode, and
accesses the parent member field.

	unsigned int parent_ino = squashfs_i(inode)->parent;

Because non-directory inodes in Squashfs do not have a parent value, this
is uninitialised, and this causes an uninitialised value access.

The fix is to initialise parent with the invalid inode 0, which will cause
an EINVAL error to be returned.

Regular inodes used to share the parent field with the block_list_start
field.  This is removed in this commit to enable the parent field to
contain the invalid inode number 0.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: 122601408d20 ("Squashfs: export operations")
Signed-off-by: Phillip Lougher <[email-masked]>
Reported-by: [email-masked]
Closes: https://lore.kernel.org/all/[email-masked]/
Cc: <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 fs/squashfs/inode.c         |    7 +++++++
 fs/squashfs/squashfs_fs_i.h |    2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

--- a/fs/squashfs/inode.c
+++ b/fs/squashfs/inode.c
@@ -165,6 +165,7 @@ int squashfs_read_inode(struct inode *in
 		squashfs_i(inode)->start = le32_to_cpu(sqsh_ino->start_block);
 		squashfs_i(inode)->block_list_start = block;
 		squashfs_i(inode)->offset = offset;
+		squashfs_i(inode)->parent = 0;
 		inode->i_data.a_ops = &squashfs_aops;
 
 		TRACE("File inode %x:%x, start_block %llx, block_list_start "
@@ -212,6 +213,7 @@ int squashfs_read_inode(struct inode *in
 		squashfs_i(inode)->start = le64_to_cpu(sqsh_ino->start_block);
 		squashfs_i(inode)->block_list_start = block;
 		squashfs_i(inode)->offset = offset;
+		squashfs_i(inode)->parent = 0;
 		inode->i_data.a_ops = &squashfs_aops;
 
 		TRACE("File inode %x:%x, start_block %llx, block_list_start "
@@ -292,6 +294,7 @@ int squashfs_read_inode(struct inode *in
 		inode->i_mode |= S_IFLNK;
 		squashfs_i(inode)->start = block;
 		squashfs_i(inode)->offset = offset;
+		squashfs_i(inode)->parent = 0;
 
 		if (type == SQUASHFS_LSYMLINK_TYPE) {
 			__le32 xattr;
@@ -329,6 +332,7 @@ int squashfs_read_inode(struct inode *in
 		set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
 		rdev = le32_to_cpu(sqsh_ino->rdev);
 		init_special_inode(inode, inode->i_mode, new_decode_dev(rdev));
+		squashfs_i(inode)->parent = 0;
 
 		TRACE("Device inode %x:%x, rdev %x\n",
 				SQUASHFS_INODE_BLK(ino), offset, rdev);
@@ -353,6 +357,7 @@ int squashfs_read_inode(struct inode *in
 		set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
 		rdev = le32_to_cpu(sqsh_ino->rdev);
 		init_special_inode(inode, inode->i_mode, new_decode_dev(rdev));
+		squashfs_i(inode)->parent = 0;
 
 		TRACE("Device inode %x:%x, rdev %x\n",
 				SQUASHFS_INODE_BLK(ino), offset, rdev);
@@ -373,6 +378,7 @@ int squashfs_read_inode(struct inode *in
 			inode->i_mode |= S_IFSOCK;
 		set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
 		init_special_inode(inode, inode->i_mode, 0);
+		squashfs_i(inode)->parent = 0;
 		break;
 	}
 	case SQUASHFS_LFIFO_TYPE:
@@ -392,6 +398,7 @@ int squashfs_read_inode(struct inode *in
 		inode->i_op = &squashfs_inode_ops;
 		set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
 		init_special_inode(inode, inode->i_mode, 0);
+		squashfs_i(inode)->parent = 0;
 		break;
 	}
 	default:
--- a/fs/squashfs/squashfs_fs_i.h
+++ b/fs/squashfs/squashfs_fs_i.h
@@ -16,6 +16,7 @@ struct squashfs_inode_info {
 	u64		xattr;
 	unsigned int	xattr_size;
 	int		xattr_count;
+	int		parent;
 	union {
 		struct {
 			u64		fragment_block;
@@ -27,7 +28,6 @@ struct squashfs_inode_info {
 			u64		dir_idx_start;
 			int		dir_idx_offset;
 			int		dir_idx_cnt;
-			int		parent;
 		};
 	};
 	struct inode	vfs_inode;

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:35:20 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367893; cv=none; b=ere3waa6cjHtB6ccoKVCFP7JpRtAhhzn6CsZdj28JDzIK5t1W1cF0vU2X+Tj3jSExSqRBgo+oQk1Wf2Kxjjoc+HvE6hCPMyUHIJMjIGOlxt6agwqQb+aFuRvdiv09pF+y4LBSIpf8gR16qDh2TsExQq5nrg5WaNY9MpZBpqdK+A=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367893; c=relaxed/simple;
	bh=g5WA7B0uezhDbC3rYoOn7VUZCO25W1g9MD6xBjfi7cE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Vpnhui+BVJlIfm7gLxizLLAFuOXu/k5bZgKkUv6w7UrNtANiYF5XasZwc/OcTKMoTAaTGQVODdLHsYpwg/Bxzo8klnDaQ9b4NnJCcEhhyNTHgmG4hrt8rnwvI4omjGPGBXsWAYi09Atl397/rmY14Y6tfzPJIcZgUGozBK71CdI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WW4Ej4IJ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Shenghao Yuan <[email-masked]>,
	Tianci Cao <[email-masked]>,
	Yazhou Tang <[email-masked]>,
	Yonghong Song <[email-masked]>,
	Alexei Starovoitov <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 168/196] bpf: Reject negative offsets for ALU ops
Date: Mon, 13 Oct 2025 16:45:59 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yazhou Tang <[email-masked]>

[ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ]

When verifying BPF programs, the check_alu_op() function validates
instructions with ALU operations. The 'offset' field in these
instructions is a signed 16-bit integer.

The existing check 'insn->off > 1' was intended to ensure the offset is
either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is
signed, this check incorrectly accepts all negative values (e.g., -1).

This commit tightens the validation by changing the condition to
'(insn->off != 0 && insn->off != 1)'. This ensures that any value
other than the explicitly permitted 0 and 1 is rejected, hardening the
verifier against malformed BPF programs.

Co-developed-by: Shenghao Yuan <[email-masked]>
Signed-off-by: Shenghao Yuan <[email-masked]>
Co-developed-by: Tianci Cao <[email-masked]>
Signed-off-by: Tianci Cao <[email-masked]>
Signed-off-by: Yazhou Tang <[email-masked]>
Acked-by: Yonghong Song <[email-masked]>
Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.")
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexei Starovoitov <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/bpf/verifier.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index a6f825b7fbe6c..5e644b1b12aaa 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -13727,7 +13727,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
 	} else {	/* all other ALU ops: and, sub, xor, add, ... */
 
 		if (BPF_SRC(insn->code) == BPF_X) {
-			if (insn->imm != 0 || insn->off > 1 ||
+			if (insn->imm != 0 || (insn->off != 0 && insn->off != 1) ||
 			    (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) {
 				verbose(env, "BPF_ALU uses reserved fields\n");
 				return -EINVAL;
@@ -13737,7 +13737,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
 			if (err)
 				return err;
 		} else {
-			if (insn->src_reg != BPF_REG_0 || insn->off > 1 ||
+			if (insn->src_reg != BPF_REG_0 || (insn->off != 0 && insn->off != 1) ||
 			    (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) {
 				verbose(env, "BPF_ALU uses reserved fields\n");
 				return -EINVAL;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:53:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367891; cv=none; b=hU4+7I0186/q7UCfWILyzw19w/+dfSm0QOyYxPmaHWrXXcfmb3oRwOwJUD6pLkAdVWFln2O6BsXgSgrHmpSDy6BWFciZy2D+qMRAeXKFcrTIEcSEX+F0yg6rFd3OWRSirqNo+M8pd0Cdmx0I/wJ6WH6/NGoMydA5/7QPi3PKtOM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367891; c=relaxed/simple;
	bh=pi5/Y0Drbw02GRsbMgh3g7RqAQ6YtyTXveGYhJRDv8c=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=RFbxXxdkEvQbktWXhjPEiglNLCbuQNZnOZqCDlD9pQTXkLfsiX4IXEuQaN5a4O/uYgIh/gVEaK7QgjFrq7/KJk86QcVBC2irRjbvrcVOXFzI72ZdA/Xc3kbTflvCRxdgWTJZcw/LUKH839eDXeL0Be5TdQ6c2X0bqCkJVOkYfuQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=NzZg/A9n; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	"Stefano Garzarella" <[email-masked]>,
	zhang jiao <[email-masked]>,
	"Michael S. Tsirkin" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 167/196] vhost: vringh: Modify the return value check
Date: Mon, 13 Oct 2025 16:45:58 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: zhang jiao <[email-masked]>

[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ]

The return value of copy_from_iter and copy_to_iter can't be negative,
check whether the copied lengths are equal.

Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
Cc: "Stefano Garzarella" <[email-masked]>
Signed-off-by: zhang jiao <[email-masked]>
Message-Id: <[email-masked]>
Signed-off-by: Michael S. Tsirkin <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/vhost/vringh.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 60961c65fd472..134cc10af776b 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -1191,6 +1191,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
 		struct iov_iter iter;
 		u64 translated;
 		int ret;
+		size_t size;
 
 		ret = iotlb_translate(vrh, (u64)(uintptr_t)src,
 				      len - total_translated, &translated,
@@ -1208,9 +1209,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
 				      translated);
 		}
 
-		ret = copy_from_iter(dst, translated, &iter);
-		if (ret < 0)
-			return ret;
+		size = copy_from_iter(dst, translated, &iter);
+		if (size != translated)
+			return -EFAULT;
 
 		src += translated;
 		dst += translated;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:44:43 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367885; cv=none; b=d8YkELvYZbo1jAXeDkc4Qt5qW6YceyEUEqwM9K9K73KK0+Dljj1McTl8Frvme4Ybbtig35Ysy00t1fQborvTdEUVT1R0uEZ3yG6dXrkTXBfU6cBO8Q/ht6ruAtB7j2VGwIgwtONGl4qK8jqFjBfPGnSaFvHy+q64b6DNr1qoYI8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367885; c=relaxed/simple;
	bh=D7L/IC8VRsT7zAr7WdPq07aFGyjhjPkEhKnFKhmyvek=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ThF/F9Ve+ml9/BzWpbNKC/qXl1YnMFNUs4x71l4RuDpKue49wZ7PkMImZSYaL9r+qb7m2JZv5cSU8DK2CwJcJi40++nnZUI9vVQ6o2SdWSah1yeX4IknLNKPw6kFJdmlUOy5B/FN7YxMNjq4WTPS9Pt0V/0GumBaWEjXrOJihNg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IgpPyYdS; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jakub Kicinski <[email-masked]>,
	Tariq Toukan <[email-masked]>,
	Paolo Abeni <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 166/196] Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
Date: Mon, 13 Oct 2025 16:45:57 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jakub Kicinski <[email-masked]>

[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]

This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.

Commit in question breaks the mapping of PGs to pools for some SKUs.
Specifically multi-host NICs seem to be shipped with a custom buffer
configuration which maps the lossy PG to pool 4. But the bad commit
overrides this with pool 0 which does not have sufficient buffer space
reserved. Resulting in ~40% packet loss. The commit also breaks BMC /
OOB connection completely (100% packet loss).

Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and
set Xon/Xoff upon port speed set""). The breakage is exactly the same,
the only difference is that quoted commit would break the NIC immediately
on boot, and the currently reverted commit only when MTU is changed.

Note: "good" kernels do not restore the configuration, so downgrade isn't
enough to recover machines. A NIC power cycle seems to be necessary to
return to a healthy state (or overriding the relevant registers using
a custom patch).

Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set")
Signed-off-by: Jakub Kicinski <[email-masked]>
Reviewed-by: Tariq Toukan <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Paolo Abeni <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../mellanox/mlx5/core/en/port_buffer.h         | 12 ------------
 .../net/ethernet/mellanox/mlx5/core/en_main.c   | 17 +----------------
 2 files changed, 1 insertion(+), 28 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
index 66d276a1be836..f4a19ffbb641c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
@@ -66,23 +66,11 @@ struct mlx5e_port_buffer {
 	struct mlx5e_bufferx_reg  buffer[MLX5E_MAX_NETWORK_BUFFER];
 };
 
-#ifdef CONFIG_MLX5_CORE_EN_DCB
 int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
 				    u32 change, unsigned int mtu,
 				    struct ieee_pfc *pfc,
 				    u32 *buffer_size,
 				    u8 *prio2buffer);
-#else
-static inline int
-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
-				u32 change, unsigned int mtu,
-				void *pfc,
-				u32 *buffer_size,
-				u8 *prio2buffer)
-{
-	return 0;
-}
-#endif
 
 int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
 			    struct mlx5e_port_buffer *port_buffer);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 09ba60b2e744b..5c6f01abdcb91 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -44,7 +44,6 @@
 #include "eswitch.h"
 #include "en.h"
 #include "en/txrx.h"
-#include "en/port_buffer.h"
 #include "en_tc.h"
 #include "en_rep.h"
 #include "en_accel/ipsec.h"
@@ -2723,11 +2722,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
 	struct mlx5e_params *params = &priv->channels.params;
 	struct net_device *netdev = priv->netdev;
 	struct mlx5_core_dev *mdev = priv->mdev;
-	u16 mtu, prev_mtu;
+	u16 mtu;
 	int err;
 
-	mlx5e_query_mtu(mdev, params, &prev_mtu);
-
 	err = mlx5e_set_mtu(mdev, params, params->sw_mtu);
 	if (err)
 		return err;
@@ -2737,18 +2734,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
 		netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n",
 			    __func__, mtu, params->sw_mtu);
 
-	if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) {
-		err = mlx5e_port_manual_buffer_config(priv, 0, mtu,
-						      NULL, NULL, NULL);
-		if (err) {
-			netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n",
-				    __func__, mtu, err, prev_mtu);
-
-			mlx5e_set_mtu(mdev, params, prev_mtu);
-			return err;
-		}
-	}
-
 	params->sw_mtu = mtu;
 	return 0;
 }
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:50:06 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367882; cv=none; b=AH/lkYphMDemN9wJrbG9UhBZMYbu++FUeMB9Cyl57+CZeQ5yTFDCPp/3qgIJQ3fqZ2qx3SeIigo6Il9NU5ZAfNtMxX88QDI0xJi6mA1KyPYM+3p4zUuP/u8A455Guf4DFSoF3H/3T2HFvSMr8Slp3mTwzy9j1CMKaSNVD7/IEWQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367882; c=relaxed/simple;
	bh=ZzB6Y15FPA4rS5JYsQHrEC2zjVmCNIqkBsd0+fpnQZw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=jOqTx8EBhnfQ88YJMBCeE64ZxS92fGYcFLO2S/QIlyOAcZxBLtROl9k72h+2mbKP0yzGX8Khhzf3D6p+UvxfxsNJ0e3C4oTAe5YxqBphEQFGAQlpbnBixQyFF3MuRkGeSv9XBzn2x/+KFmQSiw4dXFRi0mKCzyGH5KO5QrrnJ2E=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lmzI2Qlt; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Enzo Matsumiya <[email-masked]>,
	Steve French <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 165/196] smb: client: fix crypto buffers in non-linear memory
Date: Mon, 13 Oct 2025 16:45:56 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Enzo Matsumiya <[email-masked]>

[ Upstream commit 998a67b954680f26f3734040aeeed08642d49721 ]

The crypto API, through the scatterlist API, expects input buffers to be
in linear memory.  We handle this with the cifs_sg_set_buf() helper
that converts vmalloc'd memory to their corresponding pages.

However, when we allocate our aead_request buffer (@creq in
smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly
puts aead_request->__ctx in vmalloc area.

AEAD algorithm then uses ->__ctx for its private/internal data and
operations, and uses sg_set_buf() for such data on a few places.

This works fine as long as @creq falls into kmalloc zone (small
requests) or vmalloc'd memory is still within linear range.

Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too
many tasks will increment the base stacks' addresses to a point where
virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that
happens.

In practice: too many parallel reads and writes on an encrypted mount
will trigger this bug.

To fix this, always alloc @creq with kmalloc() instead.
Also drop the @sensitive_size variable/arguments since
kfree_sensitive() doesn't need it.

Backtrace:

[  945.272081] ------------[ cut here ]------------
[  945.272774] kernel BUG at include/linux/scatterlist.h:209!
[  945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI
[  945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted 6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary)
[  945.275736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014
[  945.276877] Workqueue: writeback wb_workfn (flush-cifs-2)
[  945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220
[  945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b
[  945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246
[  945.280578] RAX: 0000000000000000 RBX: ffffc90001d85060 RCX: 0000000000000030
[  945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI: ffffc90081d85070
[  945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000
[  945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070
[  945.283656] R13: ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010
[  945.284407] FS:  0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000
[  945.285262] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0
[  945.286683] Call Trace:
[  945.286952]  <TASK>
[  945.287184]  ? crypt_message+0x33f/0xad0 [cifs]
[  945.287719]  crypto_gcm_encrypt+0x36/0xe0
[  945.288152]  crypt_message+0x54a/0xad0 [cifs]
[  945.288724]  smb3_init_transform_rq+0x277/0x300 [cifs]
[  945.289300]  smb_send_rqst+0xa3/0x160 [cifs]
[  945.289944]  cifs_call_async+0x178/0x340 [cifs]
[  945.290514]  ? __pfx_smb2_writev_callback+0x10/0x10 [cifs]
[  945.291177]  smb2_async_writev+0x3e3/0x670 [cifs]
[  945.291759]  ? find_held_lock+0x32/0x90
[  945.292212]  ? netfs_advance_write+0xf2/0x310
[  945.292723]  netfs_advance_write+0xf2/0x310
[  945.293210]  netfs_write_folio+0x346/0xcc0
[  945.293689]  ? __pfx__raw_spin_unlock_irq+0x10/0x10
[  945.294250]  netfs_writepages+0x117/0x460
[  945.294724]  do_writepages+0xbe/0x170
[  945.295152]  ? find_held_lock+0x32/0x90
[  945.295600]  ? kvm_sched_clock_read+0x11/0x20
[  945.296103]  __writeback_single_inode+0x56/0x4b0
[  945.296643]  writeback_sb_inodes+0x229/0x550
[  945.297140]  __writeback_inodes_wb+0x4c/0xe0
[  945.297642]  wb_writeback+0x2f1/0x3f0
[  945.298069]  wb_workfn+0x300/0x490
[  945.298472]  process_one_work+0x1fe/0x590
[  945.298949]  worker_thread+0x1ce/0x3c0
[  945.299397]  ? __pfx_worker_thread+0x10/0x10
[  945.299900]  kthread+0x119/0x210
[  945.300285]  ? __pfx_kthread+0x10/0x10
[  945.300729]  ret_from_fork+0x119/0x1b0
[  945.301163]  ? __pfx_kthread+0x10/0x10
[  945.301601]  ret_from_fork_asm+0x1a/0x30
[  945.302055]  </TASK>

Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
Signed-off-by: Enzo Matsumiya <[email-masked]>
Signed-off-by: Steve French <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/smb/client/smb2ops.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
index b74f769047394..ee6a6ba13f89c 100644
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -4152,7 +4152,7 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len,
 static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst,
 				 int num_rqst, const u8 *sig, u8 **iv,
 				 struct aead_request **req, struct sg_table *sgt,
-				 unsigned int *num_sgs, size_t *sensitive_size)
+				 unsigned int *num_sgs)
 {
 	unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm);
 	unsigned int iv_size = crypto_aead_ivsize(tfm);
@@ -4169,9 +4169,8 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst
 	len += req_size;
 	len = ALIGN(len, __alignof__(struct scatterlist));
 	len += array_size(*num_sgs, sizeof(struct scatterlist));
-	*sensitive_size = len;
 
-	p = kvzalloc(len, GFP_NOFS);
+	p = kzalloc(len, GFP_NOFS);
 	if (!p)
 		return ERR_PTR(-ENOMEM);
 
@@ -4185,16 +4184,14 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst
 
 static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst,
 			       int num_rqst, const u8 *sig, u8 **iv,
-			       struct aead_request **req, struct scatterlist **sgl,
-			       size_t *sensitive_size)
+			       struct aead_request **req, struct scatterlist **sgl)
 {
 	struct sg_table sgtable = {};
 	unsigned int skip, num_sgs, i, j;
 	ssize_t rc;
 	void *p;
 
-	p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable,
-				&num_sgs, sensitive_size);
+	p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, &num_sgs);
 	if (IS_ERR(p))
 		return ERR_CAST(p);
 
@@ -4283,7 +4280,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
 	DECLARE_CRYPTO_WAIT(wait);
 	unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
 	void *creq;
-	size_t sensitive_size;
 
 	rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key);
 	if (rc) {
@@ -4309,8 +4305,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
 		return rc;
 	}
 
-	creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg,
-				 &sensitive_size);
+	creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg);
 	if (IS_ERR(creq))
 		return PTR_ERR(creq);
 
@@ -4340,7 +4335,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst,
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
-	kvfree_sensitive(creq, sensitive_size);
+	kfree_sensitive(creq);
 	return rc;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:47:29 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367879; cv=none; b=NbK5kup+UY/M7FbXr1zqCXn4V1EumpI7mGbd+LRi44GaNyAVHTpoo/SGzjF5FbT/kJLQq3yWgs6yIs+uijW9d6+VLlnwrWpFz/vQXbKz9jjxYnBL+zd/1kXnXZdZ1I7rjmkFrN5CfpaByOspmQE/3zNSbTrYwQFJWbyViYezXeU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367879; c=relaxed/simple;
	bh=KByn+snmi7SjAzBtZZtoN/BzMKwF7XNUJh4M+hZ+VZ4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=PmXGjVs//fUFB/wRN5kmRcU3JxjtuOpHe/JNmWQocBpP3j4u+rAKqTK2JfE+b18Wb2M5mYRlqZNcpgEgIrtCfBtwr1cVEo3FZiQH/HxH/hHw4DkWo3+iExaHuwvyS9CVtk1vnoXfRsyQ5xAq0YPL5VDyIyi87jjJ90mJvDmCqHw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DNTCKSQJ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Moshe Shemesh <[email-masked]>,
	Shay Drori <[email-masked]>,
	Tariq Toukan <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 164/196] net/mlx5: fw reset, add reset timeout work
Date: Mon, 13 Oct 2025 16:45:55 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Moshe Shemesh <[email-masked]>

[ Upstream commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 ]

Add sync reset timeout to stop poll_sync_reset in case there was no
reset done or abort event within timeout. Otherwise poll sync reset will
just continue and in case of fw fatal error no health reporting will be
done.

Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event")
Signed-off-by: Moshe Shemesh <[email-masked]>
Reviewed-by: Shay Drori <[email-masked]>
Signed-off-by: Tariq Toukan <[email-masked]>
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../ethernet/mellanox/mlx5/core/fw_reset.c    | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
index 1547704c89767..4d64d179b5dd7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
@@ -27,6 +27,7 @@ struct mlx5_fw_reset {
 	struct work_struct reset_reload_work;
 	struct work_struct reset_now_work;
 	struct work_struct reset_abort_work;
+	struct delayed_work reset_timeout_work;
 	unsigned long reset_flags;
 	u8 reset_method;
 	struct timer_list timer;
@@ -257,6 +258,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool
 		return -EALREADY;
 	}
 
+	if (current_work() != &fw_reset->reset_timeout_work.work)
+		cancel_delayed_work(&fw_reset->reset_timeout_work);
 	mlx5_stop_sync_reset_poll(dev);
 	if (poll_health)
 		mlx5_start_health_poll(dev);
@@ -327,6 +330,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev)
 	}
 	mlx5_stop_health_poll(dev, true);
 	mlx5_start_sync_reset_poll(dev);
+
+	if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS,
+		      &fw_reset->reset_flags))
+		schedule_delayed_work(&fw_reset->reset_timeout_work,
+			msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE)));
 	return 0;
 }
 
@@ -700,6 +708,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct
 	}
 }
 
+static void mlx5_sync_reset_timeout_work(struct work_struct *work)
+{
+	struct delayed_work *dwork = container_of(work, struct delayed_work,
+						  work);
+	struct mlx5_fw_reset *fw_reset =
+		container_of(dwork, struct mlx5_fw_reset, reset_timeout_work);
+	struct mlx5_core_dev *dev = fw_reset->dev;
+
+	if (mlx5_sync_reset_clear_reset_requested(dev, true))
+		return;
+	mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n");
+}
+
 static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data)
 {
 	struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb);
@@ -783,6 +804,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev)
 	cancel_work_sync(&fw_reset->reset_reload_work);
 	cancel_work_sync(&fw_reset->reset_now_work);
 	cancel_work_sync(&fw_reset->reset_abort_work);
+	cancel_delayed_work(&fw_reset->reset_timeout_work);
 }
 
 static const struct devlink_param mlx5_fw_reset_devlink_params[] = {
@@ -826,6 +848,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev)
 	INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work);
 	INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event);
 	INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event);
+	INIT_DELAYED_WORK(&fw_reset->reset_timeout_work,
+			  mlx5_sync_reset_timeout_work);
 
 	init_completion(&fw_reset->done);
 	return 0;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:24:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367876; cv=none; b=RwFdN8x+CbNgd28bk5q7R3FEfYAW7CD+Re781+LpjC5FVygfOVT7Yuk/GAa8O+jGN2D8xLITbJI+95DAcBkfbH5BHtC/AqgMv/DaWc4AdyQlUIEJ9qWM8668Q7rbOTL99JMsUZe/RZM/EY2cG4YdqzSrbYic95xK4hyTpfG7vAs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367876; c=relaxed/simple;
	bh=42akdj8HUScdXPNot71D7Kz75kSZlBNYGbxQGJcvHRo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=RhiLYYY3qYFGdTULTxLR7zQRa5hOmK0aE8Xo6wCCgJCcXvQylFv+kaqylunW1DrHS6UtcTXfj5nKdbAfZEQA1VXo1ZKLdS/U/mY+xX7aQC8RqdfWo6op7zIGF0aTufm+Lfv4ZUJkdKJEVN1eL1Xdf1liozoxAXRu+R5Ymc9A3Rk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=APzOY3qV; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Shay Drory <[email-masked]>,
	Moshe Shemesh <[email-masked]>,
	Tariq Toukan <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 163/196] net/mlx5: pagealloc: Fix reclaim race during command interface teardown
Date: Mon, 13 Oct 2025 16:45:54 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Shay Drory <[email-masked]>

[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ]

The reclaim_pages_cmd() function sends a command to the firmware to
reclaim pages if the command interface is active.

A race condition can occur if the command interface goes down (e.g., due
to a PCI error) while the mlx5_cmd_do() call is in flight. In this
case, mlx5_cmd_do() will return an error. The original code would
propagate this error immediately, bypassing the software-based page
reclamation logic that is supposed to run when the command interface is
down.

Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark
that command interface is down. If this is the case, fall through to
the software reclamation path. If the command failed for any another
reason, or finished successfully, return as before.

Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
Signed-off-by: Shay Drory <[email-masked]>
Reviewed-by: Moshe Shemesh <[email-masked]>
Signed-off-by: Tariq Toukan <[email-masked]>
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
index e0581c6f9cecd..5df1472fe2be2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
 	u32 func_id;
 	u32 npages;
 	u32 i = 0;
+	int err;
 
-	if (!mlx5_cmd_is_down(dev))
-		return mlx5_cmd_do(dev, in, in_size, out, out_size);
+	err = mlx5_cmd_do(dev, in, in_size, out, out_size);
+	/* If FW is gone (-ENXIO), proceed to forceful reclaim */
+	if (err != -ENXIO)
+		return err;
 
 	/* No hard feelings, we want our pages back! */
 	npages = MLX5_GET(manage_pages_in, in, input_num_entries);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:49:10 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367873; cv=none; b=G+6odtms5MGnFhSgv66LY9cZJCbZ/Bk4nqD+30xHQtCw6FcnYuxbBcAa2BP20obut+fA4CqOMcipXpv5faeX+jB9RznTurh7t3ouhsnnVdAobDyPIeBruahYtNa5QAlRFdZiTwPkzqp/TaARn8OCDG8KEVGG3uFJhw+tNfl5Ia0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367873; c=relaxed/simple;
	bh=Vy3I7362oG7gB6rH9H7Zwjgz1tvlGxTWXgJHw7YOGG8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=c3HQLV9G+R6lhlN5S3OY0aLICE54+XmaxoPk9EYV2x5/6c7DnvhStspHj7ihbQruaBJQz7U2cfE4IJOCdpGTmHoyGXLfyEIC2Lox/N1B0r9sPHwzKCOcpWjM5f/8Hdp0RIt40wdnsA+Es8Pfv2Cgc9CoFROz2qW2Y/mKrAdVBSM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xmsgXA+o; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Moshe Shemesh <[email-masked]>,
	Shay Drori <[email-masked]>,
	Tariq Toukan <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 162/196] net/mlx5: Stop polling for command response if interface goes down
Date: Mon, 13 Oct 2025 16:45:53 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Moshe Shemesh <[email-masked]>

[ Upstream commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 ]

Stop polling on firmware response to command in polling mode if the
command interface got down. This situation can occur, for example, if a
firmware fatal error is detected during polling.

This change halts the polling process when the command interface goes
down, preventing unnecessary waits.

Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
Signed-off-by: Moshe Shemesh <[email-masked]>
Reviewed-by: Shay Drori <[email-masked]>
Signed-off-by: Tariq Toukan <[email-masked]>
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 5a2126679415c..336e0a54b3dc2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -289,6 +289,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent)
 			return;
 		}
 		cond_resched();
+		if (mlx5_cmd_is_down(dev)) {
+			ent->ret = -ENXIO;
+			return;
+		}
 	} while (time_before(jiffies, poll_end));
 
 	ent->ret = -ETIMEDOUT;
@@ -1059,7 +1063,7 @@ static void cmd_work_handler(struct work_struct *work)
 		poll_timeout(ent);
 		/* make sure we read the descriptor after ownership is SW */
 		rmb();
-		mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT));
+		mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret);
 	}
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:39:17 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367870; cv=none; b=GCzjopc8H3+63Csz+eg5pJBByOIicgHJda2DlhMgXqdAQROqihbs+BhHCC4EV2r51c7X3nKoWSkqasSdypnreuNPMi9e2E8aRjHtW5M3cZ+3G2ph5gpgyCFMU1u2eGbc18OZ6ZAEjNfeO5N9lZTXfJcB/p1gkAQb4LpVaDPn6JM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367870; c=relaxed/simple;
	bh=cPYkXvX1gquYL+3EqPshm2NsEkr91ormqI4KRjh/UPI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=VjTR4bLSkrpMmu4yUyUM+kf0kLt2BVIrxB+EyxuvsUijf3KOFnI9PQzQ3dS78k4ofAl/3TBlOIq4WSRO9ECH+IxJcQeAzp/Rm3lCaoIBl8n1mrxYSECuaDWPJNFhkjW4O2SiMUTIrkoFmvN9B+kvnu7VPWaOP/tapjDae2u2d6o=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yDCJU8d1; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jakub Kicinski <[email-masked]>,
	Yeounsu Moon <[email-masked]>,
	Andrew Lunn <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 161/196] net: dlink: handle copy_thresh allocation failure
Date: Mon, 13 Oct 2025 16:45:52 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yeounsu Moon <[email-masked]>

[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ]

The driver did not handle failure of `netdev_alloc_skb_ip_align()`.
If the allocation failed, dereferencing `skb->protocol` could lead to
a NULL pointer dereference.

This patch tries to allocate `skb`. If the allocation fails, it falls
back to the normal path.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Suggested-by: Jakub Kicinski <[email-masked]>
Tested-on: D-Link DGE-550T Rev-A3
Signed-off-by: Yeounsu Moon <[email-masked]>
Reviewed-by: Andrew Lunn <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/dlink/dl2k.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
index f1208591ed67e..1c3a5cf379cd0 100644
--- a/drivers/net/ethernet/dlink/dl2k.c
+++ b/drivers/net/ethernet/dlink/dl2k.c
@@ -954,15 +954,18 @@ receive_packet (struct net_device *dev)
 		} else {
 			struct sk_buff *skb;
 
+			skb = NULL;
 			/* Small skbuffs for short packets */
-			if (pkt_len > copy_thresh) {
+			if (pkt_len <= copy_thresh)
+				skb = netdev_alloc_skb_ip_align(dev, pkt_len);
+			if (!skb) {
 				dma_unmap_single(&np->pdev->dev,
 						 desc_to_dma(desc),
 						 np->rx_buf_sz,
 						 DMA_FROM_DEVICE);
 				skb_put (skb = np->rx_skbuff[entry], pkt_len);
 				np->rx_skbuff[entry] = NULL;
-			} else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) {
+			} else {
 				dma_sync_single_for_cpu(&np->pdev->dev,
 							desc_to_dma(desc),
 							np->rx_buf_sz,
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:20:21 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367867; cv=none; b=dYMavfINSn66GcgOCMBDfuYCXAEABkztcWhwRm6umYzoRa0sG/12CZThuOjS1D7yKKja4WngFU9GLhB5taAmO9mGPM0chV4NbplvSXlLKarUKXRJenPIGQETPHV24Kog3ID6/2VVGPJAhUxQQsjN8psex1GHC19sABdk5SWT8/k=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367867; c=relaxed/simple;
	bh=40C6nvBsSeMwaGzv5nwGBFPcUViP8Kz+qlkReaG8wUo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=D2ZzwOup+nae3p1ia+NreMkgPZkRlnfSYGaPWeE3AZ/lLcKrvewnEBv0ezoCc8j3/Y17DgVyvgPoIud2cIvS8B2Qs+rGDeteYGVmvhlZYZoUZW5Ynxykmr7aOtZOsCeaIFaGwe1UiCdfI3ygDg7xOyFXsuOlK30X7HH1ajXqvcg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=npxz+2HP; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Kohei Enju <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 160/196] net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
Date: Mon, 13 Oct 2025 16:45:51 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kohei Enju <[email-masked]>

[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]

In EC2 instances where the RSS hash key is not configurable, ethtool
shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally
returns ENA_HASH_KEY_SIZE.

Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not
supported") added proper handling for devices that don't support RSS
hash key configuration, but ena_get_rxfh_key_size() has been unchanged.

When the RSS hash key is not configurable, return 0 instead of
ENA_HASH_KEY_SIZE to clarify getting the value is not supported.

Tested on m5 instance families.

Without patch:
 # ethtool -x ens5 | grep -A 1 "RSS hash key"
 RSS hash key:
 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00

With patch:
 # ethtool -x ens5 | grep -A 1 "RSS hash key"
 RSS hash key:
 Operation not supported

Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported")
Signed-off-by: Kohei Enju <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
index d901877544445..82a7c52fdb721 100644
--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
@@ -752,7 +752,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)
 
 static u32 ena_get_rxfh_key_size(struct net_device *netdev)
 {
-	return ENA_HASH_KEY_SIZE;
+	struct ena_adapter *adapter = netdev_priv(netdev);
+	struct ena_rss *rss = &adapter->ena_dev->rss;
+
+	return rss->hash_key ? ENA_HASH_KEY_SIZE : 0;
 }
 
 static int ena_indirection_table_set(struct ena_adapter *adapter,
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:49:32 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367864; cv=none; b=KfIysyhO3hnscMZLwr5pYmSM8w0iFYQCGZrCwB1brgqvX4+uCsj90EO5K/ptErfnfMWpRg95TRSzjTOCa1jkT2NZxnSL4L1UmSsODXslcOnKhM1bxQ2GNacLY8OMSWrqLwOxp30waAoJ7/4ZBdrWirP5wbeHTi4lyUugs3C6CnE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367864; c=relaxed/simple;
	bh=xeumYXNmw8DpOFXH3G27ju8KQ7Jat/QBAyZLvZe0Nds=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=mgMKZrUVxS0knqrIQvJpZONDStx9CmWB+aqwtQTFYJwuN3pW+fcmBV3+JDFogWxTbzIzNOlcW0VH8BoA7pIQ0dneip2jhCH2KPaU6UPYJ/TtVXDlhjnVsIKQmk9Z7CjGed6/lataMuofTxZC2UAqYkGYsBAMnOtpo4lChXFNxsE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=v3le9NN9; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Kohei Enju <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 159/196] nfp: fix RSS hash key size when RSS is not supported
Date: Mon, 13 Oct 2025 16:45:50 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kohei Enju <[email-masked]>

[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]

The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when
devices don't support RSS, and callers treat the negative value as a
large positive value since the return type is u32.

Return 0 when devices don't support RSS, aligning with the ethtool
interface .get_rxfh_key_size() that requires returning 0 in such cases.

Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function")
Signed-off-by: Kohei Enju <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
index e75cbb287625f..87383f9d09ce3 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
@@ -1413,7 +1413,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)
 	struct nfp_net *nn = netdev_priv(netdev);
 
 	if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY))
-		return -EOPNOTSUPP;
+		return 0;
 
 	return nfp_net_rss_key_sz(nn);
 }
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:30:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367861; cv=none; b=dWXzL2CY/aCAmp+uCho4b0yvALaFpgaivxhn5Trrc8HG7NSQCX7n193CoJhkwymvw2vN2TzJ1pWkt6RTPdxVxllSrljw48YNaGK9xCffQA/KVD7LLOxXwylgRAIHaPIJR9mCJdB+WKiH9LGMPqblmPhaH1vlQciD0L5evNyna3Y=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367861; c=relaxed/simple;
	bh=3K+6Ftsy9gtO08X+WV0RUQuDi0hIRlVGUls9SVgexno=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=P24IGsmRD1W5r08jfKjn4mA9zjOp+bC/4NaTzlhwfsQ+JgtFUwpvMm+I9uEyn0ZLfEZs5ODp8zM0SFGlRfS1ICKruT/KcC2bM7pK+RKBHJbEG5KjYmvbC2ZgU2QYtfHnuJ0lSexc0ojkiNAh41T1FM/lNKClGdE4XUzAdqjOQ5U=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=v5iUlgAM; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Erick Karanja <[email-masked]>,
	Miquel Raynal <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 158/196] mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands
Date: Mon, 13 Oct 2025 16:45:49 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Erick Karanja <[email-masked]>

[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ]

In case of a jump to the  err label due to atmel_nand_create() or
atmel_nand_controller_add_nand() failure, the reference to nand_np
need to be released

Use for_each_child_of_node_scoped() to fix the issue.

Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")

Signed-off-by: Erick Karanja <[email-masked]>
Signed-off-by: Miquel Raynal <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
index c5aff27ec4a89..14a09285f1551 100644
--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
@@ -1858,7 +1858,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc)
 
 static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
 {
-	struct device_node *np, *nand_np;
+	struct device_node *np;
 	struct device *dev = nc->dev;
 	int ret, reg_cells;
 	u32 val;
@@ -1885,7 +1885,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
 
 	reg_cells += val;
 
-	for_each_child_of_node(np, nand_np) {
+	for_each_child_of_node_scoped(np, nand_np) {
 		struct atmel_nand *nand;
 
 		nand = atmel_nand_create(nc, nand_np, reg_cells);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:45:41 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367858; cv=none; b=nARDtTRZW3W7JJELVtrJuRwE+BFHvWxVOSbQawVegLQknhlIkyNuD5b+SjbYN75gACVAnpED7p0RSgGN+ENlKDSM9AxBZK1a0X2qsZKArkgGL3OmjFfL/eQXKgnvvTLBoQFexV8EeetKTDbA5PghfUFMb2YLx/gzyzB/J/yo3Ms=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367858; c=relaxed/simple;
	bh=WSDWiMWQEKI1SStuWs0F10HYLC49P7HoccMdOI6Qz54=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=VduNQCXOH3Zd2USHwZemlnKYMqfSTheEYFFtPCHgCd2OaEBOCvZ1qQLF7A+8L9miRjkQHU2q7bQerfULCUPxeP/kcmebbqBnQevfACLBGbjqhCOqtUXZj3pcxzi8UrWhnuY6bOEArx3hWktefXTxt5UGXEY8AObOjwQg1IWJ/W8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rs1lTQ4l; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id E4339C4CEE7;
	Mon, 13 Oct 2025 15:04:17 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760367858;
	bh=WSDWiMWQEKI1SStuWs0F10HYLC49P7HoccMdOI6Qz54=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=rs1lTQ4lQ6t3qrOIhq6qr5ARgqCPr1gxTKxLkB4mBzb3wvGhCGcbhHBqShZBrb5If
	 jcNCM5u0VbmiXBH2a05a+gnYVj0zBLQ8raqNSqjfy8o8iai8u1Pd2T4zniX+6Ht+hZ
	 XiUUSmXBQi2mJkDdlfn1XBbvst6iQlXx/bNTZB3I=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Donet Tom <[email-masked]>,
	David Hildenbrand <[email-masked]>,
	Oscar Salvador <[email-masked]>,
	Alison Schofield <[email-masked]>,
	Chris Mason <[email-masked]>,
	Danilo Krummrich <[email-masked]>,
	Dave Jiang <[email-masked]>,
	Hiroyouki Kamezawa <[email-masked]>,
	Joanthan Cameron <[email-masked]>,
	"Ritesh Harjani (IBM)" <[email-masked]>,
	"Yury Norov (NVIDIA)" <[email-masked]>,
	Zi Yan <[email-masked]>,
	Andrew Morton <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 157/196] drivers/base/node: fix double free in register_one_node()
Date: Mon, 13 Oct 2025 16:45:48 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Donet Tom <[email-masked]>

[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]

When device_register() fails in register_node(), it calls
put_device(&node->dev).  This triggers node_device_release(), which calls
kfree(to_node(dev)), thereby freeing the entire node structure.

As a result, when register_node() returns an error, the node memory has
already been freed.  Calling kfree(node) again in register_one_node()
leads to a double free.

This patch removes the redundant kfree(node) from register_one_node() to
prevent the double free.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
Signed-off-by: Donet Tom <[email-masked]>
Acked-by: David Hildenbrand <[email-masked]>
Acked-by: Oscar Salvador <[email-masked]>
Cc: Alison Schofield <[email-masked]>
Cc: Chris Mason <[email-masked]>
Cc: Danilo Krummrich <[email-masked]>
Cc: Dave Jiang <[email-masked]>
Cc: Greg Kroah-Hartman <[email-masked]>
Cc: Hiroyouki Kamezawa <[email-masked]>
Cc: Joanthan Cameron <[email-masked]>
Cc: "Ritesh Harjani (IBM)" <[email-masked]>
Cc: Yury Norov (NVIDIA) <[email-masked]>
Cc: Zi Yan <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/base/node.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/base/node.c b/drivers/base/node.c
index 7b2ff66c119ae..47960a34305d3 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -880,7 +880,6 @@ int __register_one_node(int nid)
 	error = register_node(node_devices[nid], nid);
 	if (error) {
 		node_devices[nid] = NULL;
-		kfree(node);
 		return error;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:20:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367851; cv=none; b=SeKHbL7qNZd5Fbdwj5snWzJM3Yy0VhXiDiIr0wWHqAQty4SHhxwzgw3I3l2i3m12f0SFgNPKgc+vxGsf4102tkP51FW7u7dElsajsy7YHAqZar/F9iHZOwHfYsA67gi3LUjoSsqakdh/KDkUqhVdUvL3sFG1kpPgPiS2lVz88fM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367851; c=relaxed/simple;
	bh=7Uv7iradkIIsHg2VMmePIjxIgOFmEPEzUJOM8rjIdFA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DgbckzO9gecsFucGZBqu/K5r2xgVJfOXZVG9ErRlJcJ+DpnN8FWHTUTz8z0wsBAgmLhhi2Ebn4yz+B8QHLZrnyroGZ3fOE+aGaL/2Va1Tle9wSWL1FjgxZi67dCYyna549gAfsPmcZaxuUNvMxSW5MpSYRLChNbNpM3M3ypQtWk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vQfrxRHM; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id CA4B9C19423;
	Mon, 13 Oct 2025 15:04:10 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760367851;
	bh=7Uv7iradkIIsHg2VMmePIjxIgOFmEPEzUJOM8rjIdFA=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=vQfrxRHM6bkqRDCiFGJuB3PETb77mYpCQPkk0jf53D0vhZv+Tb2dZZHYshdmvShVx
	 lkAuEJ/8YcBJreKpiG1uiydt2EIyvNXgsDaOrQDfZzqFeL9OPEv+O25Qj/8Eht7wJo
	 Es4vlYlQHHbp4j2gG7hRSczgBVDocMqUZOoySgTw=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	Joseph Qi <[email-masked]>,
	Goldwyn Rodrigues <[email-masked]>,
	Mark Fasheh <[email-masked]>,
	Joel Becker <[email-masked]>,
	Junxiao Bi <[email-masked]>,
	Changwei Ge <[email-masked]>,
	Jun Piao <[email-masked]>,
	Andrew Morton <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 156/196] ocfs2: fix double free in user_cluster_connect()
Date: Mon, 13 Oct 2025 16:45:47 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email-masked]>

[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]

user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then
the error handling frees "lc" a second time.  Set "lc" to NULL on this
path to avoid a double free.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace")
Signed-off-by: Dan Carpenter <[email-masked]>
Reviewed-by: Joseph Qi <[email-masked]>
Reviewed-by: Goldwyn Rodrigues <[email-masked]>
Cc: Mark Fasheh <[email-masked]>
Cc: Joel Becker <[email-masked]>
Cc: Junxiao Bi <[email-masked]>
Cc: Changwei Ge <[email-masked]>
Cc: Jun Piao <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/ocfs2/stack_user.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index 9b76ee66aeb2f..38c0d6f64fce3 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -1018,6 +1018,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)
 			printk(KERN_ERR "ocfs2: Could not determine"
 					" locking version\n");
 			user_cluster_disconnect(conn);
+			lc = NULL;
 			goto out;
 		}
 		wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0));
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:36:58 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367847; cv=none; b=Z870p+7oIr5/lZsm4wVNq5EmlpCkEsngyUrFatHCepHCm6P3c84cQ4mYki7mwgKipUmRqLfck8tRM4p72MYPYc7F72XNF5C66R5BE2dxZ48p02r78hB2UzjQXokK6OI/gP6Ala+w2I3i2wVQ3SEIgtohbAB0BZBNDUAROLTSXd0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367847; c=relaxed/simple;
	bh=/Y7BiWTPEMThRoo2V97sd+KINCJ0LcZFN/CFVpeSs24=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bFifQ9fMwVTsyyk7+T0xIvd3Zsl1hAVU8QCsEDfk1T3XgKIw1FjANdYpGmqgPLUm0nBEwjoiL8Z68B28JLdxDx2iChM3AKoyabG0j+EFXu2R1Qq6F+SyPuWWtHCbv3y5t91TbRVURIWgHU9LpOBC/P6qy106mrfDS/YigZTm44w=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Ie05328w; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Nishanth Menon <[email-masked]>,
	Alexander Sverdlin <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 155/196] hwrng: ks-sa - fix division by zero in ks_sa_rng_init
Date: Mon, 13 Oct 2025 16:45:46 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nishanth Menon <[email-masked]>

[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ]

Fix division by zero in ks_sa_rng_init caused by missing clock
pointer initialization. The clk_get_rate() call is performed on
an uninitialized clk pointer, resulting in division by zero when
calculating delay values.

Add clock initialization code before using the clock.

Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling")
Signed-off-by: Nishanth Menon <[email-masked]>

 drivers/char/hw_random/ks-sa-rng.c | 7 +++++++
 1 file changed, 7 insertions(+)
Reviewed-by: Alexander Sverdlin <[email-masked]>

Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/char/hw_random/ks-sa-rng.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c
index 2f2f21f1b659e..d7b42888f25c2 100644
--- a/drivers/char/hw_random/ks-sa-rng.c
+++ b/drivers/char/hw_random/ks-sa-rng.c
@@ -240,6 +240,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev)
 		return -EINVAL;
 	}
 
+	ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL);
+	if (IS_ERR(ks_sa_rng->clk))
+		return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n");
+
 	pm_runtime_enable(dev);
 	ret = pm_runtime_resume_and_get(dev);
 	if (ret < 0) {
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:42:06 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367843; cv=none; b=JfnNw2A1TFXlcRSKKiu05U0w44Pve14hfGXT/Yhb1nS6MGVCc+DE7jU9hbyWqkd9EShw2Pdz4QRkvYBaPgNBPotKuclP2xbGIXMs7mUZhgUB4NVr6FGHoXXlnMFmHA9ABMCNvMS0Sn5d9emW9yW/f4k8rKsNp2HbfdkhN7SEue4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367843; c=relaxed/simple;
	bh=oG5MM8tYym7O2Z8oguWXjp4+0eELiCBTbbJrW9OWhrM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=NIpQX5oNU12M0v2fJAjBaIdTvoJec4N5RoVg6R+SJuxaZN9JsgKBZcjxU4Ide/IMxBJo23yzHKc4Dur5T0/PYCoJdmro+oO13OMkrxrCO2An8em5QfEAiycSCkYF+7q8WzlhWKwh4RXVVs+1QAWtqZF0dQrzEkG7dLxmMEUF/ho=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ZfTDSnQT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Fan Wu <[email-masked]>,
	Lukas Wunner <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 154/196] KEYS: X.509: Fix Basic Constraints CA flag parsing
Date: Mon, 13 Oct 2025 16:45:45 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Fan Wu <[email-masked]>

[ Upstream commit 5851afffe2ab323a53e184ba5a35fddf268f096b ]

Fix the X.509 Basic Constraints CA flag parsing to correctly handle
the ASN.1 DER encoded structure. The parser was incorrectly treating
the length field as the boolean value.

Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding.
According to ITU-T X.690, a DER-encoded BOOLEAN is represented as:

Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE)

The basicConstraints extension with CA:TRUE is encoded as:

  SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF)
                             ^-- v[2]         ^-- v[3]        ^-- v[4]

The parser was checking v[3] (the length field, always 0x01) instead
of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding).

Also handle the case where the extension is an empty SEQUENCE (30 00),
which is valid for CA:FALSE when the default value is omitted as
required by DER encoding rules (X.690 section 11.5).

Per ITU-T X.690-0207:
- Section 11.5: Default values must be omitted in DER
- Section 11.1: DER requires TRUE to be encoded as 0xFF

Link: https://datatracker.ietf.org/doc/html/rfc5280
Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA")
Signed-off-by: Fan Wu <[email-masked]>
Reviewed-by: Lukas Wunner <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 crypto/asymmetric_keys/x509_cert_parser.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index 0a7049b470c18..5201f47e31d8b 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -618,11 +618,14 @@ int x509_process_extension(void *context, size_t hdrlen,
 		/*
 		 * Get hold of the basicConstraints
 		 * v[1] is the encoding size
-		 *	(Expect 0x2 or greater, making it 1 or more bytes)
+		 *	(Expect 0x00 for empty SEQUENCE with CA:FALSE, or
+		 *	0x03 or greater for non-empty SEQUENCE)
 		 * v[2] is the encoding type
 		 *	(Expect an ASN1_BOOL for the CA)
-		 * v[3] is the contents of the ASN1_BOOL
-		 *      (Expect 1 if the CA is TRUE)
+		 * v[3] is the length of the ASN1_BOOL
+		 *	(Expect 1 for a single byte boolean)
+		 * v[4] is the contents of the ASN1_BOOL
+		 *	(Expect 0xFF if the CA is TRUE)
 		 * vlen should match the entire extension size
 		 */
 		if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ))
@@ -631,8 +634,13 @@ int x509_process_extension(void *context, size_t hdrlen,
 			return -EBADMSG;
 		if (v[1] != vlen - 2)
 			return -EBADMSG;
-		if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1)
+		/* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */
+		if (v[1] == 0)
+			return 0;
+		if (vlen >= 5 && v[2] == ASN1_BOOL && v[3] == 1 && v[4] == 0xFF)
 			ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA;
+		else
+			return -EBADMSG;
 		return 0;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:49:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367840; cv=none; b=qSPb6Fbs7wGEyzOOaRd42qVJdNfbFv/hTp7OyUbYBG6R6hN8OHa1BuJJhDNki9yBEA1G1OB/H7qk2PFqALAts+afQg7+tBfkkJWbKtDKjCl6d7+0xXR4C6PuVVDhdbEjoq6o3s9agRBJewEBo8PYnjRTKzGL5ydXbabx7XyV5aI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367840; c=relaxed/simple;
	bh=eMzUvKcb72bYBGWdTodbqSWRsGiAAPpCKolFVRiV5Vk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=FAaf2zc81bkgTxvcwCXD5T7gCvPBMynKIhTvrurkA1lDKoj3lD9VUmqs8NtgQBWj7CUigr//jTIdClnovH3EMBPeLESw70bxXJeHTqUWqWnJEc4/Xg7XHz3Td77r+k5fYY4taBzQIWFYyI9hW7xCF3TLqCzIOK8OWAlkj5F2Lgw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PX+NiBr9; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Luiz Augusto von Dentz <[email-masked]>,
	Paul Menzel <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 153/196] Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
Date: Mon, 13 Oct 2025 16:45:44 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Luiz Augusto von Dentz <[email-masked]>

[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ]

When creating an advertisement for BIG the address shall not be
non-resolvable since in case of acting as BASS/Broadcast Assistant the
address must be the same as the connection in order to use the PAST
method and even when PAST/BASS are not in the picture a Periodic
Advertisement can still be synchronized thus the same argument as to
connectable advertisements still stand.

Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections")
Signed-off-by: Luiz Augusto von Dentz <[email-masked]>
Reviewed-by: Paul Menzel <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/bluetooth/hci_sync.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index dc9209f9f1a6a..a128e5709fa15 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -1347,7 +1347,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
 {
 	struct hci_cp_le_set_ext_adv_params cp;
 	struct hci_rp_le_set_ext_adv_params rp;
-	bool connectable;
+	bool connectable, require_privacy;
 	u32 flags;
 	bdaddr_t random_addr;
 	u8 own_addr_type;
@@ -1385,10 +1385,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
 		return -EPERM;
 
 	/* Set require_privacy to true only when non-connectable
-	 * advertising is used. In that case it is fine to use a
-	 * non-resolvable private address.
+	 * advertising is used and it is not periodic.
+	 * In that case it is fine to use a non-resolvable private address.
 	 */
-	err = hci_get_random_address(hdev, !connectable,
+	require_privacy = !connectable && !(adv && adv->periodic);
+
+	err = hci_get_random_address(hdev, require_privacy,
 				     adv_use_rpa(hdev, flags), adv,
 				     &own_addr_type, &random_addr);
 	if (err < 0)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:48:02 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367837; cv=none; b=KMoS4BWTCK9OgrYCTvNeaRVsYakITvjNwPJexJw7NYRy6W6GEaeOijjzfXJySCY2047W0jH/Tim0lnfq4P0TIc2n8vKvHM+NW4lTYMJGTFHy9S2+m8+FkCbkjstYMU55W92Z4b2u81CV6bSn60k/BMuzIUpPiN9Jlz7aU9t26Sg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367837; c=relaxed/simple;
	bh=F47G5TXk7JHzRgV0SF5K4DpjxcpXXxOeTXAJZqoKZsw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=BO7qmL7O0zmZdCmxYEFM1iw4xkDspI/29o4JoO+BrcnwDSyQoy8n5Ke4QaAcMxAmWWjiu0G26U/d/vPBw15DFYgUna+91kg29eSP6lg7C/lfn2tEl8Ob+rD7a1/B3GX8pJgI2Ii/jeOlSobCI1c+9dT2iCaKlHlpFtbyNCGhXzk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=tALD5Q+b; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Pauli Virtanen <[email-masked]>,
	Luiz Augusto von Dentz <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 152/196] Bluetooth: ISO: dont leak skb in ISO_CONT RX
Date: Mon, 13 Oct 2025 16:45:43 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Pauli Virtanen <[email-masked]>

[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ]

For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the
skb is leaked.

Free skb after copying its data.

Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Pauli Virtanen <[email-masked]>
Signed-off-by: Luiz Augusto von Dentz <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/bluetooth/iso.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index be71082d9eafa..69529a3049e74 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -2091,7 +2091,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
 		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
 					  skb->len);
 		conn->rx_len -= skb->len;
-		return;
+		break;
 
 	case ISO_END:
 		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:39:08 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367835; cv=none; b=PmXSwD/oeQg1zvWQU8FXp/mdehOeD2B+4hsZDZY7dQbK6ScfTGhsb9Cr5GhudtAUpvp2TCt1Iuf9cSKAs0K5WLd3zkL8MOdz8KfjtJHOzg27UkCaZudBGNO6/1xcj6vb8kFrTwV1ypQzYHDDNn8r6GFKo4HBfSwJ3dwNX5XO21I=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367835; c=relaxed/simple;
	bh=eQrqAOyVT1g3louU1IYmXpgSDQh9zrvR5GQA1mORR1I=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=oM+V5IQYZjo6yxH1RYEJbl3TrEIxL0NfRxipkGtVNryR3pOzPByTy4+YVhgQEmXgdZ42fmk7BPOgdjyNtA1p0+yN8ytuVwNVR7JAaqLL1IIHqt/XGdpJT2iRMoijHoghR6VS12+B/7bXVY0ccBi+rtXCYi/FzgPiuZxHNHtzhFA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2Xgh4ujR; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Luiz Augusto von Dentz <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 151/196] Bluetooth: ISO: Fix possible UAF on iso_conn_free
Date: Mon, 13 Oct 2025 16:45:42 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Luiz Augusto von Dentz <[email-masked]>

[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ]

This attempt to fix similar issue to sco_conn_free where if the
conn->sk is not set to NULL may lead to UAF on iso_conn_free.

Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Luiz Augusto von Dentz <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/bluetooth/iso.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index b94d202bf3745..be71082d9eafa 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -718,6 +718,13 @@ static void iso_sock_kill(struct sock *sk)
 
 	BT_DBG("sk %p state %d", sk, sk->sk_state);
 
+	/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
+	if (iso_pi(sk)->conn) {
+		iso_conn_lock(iso_pi(sk)->conn);
+		iso_pi(sk)->conn->sk = NULL;
+		iso_conn_unlock(iso_pi(sk)->conn);
+	}
+
 	/* Kill poor orphan */
 	bt_sock_unlink(&iso_sk_list, sk);
 	sock_set_flag(sk, SOCK_DEAD);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:40:03 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367832; cv=none; b=quPCDVB8PIJ6t5kfI3LGLYNWeaI7LLmKpO4R9Pdi+wR4q0NSf7uN9XRS/Jf7vzDbDxAlKmPiESrwYq2UCfS06f6yufDpCW2bqWNueoNq0F90zs3CKb2UilTNBwnX3JA/0tFoIYgcFFpLEfuoolGz/lXW9m1HW2rXieZtOLV00zc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367832; c=relaxed/simple;
	bh=gjNIs6WYlG+3HccoDIDj3/uDhx0weW+uBG390mqRGYs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Sd69fz4mbXsAj2kFmkXH2qwEht1f51AJ5jWUETIkTAJsjGfYfYLAVQR1ywibBhUcTBnWgRvjjInK2BqcU8Xxy8KYi89H5NiCGxdDf1+2ozUBMxUAm+i0gRTyIw2EJ50xyWu02j+q9dwfkAm/9aASbJzmPyMQgesNFxgc0w4y+yc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=CxynRJbC; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Luiz Augusto von Dentz <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 150/196] Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
Date: Mon, 13 Oct 2025 16:45:41 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Luiz Augusto von Dentz <[email-masked]>

[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ]

The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO
was not called with a specific index which breaks the likes of
bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an
adapter is plugged, so instead of depending hdev not to be set just
enable the UUID on any index like it was done with iso_sock_uuid.

Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled")
Signed-off-by: Luiz Augusto von Dentz <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/bluetooth/mgmt.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 9b01eaaa0eb2d..54ddbb2635e2f 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -4405,13 +4405,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
 		return -ENOMEM;
 
 #ifdef CONFIG_BT_FEATURE_DEBUG
-	if (!hdev) {
-		flags = bt_dbg_get() ? BIT(0) : 0;
+	flags = bt_dbg_get() ? BIT(0) : 0;
 
-		memcpy(rp->features[idx].uuid, debug_uuid, 16);
-		rp->features[idx].flags = cpu_to_le32(flags);
-		idx++;
-	}
+	memcpy(rp->features[idx].uuid, debug_uuid, 16);
+	rp->features[idx].flags = cpu_to_le32(flags);
+	idx++;
 #endif
 
 	if (hdev && hci_dev_le_state_simultaneous(hdev)) {
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:19:47 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367829; cv=none; b=Lir14qvmRRQrR04cugG81VaKzvyIV0j/TW6LchVxb5L2CXGwZ6GpHQ+M1QepjeD1pDFss7zEYyiNoWDYT3CQhEh7ezmcbIHTxIEhR480eWrvi0p1USXFi1RusFflLIqBmhypCWb59SI5x+vbe/CTqKuY/K2VYNx5F32Lv721apU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367829; c=relaxed/simple;
	bh=dodF4yWw74NkMjSs/d1FmQL1mcBdvsh57jhyVkdHHKA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=uXQE6QRPcX+ZZCGC/Ze1wz8xmN/KGFuxVOhtz0I+3+Zbhr4NpfdnU/rU/5wbCmN7mNb99PWaYknGYjSiXfCRxJJUgDKU7+wuSwYrvs2kIArSaaqLaf4CasMRLP2TK8qvIYiGtF7eFq6g0g+ebIsQ0RBFa4a6FxPGMIBn2uggADo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ny8VIbgd; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	zhang jiao <[email-masked]>,
	"Michael S. Tsirkin" <[email-masked]>,
	Simon Horman <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 149/196] vhost: vringh: Fix copy_to_iter return value check
Date: Mon, 13 Oct 2025 16:45:40 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael S. Tsirkin <[email-masked]>

[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ]

The return value of copy_to_iter can't be negative, check whether the
copied length is equal to the requested length instead of checking for
negative values.

Cc: zhang jiao <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]
Signed-off-by: Michael S. Tsirkin <[email-masked]>
Reviewed-by: Simon Horman <[email-masked]>
Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/vhost/vringh.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 7b8fd977f71cc..60961c65fd472 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -1237,6 +1237,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
 		struct iov_iter iter;
 		u64 translated;
 		int ret;
+		size_t size;
 
 		ret = iotlb_translate(vrh, (u64)(uintptr_t)dst,
 				      len - total_translated, &translated,
@@ -1254,9 +1255,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
 				      translated);
 		}
 
-		ret = copy_to_iter(src, translated, &iter);
-		if (ret < 0)
-			return ret;
+		size = copy_to_iter(src, translated, &iter);
+		if (size != translated)
+			return -EFAULT;
 
 		src += translated;
 		dst += translated;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:34:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367826; cv=none; b=sx00jmmAQS8MwRw6p5Qd89iKMxkqrdYriMjava9uTt6n2xQFIqp3D0E4w4fD1dP93KjY+ouYeJcmf9vHwlP3XT1jRwqOzlFJpB7QEaK91sLWBTNC9w5K6UZMwG6PO9W+Y3GtjPJReyBBFisJcoH6o5P/2iddxM357fYmOeXMWYA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367826; c=relaxed/simple;
	bh=SewuOOZ2UnIp9qEe539bIv6sJjZgrwF8haygyXrT5zM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=hwGIapB/nfybIrDdml7/e3e+0kHD3jtw0WOc9NTm4Fg4xdvBkKLIKXj5v33yQGEeQFvjcF//Oc63t/UqnXwD8sfNSBmkH1/5M7xJ6Fq+2hxO6LLDw4jbYqXkpFAqGnaWT5DdxaPrwHpr2p+Revf/JwHkPI5k2algv8X07/Xmdxs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vx1ZRHN+; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michal Pecio <[email-masked]>,
	I Viswanath <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>,
	[email-masked]
Subject: [PATCH 6.6 148/196] net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
Date: Mon, 13 Oct 2025 16:45:39 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: I Viswanath <[email-masked]>

[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]

syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb.
This is the sequence of events that leads to the warning:

rtl8150_start_xmit() {
	netif_stop_queue();
	usb_submit_urb(dev->tx_urb);
}

rtl8150_set_multicast() {
	netif_stop_queue();
	netif_wake_queue();		<-- wakes up TX queue before URB is done
}

rtl8150_start_xmit() {
	netif_stop_queue();
	usb_submit_urb(dev->tx_urb);	<-- double submission
}

rtl8150_set_multicast being the ndo_set_rx_mode callback should not be
calling netif_stop_queue and notif_start_queue as these handle
TX queue synchronization.

The net core function dev_set_rx_mode handles the synchronization
for rtl8150_set_multicast making it safe to remove these locks.

Reported-and-tested-by: [email-masked]
Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Tested-by: Michal Pecio <[email-masked]>
Signed-off-by: I Viswanath <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/usb/rtl8150.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index ddff6f19ff98e..92add3daadbb1 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
 	rtl8150_t *dev = netdev_priv(netdev);
 	u16 rx_creg = 0x9e;
 
-	netif_stop_queue(netdev);
 	if (netdev->flags & IFF_PROMISC) {
 		rx_creg |= 0x0001;
 		dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name);
@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
 		rx_creg &= 0x00fc;
 	}
 	async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg);
-	netif_wake_queue(netdev);
 }
 
 static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:19:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367823; cv=none; b=JY6WS2iB8mCmIQh5Hj8YLxyhSzofoQccTM0ylcCjszGRL0/spXQ+0nKSDxsX8Akp89eVokvZWjCNAYM0npuRWX00v9M6kw9+HCu1hYBxCqvGKfTxRxJSLcuhYfcWa0NJiZJaS5lTeHndbriWeJgz8Jlh+yXZkxN0gRwZ/78FErg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367823; c=relaxed/simple;
	bh=jIqUX2LOrJXvhzY2u5lLMhCriosgeiyTPtPmf7xk8Dw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=uBtDm1qwVFMyUe4VhPjKdVidFkBfjqGMcZ8fPMoQG8dzlCP3gO0gStpveS92w5BTs4UN5CJdx64dV/ppVS7LRT9bxbvlOtT7ck2Z/U/Tmyj18HaEjQ2KjC90HoXK79gWDcPf0jZCn7tflG63WjFcCN4n91+veWbQlGt5bCU5zew=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FzR4ih2v; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Stefan Metzmacher <[email-masked]>,
	Bernard Metzler <[email-masked]>,
	Jason Gunthorpe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 147/196] RDMA/siw: Always report immediate post SQ errors
Date: Mon, 13 Oct 2025 16:45:38 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bernard Metzler <[email-masked]>

[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]

In siw_post_send(), any immediate error encountered during processing of
the work request list must be reported to the caller, even if previous
work requests in that list were just accepted and added to the send queue.

Not reporting those errors confuses the caller, which would wait
indefinitely for the failing and potentially subsequently aborted work
requests completion.

This fixes a case where immediate errors were overwritten by subsequent
code in siw_post_send().

Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
Link: https://patch.msgid.link/r/[email-masked]
Suggested-by: Stefan Metzmacher <[email-masked]>
Signed-off-by: Bernard Metzler <[email-masked]>
Signed-off-by: Jason Gunthorpe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
index fdbef3254e308..1768b8695c45a 100644
--- a/drivers/infiniband/sw/siw/siw_verbs.c
+++ b/drivers/infiniband/sw/siw/siw_verbs.c
@@ -761,7 +761,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
 	struct siw_wqe *wqe = tx_wqe(qp);
 
 	unsigned long flags;
-	int rv = 0;
+	int rv = 0, imm_err = 0;
 
 	if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) {
 		siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
@@ -947,9 +947,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
 	 * Send directly if SQ processing is not in progress.
 	 * Eventual immediate errors (rv < 0) do not affect the involved
 	 * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ
-	 * processing, if new work is already pending. But rv must be passed
-	 * to caller.
+	 * processing, if new work is already pending. But rv and pointer
+	 * to failed work request must be passed to caller.
 	 */
+	if (unlikely(rv < 0)) {
+		/*
+		 * Immediate error
+		 */
+		siw_dbg_qp(qp, "Immediate error %d\n", rv);
+		imm_err = rv;
+		*bad_wr = wr;
+	}
 	if (wqe->wr_status != SIW_WR_IDLE) {
 		spin_unlock_irqrestore(&qp->sq_lock, flags);
 		goto skip_direct_sending;
@@ -974,15 +982,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
 
 	up_read(&qp->state_lock);
 
-	if (rv >= 0)
-		return 0;
-	/*
-	 * Immediate error
-	 */
-	siw_dbg_qp(qp, "error %d\n", rv);
+	if (unlikely(imm_err))
+		return imm_err;
 
-	*bad_wr = wr;
-	return rv;
+	return (rv >= 0) ? 0 : rv;
 }
 
 /*
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:42:43 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367919; cv=none; b=IFbzZTWvuoowkgCDOsGz1GjokEh5zYTNPI0O2K6YLungaxOsZjaiK3wdwmy5WyPCVxviaSh6PGJjsq+Qcf9FCnLx/+xjJGfDqoHtFuT7jF5N90lbm+F/2z1bTlEc7eS/HZc1YJeUb+E6yQfMvr8EfKbdVkeGlwbaYu2rsEgcpLo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367919; c=relaxed/simple;
	bh=QXX6gnmouB7ge5PrXPu2VOhpdq8R1AewafLw6xi1P1A=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=jy4dz43RNTFS77FoQFKRco0/UKpyz96IVG7qeUi6yecG4GwvyKJ4GW0dUo3CFpWWqR1JGrgA5dboKKUxt1pnkl+lRtwioT+/77l8NUQQyqPekVfP8DoiWE5ua7xU2GWMzzWNmQNwzlyiQb6b8sKf16xC05QfA6DxwxFxGhuwmGU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=1i+KaqaS; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Cristian Ciocaltea <[email-masked]>,
	Shuah Khan <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 146/196] usb: vhci-hcd: Prevent suspending virtually attached devices
Date: Mon, 13 Oct 2025 16:45:37 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Cristian Ciocaltea <[email-masked]>

[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]

The VHCI platform driver aims to forbid entering system suspend when at
least one of the virtual USB ports are bound to an active USB/IP
connection.

However, in some cases, the detection logic doesn't work reliably, i.e.
when all devices attached to the virtual root hub have been already
suspended, leading to a broken suspend state, with unrecoverable resume.

Ensure the virtually attached devices do not enter suspend by setting
the syscore PM flag.  Note this is currently limited to the client side
only, since the server side doesn't implement system suspend prevention.

Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
Signed-off-by: Cristian Ciocaltea <[email-masked]>
Acked-by: Shuah Khan <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 14a5f55f24fc8..b22e0881bfaf3 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
 				 ctrlreq->wValue, vdev->rhport);
 
 			vdev->udev = usb_get_dev(urb->dev);
+			/*
+			 * NOTE: A similar operation has been done via
+			 * USB_REQ_GET_DESCRIPTOR handler below, which is
+			 * supposed to always precede USB_REQ_SET_ADDRESS.
+			 *
+			 * It's not entirely clear if operating on a different
+			 * usb_device instance here is a real possibility,
+			 * otherwise this call and vdev->udev assignment above
+			 * should be dropped.
+			 */
+			dev_pm_syscore_device(&vdev->udev->dev, true);
 			usb_put_dev(old);
 
 			spin_lock(&vdev->ud.lock);
@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
 					"Not yet?:Get_Descriptor to device 0 (get max pipe size)\n");
 
 			vdev->udev = usb_get_dev(urb->dev);
+			/*
+			 * Set syscore PM flag for the virtually attached
+			 * devices to ensure they will not enter suspend on
+			 * the client side.
+			 *
+			 * Note this doesn't have any impact on the physical
+			 * devices attached to the host system on the server
+			 * side, hence there is no need to undo the operation
+			 * on disconnect.
+			 */
+			dev_pm_syscore_device(&vdev->udev->dev, true);
 			usb_put_dev(old);
 			goto out;
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:20:44 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367916; cv=none; b=BFKF7dM3mkjM584H24RElBN1OsArdxugH2Y4pwDAEFS1jHA/hYrM9LLnXd+VEpNCxDY1n3sp+RJ8DzWGWKZRciCcU9QV/0ixRAvczTS34DF7A0g7yVeCXwVjt911LDpI8r8tIJAbB/vDys7jNrbXE/HzC/wznYq9FsY+ucFLPEw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367916; c=relaxed/simple;
	bh=CoXwrWSmY5h4JgGzuAXiyfpqPMm2AFW7grZ6p8VjeQM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Nj2Yt/sw1nzRgYpPbNC3vLru62wckC8T3tewMGh4nRwsBBrVezGqDWqdVGQ92lM0Kp7qSl+KOqMiiX5oA5YMFccMm/CjJjoqJHl/UhEcU3SBXk0uL+hyHHide3mSzdrivaxZmCQXHe8DKaosHTfTwmhNL54xIGBeKayel6ugdaM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aqGNKZA/; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ranjan Kumar <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 145/196] scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
Date: Mon, 13 Oct 2025 16:45:36 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ranjan Kumar <[email-masked]>

[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]

During mpt3sas_transport_port_remove(), messages were logged with
dev_printk() against &mpt3sas_port->port->dev. At this point the SAS
transport device may already be partially unregistered or freed, leading
to a crash when accessing its struct device.

Using ioc_info(), which logs via the PCI device (ioc->pdev->dev),
guaranteed to remain valid until driver removal.

[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI
[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G           OE       6.16.0-rc1+ #1 PREEMPT(voluntary)
[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024
[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70
[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff
[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206
[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32
[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845
[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8
[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000
[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30
[83428.295833] FS:  00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000
[83428.295837] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0
[83428.295844] PKRU: 55555554
[83428.295846] Call Trace:
[83428.295848]  <TASK>
[83428.295850]  _dev_printk+0x5c/0x80
[83428.295857]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.295863]  mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas]
[83428.295882]  _scsih_remove_device+0x21b/0x280 [mpt3sas]
[83428.295894]  ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas]
[83428.295906]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.295910]  mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas]
[83428.295921]  _scsih_expander_node_remove+0x129/0x140 [mpt3sas]
[83428.295933]  _scsih_expander_node_remove+0x6a/0x140 [mpt3sas]
[83428.295944]  scsih_remove+0x3f0/0x4a0 [mpt3sas]
[83428.295957]  pci_device_remove+0x3b/0xb0
[83428.295962]  device_release_driver_internal+0x193/0x200
[83428.295968]  driver_detach+0x44/0x90
[83428.295971]  bus_remove_driver+0x69/0xf0
[83428.295975]  pci_unregister_driver+0x2a/0xb0
[83428.295979]  _mpt3sas_exit+0x1f/0x300 [mpt3sas]
[83428.295991]  __do_sys_delete_module.constprop.0+0x174/0x310
[83428.295997]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.296000]  ? __x64_sys_getdents64+0x9a/0x110
[83428.296005]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.296009]  ? syscall_trace_enter+0xf6/0x1b0
[83428.296014]  do_syscall_64+0x7b/0x2c0
[83428.296019]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.296023]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
Signed-off-by: Ranjan Kumar <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
index e8a4750f6ec47..7d6e4fe31ceed 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
@@ -991,11 +991,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
 	list_for_each_entry_safe(mpt3sas_phy, next_phy,
 	    &mpt3sas_port->phy_list, port_siblings) {
 		if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
-			dev_printk(KERN_INFO, &mpt3sas_port->port->dev,
-			    "remove: sas_addr(0x%016llx), phy(%d)\n",
-			    (unsigned long long)
-			    mpt3sas_port->remote_identify.sas_address,
-			    mpt3sas_phy->phy_id);
+			ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n",
+				(unsigned long long) mpt3sas_port->remote_identify.sas_address,
+					mpt3sas_phy->phy_id);
 		mpt3sas_phy->phy_belongs_to_port = 0;
 		if (!ioc->remove_host)
 			sas_port_delete_phy(mpt3sas_port->port,
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:31:27 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367913; cv=none; b=O6fy07dMMXgEKo+hucEs6A+SIrUOn/5/TCZAOD3O7yDZaQt/nJuGYuoI38bcJHAaCxT/+Y97/ceZFjAFXTFCMh3Bp7q5ifIduANPviJZBYjgyEXh0E2NzKBmew53IgzOEcfKxbxSr3Gomu+D1VWKINP2jaauP8XM1QGloJsCdcs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367913; c=relaxed/simple;
	bh=OBujfkYY1eQsdYiXdoecNreX1LkFbphMyiZ1hAzor4s=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=KYWP93rbXixG6YKjZ25RB9kOwd7nNxxSa2cWDho6Wq8oq/UaegctMOGYVGxRXxEHPUj6+1BOVPPkidMOAOqPgePaZ8FDYkD6Jo0Mcxk/WhjqegRky8rm8ji2ub3NBdxvnJ+RxLkruNlzuoQN2vxv7JxofKCpek44yoCLrC9LTaw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hUXsGKnQ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Julian Anastasov <[email-masked]>,
	Slavin Liu <[email-masked]>,
	Florian Westphal <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 144/196] ipvs: Defer ip_vs_ftp unregister during netns cleanup
Date: Mon, 13 Oct 2025 16:45:35 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Slavin Liu <[email-masked]>

[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]

On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp
before connections with valid cp->app pointers are flushed, leading to a
use-after-free.

Fix this by introducing a global `exiting_module` flag, set to true in
ip_vs_ftp_exit() before unregistering the pernet subsystem. In
__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns
cleanup (when exiting_module is false) and defer it to
__ip_vs_cleanup_batch(), which unregisters all apps after all connections
are flushed. If called during module exit, unregister ip_vs_ftp
immediately.

Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
Suggested-by: Julian Anastasov <[email-masked]>
Signed-off-by: Slavin Liu <[email-masked]>
Signed-off-by: Julian Anastasov <[email-masked]>
Signed-off-by: Florian Westphal <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/netfilter/ipvs/ip_vs_ftp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index ef1f45e43b630..61d3797fb7995 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -53,6 +53,7 @@ enum {
 	IP_VS_FTP_EPSV,
 };
 
+static bool exiting_module;
 /*
  * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
  * First port is set to the default port.
@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net)
 {
 	struct netns_ipvs *ipvs = net_ipvs(net);
 
-	if (!ipvs)
+	if (!ipvs || !exiting_module)
 		return;
 
 	unregister_ip_vs_app(ipvs, &ip_vs_ftp);
@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void)
  */
 static void __exit ip_vs_ftp_exit(void)
 {
+	exiting_module = true;
 	unregister_pernet_subsys(&ip_vs_ftp_ops);
 	/* rcu_barrier() is called by netns */
 }
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:30:10 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367910; cv=none; b=Uzxg7Ztkg+aJWtKk++oqH27S9htKNWiBynXaGMoZ0oLFuvmg+zZVdGjsBgljOxxkiPoDi92IMewNXsMRB9Jd6GVseBLrxb0gkr2shsDObXb3YoKnH4gcZ/TfjPRATCfhzuPAw6umxsW7iGzpjWIBSA7GqGyikHtIY8h+0ivrDZc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367910; c=relaxed/simple;
	bh=nACUUktla0KaHPFrF5aRrfC4PLL2auupTChIMyBzgp0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=AA27mYCRR7CVFH4p+d5RFfLDtxtT+MnZ1odRVxUVWVDmRc+WNe5cfPb6LSaBujzRJn8z9rI91s0L/nh4YlsO4o+fKhiG/FZBBzVQGVgYFwchWbDa9neQ4/7Ha8uhuUL5jdKe+YRQKKnKezQGU+Ni3SBfY+KhGMleWi8aGr4JL0U=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PAy9NTfy; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Anthony Iliopoulos <[email-masked]>,
	Benjamin Coddington <[email-masked]>,
	Anna Schumaker <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 143/196] NFSv4.1: fix backchannel max_resp_sz verification check
Date: Mon, 13 Oct 2025 16:45:34 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Anthony Iliopoulos <[email-masked]>

[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]

When the client max_resp_sz is larger than what the server encodes in
its reply, the nfs4_verify_back_channel_attrs() check fails and this
causes nfs4_proc_create_session() to fail, in cases where the client
page size is larger than that of the server and the server does not want
to negotiate upwards.

While this is not a problem with the linux nfs server that will reflect
the proposed value in its reply irrespective of the local page size,
other nfs server implementations may insist on their own max_resp_sz
value, which could be smaller.

Fix this by accepting smaller max_resp_sz values from the server, as
this does not violate the protocol. The server is allowed to decrease
but not increase proposed the size, and as such values smaller than the
client-proposed ones are valid.

Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks")
Signed-off-by: Anthony Iliopoulos <[email-masked]>
Reviewed-by: Benjamin Coddington <[email-masked]>
Signed-off-by: Anna Schumaker <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/nfs/nfs4proc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 124b9cee6fed7..94a1caf326699 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -9226,7 +9226,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args
 		goto out;
 	if (rcvd->max_rqst_sz > sent->max_rqst_sz)
 		return -EINVAL;
-	if (rcvd->max_resp_sz < sent->max_resp_sz)
+	if (rcvd->max_resp_sz > sent->max_resp_sz)
 		return -EINVAL;
 	if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)
 		return -EINVAL;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:32:27 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367907; cv=none; b=Zmj2a+TFExf2uc0XsFGumKzwWfzvYNu1plVfu+RU4DBGrLsrXb7IvuGzZmob0maAbkqPsCi9kSkZxOOttF/J9lspRVBuGE2i+m+r1GVUMzU6QHZoz6eHsFHGwGyfDR4TYFUPLjIy6e/DIcS8ZcG77mOUICvAGlmJjwDr18VffFc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367907; c=relaxed/simple;
	bh=mqg1pmPSB84sObNBxHIBPYw6NC5qO0GMW/nYPZFN+t4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DwALAK+znZB1wVpw3g+t4SgtLxSS3uxZdlfcaBLSbFeY96EpomOG/lnbWdpTYtTx7BYmzPbcSeBqv2m7XxabX8YAYFB2eqFY1c8SsAIBdDBPFMrqhYv/wboGzP4EZzfO5MwbqfpTUqMLpGecvCxp3ERpqrTG8tJVQGsRHh2OcHE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=NTP/07WU; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Tamas Zsoldos <[email-masked]>,
	Leo Yan <[email-masked]>,
	James Clark <[email-masked]>,
	Suzuki K Poulose <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 142/196] coresight: trbe: Return NULL pointer for allocation failures
Date: Mon, 13 Oct 2025 16:45:33 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leo Yan <[email-masked]>

[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ]

When the TRBE driver fails to allocate a buffer, it currently returns
the error code "-ENOMEM". However, the caller etm_setup_aux() only
checks for a NULL pointer, so it misses the error. As a result, the
driver continues and eventually causes a kernel panic.

Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on
allocation failures. This allows that the callers can properly handle
the failure.

Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
Reported-by: Tamas Zsoldos <[email-masked]>
Signed-off-by: Leo Yan <[email-masked]>
Reviewed-by: James Clark <[email-masked]>
Signed-off-by: Suzuki K Poulose <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-trbe.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
index 7f91b1ffe66a5..a564bd5c8b62d 100644
--- a/drivers/hwtracing/coresight/coresight-trbe.c
+++ b/drivers/hwtracing/coresight/coresight-trbe.c
@@ -744,12 +744,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
 
 	buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event));
 	if (!buf)
-		return ERR_PTR(-ENOMEM);
+		return NULL;
 
 	pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL);
 	if (!pglist) {
 		kfree(buf);
-		return ERR_PTR(-ENOMEM);
+		return NULL;
 	}
 
 	for (i = 0; i < nr_pages; i++)
@@ -759,7 +759,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
 	if (!buf->trbe_base) {
 		kfree(pglist);
 		kfree(buf);
-		return ERR_PTR(-ENOMEM);
+		return NULL;
 	}
 	buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE;
 	buf->trbe_write = buf->trbe_base;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:35:38 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367905; cv=none; b=AOkfTMLGYypq59EO5WdR6tU9oZT/pk51sUgHOr1mNAkdcYUFjPRNvCyeHnSjQFtkjm9YBUThLAC+yMxdJaWA32vYGhrEAgpiUaGM+ojTrTFHwTr61Ax9LW6aR3sSgn0SIuTs2fUJp8o+vyPEf/QITZq42IOCTUTGt+g3kTyO3SM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367905; c=relaxed/simple;
	bh=CjFclI1C//unICXY0eAyPGsV5MLMZjbLu/l+Nxm0sUA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=btLibPaT9qZC0pXb71SFxebZmsJ4GK9s7Z1PYWZlkv5LtcUt3A6OwFJxTWVxfEi0aDPlB2nrb8fSsQk3XNvTTYLAh8E11j/k56m3bUqEwy7gIqDVhfN+dwVKl/OwAIyb07iEP/S9SnuHOh7gni7D7n0O3khq58ae2YYvk99a/K8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=GBmkQ8Pa; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Anshuman Khandual <[email-masked]>,
	Yeoreum Yun <[email-masked]>,
	James Clark <[email-masked]>,
	Leo Yan <[email-masked]>,
	Suzuki K Poulose <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 141/196] coresight: etm4x: Support atclk
Date: Mon, 13 Oct 2025 16:45:32 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leo Yan <[email-masked]>

[ Upstream commit 40c0cdc9cbbebae9f43bef1cab9ce152318d0cce ]

The atclk is an optional clock for the CoreSight ETMv4, but the driver
misses to initialize it.

This change enables atclk in probe of the ETMv4 driver, and dynamically
control the clock during suspend and resume.

No need to check the driver data and clock pointer in the runtime
suspend and resume, so remove checks.  And add error handling in the
resume function.

Add a minor fix to the comment format when adding the atclk field.

Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
Reviewed-by: Anshuman Khandual <[email-masked]>
Reviewed-by: Yeoreum Yun <[email-masked]>
Tested-by: James Clark <[email-masked]>
Signed-off-by: Leo Yan <[email-masked]>
Signed-off-by: Suzuki K Poulose <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../coresight/coresight-etm4x-core.c          | 20 ++++++++++++++-----
 drivers/hwtracing/coresight/coresight-etm4x.h |  4 +++-
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index 625582f7dc34c..e4d8d446ea4d3 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -2118,6 +2118,10 @@ static int etm4_probe(struct device *dev)
 	if (WARN_ON(!drvdata))
 		return -ENOMEM;
 
+	drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
+	if (IS_ERR(drvdata->atclk))
+		return PTR_ERR(drvdata->atclk);
+
 	if (pm_save_enable == PARAM_PM_SAVE_FIRMWARE)
 		pm_save_enable = coresight_loses_context_with_cpu(dev) ?
 			       PARAM_PM_SAVE_SELF_HOSTED : PARAM_PM_SAVE_NEVER;
@@ -2369,8 +2373,8 @@ static int etm4_runtime_suspend(struct device *dev)
 {
 	struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
 
-	if (drvdata->pclk && !IS_ERR(drvdata->pclk))
-		clk_disable_unprepare(drvdata->pclk);
+	clk_disable_unprepare(drvdata->atclk);
+	clk_disable_unprepare(drvdata->pclk);
 
 	return 0;
 }
@@ -2378,11 +2382,17 @@ static int etm4_runtime_suspend(struct device *dev)
 static int etm4_runtime_resume(struct device *dev)
 {
 	struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
+	int ret;
+
+	ret = clk_prepare_enable(drvdata->pclk);
+	if (ret)
+		return ret;
 
-	if (drvdata->pclk && !IS_ERR(drvdata->pclk))
-		clk_prepare_enable(drvdata->pclk);
+	ret = clk_prepare_enable(drvdata->atclk);
+	if (ret)
+		clk_disable_unprepare(drvdata->pclk);
 
-	return 0;
+	return ret;
 }
 #endif
 
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
index d72f742b41054..d8b8102d790cc 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.h
+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
@@ -920,7 +920,8 @@ struct etmv4_save_state {
 
 /**
  * struct etm4_drvdata - specifics associated to an ETM component
- * @pclk        APB clock if present, otherwise NULL
+ * @pclk:       APB clock if present, otherwise NULL
+ * @atclk:      Optional clock for the core parts of the ETMv4.
  * @base:       Memory mapped base address for this component.
  * @csdev:      Component vitals needed by the framework.
  * @spinlock:   Only one at a time pls.
@@ -988,6 +989,7 @@ struct etmv4_save_state {
  */
 struct etmv4_drvdata {
 	struct clk			*pclk;
+	struct clk			*atclk;
 	void __iomem			*base;
 	struct coresight_device		*csdev;
 	spinlock_t			spinlock;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:30:00 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367888; cv=none; b=ddgxatrPDHBhbpnjYaWJdtXxXJjonJvhbAtFdxf3buQDqvVtz4Paqid5xz/IZgwiEO989wieGGdJxdF5XB0iXOycbuTVsOgaaHvFdxC/Wk1X3hQOQsWDkdHyRxYEZpjP4rjpye0IvaGoJsIBZzlHHT2bd3rQJUHKqn500VjB+cc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367888; c=relaxed/simple;
	bh=f7CV7VLHhzSXLMWLTpd9BWiYd8KM3veg+hnMglhfPEs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=GGqpmgJ8Xbm2Jgg6pKmbxOXidkPWrj3toTd2FaI7yFMJ9CcSk9QR8LFrtAzwgW9ArFCJzo5UcV1vcYOb1pz76Fwfcyq6lzUiquY1WR7KjGDvp/JaL0Q90Pu8a3dBi6CjzSPZDBOgMx0smtDqfi/ISUg5Eax7X0eUyLr2lr6jsDQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=AFb3SGlN; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yuanfang Zhang <[email-masked]>,
	James Clark <[email-masked]>,
	Mike Leach <[email-masked]>,
	Suzuki K Poulose <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 140/196] coresight-etm4x: Conditionally access register TRCEXTINSELR
Date: Mon, 13 Oct 2025 16:45:31 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yuanfang Zhang <[email-masked]>

[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ]

The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0.
To avoid invalid accesses, introduce a check on numextinsel
(derived from TRCIDR5[11:9]) before reading or writing to this register.

Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses")
Signed-off-by: Yuanfang Zhang <[email-masked]>
Reviewed-by: James Clark <[email-masked]>
Reviewed-by: Mike Leach <[email-masked]>
Signed-off-by: Suzuki K Poulose <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++---
 drivers/hwtracing/coresight/coresight-etm4x.h      |  2 ++
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index 05d9f87e35333..625582f7dc34c 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -481,7 +481,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
 		etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
 		etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR);
 	}
-	etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
+	if (drvdata->numextinsel)
+		etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
 	for (i = 0; i < drvdata->nr_cntr; i++) {
 		etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i));
 		etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i));
@@ -1323,6 +1324,7 @@ static void etm4_init_arch_data(void *info)
 	etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5);
 	/* NUMEXTIN, bits[8:0] number of external inputs implemented */
 	drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5);
+	drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5);
 	/* TRACEIDSIZE, bits[21:16] indicates the trace ID width */
 	drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5);
 	/* ATBTRIG, bit[22] implementation can support ATB triggers? */
@@ -1750,7 +1752,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
 		state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR);
 		state->trcseqstr = etm4x_read32(csa, TRCSEQSTR);
 	}
-	state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
+
+	if (drvdata->numextinsel)
+		state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
 
 	for (i = 0; i < drvdata->nr_cntr; i++) {
 		state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i));
@@ -1882,7 +1886,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
 		etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR);
 		etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR);
 	}
-	etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
+	if (drvdata->numextinsel)
+		etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
 
 	for (i = 0; i < drvdata->nr_cntr; i++) {
 		etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i));
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
index 6b6760e49ed35..d72f742b41054 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.h
+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
@@ -162,6 +162,7 @@
 #define TRCIDR4_NUMVMIDC_MASK			GENMASK(31, 28)
 
 #define TRCIDR5_NUMEXTIN_MASK			GENMASK(8, 0)
+#define TRCIDR5_NUMEXTINSEL_MASK               GENMASK(11, 9)
 #define TRCIDR5_TRACEIDSIZE_MASK		GENMASK(21, 16)
 #define TRCIDR5_ATBTRIG				BIT(22)
 #define TRCIDR5_LPOVERRIDE			BIT(23)
@@ -999,6 +1000,7 @@ struct etmv4_drvdata {
 	u8				nr_cntr;
 	u8				nr_ext_inp;
 	u8				numcidc;
+	u8				numextinsel;
 	u8				numvmidc;
 	u8				nrseqstate;
 	u8				nr_event;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:24:28 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367856; cv=none; b=aBC/H4VzLTWXV2M980bpgG0gMXXkk5CHrGKscAV6Cmg8Q8SEU9nmgB5mOwdaU/vQWFRkVWl3gyx8F/K1tGgeRoUMV+v7qdc521i2vL88OdtcgKfiuikoNJEycn48VqyPQXf5aIyaJKoxEfKGropItojyYhNimJH/Vzq7ENdrBNY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367856; c=relaxed/simple;
	bh=Oe88VzO31f9E4tv1JWJ+V1S64+5tYjQXEcaiPbxzGvU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bDVfHIfGpo3nkRyJ3ESshU9DfKAL1lh6IW0q7R/N3V3whSgGqpfCGraMQsTL1tinB8hqYMu7/FmTUzO+y+KmIbNmDzHm5QP7w4BYEtnRt7/gBvBE8KK700VCAOilnvQhDgL0kEN9qbFyT2yzL3Bk8IHc6N8Cjpy6ZhqKw2IqaOs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=tHOs+/Aj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dmitry Baryshkov <[email-masked]>,
	Stephan Gerhold <[email-masked]>,
	Bjorn Andersson <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 139/196] remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
Date: Mon, 13 Oct 2025 16:45:30 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stephan Gerhold <[email-masked]>

[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]

enable_irq() and disable_irq() are reference counted, so we must make sure
that each enable_irq() is always paired with a single disable_irq(). If we
call disable_irq() twice followed by just a single enable_irq(), the IRQ
will remain disabled forever.

For the error handling path in qcom_q6v5_wait_for_start(), disable_irq()
will end up being called twice, because disable_irq() also happens in
qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().

Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since
qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more
sense to have the rollback handled always by qcom_q6v5_unprepare().

Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling")
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Stephan Gerhold <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Bjorn Andersson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/remoteproc/qcom_q6v5.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
index 4ee5e67a9f03f..769c6d6d6a731 100644
--- a/drivers/remoteproc/qcom_q6v5.c
+++ b/drivers/remoteproc/qcom_q6v5.c
@@ -156,9 +156,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)
 	int ret;
 
 	ret = wait_for_completion_timeout(&q6v5->start_done, timeout);
-	if (!ret)
-		disable_irq(q6v5->handover_irq);
-
 	return !ret ? -ETIMEDOUT : 0;
 }
 EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:28:08 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367821; cv=none; b=dL1bZ5hJ06nEREkE0QwKRCdbAoH9TjZITpqMuHSCVgzQmtoXdSotLIxAwC+sgtkulS4GeC87LUwAbziMqjQKQTkIxgmA5FNhXz0GJAaGPGsfD1Apm32f1dNbL5FJWGLRN3anPrPBOaU1dWZd31kc/JcLHaINICOWGb4m5Kv/Ljk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367821; c=relaxed/simple;
	bh=i9Jv2tX0Tk7YIpNhy04V1M4rtJX10is/8tpXmZ4Qa8w=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=oIxPaR8nzxatYIFdDgtJTXmQGHQ2LR1RnEBZtqhHIaqvCuUEU+ZddE2kkvIWiJ7rAlt6gVQ0XwEA0nWhmw103Lasn+c8DWdk9B6aU5xX5TxOzogt5iviZMMgMnwWe2lRhEwUrIUNn1MPsjSXQapzFk/shTfHky3owUGgR/8SLAw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=p/cFbk7t; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Nagarjuna Kristam <[email-masked]>,
	Niklas Cassel <[email-masked]>,
	Manivannan Sadhasivam <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 138/196] PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert()
Date: Mon, 13 Oct 2025 16:45:29 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nagarjuna Kristam <[email-masked]>

[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ]

During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently
called twice.

pex_ep_event_pex_rst_assert() should do the opposite of
pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate
tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate
tegra_pcie_bpmp_set_pll_state() call should instead be a call to
tegra_pcie_bpmp_set_ctrl_state().

With this, the uninitialization sequence also matches that of
tegra_pcie_unconfig_controller().

Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support")
Signed-off-by: Nagarjuna Kristam <[email-masked]>
[cassel: improve commit log]
Signed-off-by: Niklas Cassel <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
[mani: added Fixes tag]
Signed-off-by: Manivannan Sadhasivam <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
index 416d6b45d1fe8..115a21cf869ae 100644
--- a/drivers/pci/controller/dwc/pcie-tegra194.c
+++ b/drivers/pci/controller/dwc/pcie-tegra194.c
@@ -1734,9 +1734,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)
 				ret);
 	}
 
-	ret = tegra_pcie_bpmp_set_pll_state(pcie, false);
+	ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false);
 	if (ret)
-		dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret);
+		dev_err(pcie->dev, "Failed to disable controller: %d\n", ret);
 
 	pcie->ep_state = EP_STATE_DISABLED;
 	dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n");
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:45:22 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367922; cv=none; b=dGO8V1lo9J2FNzHI/ijRW7f92yd6uMbx4sSGsPPjYiwiL9xr964bb3YCUMcwog8REaAlxpHAp9A9/ozA7/DX9daWks3jH3Fo9cSom/dKH2n8o9HqE1+kgw4G6u/cDblM7qNwrpcop5K4puk6B5qAv861bFpttr/90wcCT/Yy6fw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367922; c=relaxed/simple;
	bh=n2vrkOXKcAgiwp2ueTSr/ZVTKjcmQYJwhooL7dKKQ+k=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=IPlajI06+vEw+F+o/bWww1m2YmpOBU6PJIr1KwGitkSqXhQajgu6zoy9OmQMgyLzYp1DIuy+XeCVAcnXpbrAdvMMdHyY7tHz7OVG7vZHYyUQQZQz/+UuhXKlbREngDq6VKxBfw366uVhBmScRQrvVD4ctxv7u043B5MG00z9Bx4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=T8F4yoaF; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Fedor Pchelkin <[email-masked]>,
	Ping-Ke Shih <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 137/196] wifi: rtw89: avoid circular locking dependency in ser_state_run()
Date: Mon, 13 Oct 2025 16:45:28 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Fedor Pchelkin <[email-masked]>

[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ]

Lockdep gives a splat [1] when ser_hdl_work item is executed.  It is
scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a
wiphy lock inside.  However, this workqueue can be flushed when e.g.
closing the interface and wiphy lock is already taken in that case.

Choosing wiphy_work_queue() for SER is likely not suitable.  Back on to
the global workqueue.

[1]:

 WARNING: possible circular locking dependency detected
 6.17.0-rc2 #17 Not tainted
 ------------------------------------------------------
 kworker/u32:1/61 is trying to acquire lock:
 ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core]

 but task is already holding lock:
 ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}:
        process_one_work+0x7c6/0x1450
        worker_thread+0x49e/0xd00
        kthread+0x313/0x640
        ret_from_fork+0x221/0x300
        ret_from_fork_asm+0x1a/0x30

 -> #1 ((wq_completion)phy0){+.+.}-{0:0}:
        touch_wq_lockdep_map+0x8e/0x180
        __flush_workqueue+0x129/0x10d0
        ieee80211_stop_device+0xa8/0x110
        ieee80211_do_stop+0x14ce/0x2880
        ieee80211_stop+0x13a/0x2c0
        __dev_close_many+0x18f/0x510
        __dev_change_flags+0x25f/0x670
        netif_change_flags+0x7b/0x160
        do_setlink.isra.0+0x1640/0x35d0
        rtnl_newlink+0xd8c/0x1d30
        rtnetlink_rcv_msg+0x700/0xb80
        netlink_rcv_skb+0x11d/0x350
        netlink_unicast+0x49a/0x7a0
        netlink_sendmsg+0x759/0xc20
        ____sys_sendmsg+0x812/0xa00
        ___sys_sendmsg+0xf7/0x180
        __sys_sendmsg+0x11f/0x1b0
        do_syscall_64+0xbb/0x360
        entry_SYSCALL_64_after_hwframe+0x77/0x7f

 -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}:
        __lock_acquire+0x124c/0x1d20
        lock_acquire+0x154/0x2e0
        __mutex_lock+0x17b/0x12f0
        ser_state_run+0x5e/0x180 [rtw89_core]
        rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
        process_one_work+0x82d/0x1450
        worker_thread+0x49e/0xd00
        kthread+0x313/0x640
        ret_from_fork+0x221/0x300
        ret_from_fork_asm+0x1a/0x30

 other info that might help us debug this:

 Chain exists of:
   &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work)

  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock((work_completion)(&ser->ser_hdl_work));
                                lock((wq_completion)phy0);
                                lock((work_completion)(&ser->ser_hdl_work));
   lock(&rdev->wiphy.mtx);

  *** DEADLOCK ***

 2 locks held by kworker/u32:1/61:
  #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450
  #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450

 stack backtrace:
 CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary)
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025
 Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core]
 Call Trace:
  <TASK>
  dump_stack_lvl+0x5d/0x80
  print_circular_bug.cold+0x178/0x1be
  check_noncircular+0x14c/0x170
  __lock_acquire+0x124c/0x1d20
  lock_acquire+0x154/0x2e0
  __mutex_lock+0x17b/0x12f0
  ser_state_run+0x5e/0x180 [rtw89_core]
  rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
  process_one_work+0x82d/0x1450
  worker_thread+0x49e/0xd00
  kthread+0x313/0x640
  ret_from_fork+0x221/0x300
  ret_from_fork_asm+0x1a/0x30
  </TASK>

Found by Linux Verification Center (linuxtesting.org).

Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet")
Signed-off-by: Fedor Pchelkin <[email-masked]>
Acked-by: Ping-Ke Shih <[email-masked]>
Signed-off-by: Ping-Ke Shih <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/realtek/rtw89/ser.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c
index 45165cf3e824e..ae3e02efcc5d7 100644
--- a/drivers/net/wireless/realtek/rtw89/ser.c
+++ b/drivers/net/wireless/realtek/rtw89/ser.c
@@ -207,7 +207,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work)
 
 static int ser_send_msg(struct rtw89_ser *ser, u8 event)
 {
-	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
 	struct ser_msg *msg = NULL;
 
 	if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags))
@@ -223,7 +222,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
 	list_add(&msg->list, &ser->msg_q);
 	spin_unlock_irq(&ser->msg_q_lock);
 
-	ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work);
+	schedule_work(&ser->ser_hdl_work);
 	return 0;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:40:38 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367798; cv=none; b=jB8DSZjTYDZCnuWl9K63q/1tSQSVf0p/GQN/yQLH6s5doLebl/W5tFx1RjJFcOC4etw7TdYr5eZEEIzkJvSqUUVORMZEC2+OBbWoF9OI8WWbRr94Cx8EAHecssA6ryFgi+7E/nYZSPA5c4hju4sNo2HDiVoa3xLL8py+ji9bk0I=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367798; c=relaxed/simple;
	bh=Yxd2ZkHNEwMnqr10GPZba+AWEYyRZyruOeIedl1m1KI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=oQipVrxRff2TB/nakX/xTgiAI783OZqF1dY+Nl6Bc8QI/2ufW/JdJ0CvNpMfcAFcexpYi6rCt9K28DzzTPhSJV4tVAVt/tYhy2pqD7HtyUAtKgdlFe4AWIqg6dLlx2oqfZjozZTB7NGrqJpz1/hDRDiKEuSUN5Y7uRIoCsmPyzo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JVMqW6mG; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhu Yanjun <[email-masked]>,
	Gui-Dong Han <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 136/196] RDMA/rxe: Fix race in do_task() when draining
Date: Mon, 13 Oct 2025 16:45:27 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gui-Dong Han <[email-masked]>

[ Upstream commit 8ca7eada62fcfabf6ec1dc7468941e791c1d8729 ]

When do_task() exhausts its iteration budget (!ret), it sets the state
to TASK_STATE_IDLE to reschedule, without a secondary check on the
current task->state. This can overwrite the TASK_STATE_DRAINING state
set by a concurrent call to rxe_cleanup_task() or rxe_disable_task().

While state changes are protected by a spinlock, both rxe_cleanup_task()
and rxe_disable_task() release the lock while waiting for the task to
finish draining in the while(!is_done(task)) loop. The race occurs if
do_task() hits its iteration limit and acquires the lock in this window.
The cleanup logic may then proceed while the task incorrectly
reschedules itself, leading to a potential use-after-free.

This bug was introduced during the migration from tasklets to workqueues,
where the special handling for the draining case was lost.

Fix this by restoring the original pre-migration behavior. If the state is
TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to
force a new loop iteration. This allows the task to finish its work, so
that a subsequent iteration can reach the switch statement and correctly
transition the state to TASK_STATE_DRAINED, stopping the task as intended.

Fixes: 9b4b7c1f9f54 ("RDMA/rxe: Add workqueue support for rxe tasks")
Reviewed-by: Zhu Yanjun <[email-masked]>
Signed-off-by: Gui-Dong Han <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Leon Romanovsky <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/sw/rxe/rxe_task.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c
index 80332638d9e3a..be6cd8ce4d97e 100644
--- a/drivers/infiniband/sw/rxe/rxe_task.c
+++ b/drivers/infiniband/sw/rxe/rxe_task.c
@@ -132,8 +132,12 @@ static void do_task(struct rxe_task *task)
 		 * yield the cpu and reschedule the task
 		 */
 		if (!ret) {
-			task->state = TASK_STATE_IDLE;
-			resched = 1;
+			if (task->state != TASK_STATE_DRAINING) {
+				task->state = TASK_STATE_IDLE;
+				resched = 1;
+			} else {
+				cont = 1;
+			}
 			goto exit;
 		}
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:37:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367795; cv=none; b=jIkbSE7F+onAansRYQfCo7Bge3iunlNnnAKPweg8mtuNnTkVSzftS84ueeEWAYtOWOk9T80CIV+Avkq+rj07RHN5IQE8xrOGPjE9zvpEsOFl1eHZTdyhGfPWi3dE2Tl4uQhN5c6iGBDoOxQFaEx7JDmxwk5B32jBXyaSamcYqIk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367795; c=relaxed/simple;
	bh=5VZa6XCmUNXRN87xcFHT470lLuEBoyT/gKPaON3yqp4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=W89lAScPWF2YULJxMYrM4PH01OdQ7k46xHAd2cbZAxSXGRthb5yBg8r/Hc/W2B/HmpRzgiH9ndcU1mUkisYLnC2uHG7dAkXU1xzv0HrhvRJ2WZIFN49RwWtvHrbhZZh8soFjdSx+/tbxGDuwrdqnBORO18ABXWb7pMuOhxUmQw4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=kuabf7ub; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chenghai Huang <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 135/196] crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs
Date: Mon, 13 Oct 2025 16:45:26 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chenghai Huang <[email-masked]>

[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ]

When the initialization of qm->debug.acc_diff_reg fails,
the probe process does not exit. However, after qm->debug.qm_diff_regs is
freed, it is not set to NULL. This can lead to a double free when the
remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs
should be set to NULL after it is freed.

Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue")
Signed-off-by: Chenghai Huang <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/crypto/hisilicon/debugfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c
index bd205f1f2279e..573c0033a5afe 100644
--- a/drivers/crypto/hisilicon/debugfs.c
+++ b/drivers/crypto/hisilicon/debugfs.c
@@ -865,6 +865,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm,
 		dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
 		ret = PTR_ERR(qm->debug.acc_diff_regs);
 		qm->debug.acc_diff_regs = NULL;
+		qm->debug.qm_diff_regs = NULL;
 		return ret;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:18:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367793; cv=none; b=NEWKJY2g3taBPiA+MKAY0mnz29/aXU10VlU/SngHvwoLpVOPn1zJvo5RUvrYkZwBJoo3ZEx9oeC2Zwi+MSuLU+jqolM/AWysJo9ZmLrecq8yu9gVNyMxYrEn2T3bp+CvyE/DxGDQBNNIguiRmu2JjBLl/YBenNq3nFLlUQuhHGQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367793; c=relaxed/simple;
	bh=UhaXPcoo8x+unNZ9BaoQhwuKTbL1brSRATr9HOROGkA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=a2O3DbAhqBy9V1e80I80YcG7XEqfxV5Ex2ulfNPF5+NBSMG0Eq8arJk7DDZStyBbb1J6/kQc0vhe9Ov3BzTB932a7KrVotlCDvg5y47Bdb+qzSDqwPEl4+VeAyP73zTgoL+hEVHjKPy7gwHTYYoVPgZIw25wH8I4HmVRkS75wwg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=wgqt2QrL; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zilin Guan <[email-masked]>,
	Brett Creeley <[email-masked]>,
	Alex Williamson <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 134/196] vfio/pds: replace bitmap_free with vfree
Date: Mon, 13 Oct 2025 16:45:25 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zilin Guan <[email-masked]>

[ Upstream commit acb59a4bb8ed34e738a4c3463127bf3f6b5e11a9 ]

host_seq_bmp is allocated with vzalloc but is currently freed with
bitmap_free, which uses kfree internally. This mismach prevents the
resource from being released properly and may result in memory leaks
or other issues.

Fix this by freeing host_seq_bmp with vfree to match the vzalloc
allocation.

Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking")
Signed-off-by: Zilin Guan <[email-masked]>
Reviewed-by: Brett Creeley <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alex Williamson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/vfio/pci/pds/dirty.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c
index 27607d7b9030a..6adc5f1ae2eb9 100644
--- a/drivers/vfio/pci/pds/dirty.c
+++ b/drivers/vfio/pci/pds/dirty.c
@@ -81,7 +81,7 @@ static int pds_vfio_dirty_alloc_bitmaps(struct pds_vfio_dirty *dirty,
 
 	host_ack_bmp = vzalloc(bytes);
 	if (!host_ack_bmp) {
-		bitmap_free(host_seq_bmp);
+		vfree(host_seq_bmp);
 		return -ENOMEM;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:34:49 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367789; cv=none; b=Y5FUMgelYFRX/21kv8bo0LxIRMdb7/lO1bH/XNaNXv5anPeadGE4goBQ+PnDysfJ8gY3MyvXLVHaWyu0iq1AJW1kXmn/ncT91EGum7Pf3bUHM1CI8jAVbRe36fg1ER5VzyzbGEiNjS+ywbvcCuHc5WsQtLPYbaHc2a+/JpuuD9c=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367789; c=relaxed/simple;
	bh=8EA+i/+ubFZaTqGbWu2QVibi3a/pOg9Dw4gs/F6EwQM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=LfBRER0znPQdE/ESHXF2FwcOhgqEiVlC+4iOO8v76JYNWKr0C4pVDML0RpBTxMXjDWsxpFLkT/NHTgSlLKMjICZyZMadbXmxo/J1G6r98DfrW3qf4Cf0QhcyCpFF512DOdvYi3AJU/oaAOJehj/rOFpsFROf3seu7VJpaoAAUIo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bGFqi9xJ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michael Karcher <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Sasha Levin <[email-masked]>,
	John Paul Adrian Glaubitz <[email-masked]>,
	Tony Rodriguez <[email-masked]>
Subject: [PATCH 6.6 133/196] sparc: fix accurate exception reporting in copy_{from,to}_user for M7
Date: Mon, 13 Oct 2025 16:45:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Karcher <[email-masked]>

[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a couple of bad
calculations. This will fix the return value of copy_from_user and
copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.

Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy")
Tested-by: John Paul Adrian Glaubitz <[email-masked]> # on Oracle SPARC S7
Tested-by: Tony Rodriguez <[email-masked]> # S7, see https://lore.kernel.org/r/[email-masked]
Signed-off-by: Michael Karcher <[email-masked]>
Reviewed-by: Andreas Larsson <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Andreas Larsson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/sparc/lib/M7memcpy.S     | 20 ++++++++++----------
 arch/sparc/lib/Memcpy_utils.S |  9 +++++++++
 2 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S
index cbd42ea7c3f7c..99357bfa8e82a 100644
--- a/arch/sparc/lib/M7memcpy.S
+++ b/arch/sparc/lib/M7memcpy.S
@@ -696,16 +696,16 @@ FUNC_NAME:
 	EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40)
 	faligndata %f24, %f26, %f10
 	EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40)
-	EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40)
+	EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32)
 	faligndata %f26, %f28, %f12
-	EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40)
+	EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32)
 	add	%o4, 64, %o4
-	EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40)
+	EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24)
 	faligndata %f28, %f30, %f14
-	EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40)
-	EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40)
+	EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24)
+	EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16)
 	add	%o0, 64, %o0
-	EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40)
+	EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8)
 	fsrc2	%f30, %f14
 	bgu,pt	%xcc, .Lunalign_sloop
 	 prefetch [%o4 + (8 * BLOCK_SIZE)], 20
@@ -728,7 +728,7 @@ FUNC_NAME:
 	add	%o4, 8, %o4
 	faligndata %f0, %f2, %f16
 	subcc	%o5, 8, %o5
-	EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5)
+	EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8)
 	fsrc2	%f2, %f0
 	bgu,pt	%xcc, .Lunalign_by8
 	 add	%o0, 8, %o0
@@ -772,7 +772,7 @@ FUNC_NAME:
 	subcc	%o5, 0x20, %o5
 	EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
 	EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
-	EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
+	EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
 	EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
 	bne,pt	%xcc, 1b
 	 add	%o0, 0x20, %o0
@@ -804,12 +804,12 @@ FUNC_NAME:
 	brz,pt	%o3, 2f
 	 sub	%o2, %o3, %o2
 
-1:	EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1)
+1:	EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3)
 	add	%o1, 1, %o1
 	subcc	%o3, 1, %o3
 	add	%o0, 1, %o0
 	bne,pt	%xcc, 1b
-	 EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1)
+	 EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1)
 2:
 	and	%o1, 0x7, %o3
 	brz,pn	%o3, .Lmedium_noprefetch_cp
diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S
index 64fbac28b3db1..207343367bb2d 100644
--- a/arch/sparc/lib/Memcpy_utils.S
+++ b/arch/sparc/lib/Memcpy_utils.S
@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8)
 	ba,pt	%xcc, __restore_asi
 	 add	%o2, 8, %o0
 ENDPROC(memcpy_retl_o2_plus_63_8)
+ENTRY(memcpy_retl_o2_plus_o3)
+	ba,pt	%xcc, __restore_asi
+	 add	%o2, %o3, %o0
+ENDPROC(memcpy_retl_o2_plus_o3)
+ENTRY(memcpy_retl_o2_plus_o3_plus_1)
+	add	%o3, 1, %o3
+	ba,pt	%xcc, __restore_asi
+	 add	%o2, %o3, %o0
+ENDPROC(memcpy_retl_o2_plus_o3_plus_1)
 ENTRY(memcpy_retl_o2_plus_o5)
 	ba,pt	%xcc, __restore_asi
 	 add	%o2, %o5, %o0
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:23:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367787; cv=none; b=dT2KtqhKVv1fp9eDX5OzQvCiqRap1ONuX46MlWHsWO7ABtB6FgChaxYS3atfWa300fhPBi5fqAzW5D0gKl3bvir+sBX5Gm52zMK9G26099bzeLBpyMauDJ9LJytcj5eIi92qd+XJLft+W4J9sErCeTLW/uyfWAP/oEIwonlW4ZA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367787; c=relaxed/simple;
	bh=Bysf+n9wa5oTKKDL+eObHE+LrPKKcnuOCXQGy2rhTIA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=oFnq0LdCjbgIwnkAUdIBA0r+NXrU172Knv5NazY73SaXtmQIytK+H5o8UB8ocsMBYAbjItdHAsTGxr97hopR1R5dvO/C0R2wSLF2MIIGc75uvPPPO/7pn/VF1PKT/mPqkvJh+racHgnwhQWrSc7i+lJDzBTR8htKnENkB7lQRwQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EaQkM3E/; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michael Karcher <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Sasha Levin <[email-masked]>,
	John Paul Adrian Glaubitz <[email-masked]>
Subject: [PATCH 6.6 132/196] sparc: fix accurate exception reporting in copy_to_user for Niagara 4
Date: Mon, 13 Oct 2025 16:45:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Karcher <[email-masked]>

[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a bad calculation.
This will fix the return value of copy_to_user in a specific faulting case.
The behaviour of memcpy stays unchanged.

Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <[email-masked]> # on Oracle SPARC T4-1
Signed-off-by: Michael Karcher <[email-masked]>
Reviewed-by: Andreas Larsson <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Andreas Larsson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/sparc/lib/NG4memcpy.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
index 7ad58ebe0d009..df0ec1bd19489 100644
--- a/arch/sparc/lib/NG4memcpy.S
+++ b/arch/sparc/lib/NG4memcpy.S
@@ -281,7 +281,7 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 	subcc		%o5, 0x20, %o5
 	EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
 	EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
-	EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
+	EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
 	EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
 	bne,pt		%icc, 1b
 	 add		%o0, 0x20, %o0
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:18:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367784; cv=none; b=UBM8RBh5IT0UDBgtPL7ZPldCSHZM/SkjOaB8UB2Hpv5KBZuxpD049IIMiIyekbpODOmI/V8IxgFxnl7FyWCb2p1NChcd/wACR+loroseT5hO9D5kZ3rduT9jrRHold0kkoX6yUHlhyreTaYZHyxbD2XrhXQr92FCXSGJ56yxwo4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367784; c=relaxed/simple;
	bh=pssk8PUv7M174dySH7s7UrCiFXZktX+We9OcAPfIrnM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=O4nIkZ9PdFprlOUzdDtrQK7g2MGHU6wNm4CkKp+dLXNK3JxgZKlORZBVR2AwdxnRpdiIozU+KxLlzEigj0ubUtsgYdKRG7ZA+CpHHtdkhmDYGPERqPnyhAYSwmbp/jIgewdbToUieeCfY/jrfmUyfFhimhz52cArqDi/aXmCyTA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DHh+ejD5; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michael Karcher <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Sasha Levin <[email-masked]>,
	John Paul Adrian Glaubitz <[email-masked]>,
	Magnus Lindholm <[email-masked]>,
	Ethan Hawke <[email-masked]>,
	Ken Link <[email-masked]>
Subject: [PATCH 6.6 131/196] sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
Date: Mon, 13 Oct 2025 16:45:22 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Karcher <[email-masked]>

[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a couple of bad
calculations and a broken epilogue in the exception handlers. This will
prevent crashes and ensure correct return values of copy_from_user and
copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.

Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <[email-masked]> # on SPARC T4 with modified kernel to use Niagara 1 code
Tested-by: Magnus Lindholm <[email-masked]> # on Sun Fire T2000
Signed-off-by: Michael Karcher <[email-masked]>
Tested-by: Ethan Hawke <[email-masked]> # on Sun Fire T2000
Tested-by: Ken Link <[email-masked]> # on Sun Fire T1000
Reviewed-by: Andreas Larsson <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Andreas Larsson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
index ee51c12306894..bbd3ea0a64822 100644
--- a/arch/sparc/lib/NGmemcpy.S
+++ b/arch/sparc/lib/NGmemcpy.S
@@ -79,8 +79,8 @@
 #ifndef EX_RETVAL
 #define EX_RETVAL(x)	x
 __restore_asi:
-	ret
 	wr	%g0, ASI_AIUS, %asi
+	ret
 	 restore
 ENTRY(NG_ret_i2_plus_i4_plus_1)
 	ba,pt	%xcc, __restore_asi
@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56)
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, %g1, %i0
 ENDPROC(NG_ret_i2_plus_g1_minus_56)
-ENTRY(NG_ret_i2_plus_i4)
+ENTRY(NG_ret_i2_plus_i4_plus_16)
+        add     %i4, 16, %i4
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, %i4, %i0
-ENDPROC(NG_ret_i2_plus_i4)
-ENTRY(NG_ret_i2_plus_i4_minus_8)
-	sub	%i4, 8, %i4
+ENDPROC(NG_ret_i2_plus_i4_plus_16)
+ENTRY(NG_ret_i2_plus_i4_plus_8)
+	add	%i4, 8, %i4
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, %i4, %i0
-ENDPROC(NG_ret_i2_plus_i4_minus_8)
+ENDPROC(NG_ret_i2_plus_i4_plus_8)
 ENTRY(NG_ret_i2_plus_8)
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, 8, %i0
@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4)
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, %i4, %i0
 ENDPROC(NG_ret_i2_and_7_plus_i4)
+ENTRY(NG_ret_i2_and_7_plus_i4_plus_8)
+	and	%i2, 7, %i2
+	add	%i4, 8, %i4
+	ba,pt	%xcc, __restore_asi
+	 add	%i2, %i4, %i0
+ENDPROC(NG_ret_i2_and_7_plus_i4)
 #endif
 
 	.align		64
@@ -405,13 +412,13 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
 	andn		%i2, 0xf, %i4
 	and		%i2, 0xf, %i2
 1:	subcc		%i4, 0x10, %i4
-	EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4)
+	EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16)
 	add		%i1, 0x08, %i1
-	EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4)
+	EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16)
 	sub		%i1, 0x08, %i1
-	EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4)
+	EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16)
 	add		%i1, 0x8, %i1
-	EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8)
+	EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8)
 	bgu,pt		%XCC, 1b
 	 add		%i1, 0x8, %i1
 73:	andcc		%i2, 0x8, %g0
@@ -468,7 +475,7 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
 	subcc		%i4, 0x8, %i4
 	srlx		%g3, %i3, %i5
 	or		%i5, %g2, %i5
-	EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4)
+	EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8)
 	add		%o0, 0x8, %o0
 	bgu,pt		%icc, 1b
 	 sllx		%g3, %g1, %g2
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:29:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367778; cv=none; b=CqDV7sr0smbKleXyeq2PzMv9SbAue9xO3K82JltLdH7ebiZizklaGXSXxpfgudLpMf6OjvyJX2V7nFz5hI1C7imulPWijM9Ld+dAyJsdhSlGxiSFKtHB+ROGK1t10javWHy0TLsvuG6OZuOTQTupMJZGJGJuqpjMkuo/O9d90W0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367778; c=relaxed/simple;
	bh=Y4kSbedNVFl2u4y8P6bYsY01G2wGQscatg3v7ywRndU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=PQQtpQR8+nY6+xNd+YsIDi5orfko125YSL4ckA6WGRk6XajPjF2L/pCYsB7EQS8NxgPxhaVlE2gAJ2yOWsTnwJEBjuFCrP8/+I8TJ+ItMTR98s/7cr96Sjt+jH+tKqE4dAGZKmB4p9YtHRfxCXdJ1CK4Mfo8E4N0/8d1Tvt3Gws=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=fG9pHSUf; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Anthony Yznaga <[email-masked]>,
	Michael Karcher <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Sasha Levin <[email-masked]>,
	John Paul Adrian Glaubitz <[email-masked]>,
	=?UTF-8?q?Ren=C3=A9=20Rebe?= <[email-masked]>
Subject: [PATCH 6.6 130/196] sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
Date: Mon, 13 Oct 2025 16:45:21 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Karcher <[email-masked]>

[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]

Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios
enabled resulted from copy_from_user() returning impossibly large values
greater than the size to be copied. This lead to __copy_from_iter()
returning impossible values instead of the actual number of bytes it was
able to copy.

The BUG_ON has been reported in
https://lore.kernel.org/r/[email-masked]

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. The exception handlers expect that
%o2 has already been masked during the bulk copy loop, but the masking was
performed after that loop. This will fix the return value of copy_from_user
and copy_to_user in the faulting case. The behaviour of memcpy stays
unchanged.

Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <[email-masked]> # on Sun Netra 240
Reviewed-by: Anthony Yznaga <[email-masked]>
Tested-by: René Rebe <[email-masked]> # on UltraSparc III+ and UltraSparc IIIi
Signed-off-by: Michael Karcher <[email-masked]>
Reviewed-by: Andreas Larsson <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Andreas Larsson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/sparc/lib/U3memcpy.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
index 9248d59c734ce..bace3a18f836f 100644
--- a/arch/sparc/lib/U3memcpy.S
+++ b/arch/sparc/lib/U3memcpy.S
@@ -267,6 +267,7 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 	faligndata	%f10, %f12, %f26
 	EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2)
 
+	and		%o2, 0x3f, %o2
 	subcc		GLOBAL_SPARE, 0x80, GLOBAL_SPARE
 	add		%o1, 0x40, %o1
 	bgu,pt		%XCC, 1f
@@ -336,7 +337,6 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 	 * Also notice how this code is careful not to perform a
 	 * load past the end of the src buffer.
 	 */
-	and		%o2, 0x3f, %o2
 	andcc		%o2, 0x38, %g2
 	be,pn		%XCC, 2f
 	 subcc		%g2, 0x8, %g2
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:41:13 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367776; cv=none; b=LXEgpfoyuzJmQFwm9R8pn1Nv4S9P7eIsLr/V2ftKvNlfH3PWtDLfSgjBBKBgQ4Og/808iohHfAtF609PVR7/0xJqxu4Uv3aBkF6xvAs5VdlQx6HAvhsP71QxlKEWPnFCwULHJowS+Ea+nJRwZACVSFom8zLlWwAg4eUZGHdDU2I=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367776; c=relaxed/simple;
	bh=Q10lgVH/CWaIyPgIfHEzfV59dHfrtu4SVnjsIM/nz34=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=gse3QCrMUBu8U+QErvgM6YaiNo95Bx+4+P4HALIPCaJT/57dhRcC/aaznytq8yAROFYAz0l/KMLm01Ic2MyLXh4R/Sy70pRWxk/I3TXg06rmKbuJO6oMq4UvrYULcIRnQijK4Lvkg+p79myjc4GyAiWZtuwgkYGF6ZpgZaFvTkc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=D61xtA2U; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michael Karcher <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Sasha Levin <[email-masked]>,
	John Paul Adrian Glaubitz <[email-masked]>,
	=?UTF-8?q?Ren=C3=A9=20Rebe?= <[email-masked]>,
	Jonathan 'theJPster' Pallant <[email-masked]>
Subject: [PATCH 6.6 129/196] sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
Date: Mon, 13 Oct 2025 16:45:20 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Karcher <[email-masked]>

[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a couple of bad
calculations. This will fix the return value of copy_from_user and
copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.

Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <[email-masked]> # on QEMU 10.0.3
Tested-by: René Rebe <[email-masked]> # on Ultra 5 UltraSparc IIi
Tested-by: Jonathan 'theJPster' Pallant <[email-masked]> # on Sun Netra T1
Signed-off-by: Michael Karcher <[email-masked]>
Reviewed-by: Andreas Larsson <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Andreas Larsson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/sparc/lib/U1memcpy.S | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S
index 635398ec7540e..154fbd35400ca 100644
--- a/arch/sparc/lib/U1memcpy.S
+++ b/arch/sparc/lib/U1memcpy.S
@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp)
 	retl
 	 add		%o0, %o2, %o0
 ENDPROC(U1_gs_40_fp)
-ENTRY(U1_g3_0_fp)
-	VISExitHalf
-	retl
-	 add		%g3, %o2, %o0
-ENDPROC(U1_g3_0_fp)
 ENTRY(U1_g3_8_fp)
 	VISExitHalf
 	add		%g3, 8, %g3
 	retl
 	 add		%g3, %o2, %o0
 ENDPROC(U1_g3_8_fp)
+ENTRY(U1_g3_16_fp)
+	VISExitHalf
+	add		%g3, 16, %g3
+	retl
+	 add		%g3, %o2, %o0
+ENDPROC(U1_g3_16_fp)
 ENTRY(U1_o2_0_fp)
 	VISExitHalf
 	retl
@@ -547,18 +548,18 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
 62:	FINISH_VISCHUNK(o0, f44, f46)
 63:	UNEVEN_VISCHUNK_LAST(o0, f46, f0)
 
-93:	EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp)
+93:	EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp)
 	add		%o1, 8, %o1
 	subcc		%g3, 8, %g3
 	faligndata	%f0, %f2, %f8
-	EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
+	EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
 	bl,pn		%xcc, 95f
 	 add		%o0, 8, %o0
-	EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp)
+	EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp)
 	add		%o1, 8, %o1
 	subcc		%g3, 8, %g3
 	faligndata	%f2, %f0, %f8
-	EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
+	EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
 	bge,pt		%xcc, 93b
 	 add		%o0, 8, %o0
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:35:23 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367773; cv=none; b=LiZzqBEIgsT+sCNOk+6lOzHumPJ3Y8cLcYeiiiq/P3/9c+0relkhK24pSv2VXJEN/bE4Z3hudyZ+VI6w5mstmQ3RGquPBHuycoZq+RsYCF5Y0VizTacrAr+++QOqJl8/sna+A7I8cWpcC3KqqZRQnlRrXXtFb2f0tmERGDXh+qU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367773; c=relaxed/simple;
	bh=YmHCrT86U6E5+hwd5CFjs4kfS439xL3vnxfgf9tfEhQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=OWmsXM11uT4AbbVDkyw8YsMsds0yaAVrOEX+X5Za3x9hML6BSKPONtmhn8Doqbd+Z0NA51J4ZUes0iHbM07ighiU8a2YCNAUHrk5OILOUYDwpfSIZjGTGN+YGsKkr2PkyvPX+Hh2DAdDThDN5j2PMNHc4SS/duI53I6bMhD7e8s=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=diSppZyj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Vasanthakumar Thiagarajan <[email-masked]>,
	Aditya Kumar Singh <[email-masked]>,
	Johannes Berg <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 128/196] wifi: mac80211: fix Rx packet handling when pubsta information is not available
Date: Mon, 13 Oct 2025 16:45:19 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Aditya Kumar Singh <[email-masked]>

[ Upstream commit 32d340ae675800672e1219444a17940a8efe5cca ]

In ieee80211_rx_handle_packet(), if the caller does not provide pubsta
information, an attempt is made to find the station using the address 2
(source address) field in the header. Since pubsta is missing, link
information such as link_valid and link_id is also unavailable. Now if such
a situation comes, and if a matching ML station entry is found based on
the source address, currently the packet is dropped due to missing link ID
in the status field which is not correct.

Hence, to fix this issue, if link_valid is not set and the station is an
ML station, make an attempt to find a link station entry using the source
address. If a valid link station is found, derive the link ID and proceed
with packet processing. Otherwise, drop the packet as per the existing
flow.

Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status")
Suggested-by: Vasanthakumar Thiagarajan <[email-masked]>
Signed-off-by: Aditya Kumar Singh <[email-masked]>
Link: https://patch.msgid.link/2025[email-masked]
Signed-off-by: Johannes Berg <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/mac80211/rx.c | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 210337ef23cf5..164c6e8049826 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -5219,12 +5219,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 			}
 
 			rx.sdata = prev_sta->sdata;
+			if (!status->link_valid && prev_sta->sta.mlo) {
+				struct link_sta_info *link_sta;
+
+				link_sta = link_sta_info_get_bss(rx.sdata,
+								 hdr->addr2);
+				if (!link_sta)
+					continue;
+
+				link_id = link_sta->link_id;
+			}
+
 			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
 				goto out;
 
-			if (!status->link_valid && prev_sta->sta.mlo)
-				continue;
-
 			ieee80211_prepare_and_rx_handle(&rx, skb, false);
 
 			prev_sta = sta;
@@ -5232,10 +5240,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 
 		if (prev_sta) {
 			rx.sdata = prev_sta->sdata;
-			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
-				goto out;
+			if (!status->link_valid && prev_sta->sta.mlo) {
+				struct link_sta_info *link_sta;
+
+				link_sta = link_sta_info_get_bss(rx.sdata,
+								 hdr->addr2);
+				if (!link_sta)
+					goto out;
 
-			if (!status->link_valid && prev_sta->sta.mlo)
+				link_id = link_sta->link_id;
+			}
+
+			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
 				goto out;
 
 			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:33:38 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367770; cv=none; b=NIw1/PBS5GOCiqSLnCyPM6DWBzWzuLcc+9c4OxI6rjXkDRYIjdhM04mhnyDvt5zkT7PzGcLtnG0PFQbIR217OEqiFRF+f9J4RWq8FMHHrAaZKXtCSTKqWsvq2iz1VXUHzelH1Ef9RM5tsiMMSjjKZjN6FfdShJU7DBk8zdnR4lA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367770; c=relaxed/simple;
	bh=mdN6c3ZmMv/LTZYDY/t2dGLBDaMD7HeOgCcRsoYfCjU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Em5eZ7HS874oRyFH/IvZzrKIRVHwES3kfenvg+wifKKrZ/fD3tWD6w6SLLqQwXynGgGKPPljwFIMFRJr9v/9NtC60+1riNWrLSHBbHvFIqP1/EMqXjCN05EBMVBxS8bbpMG78lOsosLmDSdhfLhKaycTRJU5YirX3q2HV8Ljea8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=thXUlDK1; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Paul Menzel <[email-masked]>,
	Baochen Qiang <[email-masked]>,
	Vasanthakumar Thiagarajan <[email-masked]>,
	Jeff Johnson <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 127/196] wifi: ath10k: avoid unnecessary wait for service ready message
Date: Mon, 13 Oct 2025 16:45:18 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Baochen Qiang <[email-masked]>

[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]

Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before
failing") works around the failure in waiting for the service ready
message by active polling. Note the polling is triggered after initial
wait timeout, which means that the wait-till-timeout can not be avoided
even the message is ready.

A possible fix is to do polling once before wait as well, however this
can not handle the race that the message arrives right after polling.
So the solution is to do periodic polling until timeout.

Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1

Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing")
Reported-by: Paul Menzel <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]
Signed-off-by: Baochen Qiang <[email-masked]>
Reviewed-by: Vasanthakumar Thiagarajan <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jeff Johnson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++--------------
 1 file changed, 19 insertions(+), 20 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 818aea99f85eb..340502c47a10d 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -1763,33 +1763,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,
 
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
 {
+	unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ;
 	unsigned long time_left, i;
 
-	time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
-						WMI_SERVICE_READY_TIMEOUT_HZ);
-	if (!time_left) {
-		/* Sometimes the PCI HIF doesn't receive interrupt
-		 * for the service ready message even if the buffer
-		 * was completed. PCIe sniffer shows that it's
-		 * because the corresponding CE ring doesn't fires
-		 * it. Workaround here by polling CE rings once.
-		 */
-		ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
-
+	/* Sometimes the PCI HIF doesn't receive interrupt
+	 * for the service ready message even if the buffer
+	 * was completed. PCIe sniffer shows that it's
+	 * because the corresponding CE ring doesn't fires
+	 * it. Workaround here by polling CE rings. Since
+	 * the message could arrive at any time, continue
+	 * polling until timeout.
+	 */
+	do {
 		for (i = 0; i < CE_COUNT; i++)
 			ath10k_hif_send_complete_check(ar, i, 1);
 
+		/* The 100 ms granularity is a tradeoff considering scheduler
+		 * overhead and response latency
+		 */
 		time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
-							WMI_SERVICE_READY_TIMEOUT_HZ);
-		if (!time_left) {
-			ath10k_warn(ar, "polling timed out\n");
-			return -ETIMEDOUT;
-		}
-
-		ath10k_warn(ar, "service ready completion received, continuing normally\n");
-	}
+							msecs_to_jiffies(100));
+		if (time_left)
+			return 0;
+	} while (time_before(jiffies, timeout));
 
-	return 0;
+	ath10k_warn(ar, "failed to receive service ready completion\n");
+	return -ETIMEDOUT;
 }
 
 int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:41:25 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367767; cv=none; b=gLeKd6hm646/iDjO2cuPPf7NJBTtL1AA/gMeHzCz2KffOt/56rE1w7X7A9SfifbM0klAUOiRH38JjM7ewb5646qet5cn558qhsi6hC7dcotfCKVOpYlUMzSU7Ad3yCZ/WMPdpcX+4c/NWgVqZEciXXWEycI7+uzGSfe3G14bzhk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367767; c=relaxed/simple;
	bh=KrVl1nmbjBwvQNYcGUr71cBZT7lkEPqWegUotMziRUI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=OQCnVG13BGP/ugSk82SmrYgdfKecMB7wAm4ec9QVDWBBLyIPj5ttteN/krJTQPSRBbh6NXtZa4L9pWscxAsvLzMbu28lb+ZdJkZSP/heMnNzIQlsr+HFGdOWIfws1iNKTu0FROQUrQuQUvLf7y2czqBlUj9Lve9hulf4rOpkyrs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vKG6ZU9Z; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Tom Zanussi <[email-masked]>,
	"Masami Hiramatsu (Google)" <[email-masked]>,
	Bagas Sanjaya <[email-masked]>,
	"Steven Rostedt (Google)" <[email-masked]>,
	Jonathan Corbet <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 126/196] Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
Date: Mon, 13 Oct 2025 16:45:17 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bagas Sanjaya <[email-masked]>

[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ]

Section heading for sched_waking histogram is shown as normal paragraph
instead due to codeblock marker for the following diagram being in the
same line as the section underline. Separate them.

Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst")
Reviewed-by: Tom Zanussi <[email-masked]>
Reviewed-by: Masami Hiramatsu (Google) <[email-masked]>
Signed-off-by: Bagas Sanjaya <[email-masked]>
Acked-by: Steven Rostedt (Google) <[email-masked]>
Signed-off-by: Jonathan Corbet <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 Documentation/trace/histogram-design.rst | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst
index 5765eb3e9efa7..a30f4bed11b4e 100644
--- a/Documentation/trace/histogram-design.rst
+++ b/Documentation/trace/histogram-design.rst
@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking
 trigger above.
 
 sched_waking histogram
-----------------------::
+----------------------
+
+.. code-block::
 
   +------------------+
   | hist_data        |<-------------------------------------------------------+
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:48:17 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367764; cv=none; b=ZkXics5iJjtpcydhlyLOoDk/62352ObqEYmhT4ic8S+8Yq+BrUXXLG8epjQe9PFbnSjvFXz4eZ0IA8/99a1mj/2zaXkFZN5TaQfgmuDJJw+vokMqI7EQPiOBpT5G9wHPqqLZfP87cKutNSwIuzN+m1XAsZ+BQq6mhSfDTrs099k=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367764; c=relaxed/simple;
	bh=TeK1Ulw8d3qa84O7VEdMSjOu6JxDHqj2Qesj5e1hLOY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Ow3rQWcwpqn4lOpisziMDAB1L9x+L6LLdh+eMRLzt5lPYizf77ZKaD8oCPnoFSS1pVjt5A2JonKwCsgXWDn/Lxv2bWZ/UELSo6Yd7iks1E7WOXFl3nNTrN+J2NmYfnC76budKY1vC7WHTtv3CputqV5qyBDollSTg+3cjspXdUg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bfdlLBJs; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Vlad Dumitrescu <[email-masked]>,
	Mark Zhang <[email-masked]>,
	Edward Srouji <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 125/196] IB/sa: Fix sa_local_svc_timeout_ms read race
Date: Mon, 13 Oct 2025 16:45:16 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vlad Dumitrescu <[email-masked]>

[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]

When computing the delta, the sa_local_svc_timeout_ms is read without
ib_nl_request_lock held. Though unlikely in practice, this can cause
a race condition if multiple local service threads are managing the
timeout.

Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
Signed-off-by: Vlad Dumitrescu <[email-masked]>
Reviewed-by: Mark Zhang <[email-masked]>
Signed-off-by: Edward Srouji <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Leon Romanovsky <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/core/sa_query.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 8175dde60b0a8..9902bb96c7409 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1013,6 +1013,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
 	if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
 		timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
 
+	spin_lock_irqsave(&ib_nl_request_lock, flags);
+
 	delta = timeout - sa_local_svc_timeout_ms;
 	if (delta < 0)
 		abs_delta = -delta;
@@ -1020,7 +1022,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
 		abs_delta = delta;
 
 	if (delta != 0) {
-		spin_lock_irqsave(&ib_nl_request_lock, flags);
 		sa_local_svc_timeout_ms = timeout;
 		list_for_each_entry(query, &ib_nl_request_list, list) {
 			if (delta < 0 && abs_delta > query->timeout)
@@ -1038,9 +1039,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
 		if (delay)
 			mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
 					 (unsigned long)delay);
-		spin_unlock_irqrestore(&ib_nl_request_lock, flags);
 	}
 
+	spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+
 settimeout_out:
 	return 0;
 }
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:23:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367762; cv=none; b=GtTq7BrfLZBGpHjwbCekxGU02WxM1Wiuf7z2m+Bu9NM+g0TsHAQr2DGaK9x/O4QJHHp3uDIjpP5PyYLogVQjQ43DKRGP9wc3OpQCxjz/aGz6gbQnvlL8q7bJmBsBjdxOh9IsXj1uE6YY28LqfuZ0fDkpmGwZe7UrTQliOUQAOdA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367762; c=relaxed/simple;
	bh=qx8OXZZnOn+kFpjp1qW7F6psKt7SFI6Zu2axctJ7xhE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=fOzIV44tWc8RUzXy/5CR/ff/K8ZISuFKiM+VeMVT7JFtCMumbkIbEFNDKmmddknR4Fr1lzPO9B6AdhyVP9CHHNpDVx0EepQs1KpFlgDWTzYiney3xmCHYdWpqtai7XKTgTxwF6pxyqDmHRNDnBEpPLrz+frhC+7JDWvIaeYL3kk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WMlF5aXK; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Parav Pandit <[email-masked]>,
	Vlad Dumitrescu <[email-masked]>,
	Edward Srouji <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 124/196] RDMA/core: Resolve MAC of next-hop device without ARP support
Date: Mon, 13 Oct 2025 16:45:15 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Parav Pandit <[email-masked]>

[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]

Currently, if the next-hop netdevice does not support ARP resolution,
the destination MAC address is silently set to zero without reporting
an error. This leads to incorrect behavior and may result in packet
transmission failures.

Fix this by deferring MAC resolution to the IP stack via neighbour
lookup, allowing proper resolution or error reporting as appropriate.

Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)")
Signed-off-by: Parav Pandit <[email-masked]>
Reviewed-by: Vlad Dumitrescu <[email-masked]>
Signed-off-by: Edward Srouji <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Leon Romanovsky <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/core/addr.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index f20dfe70fa0e4..8bf705921618c 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -460,14 +460,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst,
 {
 	int ret = 0;
 
-	if (ndev_flags & IFF_LOOPBACK) {
+	if (ndev_flags & IFF_LOOPBACK)
 		memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
-	} else {
-		if (!(ndev_flags & IFF_NOARP)) {
-			/* If the device doesn't do ARP internally */
-			ret = fetch_ha(dst, addr, dst_in, seq);
-		}
-	}
+	else
+		ret = fetch_ha(dst, addr, dst_in, seq);
 	return ret;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:18:21 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367759; cv=none; b=VGWBL3zq0rMsNkoF+aJuKBZxGgUIHtuuJMFgNUoiKLPaW5WKmpvEnznKdguHs5YVUUbaOs7bFsIj49WTu0jBojbESOf/OslUOb37F5tYxmVW5rcaoJH9XNZqqU9sk5okC+qRoTE0vmnqMRf7qEMrLNlifwW38ODBYUhSiDSKYdY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367759; c=relaxed/simple;
	bh=282EpwjOuz2ApXAkvDt8kCVK3AbDoc4o+nbiinolGys=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=MjPBgPaYy4lrwzpBNSi/HgZ01OOA+Dj2aVlHCln3s8V3bIPWJK3HimuMH9SRWNVlbZhvhUMjXrbu7epBOOEg7C0z9nNU3fanvl1DqwPo+SRvE6WiPKadTwjeI4LGHS1XrzSfRZDXEuEnz1CsQ8TQb10/mW6JrVCbd9PIPvlDKns=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ql95rFRd; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michal Pecio <[email-masked]>,
	Mathias Nyman <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 123/196] Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"
Date: Mon, 13 Oct 2025 16:45:14 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michal Pecio <[email-masked]>

[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ]

This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3.

No actual HW bugs are known where Endpoint Context shows Running state
but Stop Endpoint fails repeatedly with Context State Error and leaves
the endpoint state unchanged. Stop Endpoint retries on Running EPs have
been performed since early 2021 with no such issues reported so far.

Trying to handle this hypothetical case brings a more realistic danger:
if Stop Endpoint fails on an endpoint which hasn't yet started after a
doorbell ring and enough latency occurs before this completion event is
handled, the driver may time out and begin removing cancelled TDs from
a running endpoint, even though one more retry would stop it reliably.

Such high latency is rare but not impossible, and removing TDs from a
running endpoint can cause more damage than not giving back a cancelled
URB (which wasn't happening anyway). So err on the side of caution and
revert to the old policy of always retrying if the EP appears running.

[Remove stable tag as we are dealing with theoretical cases -Mathias]

Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running")
Signed-off-by: Michal Pecio <[email-masked]>
Signed-off-by: Mathias Nyman <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/usb/host/xhci-ring.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index a21ac9d80275f..6443e11eaac04 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1224,19 +1224,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
 			 * Stopped state, but it will soon change to Running.
 			 *
 			 * Assume this bug on unexpected Stop Endpoint failures.
-			 * Keep retrying until the EP starts and stops again.
+			 * Keep retrying until the EP starts and stops again, on
+			 * chips where this is known to help. Wait for 100ms.
 			 */
+			if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
+				break;
 			fallthrough;
 		case EP_STATE_RUNNING:
 			/* Race, HW handled stop ep cmd before ep was running */
 			xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n",
 					GET_EP_CTX_STATE(ep_ctx));
-			/*
-			 * Don't retry forever if we guessed wrong or a defective HC never starts
-			 * the EP or says 'Running' but fails the command. We must give back TDs.
-			 */
-			if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
-				break;
 
 			command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
 			if (!command) {
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:24:56 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367756; cv=none; b=pZE9HLhEYzNyX3AE01vrnLIZF6IwD4h8fxCGy7W8uEk+u0UGj7Ix0YC/QkPvLXV27vnDOapjXeHO2PBCSHzE50YwfoX1kMn4y8nneUa5imFMrHht5wP0ZATc5dI586hU6aq4yJFouz4plAEn6W1hySCu2PNSZVBluh4ThlXeju4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367756; c=relaxed/simple;
	bh=T/F15lxdCsJTtEbTcUe3OrU9kQhV3wrBuFRjlKHnDH0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=E8yI0ALuihv4y2H36LaKnV1mTgs4qLwSdsMIX2Xazow87MzrCj0C7NIqhIOvwlLA80WJsvfykJ9UVLBPZChdwXPSSw2/Z/IldkzfuVkXA3tI2ZQZ6kqcpHVZoeaZcDbxpaeCs7sJuQKHSIv2eBM2psJCc2d3MqJv/x1NLsFWN0k=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=HS9kWZfN; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	wangzijie <[email-masked]>,
	Chao Yu <[email-masked]>,
	Jaegeuk Kim <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 122/196] f2fs: fix zero-sized extent for precache extents
Date: Mon, 13 Oct 2025 16:45:13 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: wangzijie <[email-masked]>

[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ]

Script to reproduce:
f2fs_io write 1 0 1881 rand dsync testfile
f2fs_io fallocate 0 7708672 4096 testfile
f2fs_io write 1 1881 1 rand buffered testfile
fsync testfile
umount
mount
f2fs_io precache_extents testfile

When the data layout is something like this:
dnode1:                     dnode2:
[0]      A                  [0]    NEW_ADDR
[1]      A+1                [1]    0x0
...
[1016]   A+1016
[1017]   B (B!=A+1017)      [1017] 0x0

During precache_extents, we map the last block(valid blkaddr) in dnode1:
map->m_flags |= F2FS_MAP_MAPPED;
map->m_pblk = blkaddr(valid blkaddr);
map->m_len = 1;
then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out:
map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent:

map->m_len = 1
ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1
ei.fofs = start_pgofs = 1882
ei.len = map->m_len - ofs = 1 - 1 = 0

Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent:
A,B,C is valid blkaddr
case1:
dnode1:                     dnode2:
[0]      A                  [0]    NEW_ADDR
[1]      A+1                [1]    0x0
...                         ....
[1016]   A+1016
[1017]   B (B!=A+1017)      [1017] 0x0

case2:
dnode1:                     dnode2:
[0]      A                  [0]    C (C!=B+1)
[1]      A+1                [1]    C+1
...                         ....
[1016]   A+1016
[1017]   B (B!=A+1017)      [1017] 0x0

case3:
dnode1:                     dnode2:
[0]      A                  [0]    C (C!=B+2)
[1]      A+1                [1]    C+1
...                         ....
[1015]   A+1015
[1016]   B (B!=A+1016)
[1017]   B+1                [1017] 0x0

[1] https://lore.kernel.org/linux-f2fs-devel/[email-masked]/

Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
Signed-off-by: wangzijie <[email-masked]>
Reviewed-by: Chao Yu <[email-masked]>
Signed-off-by: Jaegeuk Kim <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/f2fs/data.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 0e119218ebf74..fe23ebfc88ea1 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1751,9 +1751,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
 		if (map->m_flags & F2FS_MAP_MAPPED) {
 			unsigned int ofs = start_pgofs - map->m_lblk;
 
-			f2fs_update_read_extent_cache_range(&dn,
-				start_pgofs, map->m_pblk + ofs,
-				map->m_len - ofs);
+			if (map->m_len > ofs)
+				f2fs_update_read_extent_cache_range(&dn,
+					start_pgofs, map->m_pblk + ofs,
+					map->m_len - ofs);
 		}
 		if (map->m_next_extent)
 			*map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:34:49 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367753; cv=none; b=XpZOTA9qxjP1NMNRIgzfRasKmTRlY3+/cvF8tHyhMllZe0jZcRg90sEXFZA6XmpCAfv+/KUukU9ojG1hvfXJvh+LeAHmOLzJDzPcVG0irvxJo3pzDIUL0/DjpEM0e5UY6eE4M6LqCoMMl950LekeYcGlz0EISWpwoWj3IjvquBo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367753; c=relaxed/simple;
	bh=9uPVAuZWL4VMzJ35uUNTiSSuQED25LeY2C9HoQGJQhY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=N+rWcJfRHnJsjwcbhGWKqDNImMXTjOqwCdjDf39ZPuIXpcCMTiAMLNUsk8BsUxL7zjfYs4uhMTpu/SjOphia47rrjjlusezSm8yWPbAG73rMt1FXCqZ1ELPRGbzHOhvyZw0cN40qGnGjm3xHwo3y8g9u8Lio6HSRTd+luEoyY5A=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EFfoUTlD; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 121/196] scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
Date: Mon, 13 Oct 2025 16:45:12 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 9877c004e9f4d10e7786ac80a50321705d76e036 ]

Change the error code EAGAIN to -EAGAIN in qla_nvme_xmt_ls_rsp() to
align with qla2x00_start_sp() returning negative error codes or
QLA_SUCCESS, preventing logical errors.

Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe")
Signed-off-by: Qianfeng Rong <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/qla2xxx/qla_nvme.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index 8f4cc136a9c9c..080670cb2aa51 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -420,7 +420,7 @@ static int qla_nvme_xmt_ls_rsp(struct nvme_fc_local_port *lport,
 	switch (rval) {
 	case QLA_SUCCESS:
 		break;
-	case EAGAIN:
+	case -EAGAIN:
 		msleep(PURLS_MSLEEP_INTERVAL);
 		cnt++;
 		if (cnt < PURLS_RETRY_COUNT)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:39:19 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367748; cv=none; b=ix62mTF419fz1KpQIRk+ReAEs/4eUk2e1fjUMohI0wMcU75hDp74PGQ+yecqYR3Pdkp+7grSmy3zauhQ6vUH5U2kYM042TucrQX2MtwUbnzvcf+OWJGOKgoylKSA9LJLS0oMgnbUAG8VvWXq2Ea9B7VuQl1IPp6Chw5NaxIhLkM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367748; c=relaxed/simple;
	bh=GFxvUIq4zSXJIHgnJEh1fU6qz2MLI5UgK00NtgZnZB4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=nJ/kp+mRxX5QAsbHozffyha7F9D5J4eWUyrY+5VPZSnpbx5tIPnQR36i4OIu/3EaaUphTHffj6UL/lZ9NjSe1CHcCtTS9nt49dFy8m6HP3AXYPpwwSdshbujG3ABsiLZd1OUzzQ4ahvjQhkxNwBfMJ6CEgve8hENQzJCkiabklw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=AAdoSKf6; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 120/196] scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
Date: Mon, 13 Oct 2025 16:45:11 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ]

Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align
with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS,
preventing logical errors.  Additionally, the '_rval' variable should
store negative error codes to conform to Linux kernel error code
conventions.

Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure")
Signed-off-by: Qianfeng Rong <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/qla2xxx/qla_init.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 5fa2727c1bea7..e881d704b45d1 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -2059,11 +2059,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)
 	int cnt = 5; \
 	do { \
 		if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\
-			_rval = EINVAL; \
+			_rval = -EINVAL; \
 			break; \
 		} \
 		_rval = qla2x00_start_sp(_sp); \
-		if (_rval == EAGAIN) \
+		if (_rval == -EAGAIN) \
 			msleep(1); \
 		else \
 			break; \
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:17:50 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367745; cv=none; b=H+U9vV3pDn2UdSrdzOG4JNd0/82CQJaCqUtMP/VrEH17kR8MhW+R6tQxzWl7RbITi6lCTC4KIjjT0QcqzlU4DNgLgR8IDUfYsk8usJ992RtVaWzfadEOZSNnievN3KFc+uCKYcceKCiukz0pV7OemZU8v6WLMDtrA1uDXg2ViAQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367745; c=relaxed/simple;
	bh=w57l2UuXbaGrESFjwd6xaRXjQ2L8O7hI0nvMNBRKroc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=HeBf2w78T8MPiQVu10U+FbyqYBDnArRy1bSFhZwoYEJmxLcFIaU+kosGEuWhEszZYu/80rauOTAbIBw8b/CuwRNslvusVijxcN1RQcuSvlMX0+O3jAeoWd0/ZbWrRtkoK2cv7kpb/BbRsBWLwiIvHV7JcxIb13ZwBpp4ORAEKRg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EP7Rdcjz; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 119/196] scsi: qla2xxx: edif: Fix incorrect sign of error code
Date: Mon, 13 Oct 2025 16:45:10 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ]

Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and
qla_edif_process_els() to align with qla2x00_start_sp() returning
negative error codes or QLA_SUCCESS, preventing logical errors.

Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough")
Signed-off-by: Qianfeng Rong <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/qla2xxx/qla_edif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
index dcde55c8ee5de..be20e2c457b8e 100644
--- a/drivers/scsi/qla2xxx/qla_edif.c
+++ b/drivers/scsi/qla2xxx/qla_edif.c
@@ -1797,7 +1797,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job)
 	switch (rval) {
 	case QLA_SUCCESS:
 		break;
-	case EAGAIN:
+	case -EAGAIN:
 		msleep(EDIF_MSLEEP_INTERVAL);
 		cnt++;
 		if (cnt < EDIF_RETRY_COUNT)
@@ -3648,7 +3648,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job)
 		       p->e.extra_rx_xchg_address, p->e.extra_control_flags,
 		       sp->handle, sp->remap.req.len, bsg_job);
 		break;
-	case EAGAIN:
+	case -EAGAIN:
 		msleep(EDIF_MSLEEP_INTERVAL);
 		cnt++;
 		if (cnt < EDIF_RETRY_COUNT)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:22:41 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367742; cv=none; b=jlDXMFRSLRkbYAgRg+qfRo7NYL8PpWnbwWw215cLZEybKq0kSpiD42JsOHJ+JrGLXRqEVzVimEalG1l7TU31EaTmGxjJtJsKSAzznw8yJYLwgn1D0F4ZUjjPRvZT8O6i01IPGBlvy+KFBTpnJ71nZEtvJspdsnYHZDTtSbTlxp0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367742; c=relaxed/simple;
	bh=m7GMniQjvtKwOmi3mEJQnkEbdp2d0N0e2HO7zVP0A9M=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Ag1jbGy2TSjIQGJVpgN8BL0FiB7CwZmRWmXG8bCmoULumZp7oSjLQtacpYQ92hB/alk6ifsF/2/kHtjSkNsv8XVx4fO2/E0keMQQ26CgMq3HWcAUWpGh04Ayddnq/DXlZ9QtpuIYLTnP2303STRvdbZXQcMNoX+tW2geqw9ZAcc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yqYv2WZX; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Colin Ian King <[email-masked]>,
	Ira Weiny <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 118/196] ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
Date: Mon, 13 Oct 2025 16:45:09 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Colin Ian King <[email-masked]>

[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ]

There appears to be a cut-n-paste error with the incorrect field
ndr_desc->numa_node being reported for the target node. Fix this by
using ndr_desc->target_node instead.

Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect")
Signed-off-by: Colin Ian King <[email-masked]>
Reviewed-by: Ira Weiny <[email-masked]>
Signed-off-by: Ira Weiny <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/acpi/nfit/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index a466ad6e5d93a..5a1ced5bf7f6f 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -2643,7 +2643,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
 	if (ndr_desc->target_node == NUMA_NO_NODE) {
 		ndr_desc->target_node = phys_to_target_node(spa->address);
 		dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
-			NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
+			NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end);
 	}
 
 	/*
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:22:19 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367739; cv=none; b=LDH0CmGYs2AVkqIR1WPRIjOKfSSnu4YNBlyYMgV0ajcu02w7zaH2kmfMEnDY7s6gMTHycaCYJ9kDPd9GMapaR9FFreYQqAyUDrMOtO+oDopsJyyAD378Hv1XGynkFjX6q7/JyhtUnxeWzeubkkKCRhbhaK45KPnCE6Bvchcdujk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367739; c=relaxed/simple;
	bh=1kR7RggqqdpPETiYwAo3o7NlqBrHDMt7Ft9AB5t/chs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=tCBdn03d+p3iFPkzS9AqpDZdqFDqNggL1lSBo9FsTLfwwBxi6LdvzCnAhXjblEXUhRLfPRuPx+VuL4MbF4gB2pSjlDjIz1D0AebnvKZ7JNKl8MHRmxNguqN/9fX+cQqJ10Z7Z13Gmp7ljvcBgGejc2YLg99fj7uTSZKQEqL2weY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=MMRHufiu; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chao Yu <[email-masked]>,
	Jaegeuk Kim <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 117/196] f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()
Date: Mon, 13 Oct 2025 16:45:08 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chao Yu <[email-masked]>

[ Upstream commit c2f7c32b254006ad48f8e4efb2e7e7bf71739f17 ]

f2fs_zero_post_eof_page() may cuase more overhead due to invalidate_lock
and page lookup, change as below to mitigate its overhead:
- check new_size before grabbing invalidate_lock
- lookup and invalidate pages only in range of [old_size, new_size]

Fixes: ba8dac350faf ("f2fs: fix to zero post-eof page")
Signed-off-by: Chao Yu <[email-masked]>
Signed-off-by: Jaegeuk Kim <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/f2fs/file.c | 39 +++++++++++++++++++--------------------
 1 file changed, 19 insertions(+), 20 deletions(-)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 20d102009f715..6267ba6ef1083 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -36,15 +36,23 @@
 #include <trace/events/f2fs.h>
 #include <uapi/linux/f2fs.h>
 
-static void f2fs_zero_post_eof_page(struct inode *inode, loff_t new_size)
+static void f2fs_zero_post_eof_page(struct inode *inode,
+					loff_t new_size, bool lock)
 {
 	loff_t old_size = i_size_read(inode);
 
 	if (old_size >= new_size)
 		return;
 
+	if (mapping_empty(inode->i_mapping))
+		return;
+
+	if (lock)
+		filemap_invalidate_lock(inode->i_mapping);
 	/* zero or drop pages only in range of [old_size, new_size] */
-	truncate_pagecache(inode, old_size);
+	truncate_inode_pages_range(inode->i_mapping, old_size, new_size);
+	if (lock)
+		filemap_invalidate_unlock(inode->i_mapping);
 }
 
 static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
@@ -115,9 +123,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
 
 	f2fs_bug_on(sbi, f2fs_has_inline_data(inode));
 
-	filemap_invalidate_lock(inode->i_mapping);
-	f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT);
-	filemap_invalidate_unlock(inode->i_mapping);
+	f2fs_zero_post_eof_page(inode, (folio->index + 1) << PAGE_SHIFT, true);
 
 	file_update_time(vmf->vma->vm_file);
 	filemap_invalidate_lock_shared(inode->i_mapping);
@@ -1077,7 +1083,7 @@ int f2fs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
 		filemap_invalidate_lock(inode->i_mapping);
 
 		if (attr->ia_size > old_size)
-			f2fs_zero_post_eof_page(inode, attr->ia_size);
+			f2fs_zero_post_eof_page(inode, attr->ia_size, false);
 		truncate_setsize(inode, attr->ia_size);
 
 		if (attr->ia_size <= old_size)
@@ -1196,9 +1202,7 @@ static int f2fs_punch_hole(struct inode *inode, loff_t offset, loff_t len)
 	if (ret)
 		return ret;
 
-	filemap_invalidate_lock(inode->i_mapping);
-	f2fs_zero_post_eof_page(inode, offset + len);
-	filemap_invalidate_unlock(inode->i_mapping);
+	f2fs_zero_post_eof_page(inode, offset + len, true);
 
 	pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
 	pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
@@ -1484,7 +1488,7 @@ static int f2fs_do_collapse(struct inode *inode, loff_t offset, loff_t len)
 	f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
 	filemap_invalidate_lock(inode->i_mapping);
 
-	f2fs_zero_post_eof_page(inode, offset + len);
+	f2fs_zero_post_eof_page(inode, offset + len, false);
 
 	f2fs_lock_op(sbi);
 	f2fs_drop_extent_tree(inode);
@@ -1608,9 +1612,7 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len,
 	if (ret)
 		return ret;
 
-	filemap_invalidate_lock(mapping);
-	f2fs_zero_post_eof_page(inode, offset + len);
-	filemap_invalidate_unlock(mapping);
+	f2fs_zero_post_eof_page(inode, offset + len, true);
 
 	pg_start = ((unsigned long long) offset) >> PAGE_SHIFT;
 	pg_end = ((unsigned long long) offset + len) >> PAGE_SHIFT;
@@ -1744,7 +1746,7 @@ static int f2fs_insert_range(struct inode *inode, loff_t offset, loff_t len)
 	f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
 	filemap_invalidate_lock(mapping);
 
-	f2fs_zero_post_eof_page(inode, offset + len);
+	f2fs_zero_post_eof_page(inode, offset + len, false);
 	truncate_pagecache(inode, offset);
 
 	while (!ret && idx > pg_start) {
@@ -1800,9 +1802,7 @@ static int f2fs_expand_inode_data(struct inode *inode, loff_t offset,
 	if (err)
 		return err;
 
-	filemap_invalidate_lock(inode->i_mapping);
-	f2fs_zero_post_eof_page(inode, offset + len);
-	filemap_invalidate_unlock(inode->i_mapping);
+	f2fs_zero_post_eof_page(inode, offset + len, true);
 
 	f2fs_balance_fs(sbi, true);
 
@@ -4718,9 +4718,8 @@ static ssize_t f2fs_write_checks(struct kiocb *iocb, struct iov_iter *from)
 	if (err)
 		return err;
 
-	filemap_invalidate_lock(inode->i_mapping);
-	f2fs_zero_post_eof_page(inode, iocb->ki_pos + iov_iter_count(from));
-	filemap_invalidate_unlock(inode->i_mapping);
+	f2fs_zero_post_eof_page(inode,
+		iocb->ki_pos + iov_iter_count(from), true);
 	return count;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:39:55 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367736; cv=none; b=Ejfa5g6DzGPCONpJvQ+Rg+38fCXUQavwdruMTXtojinr4wFJv9y0GbyaHMmhTTpX0pMqFy/rLD2Q/it3RH2U94hHTV2OlWQqKUWeLH0WHps0a3PtnSCd0wtOuTiqxlkd92FwL0ro9hbTPPe4cyqDhXEBwSCKVooUHuquqyh9DII=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367736; c=relaxed/simple;
	bh=o76ZkAKGjwwOich42hTAb5srdrxbscIygpBr6LFSNuY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=hWLBzw5x2qp2jf/hR6Er440QAYq5osDqFvcHzvWun3DPC4sMPqE5xuSdvuiMLjFMyjzjwM2s/k62PqVJ8vhFs7fjhULTcxX4TKyMr4BJy30gRXltTxmHDA4n1bloCybnnFnVBgNmo86wb06HCbg+ZaViWKE2YzJ8LVBHhdqUkT8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rgUL3X2a; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Chao Yu <[email-masked]>,
	Jaegeuk Kim <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 116/196] f2fs: fix to truncate first page in error path of f2fs_truncate()
Date: Mon, 13 Oct 2025 16:45:07 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chao Yu <[email-masked]>

[ Upstream commit 9251a9e6e871cb03c4714a18efa8f5d4a8818450 ]

syzbot reports a bug as below:

loop0: detected capacity change from 0 to 40427
F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072)
F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop0): invalid crc value
F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix.
------------[ cut here ]------------
kernel BUG at fs/inode.c:753!
RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753
Call Trace:
 <TASK>
 evict+0x504/0x9c0 fs/inode.c:810
 f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047
 get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692
 vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
 do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808
 do_mount fs/namespace.c:4136 [inline]
 __do_sys_mount fs/namespace.c:4347 [inline]
 __se_sys_mount+0x317/0x410 fs/namespace.c:4324
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

During f2fs_evict_inode(), clear_inode() detects that we missed to truncate
all page cache before destorying inode, that is because in below path, we
will create page #0 in cache, but missed to drop it in error path, let's fix
it.

- evict
 - f2fs_evict_inode
  - f2fs_truncate
   - f2fs_convert_inline_inode
    - f2fs_grab_cache_folio
    : create page #0 in cache
    - f2fs_convert_inline_folio
    : sanity check failed, return -EFSCORRUPTED
  - clear_inode detects that inode->i_data.nrpages is not zero

Fixes: 92dffd01790a ("f2fs: convert inline_data when i_size becomes large")
Reported-by: [email-masked]
Closes: https://lore.kernel.org/linux-f2fs-devel/[email-masked]
Signed-off-by: Chao Yu <[email-masked]>
Signed-off-by: Jaegeuk Kim <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/f2fs/file.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 031015823acb2..20d102009f715 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -844,8 +844,16 @@ int f2fs_truncate(struct inode *inode)
 	/* we should check inline_data size */
 	if (!f2fs_may_inline_data(inode)) {
 		err = f2fs_convert_inline_inode(inode);
-		if (err)
+		if (err) {
+			/*
+			 * Always truncate page #0 to avoid page cache
+			 * leak in evict() path.
+			 */
+			truncate_inode_pages_range(inode->i_mapping,
+					F2FS_BLK_TO_BYTES(0),
+					F2FS_BLK_END_BYTES(0));
 			return err;
+		}
 	}
 
 	err = f2fs_truncate_blocks(inode, i_size_read(inode), true);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:44:32 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367733; cv=none; b=a5ZMOvTO3C5p+bXbHOz89CIbt9+jHqXap5ab5ygEqCDjpCWnmipB+m2Dtrf5zCSWOQ2Fmwyxl0TRK+6XVM1vNgm2OMvowNXmvHfLj9Y2SlHUQMEQ7hm1XaFIxtA8Ek9xmgoe7ZmXk46VpA2FA0N2KYFjc5JPPIwF8AUpS/yPjZk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367733; c=relaxed/simple;
	bh=wDw1bX5QUi/7O/acn/0pNtWdZQRc58UiObEDy2Doz8I=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=LdF1WSfe3j58kx5fmYetn62+/1xZeDEJVPodfJeoi/+ot87EHYhioXLS9AK3NcUjrU8Kijv/ofI8xrzY1iNcwg9DBTo21Wktv7KSoX7A3GEvJeRZMgVOJvh3eHqMHXZFytnnZzJVhUW6igYlbqbIqLm1NAGycms85vLwL4uU9b0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QbpJmH/I; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chao Yu <[email-masked]>,
	Jaegeuk Kim <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 115/196] f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
Date: Mon, 13 Oct 2025 16:45:06 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chao Yu <[email-masked]>

[ Upstream commit 869833f54e8306326b85ca3ed08979b7ad412a4a ]

Script to reproduce:
mkfs.f2fs -O extra_attr,compression /dev/vdb -f
mount /dev/vdb /mnt/f2fs -o mode=lfs,noextent_cache
cd /mnt/f2fs
f2fs_io write 1 0 1024 rand dsync testfile
xfs_io testfile -c "fsync"
f2fs_io write 1 0 512 rand dsync testfile
xfs_io testfile -c "fsync"
cd /
umount /mnt/f2fs
mount /dev/vdb /mnt/f2fs
f2fs_io precache_extents /mnt/f2fs/testfile
umount /mnt/f2fs

Tracepoint output:
f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 0, len = 512, blkaddr = 1055744, c_len = 0
f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 513, len = 351, blkaddr = 17921, c_len = 0
f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 864, len = 160, blkaddr = 18272, c_len = 0

During precache_extents, there is off-by-one issue, we should update
map->m_next_extent to pgofs rather than pgofs + 1, if last blkaddr is
valid and not contiguous to previous extent.

Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
Signed-off-by: Chao Yu <[email-masked]>
Signed-off-by: Jaegeuk Kim <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/f2fs/data.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index d37104aa847a7..0e119218ebf74 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1756,7 +1756,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
 				map->m_len - ofs);
 		}
 		if (map->m_next_extent)
-			*map->m_next_extent = pgofs + 1;
+			*map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
 	}
 	f2fs_put_dnode(&dn);
 unlock_out:
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:22:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367730; cv=none; b=fZcDwTGTSoFrHTTaeAOKm1QZcF4NhLju3wK28imwk8SdMjS43rxqm1Ja4VA+7iC+k9kK7wT3UM9rEz6fBAN8Rz5UNIE8G9NNuFr4BuUzfnZf7NdX6hy6rVFuvk9HH11YVJ9rrBag3XaieGrVvC89IBns6L7iqOeYLy5YeWL5xSI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367730; c=relaxed/simple;
	bh=9JEWfKFIeT+o1ovoU5HfchG4YfKZv4J/rPgYEacNpvQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=b4qT17YcSf/tQgoqlFLMQLTJDrWiQCl4+N67yLyRhzEvkTnVSPL7IFuWXJkc/ZVKOW30lyodKm8FvFFTFCQJPxGODVKu20m7qGfVexwHoLUutKSiGA6RytGuPpFDX7f8WqLJYyNyx5T/zMdl4BZsou4FPoZD/+sLVaQ21p8cack=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=sD/vB8Tf; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Abdun Nihaal <[email-masked]>,
	Jiri Slaby <[email-masked]>,
	Felix Fietkau <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 114/196] wifi: mt76: fix potential memory leak in mt76_wmac_probe()
Date: Mon, 13 Oct 2025 16:45:05 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Abdun Nihaal <[email-masked]>

[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]

In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory
is allocated for both struct ieee80211_hw and a workqueue. However, on
the error path, the workqueue is not freed. Fix that by calling
mt76_free_device() on the error path.

Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
Signed-off-by: Abdun Nihaal <[email-masked]>
Reviewed-by: Jiri Slaby <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Felix Fietkau <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
index ba927033bbe8c..1206769cdc7fd 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)
 
 	return 0;
 error:
-	ieee80211_free_hw(mt76_hw(dev));
+	mt76_free_device(mdev);
 	return ret;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:34:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367727; cv=none; b=Db2IBuYL7wWaDTg1qO26dcApWrLoQPwsktSWbEV3tLgGDgeh3P4HXTSnW6MVUqOU8SjWOInJ8pygSA/9xzYL8WDOahIaCGw6NQni3ACTUxE5SxAaQTHX8fgeff7rotabAcdn51S/aYQVj8ZbPClE1MZY7Q1DZ/QToEZMgnNrmtA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367727; c=relaxed/simple;
	bh=oEgTJ+7a4zALLhMjv3ND4fgYr/6DNy/k1Vr5+QnKxRE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=qxOs15vTIBbGLatT13cS5IhRoMSFRhaE7ty+FktI9QTTKkKkrUSvxIdny1W21bqhMIV8OSrGYv6nDbrFHjoOtA5GVM7kLRHekWbE9X6pKzOuO+YAGovu4xzwUZsPcfm76Woijg2MKqVn+/NZwT2IcGCTpRaCNl3I936W3wmBHPk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lc0FZdrD; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?H=C3=A5kon=20Bugge?= <[email-masked]>,
	Zhu Yanjun <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 113/196] RDMA/cm: Rate limit destroy CM ID timeout error message
Date: Mon, 13 Oct 2025 16:45:04 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Håkon Bugge <[email-masked]>

[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ]

When the destroy CM ID timeout kicks in, you typically get a storm of
them which creates a log flooding. Hence, change pr_err() to
pr_err_ratelimited() in cm_destroy_id_wait_timeout().

Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait")
Signed-off-by: Håkon Bugge <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Reviewed-by: Zhu Yanjun <[email-masked]>
Signed-off-by: Leon Romanovsky <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/core/cm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index d45e3909dafe1..50bb3c43f40bf 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -1032,8 +1032,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,
 	struct cm_id_private *cm_id_priv;
 
 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
-	pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
-	       cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
+	pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
+			   cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
 }
 
 static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:17:40 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367724; cv=none; b=R/3JZ3q/JtuTdln/MLdMM+LsogCsClBcnXiU2al1y445ASeuve3Amogq0Clttafu1DK3hpnmd+BIr/hBzWjwY4z2D5bHunI5M+GEnbi+1a4gS9t7HQGVogBalaK7+vTfMMtWBNuSl2/Dpk5ckV6lFUC800lx827ldd5fEiu+8BI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367724; c=relaxed/simple;
	bh=H5J9bhqqAU+Dwo1n6yR4HQ88M1fxrMh0e66JLl86QfU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=jwB8AVSfsIY8eejZi2/p8XWuRnLP2BitUs069380m567rZTQXglBdRrrPKbjYinbBGRDOlP9O/yb4JMQemhQ6zBzmeeqdyn7BllEmnKzP5zM47ZstnNqqbxIUdG6ycneb5LnGTDCiwMe34p895NwOofUEBG9nsCLNDCJdpNheFo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FHOrYGWj; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id EF31BC4CEE7;
	Mon, 13 Oct 2025 15:02:03 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760367724;
	bh=H5J9bhqqAU+Dwo1n6yR4HQ88M1fxrMh0e66JLl86QfU=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=FHOrYGWjGntPYGQGHV2ToBXbxKeE9tol/yjizTfYYAWmiomG+S+ITn6EVGwmxw8lk
	 1yNVzEfRugpRqW/6xkZ2BYrBnstBfFVM/GNKBPV9QF4zekXsa0avBWpuFuaaxxGMFr
	 JngqqJcivx2OVu/qYTAPq7YwUoIDcKdJl3At4hw8=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Donet Tom <[email-masked]>,
	David Hildenbrand <[email-masked]>,
	Alison Schofield <[email-masked]>,
	Danilo Krummrich <[email-masked]>,
	Dave Jiang <[email-masked]>,
	Hiroyouki Kamezawa <[email-masked]>,
	Joanthan Cameron <[email-masked]>,
	Oscar Salvador <[email-masked]>,
	"Ritesh Harjani (IBM)" <[email-masked]>,
	"Yury Norov (NVIDIA)" <[email-masked]>,
	Zi Yan <[email-masked]>,
	Andrew Morton <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 112/196] drivers/base/node: handle error properly in register_one_node()
Date: Mon, 13 Oct 2025 16:45:03 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Donet Tom <[email-masked]>

[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]

If register_node() returns an error, it is not handled correctly.
The function will proceed further and try to register CPUs under the
node, which is not correct.

So, in this patch, if register_node() returns an error, we return
immediately from the function.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
Signed-off-by: Donet Tom <[email-masked]>
Acked-by: David Hildenbrand <[email-masked]>
Cc: Alison Schofield <[email-masked]>
Cc: Danilo Krummrich <[email-masked]>
Cc: Dave Jiang <[email-masked]>
Cc: Donet Tom <[email-masked]>
Cc: Greg Kroah-Hartman <[email-masked]>
Cc: Hiroyouki Kamezawa <[email-masked]>
Cc: Joanthan Cameron <[email-masked]>
Cc: Oscar Salvador <[email-masked]>
Cc: "Ritesh Harjani (IBM)" <[email-masked]>
Cc: Yury Norov (NVIDIA) <[email-masked]>
Cc: Zi Yan <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/base/node.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/base/node.c b/drivers/base/node.c
index 4d588f4658c85..7b2ff66c119ae 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -878,6 +878,11 @@ int __register_one_node(int nid)
 	node_devices[nid] = node;
 
 	error = register_node(node_devices[nid], nid);
+	if (error) {
+		node_devices[nid] = NULL;
+		kfree(node);
+		return error;
+	}
 
 	/* link cpu under this node */
 	for_each_present_cpu(cpu) {
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:36:25 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367721; cv=none; b=tm23JwmK9roTuNrjG4rlr6ABI++eC2e4vpzRn8Hg9yVC9+JX7MSn8pdflLG5A4GAegnUOyEw/l5q76V3/Ly/9sPqI40EMHkBdjO19p/4BRFAZsjj/RmEcsziSc4oI2kJ88Jf82iD/s4j3mzREqPCzE6exntOpXJQFQxt8tH3qVY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367721; c=relaxed/simple;
	bh=t3lMl97MuATCtwsIqCID3VG24Gp2X9G67JsQBL9LGs4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=g41tEkBUHYWRp4Lo1J+vVmInCvdH0C3ao6sT9ksRUizQb4g7Yo7xmlW8N1nEIMSnx6lpZUZvGieP5L57RWeyTzmIygRkpa0w20Mc/RAKiFBLOWASrL6qnNVSh/Mm/mDvSOQB8QwnMpwlgaMdyeaiuVL90k32UrShg9NcCjOcSO0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yUy2VWUe; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Christophe Leroy <[email-masked]>,
	Guenter Roeck <[email-masked]>,
	Wim Van Sebroeck <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 111/196] watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
Date: Mon, 13 Oct 2025 16:45:02 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christophe Leroy <[email-masked]>

[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]

When the watchdog gets enabled with this driver, it leaves enough time
for the core watchdog subsystem to start pinging it. But when the
watchdog is already started by hardware or by the boot loader, little
time remains before it fires and it happens that the core watchdog
subsystem doesn't have time to start pinging it.

Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker
function") pinging was managed by the driver itself and the watchdog
was immediately pinged by setting the timer expiry to 0.

So restore similar behaviour by pinging it when enabling it so that
if it was already enabled the watchdog timer counter is reloaded.

Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function")
Signed-off-by: Christophe Leroy <[email-masked]>
Reviewed-by: Guenter Roeck <[email-masked]>
Signed-off-by: Guenter Roeck <[email-masked]>
Signed-off-by: Wim Van Sebroeck <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/watchdog/mpc8xxx_wdt.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c
index 867f9f3113797..a4b497ecfa205 100644
--- a/drivers/watchdog/mpc8xxx_wdt.c
+++ b/drivers/watchdog/mpc8xxx_wdt.c
@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w)
 	ddata->swtc = tmp >> 16;
 	set_bit(WDOG_HW_RUNNING, &ddata->wdd.status);
 
+	mpc8xxx_wdt_keepalive(ddata);
+
 	return 0;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:32:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367815; cv=none; b=pbLxPBj4yTz+Wsh/GCT7UCKJOfBNx41dujF/yU3ozzjI92W4ae5pn5nkWoNCXNqIt0hA9S6fO+qKQ+yaOLW5UtyzvtVjTH8sjGk1BdMXtAhnZP7gXxiFcSMdwjOEq+LdyJU6VB1Kwe+qxK58Ap8rSwnRXNnQz5aiQ0F7J+e2QuM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367815; c=relaxed/simple;
	bh=I8COHu1S6ms/Jxr5xJ1Mu3E7zhCIplFjSRZyedjSrxw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=r8pfISqrM/ZrBhX2b35QN3NUTEVC50UuW1Frg4FKSGu9xsxp9QafvA7K9SM589lZIvI9PMGKixW9cS3ccXypsL3Uq1OtVhSgZIx6rAYcLz/uV5PFbF38gOQ/fbLmgcnbdJzj4gsFjWZrIkYETRudKxZMedsxum2ZySYvFmTikY4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vKMot0HS; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Julian Anastasov <[email-masked]>,
	Zhang Tengfei <[email-masked]>,
	Florian Westphal <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 110/196] ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
Date: Mon, 13 Oct 2025 16:45:01 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: syzkaller.appspot.com]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhang Tengfei <[email-masked]>

[ Upstream commit 944b6b216c0387ac3050cd8b773819ae360bfb1c ]

KCSAN reported a data-race on the `ipvs->enable` flag, which is
written in the control path and read concurrently from many other
contexts.

Following a suggestion by Julian, this patch fixes the race by
converting all accesses to use `WRITE_ONCE()/READ_ONCE()`.
This lightweight approach ensures atomic access and acts as a
compiler barrier, preventing unsafe optimizations where the flag
is checked in loops (e.g., in ip_vs_est.c).

Additionally, the `enable` checks in the fast-path hooks
(`ip_vs_in_hook`, `ip_vs_out_hook`, `ip_vs_forward_icmp`) are
removed. These are unnecessary since commit 857ca89711de
("ipvs: register hooks only with services"). The `enable=0`
condition they check for can only occur in two rare and non-fatal
scenarios: 1) after hooks are registered but before the flag is set,
and 2) after hooks are unregistered on cleanup_net. In the worst
case, a single packet might be mishandled (e.g., dropped), which
does not lead to a system crash or data corruption. Adding a check
in the performance-critical fast-path to handle this harmless
condition is not a worthwhile trade-off.

Fixes: 857ca89711de ("ipvs: register hooks only with services")
Reported-by: [email-masked]
Closes: https://syzkaller.appspot.com/bug?extid=1651b5234028c294c339
Suggested-by: Julian Anastasov <[email-masked]>
Link: https://lore.kernel.org/lvs-devel/[email-masked]/
Signed-off-by: Zhang Tengfei <[email-masked]>
Acked-by: Julian Anastasov <[email-masked]>
Signed-off-by: Florian Westphal <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/netfilter/ipvs/ip_vs_conn.c |  4 ++--
 net/netfilter/ipvs/ip_vs_core.c | 11 ++++-------
 net/netfilter/ipvs/ip_vs_ctl.c  |  6 +++---
 net/netfilter/ipvs/ip_vs_est.c  | 16 ++++++++--------
 4 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 8182833a35828..d9c3eefe8cbb0 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -884,7 +884,7 @@ static void ip_vs_conn_expire(struct timer_list *t)
 			 * conntrack cleanup for the net.
 			 */
 			smp_rmb();
-			if (ipvs->enable)
+			if (READ_ONCE(ipvs->enable))
 				ip_vs_conn_drop_conntrack(cp);
 		}
 
@@ -1432,7 +1432,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs)
 		cond_resched_rcu();
 
 		/* netns clean up started, abort delayed work */
-		if (!ipvs->enable)
+		if (!READ_ONCE(ipvs->enable))
 			break;
 	}
 	rcu_read_unlock();
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 3230506ae3ffd..34c4648ba36ec 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1353,9 +1353,6 @@ ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat
 	if (unlikely(!skb_dst(skb)))
 		return NF_ACCEPT;
 
-	if (!ipvs->enable)
-		return NF_ACCEPT;
-
 	ip_vs_fill_iph_skb(af, skb, false, &iph);
 #ifdef CONFIG_IP_VS_IPV6
 	if (af == AF_INET6) {
@@ -1936,7 +1933,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state
 		return NF_ACCEPT;
 	}
 	/* ipvs enabled in this netns ? */
-	if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
+	if (unlikely(sysctl_backup_only(ipvs)))
 		return NF_ACCEPT;
 
 	ip_vs_fill_iph_skb(af, skb, false, &iph);
@@ -2104,7 +2101,7 @@ ip_vs_forward_icmp(void *priv, struct sk_buff *skb,
 	int r;
 
 	/* ipvs enabled in this netns ? */
-	if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
+	if (unlikely(sysctl_backup_only(ipvs)))
 		return NF_ACCEPT;
 
 	if (state->pf == NFPROTO_IPV4) {
@@ -2291,7 +2288,7 @@ static int __net_init __ip_vs_init(struct net *net)
 		return -ENOMEM;
 
 	/* Hold the beast until a service is registered */
-	ipvs->enable = 0;
+	WRITE_ONCE(ipvs->enable, 0);
 	ipvs->net = net;
 	/* Counters used for creating unique names */
 	ipvs->gen = atomic_read(&ipvs_netns_cnt);
@@ -2363,7 +2360,7 @@ static void __net_exit __ip_vs_dev_cleanup_batch(struct list_head *net_list)
 		ipvs = net_ipvs(net);
 		ip_vs_unregister_hooks(ipvs, AF_INET);
 		ip_vs_unregister_hooks(ipvs, AF_INET6);
-		ipvs->enable = 0;	/* Disable packet reception */
+		WRITE_ONCE(ipvs->enable, 0);	/* Disable packet reception */
 		smp_wmb();
 		ip_vs_sync_net_cleanup(ipvs);
 	}
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index ae76542de3e98..c82dcbb4dabce 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -256,7 +256,7 @@ static void est_reload_work_handler(struct work_struct *work)
 		struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id];
 
 		/* netns clean up started, abort delayed work */
-		if (!ipvs->enable)
+		if (!READ_ONCE(ipvs->enable))
 			goto unlock;
 		if (!kd)
 			continue;
@@ -1482,9 +1482,9 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
 
 	*svc_p = svc;
 
-	if (!ipvs->enable) {
+	if (!READ_ONCE(ipvs->enable)) {
 		/* Now there is a service - full throttle */
-		ipvs->enable = 1;
+		WRITE_ONCE(ipvs->enable, 1);
 
 		/* Start estimation for first time */
 		ip_vs_est_reload_start(ipvs);
diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
index c5970ba416aea..b48d3a09e2174 100644
--- a/net/netfilter/ipvs/ip_vs_est.c
+++ b/net/netfilter/ipvs/ip_vs_est.c
@@ -230,7 +230,7 @@ static int ip_vs_estimation_kthread(void *data)
 void ip_vs_est_reload_start(struct netns_ipvs *ipvs)
 {
 	/* Ignore reloads before first service is added */
-	if (!ipvs->enable)
+	if (!READ_ONCE(ipvs->enable))
 		return;
 	ip_vs_est_stopped_recalc(ipvs);
 	/* Bump the kthread configuration genid */
@@ -304,7 +304,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
 	int i;
 
 	if ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads &&
-	    ipvs->enable && ipvs->est_max_threads)
+	    READ_ONCE(ipvs->enable) && ipvs->est_max_threads)
 		return -EINVAL;
 
 	mutex_lock(&ipvs->est_mutex);
@@ -341,7 +341,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
 	}
 
 	/* Start kthread tasks only when services are present */
-	if (ipvs->enable && !ip_vs_est_stopped(ipvs)) {
+	if (READ_ONCE(ipvs->enable) && !ip_vs_est_stopped(ipvs)) {
 		ret = ip_vs_est_kthread_start(ipvs, kd);
 		if (ret < 0)
 			goto out;
@@ -484,7 +484,7 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats)
 	struct ip_vs_estimator *est = &stats->est;
 	int ret;
 
-	if (!ipvs->est_max_threads && ipvs->enable)
+	if (!ipvs->est_max_threads && READ_ONCE(ipvs->enable))
 		ipvs->est_max_threads = ip_vs_est_max_threads(ipvs);
 
 	est->ktid = -1;
@@ -661,7 +661,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
 			/* Wait for cpufreq frequency transition */
 			wait_event_idle_timeout(wq, kthread_should_stop(),
 						HZ / 50);
-			if (!ipvs->enable || kthread_should_stop())
+			if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
 				goto stop;
 		}
 
@@ -679,7 +679,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
 		rcu_read_unlock();
 		local_bh_enable();
 
-		if (!ipvs->enable || kthread_should_stop())
+		if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
 			goto stop;
 		cond_resched();
 
@@ -755,7 +755,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
 	mutex_lock(&ipvs->est_mutex);
 	for (id = 1; id < ipvs->est_kt_count; id++) {
 		/* netns clean up started, abort */
-		if (!ipvs->enable)
+		if (!READ_ONCE(ipvs->enable))
 			goto unlock2;
 		kd = ipvs->est_kt_arr[id];
 		if (!kd)
@@ -785,7 +785,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
 	id = ipvs->est_kt_count;
 
 next_kt:
-	if (!ipvs->enable || kthread_should_stop())
+	if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
 		goto unlock;
 	id--;
 	if (id < 0)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:23:47 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367812; cv=none; b=QIyVWO4njWx8M4dGE0lzefkFzD0UXtuxJSlcPPrWy7uvJehmjmmpGdE767k1mWniWDuXjYfGNu9D2SkZ8qSS7ZsN4nXXepWwIsICypBuUfWAHYXiwH+1Q5x2uXgAG7+ImzocouDhKtDalJg47SiCVIgbZmEY8TveIcscL9VxI8s=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367812; c=relaxed/simple;
	bh=kIrLs1rb8KT4NZIEUsy8efqo/hedApX1DqMkQHXtX+M=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=K3zFR2y9MQHds+Rsm03044qjrbw54nS2npVFcDAT41AaE6aGXJIAO774gfZRqfw1eo370wJSQdW8fa2fspfEIj2uwD1zta8Y9YcPwPEhDUObvO1rm/aAFuk8j3AxrvFmrHvhyssE9zZZdiuet7oDtUFUQIotAMXxZ+C/OpvoY8Q=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=fczdiZ3p; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhen Ni <[email-masked]>,
	Phil Sutter <[email-masked]>,
	Florian Westphal <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 109/196] netfilter: ipset: Remove unused htable_bits in macro ahash_region
Date: Mon, 13 Oct 2025 16:45:00 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhen Ni <[email-masked]>

[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]

Since the ahash_region() macro was redefined to calculate the region
index solely from HTABLE_REGION_BITS, the htable_bits parameter became
unused.

Remove the unused htable_bits argument and its call sites, simplifying
the code without changing semantics.

Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types")
Signed-off-by: Zhen Ni <[email-masked]>
Reviewed-by: Phil Sutter <[email-masked]>
Signed-off-by: Florian Westphal <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index c2d88b1b06b87..20b223e6e93b9 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -62,7 +62,7 @@ struct hbucket {
 		: jhash_size((htable_bits) - HTABLE_REGION_BITS))
 #define ahash_sizeof_regions(htable_bits)		\
 	(ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region))
-#define ahash_region(n, htable_bits)		\
+#define ahash_region(n)		\
 	((n) / jhash_size(HTABLE_REGION_BITS))
 #define ahash_bucket_start(h,  htable_bits)	\
 	((htable_bits) < HTABLE_REGION_BITS ? 0	\
@@ -701,7 +701,7 @@ mtype_resize(struct ip_set *set, bool retried)
 #endif
 				key = HKEY(data, h->initval, htable_bits);
 				m = __ipset_dereference(hbucket(t, key));
-				nr = ahash_region(key, htable_bits);
+				nr = ahash_region(key);
 				if (!m) {
 					m = kzalloc(sizeof(*m) +
 					    AHASH_INIT_SIZE * dsize,
@@ -851,7 +851,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
 	rcu_read_lock_bh();
 	t = rcu_dereference_bh(h->table);
 	key = HKEY(value, h->initval, t->htable_bits);
-	r = ahash_region(key, t->htable_bits);
+	r = ahash_region(key);
 	atomic_inc(&t->uref);
 	elements = t->hregion[r].elements;
 	maxelem = t->maxelem;
@@ -1049,7 +1049,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
 	rcu_read_lock_bh();
 	t = rcu_dereference_bh(h->table);
 	key = HKEY(value, h->initval, t->htable_bits);
-	r = ahash_region(key, t->htable_bits);
+	r = ahash_region(key);
 	atomic_inc(&t->uref);
 	rcu_read_unlock_bh();
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:50:02 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367810; cv=none; b=XQ5nkkBGsOO4ZmcOk21TXh3/pT6/atZR7/A5b2x3XHRjFqKoHEUmRicPONWjwGyKT8AfmuLtF2vzgddt9ifetMXPeKWPU4GBn7rg+TDN5hSxNFjomLwWRvLqJeuqimQdRoGgwHVFlAfgdaG5YLy+GKlzCGaw/a53a1U36nJloQM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367810; c=relaxed/simple;
	bh=ZUhEa3hiRqvHATtGWxXIfG/Y1oTa+pQZ/MdT0Ju86Zs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=d/okyGm27uo30ZOzED72rOVOHU5vVUDFfKkphOTgjtbVVVLOcabZUo4fiFFdde+03vb0XDyQEgwwYCewqxQXkrGXyXUn7iRB1SgkEoVX5+TJ8t+RMvYxTLm+i1lAOeadzuK0l1JKtaj65V/fi0qSjkeKNiwp3OB0QZD135dOcAw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dO96JG0l; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Liam Beguin <[email-masked]>,
	Andy Shevchenko <[email-masked]>,
	Hans de Goede <[email-masked]>,
	Jonathan Cameron <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 108/196] iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
Date: Mon, 13 Oct 2025 16:44:59 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hans de Goede <[email-masked]>

[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]

Fix iio_convert_raw_to_processed() offset handling for channels without
a scale attribute.

The offset has been applied to the raw64 value not to the original raw
value. Use the raw64 value so that the offset is taken into account.

Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available")
Cc: Liam Beguin <[email-masked]>
Reviewed-by: Andy Shevchenko <[email-masked]>
Signed-off-by: Hans de Goede <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jonathan Cameron <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/iio/inkern.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index 34abbf46916cc..c7b2ab7870993 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -671,7 +671,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
 		 * If no channel scaling is available apply consumer scale to
 		 * raw value and return.
 		 */
-		*processed = raw * scale;
+		*processed = raw64 * scale;
 		return 0;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:19:10 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367806; cv=none; b=J6zNYiWj6DhkDglg7yDvPkdBefexYgBj45Xwa5FsoH4U0wKHkUnzUM/uZ8pdPTTcR1CvWj8bv3/JnEpkxeB8ISY3psFXZXFAlt4bw4ABjoVfYR786bD7P44SsvQZQDRS/jRusxPF194/+M876UoQKYIfBfSAMQqzu/i4CQMJ6S0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367806; c=relaxed/simple;
	bh=G9o6cOaDCMhWRv6vt3w6FKTqxS5vn76l20Yh0mXO8Z0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bd9pS/Eeqa/+1xB+m9bYCZ5ZmENAOxZt0/PiEo/pzek2NtvEgCqsFwXQkhndXfkVwIyZNMBc+jKONN/WZaCbWxzQ7y7lswHdOSvdwW0W6nirvsJqDHF4fKrWMuFL5hOr8gPCwu007XL+2qBX3GD5sMKDDdgsP24i3ZEz9juFKJQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=h3w0YRzI; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Matteo Martelli <[email-masked]>,
	Andy Shevchenko <[email-masked]>,
	Hans de Goede <[email-masked]>,
	Jonathan Cameron <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 107/196] iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed()
Date: Mon, 13 Oct 2025 16:44:58 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hans de Goede <[email-masked]>

[ Upstream commit 0f85406bf830eb8747dd555ab53c9d97ee4af293 ]

There is an issue with the handling of negative channel scales
in iio_convert_raw_to_processed_unlocked() when the channel-scale
is of the IIO_VAL_INT_PLUS_[MICRO|NANO] type:

Things work for channel-scale values > -1.0 and < 0.0 because of
the use of signed values in:

	*processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000LL);

Things will break however for scale values < -1.0. Lets for example say
that raw = 2, (caller-provided)scale = 10 and (channel)scale_val = -1.5.

The result should then be 2 * 10 * -1.5 = -30.

channel-scale = -1.5 means scale_val = -1 and scale_val2 = 500000,
now lets see what gets stored in processed:

1. *processed = raw64 * scale_val * scale;
2. *processed += raw64 * scale_val2 * scale / 1000000LL;

1. Sets processed to 2 * -1 * 10 = -20
2. Adds 2 * 500000 * 10 / 1000000 = 10 to processed

And the end result is processed = -20 + 10 = -10, which is not correct.

Fix this by always using the abs value of both scale_val and scale_val2
and if either is negative multiply the end-result by -1.

Note there seems to be an unwritten rule about negative
IIO_VAL_INT_PLUS_[MICRO|NANO] values that:

i.   values > -1.0 and < 0.0 are written as val=0 val2=-xxx
ii.  values <= -1.0 are written as val=-xxx val2=xxx

But iio_format_value() will also correctly display a third option:

iii. values <= -1.0 written as val=-xxx val2=-xxx

Since iio_format_value() uses abs(val) when val2 < 0.

This fix also makes iio_convert_raw_to_processed() properly handle
channel-scales using this third option.

Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value")
Cc: Matteo Martelli <[email-masked]>
Reviewed-by: Andy Shevchenko <[email-masked]>
Signed-off-by: Hans de Goede <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jonathan Cameron <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/iio/inkern.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index 8255035ff124f..34abbf46916cc 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -9,6 +9,7 @@
 #include <linux/mutex.h>
 #include <linux/property.h>
 #include <linux/slab.h>
+#include <linux/units.h>
 
 #include <linux/iio/iio.h>
 #include <linux/iio/iio-opaque.h>
@@ -635,7 +636,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
 {
 	int scale_type, scale_val, scale_val2;
 	int offset_type, offset_val, offset_val2;
-	s64 raw64 = raw;
+	s64 denominator, raw64 = raw;
 
 	offset_type = iio_channel_read(chan, &offset_val, &offset_val2,
 				       IIO_CHAN_INFO_OFFSET);
@@ -679,20 +680,19 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
 		*processed = raw64 * scale_val * scale;
 		break;
 	case IIO_VAL_INT_PLUS_MICRO:
-		if (scale_val2 < 0)
-			*processed = -raw64 * scale_val * scale;
-		else
-			*processed = raw64 * scale_val * scale;
-		*processed += div_s64(raw64 * (s64)scale_val2 * scale,
-				      1000000LL);
-		break;
 	case IIO_VAL_INT_PLUS_NANO:
-		if (scale_val2 < 0)
-			*processed = -raw64 * scale_val * scale;
-		else
-			*processed = raw64 * scale_val * scale;
-		*processed += div_s64(raw64 * (s64)scale_val2 * scale,
-				      1000000000LL);
+		switch (scale_type) {
+		case IIO_VAL_INT_PLUS_MICRO:
+			denominator = MICRO;
+			break;
+		case IIO_VAL_INT_PLUS_NANO:
+			denominator = NANO;
+			break;
+		}
+		*processed = raw64 * scale * abs(scale_val);
+		*processed += div_s64(raw64 * scale * abs(scale_val2), denominator);
+		if (scale_val < 0 || scale_val2 < 0)
+			*processed *= -1;
 		break;
 	case IIO_VAL_FRACTIONAL:
 		*processed = div_s64(raw64 * (s64)scale_val * scale,
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:19:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367804; cv=none; b=A4RAzy4sqvFEGYszypO+i3TCEB5kkt+CF+Ws7cJpOd8cxDU0MoU/6+WKwl/C8TbpJVyZDGbB6+yy05D9yBo4F529FVhBvWdEAOuk6PSokspj9UjeRvIgrF4WUQ6PN+iR7JJx1WO/y/70Mkm4kGPPMR1Kw+hH9vnFvt+Lu2qm6qc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367804; c=relaxed/simple;
	bh=2Qljs/6GQ5kYpXFf7eAuoe/7XdV5B28KuLHFGC57YYs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=gxMki7j+u15cuaV3Oy5Npse7TCnalSNO9yQH+Ch3G0WSkN8aecw0oDjsxTvd+FUXiwrS580uTlx1msMwywDY6mt1IZrTuHIFuOuDciZlF8ocVce1GoBxwlD275NvnNNICGv7AwRo8aQxEaMDMHsKDFRJlRUJZvYranpWF8NOzj0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=fD9pGd+W; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Moon Hee Lee <[email-masked]>,
	Konstantin Komarov <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 106/196] fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
Date: Mon, 13 Oct 2025 16:44:57 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: syzkaller.appspot.com]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Moon Hee Lee <[email-masked]>

[ Upstream commit 0dc7117da8f92dd5fe077d712a756eccbe377d40 ]

Index allocation requires at least one bit in the $BITMAP attribute to
track usage of index entries. If the bitmap is empty while index blocks
are already present, this reflects on-disk corruption.

syzbot triggered this condition using a malformed NTFS image. During a
rename() operation involving a long filename (which spans multiple
index entries), the empty bitmap allowed the name to be added without
valid tracking. Subsequent deletion of the original entry failed with
-ENOENT, due to unexpected index state.

Reject such cases by verifying that the bitmap is not empty when index
blocks exist.

Reported-by: [email-masked]
Closes: https://syzkaller.appspot.com/bug?extid=b0373017f711c06ada64
Fixes: d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails")
Tested-by: [email-masked]
Signed-off-by: Moon Hee Lee <[email-masked]>
Signed-off-by: Konstantin Komarov <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/ntfs3/index.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 191b91ffadbb2..f227db9f76c2b 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1510,6 +1510,16 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni,
 			bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size);
 		}
 
+		/*
+		 * Index blocks exist, but $BITMAP has zero valid bits.
+		 * This implies an on-disk corruption and must be rejected.
+		 */
+		if (in->name == I30_NAME &&
+		    unlikely(bmp_size_v == 0 && indx->alloc_run.count)) {
+			err = -EINVAL;
+			goto out1;
+		}
+
 		bit = bmp_size << 3;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:26:29 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367801; cv=none; b=NrgOPppA9GUefnAvAzOojmux+mo9srgzvAfswjuPNmxIGOT5DjMHtpirPnrLjhMbJ6Ur3Gs9rjej0PwtZms6OkYurCnCtvjcHhQAvXMtEa2TK2drRcc3QhXjRJIrZxcmZyeSE8a8q7BpjxrAFjsDD6lofYitQ8kIVR365nIVroY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367801; c=relaxed/simple;
	bh=U6fKqyIzDpd+KRgEAZ2Ua9t9Wm4dDopisqpaR4UZtX4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Hsfw44YWN8MjiuTS5ZVgqN0CZeRthwPypiIh5kz+cRgCMwU1Kj1HAz4UB4J0IqXBUTvnLnBCCs4/fYoMWdLPFpRL+rxP6Pzeje2Gq7pLTLfMMIgB6ftNkwOrY/x1tUsZhC1I9D+2wkQsxYG7O93rLaStU+ryhcCUTDEulSEdQXo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=cnUEExDc; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Vitaly Grigoryev <[email-masked]>,
	Konstantin Komarov <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 105/196] fs: ntfs3: Fix integer overflow in run_unpack()
Date: Mon, 13 Oct 2025 16:44:56 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vitaly Grigoryev <[email-masked]>

[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ]

The MFT record relative to the file being opened contains its runlist,
an array containing information about the file's location on the physical
disk. Analysis of all Call Stack paths showed that the values of the
runlist array, from which LCNs are calculated, are not validated before
run_unpack function.

The run_unpack function decodes the compressed runlist data format
from MFT attributes (for example, $DATA), converting them into a runs_tree
structure, which describes the mapping of virtual clusters (VCN) to
logical clusters (LCN). The NTFS3 subsystem also has a shortcut for
deleting files from MFT records - in this case, the RUN_DEALLOCATE
command is sent to the run_unpack input, and the function logic
provides that all data transferred to the runlist about file or
directory is deleted without creating a runs_tree structure.

Substituting the runlist in the $DATA attribute of the MFT record for an
arbitrary file can lead either to access to arbitrary data on the disk
bypassing access checks to them (since the inode access check
occurs above) or to destruction of arbitrary data on the disk.

Add overflow check for addition operation.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
Signed-off-by: Vitaly Grigoryev <[email-masked]>
Signed-off-by: Konstantin Komarov <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/ntfs3/run.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
index 44e93ad491ba7..0139124578d9e 100644
--- a/fs/ntfs3/run.c
+++ b/fs/ntfs3/run.c
@@ -9,6 +9,7 @@
 #include <linux/blkdev.h>
 #include <linux/fs.h>
 #include <linux/log2.h>
+#include <linux/overflow.h>
 
 #include "debug.h"
 #include "ntfs.h"
@@ -982,12 +983,16 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
 
 			if (!dlcn)
 				return -EINVAL;
-			lcn = prev_lcn + dlcn;
+
+			if (check_add_overflow(prev_lcn, dlcn, &lcn))
+				return -EINVAL;
 			prev_lcn = lcn;
 		} else
 			return -EINVAL;
 
-		next_vcn = vcn64 + len;
+		if (check_add_overflow(vcn64, len, &next_vcn))
+			return -EINVAL;
+
 		/* Check boundary. */
 		if (next_vcn > evcn + 1)
 			return -EINVAL;
@@ -1151,7 +1156,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn)
 			return -EINVAL;
 
 		run_buf += size_size + offset_size;
-		vcn64 += len;
+		if (check_add_overflow(vcn64, len, &vcn64))
+			return -EINVAL;
 
 #ifndef CONFIG_NTFS3_64BIT_CLUSTER
 		if (vcn64 > 0x100000000ull)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:42:08 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367782; cv=none; b=VjzW2EM5+htdfxdv0Qxp6M2YtsYDhbZIgtnX9hQ1GmYeCz9Xcnb1ACuKQNT942/n9z/uv7x8HEi5J6y+zVnI/Mjf92s1WGxGvutfHrzbYegOGYDouGmyMieYH87iozXXd0+zKA5NYw8t7RpC488G5TGp52xIhwDB4zju+Sc1moQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367782; c=relaxed/simple;
	bh=PCjItww/6P8Ldd/+Xzy/ip2/7ybv7kKMbRZ2hT1/lng=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bhvKwiHkujjaGV/jMiROA3E++/vnVRO3ouFdpRQrmBwG0mfHKH52YMqLPQU6IRSvIWViGshnHZwB2iVj8mNBaVouIco7WGPLxfeVJdYAE61zHJ0JD3Z+2CTrUO/op24ZyF5gQ9Rz9CjC5/RPeKknMUPpAAm3VtoZOzfFIbmE7n0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Nz04NYjs; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 104/196] drm/msm/dpu: fix incorrect type for ret
Date: Mon, 13 Oct 2025 16:44:55 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 88ec0e01a880e3326794e149efae39e3aa4dbbec ]

Change 'ret' from unsigned long to int, as storing negative error codes
in an unsigned long makes it never equal to -ETIMEDOUT, causing logical
errors.

Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback")
Signed-off-by: Qianfeng Rong <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Patchwork: https://patchwork.freedesktop.org/patch/671100/
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
index 0a45c546b03f2..a5cd41c9224d7 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
@@ -433,7 +433,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout(
 static int dpu_encoder_phys_wb_wait_for_commit_done(
 		struct dpu_encoder_phys *phys_enc)
 {
-	unsigned long ret;
+	int ret;
 	struct dpu_encoder_wait_info wait_info;
 	struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:30:04 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367751; cv=none; b=kLzkli05MmFqg/8ZtJB0SkMATB+VZpcvsBSyFso1czV65mKRgwJn6RqA0hvaaf9sMt8fJua4O9mwzd6td15ae9FlOzOa83lrOpzpZCHaao55jIbYXe+VpB3RP9W6uRRnwKaz7PKzdiuC85lO6i20fBLAlhvvmKywkkDJ+xnCSpQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367751; c=relaxed/simple;
	bh=++ROtoxPusOHugSu8dnM5Yh7akBDj6qD6wlmSHWJoWU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Xn6k73HtiFGRW9UfMNrrqp0myp1BqRu7w6l5KqwBQ9ly9kISpboRB3a+cFsvgT7ElAdkxYX748/LwFc05vXrAu9h8LVKLYeE1r2VrAhe5F8jpodPamMYNDzHrrNMDgd+A935jPozZftIjU5vPgKqO4lcfWkxOdNDWoe5IgGu3AM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QqwxWIPj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Takashi Iwai <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 103/196] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
Date: Mon, 13 Oct 2025 16:44:54 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email-masked]>

[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]

When an invalid value is passed via quirk option, currently
bytcr_rt5640 driver just ignores and leaves as is, which may lead to
unepxected results like OOB access.

This patch adds the sanity check and corrects the input mapping to the
certain default value if an invalid value is passed.

Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks")
Signed-off-by: Takashi Iwai <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
index 805afaf47b290..2abe47303ecdb 100644
--- a/sound/soc/intel/boards/bytcr_rt5651.c
+++ b/sound/soc/intel/boards/bytcr_rt5651.c
@@ -58,7 +58,8 @@ enum {
 	BYT_RT5651_OVCD_SF_1P5	= (RT5651_OVCD_SF_1P5 << 13),
 };
 
-#define BYT_RT5651_MAP(quirk)		((quirk) & GENMASK(3, 0))
+#define BYT_RT5651_MAP_MASK		GENMASK(3, 0)
+#define BYT_RT5651_MAP(quirk)		((quirk) & BYT_RT5651_MAP_MASK)
 #define BYT_RT5651_JDSRC(quirk)		(((quirk) & GENMASK(7, 4)) >> 4)
 #define BYT_RT5651_OVCD_TH(quirk)	(((quirk) & GENMASK(12, 8)) >> 8)
 #define BYT_RT5651_OVCD_SF(quirk)	(((quirk) & GENMASK(14, 13)) >> 13)
@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
 
 static void log_quirks(struct device *dev)
 {
-	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP)
+	int map;
+
+	map = BYT_RT5651_MAP(byt_rt5651_quirk);
+	switch (map) {
+	case BYT_RT5651_DMIC_MAP:
 		dev_info(dev, "quirk DMIC_MAP enabled");
-	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP)
+		break;
+	case BYT_RT5651_IN1_MAP:
 		dev_info(dev, "quirk IN1_MAP enabled");
-	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP)
+		break;
+	case BYT_RT5651_IN2_MAP:
 		dev_info(dev, "quirk IN2_MAP enabled");
-	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP)
+		break;
+	case BYT_RT5651_IN1_IN2_MAP:
 		dev_info(dev, "quirk IN1_IN2_MAP enabled");
+		break;
+	default:
+		dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map);
+		byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK;
+		byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP;
+		break;
+	}
+
 	if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) {
 		dev_info(dev, "quirk realtek,jack-detect-source %ld\n",
 			 BYT_RT5651_JDSRC(byt_rt5651_quirk));
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:34:13 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367719; cv=none; b=P9TIFl454CQjgUH0RDIqTVxwNSLJbipmgks15Dax+qaq/AhG6IQMQMDyhsWm/5BAqNXuhMZZcWT6YkNVPzmcHoeyOeMaKRDYP1/uJ56tpEqqwfeCdFNzqClsj50AjxJWFHluWBJwcVL8FUX3N8R+GBHY4cI1jGXrMlGYrO3y1Og=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367719; c=relaxed/simple;
	bh=D3+Y4KbodPS5t4vbiA7cyBxTizcrw7s0OmS20rWh0nE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=gcjFoV6WubnYeDuuWsZKubcMvkACErms2KjOXDZNC2HroKyP2cGV5nvhkC9rCWqcOMPwWhxUcIwhOrt3FZdyvyjw1JtNleAPjJowRi8QW9Hz1gatea/C++xBHalXTl3JuRda1lWzmHU5hEoDBHCbjD0E6QukY8OsbIZVywNBQg0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FVPpjJT7; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Takashi Iwai <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 102/196] ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
Date: Mon, 13 Oct 2025 16:44:53 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email-masked]>

[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]

When an invalid value is passed via quirk option, currently
bytcr_rt5640 driver only shows an error message but leaves as is.
This may lead to unepxected results like OOB access.

This patch corrects the input mapping to the certain default value if
an invalid value is passed.

Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks")
Signed-off-by: Takashi Iwai <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
index 6a85e8fdcae64..beca466dd468e 100644
--- a/sound/soc/intel/boards/bytcr_rt5640.c
+++ b/sound/soc/intel/boards/bytcr_rt5640.c
@@ -68,7 +68,8 @@ enum {
 	BYT_RT5640_OVCD_SF_1P5		= (RT5640_OVCD_SF_1P5 << 13),
 };
 
-#define BYT_RT5640_MAP(quirk)		((quirk) &  GENMASK(3, 0))
+#define BYT_RT5640_MAP_MASK		GENMASK(3, 0)
+#define BYT_RT5640_MAP(quirk)		((quirk) & BYT_RT5640_MAP_MASK)
 #define BYT_RT5640_JDSRC(quirk)		(((quirk) & GENMASK(7, 4)) >> 4)
 #define BYT_RT5640_OVCD_TH(quirk)	(((quirk) & GENMASK(12, 8)) >> 8)
 #define BYT_RT5640_OVCD_SF(quirk)	(((quirk) & GENMASK(14, 13)) >> 13)
@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev)
 		dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n");
 		break;
 	default:
-		dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map);
+		dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map);
+		byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK;
+		byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP;
 		break;
 	}
 	if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:19:42 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367818; cv=none; b=ajdQc74sdX6oAvpUCkSI3dhExygNHaJ6vT3iJkNOKs+HNA+Q+f/Y6th8/he31tEkgxlBCuYBz/YB4r3vOm487UaDxd8tXo04JgEFE9rSHUKroV3KL6ahFhF2oDDH4R4z3GEWcKoSk+KCsAjgI5cL19LD1LiZXOJ8apEXpLNy5wE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367818; c=relaxed/simple;
	bh=SzBjNUP20MTtHshH5dVadKh+/e8iLEDQIW+SMkEo8Cw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DpEOKST9VAG5DmjAyTqpuJEf48ywbKk1NHEtOHivt3MmZtWAKq0aTfl4SxJZ1QwhplP7rwESnrB4NJx7kbpj5jmUKILpzxaG51rmHS/+sm5fOaKr8t3WS2Nfs9WZQ+BLZ7T6oJ4lQYL1ioqsNUe3t4qNaqoy/vrBucCPVp4Y8D4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=iDzo4bNu; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Takashi Iwai <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 101/196] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
Date: Mon, 13 Oct 2025 16:44:52 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email-masked]>

[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]

When an invalid value is passed via quirk option, currently
bytcht_es8316 driver just ignores and leaves as is, which may lead to
unepxected results like OOB access.

This patch adds the sanity check and corrects the input mapping to the
certain default value if an invalid value is passed.

Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks")
Signed-off-by: Takashi Iwai <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
index 7a30d2d36f199..fbd7e1f0783fd 100644
--- a/sound/soc/intel/boards/bytcht_es8316.c
+++ b/sound/soc/intel/boards/bytcht_es8316.c
@@ -46,7 +46,8 @@ enum {
 	BYT_CHT_ES8316_INTMIC_IN2_MAP,
 };
 
-#define BYT_CHT_ES8316_MAP(quirk)		((quirk) & GENMASK(3, 0))
+#define BYT_CHT_ES8316_MAP_MASK			GENMASK(3, 0)
+#define BYT_CHT_ES8316_MAP(quirk)		((quirk) & BYT_CHT_ES8316_MAP_MASK)
 #define BYT_CHT_ES8316_SSP0			BIT(16)
 #define BYT_CHT_ES8316_MONO_SPEAKER		BIT(17)
 #define BYT_CHT_ES8316_JD_INVERTED		BIT(18)
@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
 
 static void log_quirks(struct device *dev)
 {
-	if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP)
+	int map;
+
+	map = BYT_CHT_ES8316_MAP(quirk);
+	switch (map) {
+	case BYT_CHT_ES8316_INTMIC_IN1_MAP:
 		dev_info(dev, "quirk IN1_MAP enabled");
-	if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP)
+		break;
+	case BYT_CHT_ES8316_INTMIC_IN2_MAP:
 		dev_info(dev, "quirk IN2_MAP enabled");
+		break;
+	default:
+		dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map);
+		quirk &= ~BYT_CHT_ES8316_MAP_MASK;
+		quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP;
+		break;
+	}
+
 	if (quirk & BYT_CHT_ES8316_SSP0)
 		dev_info(dev, "quirk SSP0 enabled");
 	if (quirk & BYT_CHT_ES8316_MONO_SPEAKER)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:35:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367696; cv=none; b=tyZCCfoBLfscZu8eWb792SqGb+xeOQc35xZGDJn1G/dcn0+oIwkvQX5FFJODXRXcKHEmDqgQTSWpny32TxZHq3UKjfBll+Qm/ngcFSJ2EgjSM6zvrkCXY8gzi0MqRB8hnE1VS+kfXeEj3EyfDkfyWuE5HfloSQmuQdLHHYnlwXo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367696; c=relaxed/simple;
	bh=7+sK/d08x2tiRCO+WQx7O2ufwikTKRBJ/BjgSJwYK2c=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=PSo9BIvczVf0Mx/oZY79c4hTIe8zYScgEJBN8ytnslo1y0xN0X+FHdG/WfxNXeCb5iuQrbtVNJ1LuGTQ1/oSyFpM9+PuEYFTb9azXd9muaPgt91sITgFgwnOAKd3hz613z+KhGYtkHQvKcYStGiMyDRU8xwQhTHZhMI9jkRmMFE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=F62b47Ch; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Wang Liang <[email-masked]>,
	Calvin Owens <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 100/196] pps: fix warning in pps_register_cdev when register device fail
Date: Mon, 13 Oct 2025 16:44:51 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wang Liang <[email-masked]>

[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]

Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error
handling in __video_register_device()"), the release hook should be set
before device_register(). Otherwise, when device_register() return error
and put_device() try to callback the release function, the below warning
may happen.

  ------------[ cut here ]------------
  WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567
  Modules linked in:
  CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE
  RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567
  Call Trace:
   <TASK>
   kobject_cleanup+0x136/0x410 lib/kobject.c:689
   kobject_release lib/kobject.c:720 [inline]
   kref_put include/linux/kref.h:65 [inline]
   kobject_put+0xe9/0x130 lib/kobject.c:737
   put_device+0x24/0x30 drivers/base/core.c:3797
   pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402
   pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108
   pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57
   tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432
   tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563
   tiocsetd drivers/tty/tty_io.c:2429 [inline]
   tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:598 [inline]
   __se_sys_ioctl fs/ioctl.c:584 [inline]
   __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
   </TASK>

Before commit c79a39dc8d06 ("pps: Fix a use-after-free"),
pps_register_cdev() call device_create() to create pps->dev, which will
init dev->release to device_create_release(). Now the comment is outdated,
just remove it.

Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed
in pps_register_source() to avoid a double free in the failure case.

Link: https://lore.kernel.org/all/[email-masked]/
Fixes: c79a39dc8d06 ("pps: Fix a use-after-free")
Signed-off-by: Wang Liang <[email-masked]>
Reviewed-By: Calvin Owens <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pps/kapi.c | 5 +----
 drivers/pps/pps.c  | 5 ++---
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
index 92d1b62ea239d..e9389876229ea 100644
--- a/drivers/pps/kapi.c
+++ b/drivers/pps/kapi.c
@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,
 	if (err < 0) {
 		pr_err("%s: unable to create char device\n",
 					info->name);
-		goto kfree_pps;
+		goto pps_register_source_exit;
 	}
 
 	dev_dbg(&pps->dev, "new PPS source %s\n", info->name);
 
 	return pps;
 
-kfree_pps:
-	kfree(pps);
-
 pps_register_source_exit:
 	pr_err("%s: unable to register source\n", info->name);
 
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index e1689957736d9..9539695b337a8 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -375,6 +375,7 @@ int pps_register_cdev(struct pps_device *pps)
 			       pps->info.name);
 			err = -EBUSY;
 		}
+		kfree(pps);
 		goto out_unlock;
 	}
 	pps->id = err;
@@ -384,13 +385,11 @@ int pps_register_cdev(struct pps_device *pps)
 	pps->dev.devt = MKDEV(pps_major, pps->id);
 	dev_set_drvdata(&pps->dev, pps);
 	dev_set_name(&pps->dev, "pps%d", pps->id);
+	pps->dev.release = pps_device_destruct;
 	err = device_register(&pps->dev);
 	if (err)
 		goto free_idr;
 
-	/* Override the release function with our own */
-	pps->dev.release = pps_device_destruct;
-
 	pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major,
 		 pps->id);
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:21:48 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367693; cv=none; b=rnv4NX894nP0C5mryUo+NGuu4lsX+4U+5zr1F77KkJ02+Dg6MYUFVVW9RM24V36KBsO0dqkLlC0rZKSzeBsXlfrwAzwnJ0IimRBXSaqohe60lm8N8j3fgMxI26aloF4Y4r9ZU70PhFi0jDRL+2IokZirFcuZL34VMZeGQMVBbbc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367693; c=relaxed/simple;
	bh=3sdLnPEw+a0SKfTZds8OP1OYQ/5xaVAxP6n2GXwYjiw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=JXxJ1WNqMTVD00CCJTLwRtKdVCIZViLzDmIevNGPyqKAd7HZvCZFWuU+9tdOqOzRNnRp5xQav17vEwNWL5WWb3TjUdfCpvKQAAtJO+b9QW01ZINwnfX0WuCTdVVPVe4YYSZZ//tSS7L8yOgcWdrR9ev+sE+9tZ4anspyL2o6UzA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Kyp6jtyx; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Colin Ian King <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 099/196] misc: genwqe: Fix incorrect cmd field being reported in error
Date: Mon, 13 Oct 2025 16:44:50 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Colin Ian King <[email-masked]>

[ Upstream commit 6b26053819dccc664120e07c56f107fb6f72f3fa ]

There is a dev_err message that is reporting the value of
cmd->asiv_length when it should be reporting cmd->asv_length
instead. Fix this.

Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
Signed-off-by: Colin Ian King <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/misc/genwqe/card_ddcb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
index 500b1feaf1f6f..fd7d5cd50d396 100644
--- a/drivers/misc/genwqe/card_ddcb.c
+++ b/drivers/misc/genwqe/card_ddcb.c
@@ -923,7 +923,7 @@ int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd,
 	}
 	if (cmd->asv_length > DDCB_ASV_LENGTH) {
 		dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n",
-			__func__, cmd->asiv_length);
+			__func__, cmd->asv_length);
 		return -EINVAL;
 	}
 	rc = __genwqe_enqueue_ddcb(cd, req, f_flags);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:35:19 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367690; cv=none; b=Arcnqlsmzf3Tc9f1TJntCCVKhsWXn7RWXxktWyT131PPKNCG8A4EQw0jlqDub8JAKvTypSRoc456ZrZxwaDb0Ix4ykiB/EPVkmfU0Sq5Jiik9lhAldDE2Pn0zgAPpG3sQdYINE/mdYI5F9v6pGDJrAts0itepidVk+FRvU73U9o=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367690; c=relaxed/simple;
	bh=fDLHY/9Jg0MZ//jHvSJVW++HRSO39KMtVCZsNpA3Ozk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=k264teg83v5U3XwUfqcFTjLeMWLq4YUBJ1GpiZlmZXq5FrhCgLes2Bn2kXlBpeBZG64swAxvZuwOkgTbVqqGKzc+MrYIJGmm7SWn6sz53xAIveSOj52XwY+0FpQFqJfQG1AN+I67EYWxUE2ynMibTtxys95gP/AJ8BrNgvW2Qfg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=VsU+KBJM; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Seppo Takalo <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 098/196] tty: n_gsm: Dont block input queue by waiting MSC
Date: Mon, 13 Oct 2025 16:44:49 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Seppo Takalo <[email-masked]>

[ Upstream commit 3cf0b3c243e56bc43be560617416c1d9f301f44c ]

Currently gsm_queue() processes incoming frames and when opening
a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update().
If basic mode is used it calls gsm_modem_upd_via_msc() and it
cannot block the input queue by waiting the response to come
into the same input queue.

Instead allow sending Modem Status Command without waiting for remote
end to respond. Define a new function gsm_modem_send_initial_msc()
for this purpose. As MSC is only valid for basic encoding, it does
not do anything for advanced or when convergence layer type 2 is used.

Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open")
Signed-off-by: Seppo Takalo <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/tty/n_gsm.c | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 8559ba1361c64..901f5c8311fbf 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -460,6 +460,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg);
 static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr);
 static void gsmld_write_trigger(struct gsm_mux *gsm);
 static void gsmld_write_task(struct work_struct *work);
+static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci);
 
 /**
  *	gsm_fcs_add	-	update FCS
@@ -2173,7 +2174,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci)
 		pr_debug("DLCI %d goes open.\n", dlci->addr);
 	/* Send current modem state */
 	if (dlci->addr) {
-		gsm_modem_update(dlci, 0);
+		gsm_modem_send_initial_msc(dlci);
 	} else {
 		/* Start keep-alive control */
 		gsm->ka_num = 0;
@@ -4156,6 +4157,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk)
 	return gsm_control_wait(dlci->gsm, ctrl);
 }
 
+/**
+ * gsm_modem_send_initial_msc - Send initial modem status message
+ *
+ * @dlci channel
+ *
+ * Send an initial MSC message after DLCI open to set the initial
+ * modem status lines. This is only done for basic mode.
+ * Does not wait for a response as we cannot block the input queue
+ * processing.
+ */
+static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci)
+{
+	u8 modembits[2];
+
+	if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT)
+		return 0;
+
+	modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */
+	modembits[1] = (gsm_encode_modem(dlci) << 1) | EA;
+	return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2);
+}
+
 /**
  *	gsm_modem_update	-	send modem status line state
  *	@dlci: channel
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:26:54 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367687; cv=none; b=K3YqHVAiWzAGp5b3wuqhor1NBX9PerUdEuRK6SeGglA59JnmGNW4LgHeExBDi/BR1wJC1HAkI3LAMtTTydnbtjoe5y7Kbqibs1Lmr3bmPU4Kp7g7S+cvc8ko54aEIHMNGByCO28t7NhmHaBD7MjaAI/J5f2qfBxKAIFkKDAbA0w=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367687; c=relaxed/simple;
	bh=jiVQTjJdFnYlNxd1u1gndieMwApl3phasNs1RopqPxk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=MK1rdPmJ2shbuvv5oGt7TQOoiP2QB1iJfJR8aiiYn7IZ0WSeifkKiOUgFE36bsfb9oYpqaz230vKtRZZWX1ZXT+47OerATa0Q23tECFoIqzszmvGK0B4YaNne4VUGOapvOca1Y81GhCyxroZYVOX5UqqRa730GsgfTxlFuGlmnc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=CTzk6x4e; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	William Wu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 097/196] usb: gadget: configfs: Correctly set use_os_string at bind
Date: Mon, 13 Oct 2025 16:44:48 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: William Wu <[email-masked]>

[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]

Once the use_os_string flag is set to true for some functions
(e.g. adb/mtp) which need to response the OS string, and then
if we re-bind the ConfigFS gadget to use the other functions
(e.g. hid) which should not to response the OS string, however,
because the use_os_string flag is still true, so the usb gadget
response the OS string descriptor incorrectly, this can cause
the USB device to be unrecognizable on the Windows system.

An example of this as follows:

echo 1 > os_desc/use
ln -s functions/ffs.adb configs/b.1/function0
start adbd
echo "<udc device>" > UDC   #succeed

stop adbd
rm configs/b.1/function0
echo 0 > os_desc/use
ln -s functions/hid.gs0 configs/b.1/function0
echo "<udc device>" > UDC  #fail to connect on Windows

This patch sets the use_os_string flag to false at bind if
the functions not support OS Descriptors.

Signed-off-by: William Wu <[email-masked]>
Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support")
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/usb/gadget/configfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 4c89f7629d530..9e8af571448bf 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1747,6 +1747,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
 		cdev->use_os_string = true;
 		cdev->b_vendor_code = gi->b_vendor_code;
 		memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN);
+	} else {
+		cdev->use_os_string = false;
 	}
 
 	if (gadget_is_otg(gadget) && !otg_desc[0]) {
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:39:58 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367684; cv=none; b=fZ2Ccy/XQQjf3idzgxjreraCEhBdsxvrKKFBIbjAZzCazZHoLTX/SXoLj6hskdJqaAYNjg4t3I5uBfvFMH2m/mvj9kgFRp6+Co+wIk6a1yNeDXq/Say5Fx7U5lhwRrztoMyxDYGWo8b7A8zklRelkpybY0I7zOrcxwsIyaizewY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367684; c=relaxed/simple;
	bh=PnW2lzPItGkX+LIyMoN327l7nYnnP6gaLDjxpcAh9fs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Lf3IG78eiUeAZ5PPVeuq70cZhxwg+7epoLxmbJrfxyTJaT37Vk7zMXSwTa9ubc4Z5DGO29ZypVhlee3BahUCWoLR1puif5PlWh8aDT8yp3lOh/bk9MoIGogbXdgfT1VVAYE7Vh0EIC7NTsv0LRtfI0BNxTZpw6AYcCL9xkD4Ao0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=v9ClVQQt; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Xichao Zhao <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 096/196] usb: phy: twl6030: Fix incorrect type for ret
Date: Mon, 13 Oct 2025 16:44:47 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xichao Zhao <[email-masked]>

[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]

In the twl6030_usb_probe(), the variable ret is declared as
a u32 type. However, since ret may receive -ENODEV when accepting
the return value of omap_usb2_set_comparator().Therefore, its type
should be changed to int.

Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2")
Signed-off-by: Xichao Zhao <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/usb/phy/phy-twl6030-usb.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
index c3ce6b1054f1c..292c32ccae050 100644
--- a/drivers/usb/phy/phy-twl6030-usb.c
+++ b/drivers/usb/phy/phy-twl6030-usb.c
@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)
 
 static int twl6030_usb_probe(struct platform_device *pdev)
 {
-	u32 ret;
 	struct twl6030_usb	*twl;
-	int			status, err;
+	int			status, err, ret;
 	struct device_node	*np = pdev->dev.of_node;
 	struct device		*dev = &pdev->dev;
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:30:54 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367682; cv=none; b=I3K1NRjCVWdfuPyFCP6+JScw65ycYGln31AhjGLUafBDk/EPa0AcCnXbvfbl4JADexsnZWz0Y0wUxblMIScF7KsFg8bSBuCNIJkcVAAaDRt9H9PZk2vrZJvccp8Nj7KlC4TLGcTMbu1bdl3+p8aQ6CloEcDc+/UAnEmCXyqz5uQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367682; c=relaxed/simple;
	bh=xz+ns9TFE8Sf8pBb1aEpxyts31EpleyL62C+fYV5GnY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=dhmQ+ErQh22z8gJDwqa5yPoU+otx+n3gdRuyzNvN9xLgKrSPj8VGQDtewwq2ojOJRn7dR42iKxHdjsO7puMkgHlUzogSyqYSXbJkOIinh/pPMnJRQThH1o7Mdczb/0bOanOazuavu63aD+kc6rGJJenNrvnFDL7zcFS41tTsZlA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=AwgIcOVb; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	Alex Deucher <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 095/196] drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
Date: Mon, 13 Oct 2025 16:44:46 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ]

Use negative error code -EINVAL instead of positive EINVAL in the default
case of svm_ioctl() to conform to Linux kernel error code conventions.

Fixes: 42de677f7999 ("drm/amdkfd: register svm range")
Signed-off-by: Qianfeng Rong <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index b77b472332316..3168d6fb11e76 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -4142,7 +4142,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start,
 		r = svm_range_get_attr(p, mm, start, size, nattrs, attrs);
 		break;
 	default:
-		r = EINVAL;
+		r = -EINVAL;
 		break;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:33:21 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367679; cv=none; b=h8O+QgIAS805qkCo9I4QuyaRvLtcJTYRgCtRji9G7XOZJObmdLH4jBWNrAp+MQ9nJsywZ9R6FFYAm74DrYs48kQ42GCAkQMSfv9VKvYjzFlx5xrMLi55OJtpDD7GOECKM8tLzL784HrFy6ki6+JxHB8plgy0Kl+yU42+yyrZs1Y=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367679; c=relaxed/simple;
	bh=iz8NZymndqihdgdSpyEjGm0M9xjhbSPGB0M8DinSmxw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=NEuhmWSJqx5sW5pfIU3Ijs1/8g+sBkio4rb75QS3ZMivc1USSDID9fr4pXk5Q9F0pta+toCdzNTtuyupbrBCtAMO7+jVCKcuY57Zbacw9kcixcYfHcEuyieYHQ6md78b0OITdidphHuNk/oHcKmB8xbIWAon1227TgR6H80xVMU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hhe78Orv; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Eric Dumazet <[email-masked]>,
	Neal Cardwell <[email-masked]>,
	Kuniyuki Iwashima <[email-masked]>,
	Jason Xing <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 094/196] tcp: fix __tcp_close() to only send RST when required
Date: Mon, 13 Oct 2025 16:44:45 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email-masked]>

[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]

If the receive queue contains payload that was already
received, __tcp_close() can send an unexpected RST.

Refine the code to take tp->copied_seq into account,
as we already do in tcp recvmsg().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <[email-masked]>
Reviewed-by: Neal Cardwell <[email-masked]>
Reviewed-by: Kuniyuki Iwashima <[email-masked]>
Reviewed-by: Jason Xing <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/ipv4/tcp.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 40a2f172be2cb..7d824578f217a 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2786,8 +2786,8 @@ bool tcp_check_oom(struct sock *sk, int shift)
 
 void __tcp_close(struct sock *sk, long timeout)
 {
+	bool data_was_unread = false;
 	struct sk_buff *skb;
-	int data_was_unread = 0;
 	int state;
 
 	WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
@@ -2806,11 +2806,12 @@ void __tcp_close(struct sock *sk, long timeout)
 	 *  reader process may not have drained the data yet!
 	 */
 	while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-		u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;
+		u32 end_seq = TCP_SKB_CB(skb)->end_seq;
 
 		if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
-			len--;
-		data_was_unread += len;
+			end_seq--;
+		if (after(end_seq, tcp_sk(sk)->copied_seq))
+			data_was_unread = true;
 		__kfree_skb(skb);
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:21:33 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367673; cv=none; b=BiJY93puwmewnHQ24lFNErKZrNRnMcJshvBwkUk4T99y+La9lIMIK0qcKKhCA/G1d1ikylXBhoF6x7CmDRi+4h836YcF8v8raO/+yfajH4/6qtXB1LY4f9KY+1E1cKlKr+rnlpXLvFvwGr6Yn95z80OqxHlGkw5dws9RotT52XE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367673; c=relaxed/simple;
	bh=cvpK/uj17mORDCONLNTQ/hXzOjbVQIpePGs/CMI5ThQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=caMWY34pTY34c/LlPMuijNRYJ35cX+OxzuxsNSeXEGZCk1KHffH1SY/IDGFngql/NqpUYdNBzwMyHxgbxXv2I23hPwRWLIo/AKdzOxtZ4mZbeIUwg1JDjAf/72rurAmxPRMwHdwtUhIAG5WFxFdp/nolTj9dMfKiLaL958U9rkM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=w/a0CaAC; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alok Tiwari <[email-masked]>,
	Manivannan Sadhasivam <[email-masked]>,
	Bjorn Helgaas <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 093/196] PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
Date: Mon, 13 Oct 2025 16:44:44 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alok Tiwari <[email-masked]>

[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]

Fix incorrect argument order in devm_kcalloc() when allocating port->phys.
The original call used sizeof(phy) as the number of elements and
port->lanes as the element size, which is reversed.  While this happens to
produce the correct total allocation size with current pointer size and
lane counts, the argument order is wrong.

Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs")
Signed-off-by: Alok Tiwari <[email-masked]>
[mani: added Fixes tag]
Signed-off-by: Manivannan Sadhasivam <[email-masked]>
Signed-off-by: Bjorn Helgaas <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pci/controller/pci-tegra.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
index 038d974a318ea..80d975dcb2ee2 100644
--- a/drivers/pci/controller/pci-tegra.c
+++ b/drivers/pci/controller/pci-tegra.c
@@ -1343,7 +1343,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)
 	unsigned int i;
 	int err;
 
-	port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL);
+	port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL);
 	if (!port->phys)
 		return -ENOMEM;
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:21:44 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367670; cv=none; b=tUsfbxD3d7DvS8FUxiYmgn8/Bw38SiT2zJ5Tr+yJFdQTmlDv/Qhpbq0O5mppeKHHMJwIjCgNaZAOMzHXYsRBGyokTNHGxiFzrrW9NiOICwNnXYil2i07DBCV9z1pXb/eHrTD2C+0d8Jd9m2fipU9IQ2x0s41dcmbQxGho7aCtac=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367670; c=relaxed/simple;
	bh=Fn2dWrSR+WpwQ8lL7XtJCapCss+ym1mFWXIdpOjG/iA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ukdzC6f4j8Kvz+bm89DG15IcNmwign3X0BWu9d+Cx0VR+TJkMv/+meXME2yneLsSIoB1G9wYo/ThWo+Y9K1vgGuLBXIg1F710W4FbCaKCDW/aovIfEsZ5rFFup5wexZjjuZgEohy2h87tFguJP0IGBQTn0U+V4Gq0HdF6CVNPUM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=g6lww2gi; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Stefan Kerkmann <[email-masked]>,
	Jeff Chen <[email-masked]>,
	Johannes Berg <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 092/196] wifi: mwifiex: send world regulatory domain to driver
Date: Mon, 13 Oct 2025 16:44:43 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Kerkmann <[email-masked]>

[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]

The world regulatory domain is a restrictive subset of channel
configurations which allows legal operation of the adapter all over the
world. Changing to this domain should not be prevented.

Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed
Signed-off-by: Stefan Kerkmann <[email-masked]>
Reviewed-by: Jeff Chen <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Johannes Berg <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 69eea0628e670..df6e4a112ec48 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -659,10 +659,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
 		return;
 	}
 
-	/* Don't send world or same regdom info to firmware */
-	if (strncmp(request->alpha2, "00", 2) &&
-	    strncmp(request->alpha2, adapter->country_code,
-		    sizeof(request->alpha2))) {
+	/* Don't send same regdom info to firmware */
+	if (strncmp(request->alpha2, adapter->country_code,
+		    sizeof(request->alpha2)) != 0) {
 		memcpy(adapter->country_code, request->alpha2,
 		       sizeof(request->alpha2));
 		mwifiex_send_domain_info_cmd_fw(wiphy);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:24:58 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367667; cv=none; b=jMZs7qw6eTX/4AahwMz0k4ln3ZDbeNkNr8kxgcDVzSNbGrwyZxJpLECQbp7t+y6BUnKi+pfNLNt+xeFnUPxqkeq+n+HYrNzkDni26YJP/KTlNfUKvuaWyJhY0AV1FcGyH4lPDM0x+wb9rSF3IJqdZQe2wdJ/a8Bqv58Rr65RNPs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367667; c=relaxed/simple;
	bh=T1dmxHOg95FUBKBKqceQw97ZfLpnmAgLYfwX+csh814=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=EBtNY3RuvSeprITtlwqj1lFLsevsUtDSG5U8039ees5LjjkCWU4tQ0BxJMh1hFfuHiNvhmgfZ9C/iRY4uvkBBqJ5QMj4Q63duNzkPfXc4RAmKXCJaDeKjzl0GjVOx5ZRa+MPZinu2tXoIax6+AaCNh2qD7/xeL5Q5n9xxXJHRig=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=AK78pB+1; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 091/196] drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
Date: Mon, 13 Oct 2025 16:44:42 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ]

Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk
switching on Oland when two 4K 60Hz monitors are connected")

This is an ad-hoc DPM fix, necessary because we don't have
proper bandwidth calculation for DCE 6.

We define "high pixelclock" for SI as higher than necessary
for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into
this category.

When two high pixel clock displays are connected to Oland,
additionally disable shader clock switching, which results in
a higher voltage, thereby addressing some visible flickering.

v2:
Add more comments.
v3:
Split into two commits for easier review.

Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index 075d183bb1bb9..2863dc65ffc6f 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -3430,12 +3430,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
 {
 	struct  si_ps *ps = si_get_ps(rps);
 	struct amdgpu_clock_and_voltage_limits *max_limits;
+	struct amdgpu_connector *conn;
 	bool disable_mclk_switching = false;
 	bool disable_sclk_switching = false;
 	u32 mclk, sclk;
 	u16 vddc, vddci, min_vce_voltage = 0;
 	u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
 	u32 max_sclk = 0, max_mclk = 0;
+	u32 high_pixelclock_count = 0;
 	int i;
 
 	if (adev->asic_type == CHIP_HAINAN) {
@@ -3463,6 +3465,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
 		}
 	}
 
+	/* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz.
+	 * For example, 4K 60Hz and 1080p 144Hz fall into this category.
+	 * Find number of such displays connected.
+	 */
+	for (i = 0; i < adev->mode_info.num_crtc; i++) {
+		if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) ||
+			!adev->mode_info.crtcs[i]->enabled)
+			continue;
+
+		conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector);
+
+		if (conn->pixelclock_for_modeset > 297000)
+			high_pixelclock_count++;
+	}
+
+	/* These are some ad-hoc fixes to some issues observed with SI GPUs.
+	 * They are necessary because we don't have something like dce_calcs
+	 * for these GPUs to calculate bandwidth requirements.
+	 */
+	if (high_pixelclock_count) {
+		/* On Oland, we observe some flickering when two 4K 60Hz
+		 * displays are connected, possibly because voltage is too low.
+		 * Raise the voltage by requiring a higher SCLK.
+		 * (Voltage cannot be adjusted independently without also SCLK.)
+		 */
+		if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND)
+			disable_sclk_switching = true;
+	}
+
 	if (rps->vce_active) {
 		rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk;
 		rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:21:24 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367664; cv=none; b=X2RtJKouUJC8CDXdrhY7dt6+9M8ZdTcGXN0EjOnvPhKU3Tgsyf9lrxlxsTVsdfdOLI+OhKq7UF+pAaiTbxOXFhYBbDmkEpSwsaYgXN6LP6YiMDna3iXabqfkNSlYJ3tNszCgnPza4+wIQKZkC9JbtVyXnJLP9NSXNTQprxQ0Q+E=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367664; c=relaxed/simple;
	bh=FYyvo67Ar1WnHAt/xYmrhfbi6s6ZMFRpOIGszqNvdX0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=HCg2civaShJHGYJUMP1+sdCQe8RZsDsH26jMZr59yMtYdu41nAvGYqta0KfclM2aMf/E7AuIwRpcMyUTfJlkkDYFVmcDKGaK9VZD2UCeu7u1OowxhkXQhBzVDe+6nuD48zWC/U4DqyyfJtm+PGjyW6sRDTuLLP6/vHnQkw0ce5A=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=UoLUC/Le; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 090/196] drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
Date: Mon, 13 Oct 2025 16:44:41 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 ]

According to pp_pm_compute_clocks the non-DC display code
has "issues with mclk switching with refresh rates over 120 hz".
The workaround is to disable MCLK switching in this case.

Do the same for legacy DPM.

Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
index 42efe838fa85c..2d2d2d5e67634 100644
--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev)
 					(amdgpu_crtc->v_border * 2));
 
 				vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock;
+
+				/* we have issues with mclk switching with
+				 * refresh rates over 120 hz on the non-DC code.
+				 */
+				if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120)
+					vblank_time_us = 0;
+
 				break;
 			}
 		}
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:32:17 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367661; cv=none; b=dUbz5bTma/jkojSnghON+fJ5XzEQY1dltSzIo9MEnUODmGWzyd0lRwGHYIX7gPZ+jaIdjGRXPFQfkv8ozMx2PyTaSJLr2WAh0A6YvQor+PfXemrVhdQyusmoXBRmM8+HKyjUu/UMBWfuVC80z7NmWJhrqw+lqqn4XF8WOhO5nQ0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367661; c=relaxed/simple;
	bh=hlhFP6MtNaPxb2rz1OzGYzopiK09Ehz2ZtphqMrVjNY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=fS8WZ5OeFiHvJzVBsHRyny5ASET3kGyAL6WktBDjY3UwNeAk9sJncQh9FKUkAPQmZql/tx2n0DgNXs58k++s/mKUk99IbZCkOLYeiJMFOSYVcuneJ5Okh8eNJeEhcTOIexkwOAblOghBG7ubaAbXJt6Zat0bfTGqEAYiGQPqQek=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=cP+XRhy0; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 089/196] drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
Date: Mon, 13 Oct 2025 16:44:40 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ]

Some parts of the code base expect that MCLK switching is turned
off when the vblank time is set to zero.

According to pp_pm_compute_clocks the non-DC code has issues
with MCLK switching with refresh rates over 120 Hz.

v3:
Add code comment to explain this better.
Add an if statement instead of changing the switch_limit.

Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index 3ce9396900f7f..075d183bb1bb9 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -3066,7 +3066,13 @@ static bool si_dpm_vblank_too_short(void *handle)
 	/* we never hit the non-gddr5 limit so disable it */
 	u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0;
 
-	if (vblank_time < switch_limit)
+	/* Consider zero vblank time too short and disable MCLK switching.
+	 * Note that the vblank time is set to maximum when no displays are attached,
+	 * so we'll still enable MCLK switching in that case.
+	 */
+	if (vblank_time == 0)
+		return true;
+	else if (vblank_time < switch_limit)
 		return true;
 	else
 		return false;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:21:21 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367658; cv=none; b=uG3j4Fffb5SjwRz+1NcuLtowXMfDla7wSyhLZIFEdxkqC8hwyY3dwPMaIn9lqfc1jXxF8Voz2pSy5Y3NE4+jnaMdcqbq32drVdNP6jMhT+Dgkz67GxXu1osrCM9RX9CiCT+P+RtALsDgkJqLI8AeyhtdTLbrzotQlLuOXZX/lqo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367658; c=relaxed/simple;
	bh=P76veXCjA5vhRYQlVXgc9YkkDypr16xJ4sYXfXvzEDg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=tIp61DUBs8yTta+13NcbpdbdnO3JqY10oNwQ4/zbpjcrLwaEzq3VCwKRI28Z4l+6c9w1DGvRBSVuffE1rH/geSxraQN5ZRCq/6q3Vm37bK1gaTNa8HsLvxhYjxnVS2zu9+j6WXlSbBRHJ5J24x+23ltTVLE3hSvIIMGCjcKdUDM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FmdKQq5M; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 088/196] drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
Date: Mon, 13 Oct 2025 16:44:39 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ]

Based on some comments in dm_pp_display_configuration
above the crtc_index and line_time fields, these values
are programmed to the SMC to work around an SMC hang
when it switches MCLK.

According to Alex, the Windows driver programs them to:
mclk_change_block_cp_min = 200 / line_time
mclk_change_block_cp_max = 100 / line_time
Let's use the same for the sake of consistency.

Previously we used the watermark values, but it seemed buggy
as the code was mixing up low/high and A/B watermarks, and
was not saving a low watermark value on DCE 6, so
mclk_change_block_cp_max would be always zero previously.

Split this change off from the previous si_upload_smc_data
to make it easier to bisect, in case it causes any issues.

Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index cff55daa68ab8..3ce9396900f7f 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -5813,8 +5813,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
 		crtc_index = amdgpu_crtc->crtc_id;
 
 		if (amdgpu_crtc->line_time) {
-			mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
-			mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
+			mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time;
+			mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time;
 		}
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:21:28 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367656; cv=none; b=a8tuCPqHj7mU/WELARIPuYxULbxaWsz2JwETj++amHk86ZUKpXPRWBV9d12qUzq02QFNfMcpOidSrUwBbc4ldC/oaknbRDEgD6YtkkVcrzoMBVXgibb40D6DD5MWRLKOEkW7c8YW50hkGMSft2CGr7JSqsYUbxNw6R0fy3ca4PA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367656; c=relaxed/simple;
	bh=2zdPcHyXhk82sqS868T1RIMXa4wEy1B87LTLCxqyqe4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=e6lEwSTxYJocRtSpYLJsmMf+ePWczT8UUWnSb08NhleLe4xWS5Vxpid26DTUSMGtQijrvDCtc4r+Ahao6z73sRf5wQLxQDifiiVEMD0LojZA4rbafnl8BQNAchTdbgUA3nE011Wb8cDHp4nYKj7HmsQGFGL08Q8At58iyxVY9WY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=d/gzGl+D; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 087/196] drm/amd/pm: Fix si_upload_smc_data (v3)
Date: Mon, 13 Oct 2025 16:44:38 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 ]

The si_upload_smc_data function uses si_write_smc_soft_register
to set some register values in the SMC, and expects the result
to be PPSMC_Result_OK which is 1.

The PPSMC_Result_OK / PPSMC_Result_Failed values are used for
checking the result of a command sent to the SMC.
However, the si_write_smc_soft_register actually doesn't send
any commands to the SMC and returns zero on success,
so this check was incorrect.

Fix that by not checking the return value, just like other
calls to si_write_smc_soft_register.

v3:
Additionally, when no display is plugged in, there is no need
to restrict MCLK switching, so program the registers to zero.

Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 43 ++++++++++++----------
 1 file changed, 24 insertions(+), 19 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index 8be367c49367d..cff55daa68ab8 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -5793,9 +5793,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
 {
 	struct amdgpu_crtc *amdgpu_crtc = NULL;
 	int i;
-
-	if (adev->pm.dpm.new_active_crtc_count == 0)
-		return 0;
+	u32 crtc_index = 0;
+	u32 mclk_change_block_cp_min = 0;
+	u32 mclk_change_block_cp_max = 0;
 
 	for (i = 0; i < adev->mode_info.num_crtc; i++) {
 		if (adev->pm.dpm.new_active_crtcs & (1 << i)) {
@@ -5804,26 +5804,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
 		}
 	}
 
-	if (amdgpu_crtc == NULL)
-		return 0;
+	/* When a display is plugged in, program these so that the SMC
+	 * performs MCLK switching when it doesn't cause flickering.
+	 * When no display is plugged in, there is no need to restrict
+	 * MCLK switching, so program them to zero.
+	 */
+	if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) {
+		crtc_index = amdgpu_crtc->crtc_id;
 
-	if (amdgpu_crtc->line_time <= 0)
-		return 0;
+		if (amdgpu_crtc->line_time) {
+			mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
+			mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
+		}
+	}
 
-	if (si_write_smc_soft_register(adev,
-				       SI_SMC_SOFT_REGISTER_crtc_index,
-				       amdgpu_crtc->crtc_id) != PPSMC_Result_OK)
-		return 0;
+	si_write_smc_soft_register(adev,
+		SI_SMC_SOFT_REGISTER_crtc_index,
+		crtc_index);
 
-	if (si_write_smc_soft_register(adev,
-				       SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
-				       amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK)
-		return 0;
+	si_write_smc_soft_register(adev,
+		SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
+		mclk_change_block_cp_min);
 
-	if (si_write_smc_soft_register(adev,
-				       SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
-				       amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK)
-		return 0;
+	si_write_smc_soft_register(adev,
+		SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
+		mclk_change_block_cp_max);
 
 	return 0;
 }
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:41:58 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367653; cv=none; b=S/DukINYsLsxzdwZUR30Or+XRc21ZxVAu3iKSJGhWMMvkFBjKro0dtskOuk+zn0rCZjsaMRjtdm5WxWoOoVQ5IFb4X2Ryo5itYHwwQ4CJN/f+Jli+MRTzrDnd6rHYO/7h/fhvKu978ylrrT0UGEzGskhcmj2NipNgohdlmwbfRc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367653; c=relaxed/simple;
	bh=4+TD6mfvXTXFjGwlcwpGuouiDIxcp8w5QgjDdK+PyOY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=oKNNcLIDp2ZsT1qDhNjDmY2cFb9/i0TDNUWnAY+nYbaqa1b+S8dTT0ibFE/MsXnRJsGDPAEcGanman7DvaWz8zIc805tdpG6UNG+byJ9Kr+AYkCToHRst4U4H9Cr2dPXufmC1Ma25bZ/vff7cUtRmIMRaOLrgaMEhIj1IKIJPYQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ZytXOv1n; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 086/196] drm/amd/pm: Disable ULV even if unsupported (v3)
Date: Mon, 13 Oct 2025 16:44:37 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c ]

Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode
is unsupported, to make sure it is properly turned off.

v3:
Simplify si_disable_ulv further.
Always check the return value of amdgpu_si_send_msg_to_smc.

Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index e7b1fa2feb928..8be367c49367d 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -5617,14 +5617,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev,
 
 static int si_disable_ulv(struct amdgpu_device *adev)
 {
-	struct si_power_info *si_pi = si_get_pi(adev);
-	struct si_ulv_param *ulv = &si_pi->ulv;
+	PPSMC_Result r;
 
-	if (ulv->supported)
-		return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ?
-			0 : -EINVAL;
-
-	return 0;
+	r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV);
+	return (r == PPSMC_Result_OK) ? 0 : -EINVAL;
 }
 
 static bool si_is_state_ulv_compatible(struct amdgpu_device *adev,
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:21:16 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367650; cv=none; b=pAxjtTvnWcOizvR0MPHooUQt/wkzvyGdanqbuB+ftHqSa1tJQ5X5OSXR2AGhSnCHHTj2ld8QwzwYfVDVvBrOP1N1EMCobIg0KQTJ1w28TVF4ehVvNdGnYe3Kbce7jvtgiu+91P1/Z2m2dJUylsFjyyAl0XYKhev4eo3ex/U34q8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367650; c=relaxed/simple;
	bh=ijKNbPL20XxfzBjP5Bc37Fy3sBPu5ZsKn1g0SbUVhAM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=WxaG0Sm61yXYi2RGpMVaktMguyg9O5tpWLTFvO2saJOWD+YEKYTR+PZuARXCyo/Am3jUwwIudAtLV8m3krBygI9J5oFxFLzYLHaOUlenrSc5AKlUBYuOccVOoO0Yw1r6NRzxW0IyucyvyFZy+DtpQh/yxMnEh9N4lLLsEX2y4yU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WIxz/6Wz; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 085/196] drm/amdgpu: Power up UVD 3 for FW validation (v2)
Date: Mon, 13 Oct 2025 16:44:36 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ]

Unlike later versions, UVD 3 has firmware validation.
For this to work, the UVD should be powered up correctly.

When DPM is enabled and the display clock is off,
the SMU may choose a power state which doesn't power
the UVD, which can result in failure to initialize UVD.

v2:
Add code comments to explain about the UVD power state
and how UVD clock is turned on/off.

Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
index 5534c769b6550..1e0189f90fd6a 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
@@ -625,7 +625,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev,
  *
  * @handle: handle used to pass amdgpu_device pointer
  *
- * Initialize the hardware, boot up the VCPU and do some testing
+ * Initialize the hardware, boot up the VCPU and do some testing.
+ *
+ * On SI, the UVD is meant to be used in a specific power state,
+ * or alternatively the driver can manually enable its clock.
+ * In amdgpu we use the dedicated UVD power state when DPM is enabled.
+ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state
+ * for the SMU and afterwards enables the UVD clock.
+ * This is automatically done by amdgpu_uvd_ring_begin_use when work
+ * is submitted to the UVD ring. Here, we have to call it manually
+ * in order to power up UVD before firmware validation.
+ *
+ * Note that we must not disable the UVD clock here, as that would
+ * cause the ring test to fail. However, UVD is powered off
+ * automatically after the ring test: amdgpu_uvd_ring_end_use calls
+ * the UVD idle work handler which will disable the UVD clock when
+ * all fences are signalled.
  */
 static int uvd_v3_1_hw_init(void *handle)
 {
@@ -635,6 +650,15 @@ static int uvd_v3_1_hw_init(void *handle)
 	int r;
 
 	uvd_v3_1_mc_resume(adev);
+	uvd_v3_1_enable_mgcg(adev, true);
+
+	/* Make sure UVD is powered during FW validation.
+	 * It's going to be automatically powered off after the ring test.
+	 */
+	if (adev->pm.dpm_enabled)
+		amdgpu_dpm_enable_uvd(adev, true);
+	else
+		amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
 
 	r = uvd_v3_1_fw_validate(adev);
 	if (r) {
@@ -642,9 +666,6 @@ static int uvd_v3_1_hw_init(void *handle)
 		return r;
 	}
 
-	uvd_v3_1_enable_mgcg(adev, true);
-	amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
-
 	uvd_v3_1_start(adev);
 
 	r = amdgpu_ring_test_helper(ring);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:26:21 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367647; cv=none; b=V2rSC4Wmw2lJ9xbfL3NSC6/RTtNr4mylEm9g2w5eLq8FBmNoaotV/20kO+g2dbFaoSc+/5NLh0Ue8yYxvP6d3S2odkV9ZBqO5ykwcFmVVAo1vDGdGyBJOSke8S7Q/kSrkqdu3S6W2iHPbRE9q8Fm6zEmvC7ifG7OOj6Bsrt60ks=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367647; c=relaxed/simple;
	bh=Ejs6OJfUJ5Lmv/NgJxD2LZ0IxwJPlY2ZV7weqN1p9qg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=NYhxT1c9wCrjf018NrB2/KPnQbktF5ZuJIFBKX7uAXIL6gKIW/gvd05yLrpkJN18Qv+FSZgxesXvzBvy+K/o1GiYe8tHh2bBRcm3RkLxIU5EBF48WRBk2nivtGmhOM/U9TBrFTEdBYzC2MoMXjFnPqjvNMxLUZSCteoh35RTXpg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=li1bIZCe; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yuanfang Zhang <[email-masked]>,
	Suzuki K Poulose <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 084/196] coresight: Only register perf symlink for sinks with alloc_buffer
Date: Mon, 13 Oct 2025 16:44:35 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yuanfang Zhang <[email-masked]>

[ Upstream commit 12d9a9dd9d8a4f1968073e7f34515896d1e22b78 ]

Ensure that etm_perf_add_symlink_sink() is only called for devices
that implement the alloc_buffer operation. This prevents invalid
symlink creation for dummy sinks that do not implement alloc_buffer.

Without this check, perf may attempt to use a dummy sink that lacks
alloc_buffer operationsu to initialise perf's ring buffer, leading
to runtime failures.

Fixes: 9d3ba0b6c0569 ("Coresight: Add coresight dummy driver")
Signed-off-by: Yuanfang Zhang <[email-masked]>
Signed-off-by: Suzuki K Poulose <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-core.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
index 3b57851869eaa..a836952737209 100644
--- a/drivers/hwtracing/coresight/coresight-core.c
+++ b/drivers/hwtracing/coresight/coresight-core.c
@@ -1638,8 +1638,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc)
 		goto out_unlock;
 	}
 
-	if (csdev->type == CORESIGHT_DEV_TYPE_SINK ||
-	    csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) {
+	if ((csdev->type == CORESIGHT_DEV_TYPE_SINK ||
+	     csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) &&
+	    sink_ops(csdev)->alloc_buffer) {
 		ret = etm_perf_add_symlink_sink(csdev);
 
 		if (ret) {
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:21:17 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367641; cv=none; b=QaH7iaiHSWHAmGxM2YzI4GHSH1kgB5qoGCSZ7nW+GRr1bHJM/Wuwa00CKAYA8pmcRl8Y5HbByR4+FTFR91HmtmztqDp4k7rE9eO1R1+yONKVpRJlI1BVQCF41MEr7pR1v4Un9q6/vicWQmPtcGjtrflA9xWN0ZV6+r1MHeuAsT8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367641; c=relaxed/simple;
	bh=gtiMrOkwy3zUD8YgXNoRYB2NHRFc8NgIr3auGSCrxzE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ALkkdyuciSjcqekTKO9PWt637+uIysP69c2JkFEF3+pQ3ny+x6kMT718N61QVCjSC26BdmLeHQzhj4OjWX5SGJqz7DC/jDbuijzc8PIhWHaQwl5jLtDkMFNB8dqxrebC9yWSqyzkYpUY/f+2BLqz2vn24Je09kMORyKa+430hyU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=d5lN6Fwh; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Eric Dumazet <[email-masked]>,
	David Ahern <[email-masked]>,
	Yue Haibing <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 083/196] inet: ping: check sock_net() in ping_get_port() and ping_lookup()
Date: Mon, 13 Oct 2025 16:44:34 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email-masked]>

[ Upstream commit 59f26d86b2a16f1406f3b42025062b6d1fba5dd5 ]

We need to check socket netns before considering them in ping_get_port().
Otherwise, one malicious netns could 'consume' all ports.

Add corresponding check in ping_lookup().

Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
Signed-off-by: Eric Dumazet <[email-masked]>
Reviewed-by: David Ahern <[email-masked]>
Reviewed-by: Yue Haibing <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/ipv4/ping.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 4cb0c896caf97..5c848136bc266 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table,
 
 int ping_get_port(struct sock *sk, unsigned short ident)
 {
+	struct net *net = sock_net(sk);
 	struct inet_sock *isk, *isk2;
 	struct hlist_head *hlist;
 	struct sock *sk2 = NULL;
@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
 		for (i = 0; i < (1L << 16); i++, result++) {
 			if (!result)
 				result++; /* avoid zero */
-			hlist = ping_hashslot(&ping_table, sock_net(sk),
-					    result);
+			hlist = ping_hashslot(&ping_table, net, result);
 			sk_for_each(sk2, hlist) {
+				if (!net_eq(sock_net(sk2), net))
+					continue;
 				isk2 = inet_sk(sk2);
 
 				if (isk2->inet_num == result)
@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
 		if (i >= (1L << 16))
 			goto fail;
 	} else {
-		hlist = ping_hashslot(&ping_table, sock_net(sk), ident);
+		hlist = ping_hashslot(&ping_table, net, ident);
 		sk_for_each(sk2, hlist) {
+			if (!net_eq(sock_net(sk2), net))
+				continue;
 			isk2 = inet_sk(sk2);
 
 			/* BUG? Why is this reuse and not reuseaddr? ping.c
@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident)
 		pr_debug("was not hashed\n");
 		sk_add_node_rcu(sk, hlist);
 		sock_set_flag(sk, SOCK_RCU_FREE);
-		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+		sock_prot_inuse_add(net, sk->sk_prot, 1);
 	}
 	spin_unlock(&ping_table.lock);
 	return 0;
@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
 	}
 
 	sk_for_each_rcu(sk, hslot) {
+		if (!net_eq(sock_net(sk), net))
+			continue;
 		isk = inet_sk(sk);
 
 		pr_debug("iterate\n");
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:21:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367638; cv=none; b=qlDa7LZj8PCR53R5wxF/w1rX4OQy9suse776xaTLWnbsmN1S/mW3lCWPk3KmVbJB2xpGxReKsgrfcry2oqzeVeXuGZFrmdE8lHtjFNhmOB7Bb4kgSuP8qMuJPLS2968bRpTONTorso+Q/Lx/T9ldb/3yQaKFc5X4gFBKhzb9DKA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367638; c=relaxed/simple;
	bh=y2RCJGMr6nQw0rZYXAt7Jt6CdsclQluBxMiHTun9TnY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=oyt+td3+QOFTiwApZ7tDeZ8nkWbqn34P8bi32JAbEaWzJq70hy9cW5BtY6Z8Ewl4RYVB1bdinFpTcdyJRwbru2QobgnPCttl6xPXnL5j1UeTia1R7tjavqkZXRaORl0OJ2WFTxahXoJReMeePC9UYoaPdCtNrFtL2mZ/Fdaco1Y=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2MUybptm; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhushuai Yin <[email-masked]>,
	Chenghai Huang <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 082/196] crypto: hisilicon/qm - check whether the input function and PF are on the same device
Date: Mon, 13 Oct 2025 16:44:33 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhushuai Yin <[email-masked]>

[ Upstream commit 6a2c9164b52e6bc134127fd543461fdef95cc8ec ]

Function rate limiting is set through physical function driver.
Users configure by providing function information and rate limit values.
Before configuration, it is necessary to check whether the
provided function and PF belong to the same device.

Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check")
Signed-off-by: Zhushuai Yin <[email-masked]>
Signed-off-by: Chenghai Huang <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/crypto/hisilicon/qm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
index 183885619eb8b..203240e78f6ad 100644
--- a/drivers/crypto/hisilicon/qm.c
+++ b/drivers/crypto/hisilicon/qm.c
@@ -3748,6 +3748,10 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf,
 	}
 
 	pdev = container_of(dev, struct pci_dev, dev);
+	if (pci_physfn(pdev) != qm->pdev) {
+		pci_err(qm->pdev, "the pdev input does not match the pf!\n");
+		return -EINVAL;
+	}
 
 	*fun_index = pdev->devfn;
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:21:03 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367636; cv=none; b=dK81++/Oji8Pdwf2W1/8iU1iImLUTTlX7X2+PQ+sSwLAcnGrIzNadFeYGJXSN/uypefIm0Ml9R0HDf+A9OGhmcFy/OVHSR5xEZuimzvIacekQJL3e03/fWO0RdPVUMRviErOPwI6AWC1T/vRu7LNgdplPd5xLs7m8DGK65FYyTs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367636; c=relaxed/simple;
	bh=we3SVKs0k+edK3JWQ4+4fknKuiZNleTxoALk8wQXEfw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=JHj+IMWTlFJU0uCaGN10HBtQ95ZJJnbNCSeybFGepGGZGQAlECGTTm4+oBNDQKdXSv9MiCSg7KO4YT8iHGlYA73MDtcYdZs+K4vpV6aXXDzua5AEEChbVzVuMKFEp/lh34gvwaCAA2zhxsp80BuK6Mvhr6tXLJMVbZf6S+QjYcQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=NToomgBB; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chenghai Huang <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 081/196] crypto: hisilicon - re-enable address prefetch after device resuming
Date: Mon, 13 Oct 2025 16:44:32 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chenghai Huang <[email-masked]>

[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ]

When the device resumes from a suspended state, it will revert to its
initial state and requires re-enabling. Currently, the address prefetch
function is not re-enabled after device resuming. Move the address prefetch
enable to the initialization process. In this way, the address prefetch
can be enabled when the device resumes by calling the initialization
process.

Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device")
Signed-off-by: Chenghai Huang <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/crypto/hisilicon/hpre/hpre_main.c |  3 +-
 drivers/crypto/hisilicon/qm.c             |  3 -
 drivers/crypto/hisilicon/sec2/sec_main.c  | 80 +++++++++++------------
 drivers/crypto/hisilicon/zip/zip_main.c   |  5 +-
 4 files changed, 43 insertions(+), 48 deletions(-)

diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
index 762a2a54ca821..e3d113334d4e4 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
@@ -689,6 +689,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)
 
 	/* Config data buffer pasid needed by Kunpeng 920 */
 	hpre_config_pasid(qm);
+	hpre_open_sva_prefetch(qm);
 
 	hpre_enable_clock_gate(qm);
 
@@ -1366,8 +1367,6 @@ static int hpre_pf_probe_init(struct hpre *hpre)
 	if (ret)
 		return ret;
 
-	hpre_open_sva_prefetch(qm);
-
 	hisi_qm_dev_err_init(qm);
 	ret = hpre_show_last_regs_init(qm);
 	if (ret)
diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
index 7921409791fb0..183885619eb8b 100644
--- a/drivers/crypto/hisilicon/qm.c
+++ b/drivers/crypto/hisilicon/qm.c
@@ -4363,9 +4363,6 @@ static void qm_restart_prepare(struct hisi_qm *qm)
 {
 	u32 value;
 
-	if (qm->err_ini->open_sva_prefetch)
-		qm->err_ini->open_sva_prefetch(qm);
-
 	if (qm->ver >= QM_HW_V3)
 		return;
 
diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
index 6aaaaf784ddc0..064fbc8db16fc 100644
--- a/drivers/crypto/hisilicon/sec2/sec_main.c
+++ b/drivers/crypto/hisilicon/sec2/sec_main.c
@@ -436,6 +436,45 @@ static void sec_set_endian(struct hisi_qm *qm)
 	writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
 }
 
+static void sec_close_sva_prefetch(struct hisi_qm *qm)
+{
+	u32 val;
+	int ret;
+
+	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+		return;
+
+	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+	val |= SEC_PREFETCH_DISABLE;
+	writel(val, qm->io_base + SEC_PREFETCH_CFG);
+
+	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
+					 val, !(val & SEC_SVA_DISABLE_READY),
+					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+	if (ret)
+		pci_err(qm->pdev, "failed to close sva prefetch\n");
+}
+
+static void sec_open_sva_prefetch(struct hisi_qm *qm)
+{
+	u32 val;
+	int ret;
+
+	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+		return;
+
+	/* Enable prefetch */
+	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+	val &= SEC_PREFETCH_ENABLE;
+	writel(val, qm->io_base + SEC_PREFETCH_CFG);
+
+	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
+					 val, !(val & SEC_PREFETCH_DISABLE),
+					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+	if (ret)
+		pci_err(qm->pdev, "failed to open sva prefetch\n");
+}
+
 static void sec_engine_sva_config(struct hisi_qm *qm)
 {
 	u32 reg;
@@ -469,45 +508,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm)
 		writel_relaxed(reg, qm->io_base +
 				SEC_INTERFACE_USER_CTRL1_REG);
 	}
-}
-
-static void sec_open_sva_prefetch(struct hisi_qm *qm)
-{
-	u32 val;
-	int ret;
-
-	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
-		return;
-
-	/* Enable prefetch */
-	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
-	val &= SEC_PREFETCH_ENABLE;
-	writel(val, qm->io_base + SEC_PREFETCH_CFG);
-
-	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
-					 val, !(val & SEC_PREFETCH_DISABLE),
-					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
-	if (ret)
-		pci_err(qm->pdev, "failed to open sva prefetch\n");
-}
-
-static void sec_close_sva_prefetch(struct hisi_qm *qm)
-{
-	u32 val;
-	int ret;
-
-	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
-		return;
-
-	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
-	val |= SEC_PREFETCH_DISABLE;
-	writel(val, qm->io_base + SEC_PREFETCH_CFG);
-
-	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
-					 val, !(val & SEC_SVA_DISABLE_READY),
-					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
-	if (ret)
-		pci_err(qm->pdev, "failed to close sva prefetch\n");
+	sec_open_sva_prefetch(qm);
 }
 
 static void sec_enable_clock_gate(struct hisi_qm *qm)
@@ -1090,7 +1091,6 @@ static int sec_pf_probe_init(struct sec_dev *sec)
 	if (ret)
 		return ret;
 
-	sec_open_sva_prefetch(qm);
 	hisi_qm_dev_err_init(qm);
 	sec_debug_regs_clear(qm);
 	ret = sec_show_last_regs_init(qm);
diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
index 6e419c5165cb4..b70aa6032874e 100644
--- a/drivers/crypto/hisilicon/zip/zip_main.c
+++ b/drivers/crypto/hisilicon/zip/zip_main.c
@@ -577,6 +577,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
 		writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63);
 		writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63);
 	}
+	hisi_zip_open_sva_prefetch(qm);
 
 	/* let's open all compression/decompression cores */
 	dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val;
@@ -588,6 +589,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
 	       CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) |
 	       FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL);
 
+	hisi_zip_set_high_perf(qm);
 	hisi_zip_enable_clock_gate(qm);
 
 	return 0;
@@ -1172,9 +1174,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
 	if (ret)
 		return ret;
 
-	hisi_zip_set_high_perf(qm);
-
-	hisi_zip_open_sva_prefetch(qm);
 	hisi_qm_dev_err_init(qm);
 	hisi_zip_debug_regs_clear(qm);
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:38:33 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367633; cv=none; b=aZ7rY2/dgb1nGH1Rj73/uCREhvSqhaE9WhEw6hrUbhWaobd82dP+pMhMzqTeCdPuNMPkBiN00vLqUs9Cy5hg8x2aZFGIU7QCO953DRu7/440ypQ+vfVBNf3ZoWW13owf/rYutOpI/b3yvRm5BKwmyJ9kcirJ6u8UA2f+u8rrrNc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367633; c=relaxed/simple;
	bh=QHw4dncETxSk9SU8m2ykMOAuwpcnd7U4iGlTygG61ZI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=aOOj7rK/j8o1fiQgMsCi9hIZeX2PKkGeF6DcmrVMGYoC94NmR2s9T7scyFlAWv+2lKD48zmR7OzFqt83wW0uH1saMbG/819sAE3ofiHlklL+ZdtQ/4BFXK32bbeuNFyQpBjXevIXxVnBkdFW/dv/QmmbY5fkpSgb26dAoweJFU8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=pLraV/Wd; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chenghai Huang <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 080/196] crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations
Date: Mon, 13 Oct 2025 16:44:31 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chenghai Huang <[email-masked]>

[ Upstream commit d4e081510471e79171c4e0a11f6cb608e49bc082 ]

When configuring the high-performance mode register, there is no
need to verify whether the register has been successfully
enabled, as there is no possibility of a write failure for this
register.

Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration")
Signed-off-by: Chenghai Huang <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/crypto/hisilicon/zip/zip_main.c | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
index 66e553115adfd..6e419c5165cb4 100644
--- a/drivers/crypto/hisilicon/zip/zip_main.c
+++ b/drivers/crypto/hisilicon/zip/zip_main.c
@@ -469,10 +469,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg)
 	return false;
 }
 
-static int hisi_zip_set_high_perf(struct hisi_qm *qm)
+static void hisi_zip_set_high_perf(struct hisi_qm *qm)
 {
 	u32 val;
-	int ret;
 
 	val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET);
 	if (perf_mode == HZIP_HIGH_COMP_PERF)
@@ -482,13 +481,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm)
 
 	/* Set perf mode */
 	writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
-	ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET,
-					 val, val == perf_mode, HZIP_DELAY_1_US,
-					 HZIP_POLL_TIMEOUT_US);
-	if (ret)
-		pci_err(qm->pdev, "failed to set perf mode\n");
-
-	return ret;
 }
 
 static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
@@ -1180,9 +1172,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
 	if (ret)
 		return ret;
 
-	ret = hisi_zip_set_high_perf(qm);
-	if (ret)
-		return ret;
+	hisi_zip_set_high_perf(qm);
 
 	hisi_zip_open_sva_prefetch(qm);
 	hisi_qm_dev_err_init(qm);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:40:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367630; cv=none; b=KQDcsTYLBLX0JVgETLsNTDc2nkA2vTS7Y43av0TjP9Ms16p29RBar+NsFVNki27gCaCUc4qr5gpqOxA1VHW2iVbUplsHV/A1sS2+YKCxMmL992YSE/KzW8LOJcSp8odEJjOkaBPCTX7PCIHkHeuXUV8v+HA1aousveX3UeLykgU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367630; c=relaxed/simple;
	bh=qqKmCwLv+cvuT/Mk6evSTsJG5itwFLmt64tB9MDEcKs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Ku+vcIlZ6pG2fnrIavRoQZ5ie4yqOq5uTfKiECYyB5DN8s1b/xMBkR2+1XHQCgc+mfAj7ySGmxKpdeIabWonxbHuqE2/ASFE2l8Enj9+t/U+IVgRBrmt5EZ7iONxGuIGR6zkmpQvrZ8sEhCkLmDQiju+NlSEJXM7q3b/BPh7F1c=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bIlHs5ET; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Arnd Bergmann <[email-masked]>,
	Hans Verkuil <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 079/196] media: st-delta: avoid excessive stack usage
Date: Mon, 13 Oct 2025 16:44:30 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email-masked]>

[ Upstream commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 ]

Building with a reduced stack warning limit shows that delta_mjpeg_decode()
copies a giant structure to the stack each time but only uses three of
its members:

drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode':
drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]

Open-code the passing of the structure members that are actually used here.

Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support")
Signed-off-by: Arnd Bergmann <[email-masked]>
Signed-off-by: Hans Verkuil <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../platform/st/sti/delta/delta-mjpeg-dec.c   | 20 ++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
index 0533d4a083d24..a078f1107300e 100644
--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
+++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx)
 	return 0;
 }
 
-static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
+static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend)
 {
 	struct delta_dev *delta = pctx->dev;
 	struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
 
 	memset(params, 0, sizeof(*params));
 
-	params->picture_start_addr_p = (u32)(au->paddr);
-	params->picture_end_addr_p = (u32)(au->paddr + au->size - 1);
+	params->picture_start_addr_p = pstart;
+	params->picture_end_addr_p = pend;
 
 	/*
 	 * !WARNING!
@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
 	struct delta_dev *delta = pctx->dev;
 	struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
 	int ret;
-	struct delta_au au = *pau;
+	void *au_vaddr = pau->vaddr;
+	dma_addr_t au_dma = pau->paddr;
+	size_t au_size = pau->size;
 	unsigned int data_offset = 0;
 	struct mjpeg_header *header = &ctx->header_struct;
 
 	if (!ctx->header) {
-		ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
+		ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
 					      header, &data_offset);
 		if (ret) {
 			pctx->stream_errors++;
@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
 			goto err;
 	}
 
-	ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
+	ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
 				      ctx->header, &data_offset);
 	if (ret) {
 		pctx->stream_errors++;
 		goto err;
 	}
 
-	au.paddr += data_offset;
-	au.vaddr += data_offset;
+	au_dma += data_offset;
+	au_vaddr += data_offset;
 
-	ret = delta_mjpeg_ipc_decode(pctx, &au);
+	ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1);
 	if (ret)
 		goto err;
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:33:12 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367627; cv=none; b=XlPuacw1ITl1E0oWwm0DAEBz9IoxjjqHAvg1UqndfnLrM6SQwJUDoZRaNeZWnryyq+UCDri8VzS3YM8LT6W9/VL835FGXV6TCOcfbhy4Y0c+BuxGOqDvGjfvcE8WvulL9iuy34OR12PDiizQYL37ZAjteO0xN2F+WQ010gTJauY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367627; c=relaxed/simple;
	bh=3KhxNLNY9b/KI/B8JRZRmn3SNbkv+xcRruUTi2GiULU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=m4abnDnCiE0cjFDz2krSgpbbP3U0efm0pY2kNkHoC67ygpj8T93OXVbQsjaqYwyTo1UYyapOwXqmm9id+fTxB21UT7IuHNZXTtcvmDI33uRtvXJwqGSCKQRb0Zo/d+ocbuNF1xjSTHjBI0u10uSwL4cx7GoHwuuQBHkb4laKfz0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ddJ2YHgd; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	Takashi Iwai <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 078/196] ALSA: lx_core: use int type to store negative error codes
Date: Mon, 13 Oct 2025 16:44:29 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]

Change the 'ret' variable from u16 to int to store negative error codes or
zero returned by lx_message_send_atomic().

Storing the negative error codes in unsigned type, doesn't cause an issue
at runtime but it's ugly as pants. Additionally, assigning negative error
codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
flag is enabled.

No effect on runtime.

Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface")
Signed-off-by: Qianfeng Rong <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Takashi Iwai <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 sound/pci/lx6464es/lx_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
index b5b0d43bb8dcd..c3f2717aebf25 100644
--- a/sound/pci/lx6464es/lx_core.c
+++ b/sound/pci/lx6464es/lx_core.c
@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)
 /* low-level dsp access */
 int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
 {
-	u16 ret;
+	int ret;
 
 	mutex_lock(&chip->msg_lock);
 
@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
 
 int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq)
 {
-	u16 ret = 0;
 	u32 freq_raw = 0;
 	u32 freq = 0;
 	u32 frequency = 0;
+	int ret;
 
 	mutex_lock(&chip->msg_lock);
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:20:59 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367624; cv=none; b=qccevNh91w9LQQ1+7Dx9zd9nlpkvBFSnD0AcN1529gz17w871Mcd3RWyl4KkwTfVEuCcoWgTI3XRQEL+Qmm0AUA0m8zJW/i8ytkAtI79VCfihr6q0Jnz30ImFbsbvZlZYHWxOEKNBEyTPhCHJCk+7KhtGwlmmKI1YbSqlniKPfU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367624; c=relaxed/simple;
	bh=/HRHDQefdWQZ7vSqPisilLq8614DubqZFR9TirJ8TmM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=B+32rRQAYLumHbhP6E5ty1vEGpGsQFvE8ynBeHqbkE8SYcWWEr+FJl/xXDltfkYst+f9tkgRECouNrR4icLNnESHYqChzUiXfLt9dpNfCcv9VCTNCzePc22aJv9IWPnZTnm3rWaOxljCAnuDsUhU3W5YhUGfJkhmEp/NhYdZ4C0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bppjVgq1; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Patrisious Haddad <[email-masked]>,
	Mark Bloch <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	Jason Gunthorpe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 077/196] RDMA/mlx5: Fix vport loopback forcing for MPV device
Date: Mon, 13 Oct 2025 16:44:28 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Patrisious Haddad <[email-masked]>

[ Upstream commit 08aae7860450c89eebbc6fd4d38416e53c7a33d2 ]

Previously loopback for MPV was supposed to be permanently enabled,
however other driver flows were able to over-ride that configuration and
disable it.

Add force_lb parameter that indicates that loopback should always be
enabled which prevents all other driver flows from disabling it.

Fixes: a9a9e68954f2 ("RDMA/mlx5: Fix vport loopback for MPV device")
Link: https://patch.msgid.link/r/[email-masked]
Signed-off-by: Patrisious Haddad <[email-masked]>
Reviewed-by: Mark Bloch <[email-masked]>
Signed-off-by: Leon Romanovsky <[email-masked]>
Signed-off-by: Jason Gunthorpe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/hw/mlx5/main.c    | 19 +++++++++++++++----
 drivers/infiniband/hw/mlx5/mlx5_ib.h |  1 +
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index e922fb8728654..0adb98b8dacc8 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1691,7 +1691,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev,
 }
 
 static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
-				struct mlx5_core_dev *slave)
+				struct mlx5_core_dev *slave,
+				struct mlx5_ib_lb_state *lb_state)
 {
 	int err;
 
@@ -1703,6 +1704,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
 	if (err)
 		goto out;
 
+	lb_state->force_enable = true;
 	return 0;
 
 out:
@@ -1711,16 +1713,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
 }
 
 static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master,
-				  struct mlx5_core_dev *slave)
+				  struct mlx5_core_dev *slave,
+				  struct mlx5_ib_lb_state *lb_state)
 {
 	mlx5_nic_vport_update_local_lb(slave, false);
 	mlx5_nic_vport_update_local_lb(master, false);
+
+	lb_state->force_enable = false;
 }
 
 int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
 {
 	int err = 0;
 
+	if (dev->lb.force_enable)
+		return 0;
+
 	mutex_lock(&dev->lb.mutex);
 	if (td)
 		dev->lb.user_td++;
@@ -1742,6 +1750,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
 
 void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
 {
+	if (dev->lb.force_enable)
+		return;
+
 	mutex_lock(&dev->lb.mutex);
 	if (td)
 		dev->lb.user_td--;
@@ -3251,7 +3262,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev,
 
 	lockdep_assert_held(&mlx5_ib_multiport_mutex);
 
-	mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev);
+	mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
 
 	mlx5_core_mp_event_replay(ibdev->mdev,
 				  MLX5_DRIVER_EVENT_AFFILIATION_REMOVED,
@@ -3348,7 +3359,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev,
 				  MLX5_DRIVER_EVENT_AFFILIATION_DONE,
 				  &key);
 
-	err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev);
+	err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
 	if (err)
 		goto unbind;
 
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 94678e5c59dd5..9b780f48a382b 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -1065,6 +1065,7 @@ struct mlx5_ib_lb_state {
 	u32			user_td;
 	int			qps;
 	bool			enabled;
+	bool			force_enable;
 };
 
 struct mlx5_ib_pf_eq {
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:27:59 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367621; cv=none; b=IcY+3B2KQ/uhq4DQW4OwS9Ug+t7bBZ0y8YcxBMr/BAYcBmtCyr4x0/xcxBc025Zt8IuWwCExC0APK9u1eYmM8xD6boa4CYsxoK94fQ5shntonwKz1+ILw1YqW9ahkJfk/simEnN0PvAaFgXRq752m1eOkXmFD7R2NY4McR++aEU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367621; c=relaxed/simple;
	bh=Nc3dihz2l11mbgzYejMt/pqNs0eriT11R45iZrHRk7M=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=VaX/GSaQTJ+j7ONk/8I2MXBJWZEfkkR/NKe4uP/QoPs6LGGUjaYYPSKsTU7ND+ULoYSnTrv0VUKROk9rHkdAw2LeSDvvxZ+/zUiYMO5B5NdbiuBgMJlao3KqyhZSRH5/0SErgmJ6DhO7gGq8C3Fe8tLEf3776eBjqhbeqK2oILg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KY7Hngrq; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhang Shurong <[email-masked]>,
	Jacopo Mondi <[email-masked]>,
	Sakari Ailus <[email-masked]>,
	Hans Verkuil <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 076/196] media: rj54n1cb0c: Fix memleak in rj54n1_probe()
Date: Mon, 13 Oct 2025 16:44:27 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  2.0 PDS_OTHER_BAD_TLD      Untrustworthy TLDs
                             [URI: rect.top (top)]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 24

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhang Shurong <[email-masked]>

[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]

rj54n1_probe() won't clean all the allocated resources in fail
path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
prevent memleak.

Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver")
Signed-off-by: Zhang Shurong <[email-masked]>
Reviewed-by: Jacopo Mondi <[email-masked]>
Signed-off-by: Sakari Ailus <[email-masked]>
Signed-off-by: Hans Verkuil <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/media/i2c/rj54n1cb0c.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
index b430046f9e2a9..09293e90025d5 100644
--- a/drivers/media/i2c/rj54n1cb0c.c
+++ b/drivers/media/i2c/rj54n1cb0c.c
@@ -1331,10 +1331,13 @@ static int rj54n1_probe(struct i2c_client *client)
 			V4L2_CID_GAIN, 0, 127, 1, 66);
 	v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops,
 			V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1);
-	rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
-	if (rj54n1->hdl.error)
-		return rj54n1->hdl.error;
 
+	if (rj54n1->hdl.error) {
+		ret = rj54n1->hdl.error;
+		goto err_free_ctrl;
+	}
+
+	rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
 	rj54n1->clk_div		= clk_div;
 	rj54n1->rect.left	= RJ54N1_COLUMN_SKIP;
 	rj54n1->rect.top	= RJ54N1_ROW_SKIP;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:43:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367620; cv=none; b=bPtAxIJsK9KbfA7NQkUMBgajS8Kbb01IwvS/1w4HMQd3XWkDSh53S7rTR/7+o2+hTH8ml763vC/o+3EPE/LkhVPHfKsUyFZYBnPSQTd6OSFUuahCPANHbSAgrZOLeE0xQsY8DI+31aIRACo7nc0uXpGNATcnnSyHaQsoTpa/j3o=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367620; c=relaxed/simple;
	bh=CBTCTllIakSZoheUBnWKzZLlRp7+OldiBrJd4iKeHvw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=aGYS3K7LP7rKxcT90LNBA4uYTgNWLCLzKUGiF485o7WEHEFcgTSc1suoAwJ41c6vNPbI8tcryJJaVJr24ZCniuMXreSSYnQxG6CP5/0Tx3tKsbE187TL26+dIc1HlOKOKhVDrrqoiuiyyt5mZtSQk91eJ8TBHduAhvJebhPlN7I=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mENgSXeR; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Thomas Fourier <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 075/196] scsi: myrs: Fix dma_alloc_coherent() error check
Date: Mon, 13 Oct 2025 16:44:26 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Fourier <[email-masked]>

[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]

Check for NULL return value with dma_alloc_coherent(), because DMA
address is not always set by dma_alloc_coherent() on failure.

Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)")
Signed-off-by: Thomas Fourier <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/myrs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c
index e824be9d9bbb9..9075836ccc3e2 100644
--- a/drivers/scsi/myrs.c
+++ b/drivers/scsi/myrs.c
@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
 	/* Temporary dma mapping, used only in the scope of this function */
 	mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox),
 				  &mbox_addr, GFP_KERNEL);
-	if (dma_mapping_error(&pdev->dev, mbox_addr))
+	if (!mbox)
 		return false;
 
 	/* These are the base addresses for the command memory mailbox array */
 	cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox);
 	cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size,
 				      &cs->cmd_mbox_addr, GFP_KERNEL);
-	if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) {
+	if (!cmd_mbox) {
 		dev_err(&pdev->dev, "Failed to map command mailbox\n");
 		goto out_free;
 	}
@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
 	cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox);
 	stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size,
 				       &cs->stat_mbox_addr, GFP_KERNEL);
-	if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) {
+	if (!stat_mbox) {
 		dev_err(&pdev->dev, "Failed to map status mailbox\n");
 		goto out_free;
 	}
@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
 	cs->fwstat_buf = dma_alloc_coherent(&pdev->dev,
 					    sizeof(struct myrs_fwstat),
 					    &cs->fwstat_addr, GFP_KERNEL);
-	if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) {
+	if (!cs->fwstat_buf) {
 		dev_err(&pdev->dev, "Failed to map firmware health buffer\n");
 		cs->fwstat_buf = NULL;
 		goto out_free;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:44:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367616; cv=none; b=VPsxSUp4IrgidzhdSTghqbOZX3l8OmTpAQOn4Zh7olY82j5KnahoUmRiPqHVoaYLKDZfy+OCpyET96PQZB3rbO7dwa9Ej6483F5aOXt1MGUs43CcDWReD74GiSTaXn1eRx2yiHFyPYSXUjN1olAURco1dBzpy9Io3mz5w02n02A=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367616; c=relaxed/simple;
	bh=BVynEt/Ig5jEVI/NmcOso8CDKxyLEmFrMJ4GEJqO0vY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=nUGpGELotSm8HnP6jbkjIHTSGdU7DHnUDSNmCzM3jHJ5vtGIKdpSYpLrU9qDFgZFhbFGgwUrAt5+2jWYXYVspQIj7kFuX7ta3NSoy6/cvtxyGGBa2B2JHpE3/TWXvRnI1Ar91JvNGNtd0tkE6k7kQ3Kdi7F1vBswEGJYoNqBc1o=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=jEXdp/U6; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Igor Pylypiv <[email-masked]>,
	Niklas Cassel <[email-masked]>,
	Damien Le Moal <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 074/196] scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
Date: Mon, 13 Oct 2025 16:44:25 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Niklas Cassel <[email-masked]>

[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]

Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when
device is gone") UBSAN reports:

  UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
  index 28 is out of range for type 'pm8001_phy [16]'

on rmmod when using an expander.

For a direct attached device, attached_phy contains the local phy id.
For a device behind an expander, attached_phy contains the remote phy
id, not the local phy id.

I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
device behind an expander, attached_phy can be much larger than
pm8001_ha->chip->n_phy (depending on the amount of phys of the
expander).

E.g. on my system pm8001_ha has 8 phys with phy ids 0-7.  One of the
ports has an expander connected.  The expander has 31 phys with phy ids
0-30.

The pm8001_ha->phy array only contains the phys of the HBA.  It does not
contain the phys of the expander.  Thus, it is wrong to use attached_phy
to index the pm8001_ha->phy array for a device behind an expander.

Thus, we can only clear phy_attached for devices that are directly
attached.

Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
Reviewed-by: Igor Pylypiv <[email-masked]>
Signed-off-by: Niklas Cassel <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Reviewed-by: Damien Le Moal <[email-masked]>
Tested-by: Damien Le Moal <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index a9d6dac413346..4daab8b6d6752 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -703,6 +703,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
 	unsigned long flags = 0;
 	struct pm8001_hba_info *pm8001_ha;
 	struct pm8001_device *pm8001_dev = dev->lldd_dev;
+	struct domain_device *parent_dev = dev->parent;
 
 	pm8001_ha = pm8001_find_ha_by_dev(dev);
 	spin_lock_irqsave(&pm8001_ha->lock, flags);
@@ -719,7 +720,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
 			spin_lock_irqsave(&pm8001_ha->lock, flags);
 		}
 		PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
-		pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
+
+		/*
+		 * The phy array only contains local phys. Thus, we cannot clear
+		 * phy_attached for a device behind an expander.
+		 */
+		if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
+			pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
 		pm8001_free_dev(pm8001_dev);
 	} else {
 		pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n");
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:38:42 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367713; cv=none; b=MIV6zrgRHzxfEE4P4P/Ys8cWpXDvKU4BechOcFlJmhlATgZuZN1Pe/9+K6DvS3822za6RE19V6uetKxiWtzlasTLcBkmM2/kOuID9W3/PDphlncIRqHyItHYSrKw3yQjiFAohUZjRrPMlTOFaDAcJ0YWDnKLxprXIEiojf2nsMI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367713; c=relaxed/simple;
	bh=H8rXO36gjAXKImzST7gMS5/1QR9m8aeaDY/79KdQNVo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=KtWHLj+IS2cieptRNa6HCxinJTbM1iH8dsiKly+k99Rj55yDySSX6URLRG7HgPYi0jRiTkbTAGb3wS3WEoGrrqDmin+hfB6qYKnPUpz5ULqPn+3w5UP5brAKk+LnabCXtwSVWX/1Ya6IE5VKc9wLwDh8f2HCCUwLpBiFZ5FEz8E=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=m0he5A2K; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Arnd Bergmann <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 073/196] hwrng: nomadik - add ARM_AMBA dependency
Date: Mon, 13 Oct 2025 16:44:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email-masked]>

[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ]

Compile-testing this driver is only possible when the AMBA bus driver is
available in the kernel:

x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove':
nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions'
x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe':
nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions'
x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions'

The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be
specified for the COMPILE_TEST case.

Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST")
Signed-off-by: Arnd Bergmann <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/char/hw_random/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index 8de74dcfa18cf..ece2d794174d4 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -286,6 +286,7 @@ config HW_RANDOM_INGENIC_TRNG
 config HW_RANDOM_NOMADIK
 	tristate "ST-Ericsson Nomadik Random Number Generator support"
 	depends on ARCH_NOMADIK || COMPILE_TEST
+	depends on ARM_AMBA
 	default HW_RANDOM
 	help
 	  This driver provides kernel-side support for the Random Number
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:17:32 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367710; cv=none; b=ddJsZcWfQMM2gtppa+04nT8CQS+kUgJhRkVH5mHJ6AtP/jpNJPqmA+GVxE2Pt64V2VDH/9RNm02yY+6O6S7urjG+gVpCjGsKtk8sZviNnn1TcifgxBBQ0qFum3Qd7j+fqN9ROSYJMreWqq1pH67x10aLMl9dYGhJrSTM4WtSAyg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367710; c=relaxed/simple;
	bh=SkEMIjjaBoH2/etsIEx0CHFH3rTCDRcOxvVmtpQNwDo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=adjF0MfFrfEiEPR3MXPlc+aDWx6Z6ur1CAvX0yn7OV7l3QCVdQO07/rStw5ae4rW649PGyHAsEauY3kmmH9jnApY8BcbsI99zh0fUvO5Zb8IgXuxo7cnDQu92hLKyo0gflLvbieTneUYCazyFel9ZIOGHzJ1wuIm9rm2lZmvO5M=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ErlTGxRo; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Thomas Fourier <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 072/196] crypto: keembay - Add missing check after sg_nents_for_len()
Date: Mon, 13 Oct 2025 16:44:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Fourier <[email-masked]>

[ Upstream commit 4e53be21dd0315c00eaf40cc8f8c0facd4d9a6b2 ]

sg_nents_for_len() returns an int which is negative in case of error.

Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver")
Signed-off-by: Thomas Fourier <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
index b732223035399..3b5d5b64e1414 100644
--- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
+++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
@@ -232,7 +232,7 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
 	struct device *dev = rctx->hcu_dev->dev;
 	unsigned int remainder = 0;
 	unsigned int total;
-	size_t nents;
+	int nents;
 	size_t count;
 	int rc;
 	int i;
@@ -253,6 +253,9 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
 	/* Determine the number of scatter gather list entries to process. */
 	nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder);
 
+	if (nents < 0)
+		return nents;
+
 	/* If there are entries to process, map them. */
 	if (nents) {
 		rctx->sg_dma_nents = dma_map_sg(dev, req->src, nents,
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:22:00 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367707; cv=none; b=WSV3E3RWm/BKYNjVoIsNHAuhuwKd5QY8cx/8V7PGzBHQL8ewZy8T7C2n2jb9onw8PL+umBzRf6Qz6Exu9HABpTG8gp5tjgWKwCtiorKfimAUax6StfG1H2JeZ6Td3j/fhkB5d6YtX+Avw4LkthHtwH2yt5UGuAHUZLi+N2uQNk8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367707; c=relaxed/simple;
	bh=Kx1g2Z7eOXqKUgBDW6g8yU+bdPj9AiBWyDXo6wOyJNE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=O+Us2oDty2JjtZ3BpNtDutg2lsOo4TeNfKlt6Yd+pGBO9re+M/IPPEryP27LiaYOzSLbs7M0YQ8ZeztL8wfKX70L3rjnEWxu8OL9mrhcXCnKwnBLlEUge7W1vc7mpupJkHUpkBRJkGO6sGj1KnfBKgkl8lZNKQ2xYOoa5y8sjaA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=f8pOzXEY; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Liao Yuanhong <[email-masked]>,
	Alex Deucher <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 071/196] drm/amd/display: Remove redundant semicolons
Date: Mon, 13 Oct 2025 16:44:22 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Liao Yuanhong <[email-masked]>

[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ]

Remove unnecessary semicolons.

Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321")
Signed-off-by: Liao Yuanhong <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c    | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
index 9ba6cb67655f4..6c75aa82327ac 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs,
 	if (dual_plane) {
 		unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param,
 				num_pipes, pipe_idx);
-		;
 		if (src->sw_mode == dm_sw_linear)
 			ASSERT(p1_pte_row_height_linear >= 8);
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:17:29 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367704; cv=none; b=oGCwBbRI+ORbB6fEcddAmck82O3wutHH54AtR+wBfPw3T4O5m8KGgA8rm6xK7XVTJm9QvWTwWB1mNSyBHoe/VjEiHkLjW0pmo2XudyTAqmMVvKbePB4sMptwFoFHtbuX7KWIGAmoKFPPClPVPoTxQxsPKCL8ZNXheWJ7BaNRHTI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367704; c=relaxed/simple;
	bh=b1DmzkKcyY/hDRIUqkz+PP/5bjNpCZ1oN/7cB0VuSvo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=A/yhq4s+p3XZCwKRLgk6pXwvF+riLyCfm0ugWlwX2ekUbw3+BMMeY8Mf3jW4xtRt1GH9hGF00+83Kp6MfZ69aIrWRrs1XKcdZ+brDPq1J5ZWjOChN0ekFxu0nL1wyc6xHgIdRTFkZM9CC3UfJRsoBFGfjgvt2T2DyrB2p8S4jp0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=oaw6k8Lq; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 070/196] serial: max310x: Add error checking in probe()
Date: Mon, 13 Oct 2025 16:44:21 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email-masked]>

[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ]

Check if devm_i2c_new_dummy_device() fails.

Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support")
Signed-off-by: Dan Carpenter <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/tty/serial/max310x.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
index e339abff926d3..e10dcdeeda2d3 100644
--- a/drivers/tty/serial/max310x.c
+++ b/drivers/tty/serial/max310x.c
@@ -1659,6 +1659,8 @@ static int max310x_i2c_probe(struct i2c_client *client)
 		port_client = devm_i2c_new_dummy_device(&client->dev,
 							client->adapter,
 							port_addr);
+		if (IS_ERR(port_client))
+			return PTR_ERR(port_client);
 
 		regmaps[i] = devm_regmap_init_i2c(port_client, &regcfg_i2c);
 	}
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:22:06 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367701; cv=none; b=uYp/RR9QuCwv0Q1Zp+oknLpVqJID6J14KL22s2BouLL/pMPqdVxPxhRCvwBut3UP5Nw5Oivs7piXyXFIc1Z3U/qkCOshzxS3H91os1SLuWe/6fn+bxSeONC+P1rpL2cvOcW2lFmv+JtXkao43uIYXrRBRArJM2nTzywHAiLcF9s=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367701; c=relaxed/simple;
	bh=8s9NtSgAbEprt+ssMyIhenXz2r3Sp+cOYqQc9ax6Wso=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pPcinf8mvUHahrbgU7WDiO3dKxifnPipsVDIgZMMRLvPrxhHFl6OMbEJAXnydvY1jGl/Q7vu1h+GRrgFvsOc+0ugUR3GWz+Fwm+WbZZQZlwHp+P3V0OAhw83HEUM9GmtIztriuWb3Ungg2V4FB9JZk4s6OKT9IxBvDvQXArF5iE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=HVUt/RcD; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Melody Olvera <[email-masked]>,
	Konrad Dybcio <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Souradeep Chowdhury <[email-masked]>,
	Komal Bajaj <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 069/196] usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls
Date: Mon, 13 Oct 2025 16:44:20 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Komal Bajaj <[email-masked]>

[ Upstream commit c0485e864a2eaa1d5a84c71e573dd236d0e885ae ]

EUD_MODE_MANAGER2 register is mapped to a memory region that is marked
as read-only for operating system running at EL1, enforcing access
restrictions that prohibit direct memory-mapped writes via writel().

Attempts to write to this region from HLOS can result in silent failures
or memory access violations, particularly when toggling EUD (Embedded
USB Debugger) state. To ensure secure register access, modify the driver
to use qcom_scm_io_writel(), which routes the write operation to Qualcomm
Secure Channel Monitor (SCM). SCM has the necessary permissions to access
protected memory regions, enabling reliable control over EUD state.

SC7280, the only user of EUD is also affected, indicating that this could
never have worked on a properly fused device.

Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)")
Signed-off-by: Melody Olvera <[email-masked]>
Reviewed-by: Konrad Dybcio <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Reviewed-by: Souradeep Chowdhury <[email-masked]>
Signed-off-by: Komal Bajaj <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/usb/misc/Kconfig    |  1 +
 drivers/usb/misc/qcom_eud.c | 33 ++++++++++++++++++++++++---------
 2 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
index 99b15b77dfd57..fe1b5fec1dfca 100644
--- a/drivers/usb/misc/Kconfig
+++ b/drivers/usb/misc/Kconfig
@@ -147,6 +147,7 @@ config USB_APPLEDISPLAY
 config USB_QCOM_EUD
 	tristate "QCOM Embedded USB Debugger(EUD) Driver"
 	depends on ARCH_QCOM || COMPILE_TEST
+	select QCOM_SCM
 	select USB_ROLE_SWITCH
 	help
 	  This module enables support for Qualcomm Technologies, Inc.
diff --git a/drivers/usb/misc/qcom_eud.c b/drivers/usb/misc/qcom_eud.c
index 7f371ea1248c3..cfb195a0f6ce2 100644
--- a/drivers/usb/misc/qcom_eud.c
+++ b/drivers/usb/misc/qcom_eud.c
@@ -15,6 +15,7 @@
 #include <linux/slab.h>
 #include <linux/sysfs.h>
 #include <linux/usb/role.h>
+#include <linux/firmware/qcom/qcom_scm.h>
 
 #define EUD_REG_INT1_EN_MASK	0x0024
 #define EUD_REG_INT_STATUS_1	0x0044
@@ -34,7 +35,7 @@ struct eud_chip {
 	struct device			*dev;
 	struct usb_role_switch		*role_sw;
 	void __iomem			*base;
-	void __iomem			*mode_mgr;
+	phys_addr_t			mode_mgr;
 	unsigned int			int_status;
 	int				irq;
 	bool				enabled;
@@ -43,18 +44,29 @@ struct eud_chip {
 
 static int enable_eud(struct eud_chip *priv)
 {
+	int ret;
+
+	ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 1);
+	if (ret)
+		return ret;
+
 	writel(EUD_ENABLE, priv->base + EUD_REG_CSR_EUD_EN);
 	writel(EUD_INT_VBUS | EUD_INT_SAFE_MODE,
 			priv->base + EUD_REG_INT1_EN_MASK);
-	writel(1, priv->mode_mgr + EUD_REG_EUD_EN2);
 
 	return usb_role_switch_set_role(priv->role_sw, USB_ROLE_DEVICE);
 }
 
-static void disable_eud(struct eud_chip *priv)
+static int disable_eud(struct eud_chip *priv)
 {
+	int ret;
+
+	ret = qcom_scm_io_writel(priv->mode_mgr + EUD_REG_EUD_EN2, 0);
+	if (ret)
+		return ret;
+
 	writel(0, priv->base + EUD_REG_CSR_EUD_EN);
-	writel(0, priv->mode_mgr + EUD_REG_EUD_EN2);
+	return 0;
 }
 
 static ssize_t enable_show(struct device *dev,
@@ -82,11 +94,12 @@ static ssize_t enable_store(struct device *dev,
 			chip->enabled = enable;
 		else
 			disable_eud(chip);
+
 	} else {
-		disable_eud(chip);
+		ret = disable_eud(chip);
 	}
 
-	return count;
+	return ret < 0 ? ret : count;
 }
 
 static DEVICE_ATTR_RW(enable);
@@ -178,6 +191,7 @@ static void eud_role_switch_release(void *data)
 static int eud_probe(struct platform_device *pdev)
 {
 	struct eud_chip *chip;
+	struct resource *res;
 	int ret;
 
 	chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL);
@@ -200,9 +214,10 @@ static int eud_probe(struct platform_device *pdev)
 	if (IS_ERR(chip->base))
 		return PTR_ERR(chip->base);
 
-	chip->mode_mgr = devm_platform_ioremap_resource(pdev, 1);
-	if (IS_ERR(chip->mode_mgr))
-		return PTR_ERR(chip->mode_mgr);
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+	if (!res)
+		return -ENODEV;
+	chip->mode_mgr = res->start;
 
 	chip->irq = platform_get_irq(pdev, 0);
 	ret = devm_request_threaded_irq(&pdev->dev, chip->irq, handle_eud_irq,
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:30:10 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367698; cv=none; b=avUCPP45LiPkY29MEZRmfkQ8D+QT9abunSEGycU3hxGgInp2tPrf7T8+vAlxmwfaZwCR5CnHQS29YxDCrnkLoz4CVGiL8yuTZvUfUfAsiSWPz1szNM3ix9BIjPbjx1Wt3zm8XYykvpJRGP3WoB6zgqdgbwLN3xoQI6Pr1IntvNk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367698; c=relaxed/simple;
	bh=J8K9gQqmwLjtFRHdyXvigUQq0QmohOozQ/c5GSt8pDo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=mI5apRLoiodcstq2TLU+dGw92Hye+3+m5u2A5nG9bCq6xKEwzrG1RHYjEHNioKpzbZQgC4oV7BLzlCHmrmAPpeejfrf+F8wWG6yrMIfVMYLNoTfBfePAfafMBl3rcVMl64GnAs+daoUTLcJONrljhr5EWMkiCw76I1NkUAI5+uk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IN4u0vuT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 068/196] usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
Date: Mon, 13 Oct 2025 16:44:19 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email-masked]>

[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]

The kthread_run() function returns error pointers so the
max3421_hcd->spi_thread pointer can be either error pointers or NULL.
Check for both before dereferencing it.

Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning")
Signed-off-by: Dan Carpenter <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/usb/host/max3421-hcd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index cc1f579f02de1..2d792ab271e2a 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1916,7 +1916,7 @@ max3421_probe(struct spi_device *spi)
 	if (hcd) {
 		kfree(max3421_hcd->tx);
 		kfree(max3421_hcd->rx);
-		if (max3421_hcd->spi_thread)
+		if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread))
 			kthread_stop(max3421_hcd->spi_thread);
 		usb_put_hcd(hcd);
 	}
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:45:49 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367676; cv=none; b=cf8Arn7Bm1Yz8kAFZzddc/lpdyN7JqMXeR9PIGyCcjVYNx00NhUJcShR18pQRP+aDzGaMNwWAyPvJqUKz28yPl5/ufmDPelBs1lgsCIIDRi8yqsSQYN6ZQvW9ZgV5UaClfIbe+0hvXE/HZ04XYitkceJF7+GXzQFHwS4blSSM0o=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367676; c=relaxed/simple;
	bh=lWb2FjKa85bTtAukHDdxFZ9DAXe7x5Mbi/YkRi57XEw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=T7QCswPYbonNcIC/FJ7euaHkAOb4SulyfaHBf+VDdNMVB9XuuvmLuL3+lIiTBUL0jlEZcqBXeaUup+j2xbecN7tItZPNHtryS9ZxMppm/FSZORj07Yy3nuuCz4pG7ydJ/38U9UMajmILb8CSL6okSHSahNz8dCVij9cPCYDpkg0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xpp9PE82; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jonas Karlman <[email-masked]>,
	Vinod Koul <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 067/196] phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
Date: Mon, 13 Oct 2025 16:44:18 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jonas Karlman <[email-masked]>

[ Upstream commit 7bb14b61b7d03db770b7e8871493f5b9b2be2b79 ]

The boot firmware may disable the U3 port early during boot and leave it
up to the controller or PHY driver to re-enable U3 when needed.

The Rockchip USBDP PHY driver currently does this for RK3576 and RK3588,
something the Rockchip Naneng Combo PHY driver never does for RK3568.
This may result in USB 3.0 ports being limited to only using USB 2.0 or
in special cases not working at all on RK3568.

Write to PIPE_GRF USB3OTGx_CON1 reg to ensure the U3 port is enabled
when a PHY with PHY_TYPE_USB3 mode is used.

Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568")
Signed-off-by: Jonas Karlman <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Vinod Koul <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
index 2354ce8b21594..9ef496092b7e6 100644
--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
+++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
@@ -122,6 +122,8 @@ struct rockchip_combphy_grfcfg {
 	struct combphy_reg pipe_xpcs_phy_ready;
 	struct combphy_reg pipe_pcie1l0_sel;
 	struct combphy_reg pipe_pcie1l1_sel;
+	struct combphy_reg u3otg0_port_en;
+	struct combphy_reg u3otg1_port_en;
 };
 
 struct rockchip_combphy_cfg {
@@ -431,6 +433,14 @@ static int rk3568_combphy_cfg(struct rockchip_combphy_priv *priv)
 		rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txcomp_sel, false);
 		rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txelec_sel, false);
 		rockchip_combphy_param_write(priv->phy_grf, &cfg->usb_mode_set, true);
+		switch (priv->id) {
+		case 0:
+			rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg0_port_en, true);
+			break;
+		case 1:
+			rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg1_port_en, true);
+			break;
+		}
 		break;
 
 	case PHY_TYPE_SATA:
@@ -574,6 +584,8 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = {
 	/* pipe-grf */
 	.pipe_con0_for_sata	= { 0x0000, 15, 0, 0x00, 0x2220 },
 	.pipe_xpcs_phy_ready	= { 0x0040, 2, 2, 0x00, 0x01 },
+	.u3otg0_port_en		= { 0x0104, 15, 0, 0x0181, 0x1100 },
+	.u3otg1_port_en		= { 0x0144, 15, 0, 0x0181, 0x1100 },
 };
 
 static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = {
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:31:27 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367644; cv=none; b=Is13Q25X9kwYK2loLhcPuiG9q3cSTBP01rW4msF5Xb55i1R5WZaJXZSLgDquFVdXFisgEbBhV9qEPYXiLGLZhazltNGvvScaNjpAl+XBrUAFpLHY0Ij4KnnaawYw7Dm69pOZKRs4jAvmIx+mbrGYvvVXqmUo77hTo0v6YtA6jLU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367644; c=relaxed/simple;
	bh=TThNX95KLHUfL6dHyd0h/BVBIwFf7CdGWaQlap5Dx3g=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=HHmn9UM9Q7zVe4cq8loVzdai7HB2HX5fByMXceeHn0JeqbqScvOhhib+phW1SJxGQmK075PzzOpXU0iSTKs0c7LxOysMHvRwBpojjRLgGyiQCUA5KH2LABeUnS5rRfXHFXEvqnL7ZprrYRkfFbvqK8SzpabXD2VN5EcSpwu+uCk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=pw/oIhzl; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jacopo Mondi <[email-masked]>,
	Laurent Pinchart <[email-masked]>,
	Hans Verkuil <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 066/196] media: zoran: Remove zoran_fh structure
Date: Mon, 13 Oct 2025 16:44:17 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jacopo Mondi <[email-masked]>

[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ]

The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been
mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"),
but the structure stayed by mistake. It is now used in a single
location, assigned from a void pointer and then recast to a void
pointer, without being every accessed. Drop it.

Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2")
Signed-off-by: Jacopo Mondi <[email-masked]>
Signed-off-by: Laurent Pinchart <[email-masked]>
Signed-off-by: Hans Verkuil <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/media/pci/zoran/zoran.h        | 6 ------
 drivers/media/pci/zoran/zoran_driver.c | 3 +--
 2 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h
index 56340553b2823..63592c4f9ed8c 100644
--- a/drivers/media/pci/zoran/zoran.h
+++ b/drivers/media/pci/zoran/zoran.h
@@ -154,12 +154,6 @@ struct zoran_jpg_settings {
 
 struct zoran;
 
-/* zoran_fh contains per-open() settings */
-struct zoran_fh {
-	struct v4l2_fh fh;
-	struct zoran *zr;
-};
-
 struct card_info {
 	enum card_type type;
 	char name[32];
diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c
index fa672cc8bc678..feb39854a989e 100644
--- a/drivers/media/pci/zoran/zoran_driver.c
+++ b/drivers/media/pci/zoran/zoran_driver.c
@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh,
 			       struct v4l2_format *fmt)
 {
 	struct zoran *zr = video_drvdata(file);
-	struct zoran_fh *fh = __fh;
 	int i;
 	int res = 0;
 
 	if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG)
-		return zoran_s_fmt_vid_out(file, fh, fmt);
+		return zoran_s_fmt_vid_out(file, __fh, fmt);
 
 	for (i = 0; i < NUM_FORMATS; i++)
 		if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:40:02 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367613; cv=none; b=a7SYHq+MOlSXmusR047RMskOGmHNVUf9aXNqNyxYCV3g22AhrUN7jAtukaPOM/t++2uv6tFTyaxhcV8c9jvH+IYcarsdnMa57Bn1GBrDPP2BF4W6gB0uku6rymD69uHFsDuBG0aHB1TY7AUlHluhbRBjcPOM9OvFaHlkvaYP1Ko=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367613; c=relaxed/simple;
	bh=TGEykBH46IFAONrfnOVixLB+AEn0AnIZecAgOPWtOoM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=RhYYVARdNHFsqLSyJyhH74mV1AqFP0M+wincgVhvJssQTX3ubcnQPKbWGQnpktfn2CAUtCzFDM0Uvg7plAaa3A4f8qCkBdI4+Jk3IMBRpsLu/jdh+4iAjITD59UvV5PChDooxbHyec8irxxuMTjNFTJSly37AKIQXgQgIg0zPsU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=MpLuR/5y; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chia-I Wu <[email-masked]>,
	Chen-Yu Tsai <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 065/196] drm/bridge: it6505: select REGMAP_I2C
Date: Mon, 13 Oct 2025 16:44:16 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chia-I Wu <[email-masked]>

[ Upstream commit 21b137f651cf9d981e22d2c60a2a8105f50a6361 ]

Fix

  aarch64-linux-gnu-ld: drivers/gpu/drm/bridge/ite-it6505.o: in function `it6505_i2c_probe':
  ite-it6505.c:(.text+0x754): undefined reference to `__devm_regmap_init_i2c'

Signed-off-by: Chia-I Wu <[email-masked]>
Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver")
Reviewed-by: Chen-Yu Tsai <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Chen-Yu Tsai <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/bridge/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig
index 3e6a4e2044c0e..5a4d574b37b89 100644
--- a/drivers/gpu/drm/bridge/Kconfig
+++ b/drivers/gpu/drm/bridge/Kconfig
@@ -85,6 +85,7 @@ config DRM_ITE_IT6505
 	select EXTCON
 	select CRYPTO
 	select CRYPTO_HASH
+	select REGMAP_I2C
 	help
 	  ITE IT6505 DisplayPort bridge chip driver.
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:17:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367716; cv=none; b=gflc96AwkNdWm1/fWpe5GDKducyEtud73sHv9YDkIIXBxYkPniQW4CwVXjzxY3V9OEUsi3Oc/inklcwx4nc+TwzUHIOJggaTnJPb/lxpsz2DwFozUeF3ldUr8dXmrEkve4AKGFlQJ/WIRitk41PfLjF2QQvoZyXFIa2qObF3wQc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367716; c=relaxed/simple;
	bh=fOnjbeODVetse5ljQwi61eDC2coiM6k4NbWHor4W6uY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=tG1UgpaE13unEU+Os43fjbw8wyDDKcbTmtxojgUctvdtxAkxl17v/XKAxlxppUEVLX1vZhyQfjj6Q5X4WDkfPQThCgbyLNhElU4fZjtFGtuWAMVNEIq7k4vSmvufOvLf7+aL/cIEM8t9SuVNQgrF9i8hby4wFGqglS9BMjqh4VU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=BiYMY8O3; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chao Yu <[email-masked]>,
	Jaegeuk Kim <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 064/196] f2fs: fix condition in __allow_reserved_blocks()
Date: Mon, 13 Oct 2025 16:44:15 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chao Yu <[email-masked]>

[ Upstream commit e75ce117905d2830976a289e718470f3230fa30a ]

If reserve_root mount option is not assigned, __allow_reserved_blocks()
will return false, it's not correct, fix it.

Fixes: 7e65be49ed94 ("f2fs: add reserved blocks for root user")
Signed-off-by: Chao Yu <[email-masked]>
Signed-off-by: Jaegeuk Kim <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/f2fs/f2fs.h | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 7329f706da83c..ab2ddd09d8131 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -2296,8 +2296,6 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
 {
 	if (!inode)
 		return true;
-	if (!test_opt(sbi, RESERVE_ROOT))
-		return false;
 	if (IS_NOQUOTA(inode))
 		return true;
 	if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid()))
@@ -2318,7 +2316,7 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi,
 	avail_user_block_count = sbi->user_block_count -
 					sbi->current_reserved_blocks;
 
-	if (!__allow_reserved_blocks(sbi, inode, cap))
+	if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_blocks(sbi, inode, cap))
 		avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks;
 
 	if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:16:15 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367589; cv=none; b=Y2t+10RNMgPQiv3zwomyAqcxRsejNTlRaZ7lvD4Iev1PIUt087M6x1/lkKa7ls70dpjo+y7+Rd+d4lkxR5GTQnArXBWji8EZzgg1bB+YLuBWnlmTzEP4MXY7oBHDJiVzlH0vbx/zROpjjGJ5n6eBAfAzo5nLuKJ+HBLVrt6Opj8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367589; c=relaxed/simple;
	bh=ZPnOFIi1hTaagiowsQpodocCHmtEgKm+unR3Z5Y7060=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=Epw8BBReFWvXfViTw0J/oMTbePB2LhnITqwZ4frVFUFoD51IfkKhqd2HQc0nNRhGL6J731o1eoiQNtzG3AoLG6RHgSd0pf4Ry+ST+guVIKMNS0CZC2iJ2a7HGzQA2jJTrJQrEhYQRD8Y3w/QCxPuHPtL88snZZkG9Vr3vgkDbTI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=eecgEs3h; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Christian=20K=C3=B6nig?= <[email-masked]>,
	Brahmajit Das <[email-masked]>,
	Alex Deucher <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 063/196] drm/radeon/r600_cs: clean up of dead code in r600_cs
Date: Mon, 13 Oct 2025 16:44:14 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brahmajit Das <[email-masked]>

[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]

GCC 16 enables -Werror=unused-but-set-variable= which results in build
error with the following message.

drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:
drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
 1411 |         unsigned offset, i, level;
      |                             ^~~~~
cc1: all warnings being treated as errors
make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1

level although is set, but in never used in the function
r600_texture_size. Thus resulting in dead code and this error getting
triggered.

Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)")
Acked-by: Christian König <[email-masked]>
Signed-off-by: Brahmajit Das <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index ac77d1246b945..811265648a582 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
 			      unsigned block_align, unsigned height_align, unsigned base_align,
 			      unsigned *l0_size, unsigned *mipmap_size)
 {
-	unsigned offset, i, level;
+	unsigned offset, i;
 	unsigned width, height, depth, size;
 	unsigned blocksize;
 	unsigned nbx, nby;
@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
 	w0 = r600_mip_minify(w0, 0);
 	h0 = r600_mip_minify(h0, 0);
 	d0 = r600_mip_minify(d0, 0);
-	for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) {
+	for (i = 0, offset = 0; i < nlevels; i++) {
 		width = r600_mip_minify(w0, i);
 		nbx = r600_fmt_get_nblocksx(format, width);
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:20:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367586; cv=none; b=Eht7B9/aBced9Jw4UqDk7QuEQmyo4nd0BmquLXGeUbEosy4bI7IS/Tm9xGSYJcNOxJCdu9DXkoCD8Rj4RbC02WxleB5wLIyHSN0gcK/FBVxiYTvfKzcwWydm9NkS3SGtWCgOoGclnpKN0y1GQbfhpQ4WeAkhrScq8EtXKt2NP2o=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367586; c=relaxed/simple;
	bh=6z/UT84n9sx431eCOFQqUvHkg70wyjy+D7RRZfGRNWM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bEaif9+FpaUEWP5MPYBe7tjTo/Ao1zp8wDDZLXKedJECoSszRu2aq0PsGqR1USd4aSdBlbQjdVIvhZYhYryscgi3UcgU227h3r5c40g19NiFCNM0HOQ7AAK+9zC3YmvTfZgzEjMK1opalkwgO2XFhVaElPhAWKKL3gTTxeidK6k=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=HhOkJEE7; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Douglas Anderson <[email-masked]>,
	Neil Armstrong <[email-masked]>,
	Brigham Campbell <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 062/196] drm/panel: novatek-nt35560: Fix invalid return value
Date: Mon, 13 Oct 2025 16:44:13 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brigham Campbell <[email-masked]>

[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ]

Fix bug in nt35560_set_brightness() which causes the function to
erroneously report an error. mipi_dsi_dcs_write() returns either a
negative value when an error occurred or a positive number of bytes
written when no error occurred. The buggy code reports an error under
either condition.

Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel")
Reviewed-by: Douglas Anderson <[email-masked]>
Reviewed-by: Neil Armstrong <[email-masked]>
Signed-off-by: Brigham Campbell <[email-masked]>
Signed-off-by: Neil Armstrong <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
index 5bbea734123bc..ee04c55175bb8 100644
--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl)
 		par = 0x00;
 		ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY,
 					 &par, 1);
-		if (ret) {
+		if (ret < 0) {
 			dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret);
 			return ret;
 		}
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:35:21 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367583; cv=none; b=ktZWtrFcsuHYA2ZK6FdS0kxaGfOgPenGg/fI4CBn6OwZGq4wx8k+66tzeMG+r+SuG71sXo1jGEnF7/+T3k4ajP80furMlSDKcIOHVYBBpvWFgojYCAmiRSZjmbrKZ/4nK+qStnNC7H95OmJHQcYIfcTKgNhHzR0UIXat4I5o5+4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367583; c=relaxed/simple;
	bh=5HpMWz7xs6aN+DD5juA/0lSVV/KSUiG27EkoSWwJD80=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Iyr9VlsGM9eQ9asM47yu+3lirirrF2MSI19jzknXfvJrXOq3UBoIC+GVOagn20r2vrLwAvydbEGciBFqPA+qVSLvxIqI1N3vP7z4F6FZ68mn1sMPR3jNNJfWm9++KKp7+rCj2qIn3CBGFmJn9yTPqcvT6yEqQ/hmNl7dJEv9f+I=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KhuITACd; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yinhao Hu <[email-masked]>,
	Kaiyan Mei <[email-masked]>,
	Dongliang Mu <[email-masked]>,
	Daniel Borkmann <[email-masked]>,
	Alexei Starovoitov <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 061/196] bpf: Enforce expected_attach_type for tailcall compatibility
Date: Mon, 13 Oct 2025 16:44:12 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <[email-masked]>

[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ]

Yinhao et al. recently reported:

  Our fuzzer tool discovered an uninitialized pointer issue in the
  bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.
  This leads to a NULL pointer dereference when a BPF program attempts to
  deference the txq member of struct xdp_buff object.

The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the
entry point for bpf_prog_test_run_xdp() and its expected_attach_type can
neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot
of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP
to pass xdp_is_valid_access() validation. The program returns struct xdp_md's
egress_ifindex, and the latter is only allowed to be accessed under mentioned
expected_attach_type. progB is then inserted into the tailcall which progA
calls.

The underlying issue goes beyond XDP though. Another example are programs
of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well
as sock_addr_func_proto() have different logic depending on the programs'
expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME
should not be allowed doing a tailcall into a program which calls bpf_bind()
out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.

In short, specifying expected_attach_type allows to open up additional
functionality or restrictions beyond what the basic bpf_prog_type enables.
The use of tailcalls must not violate these constraints. Fix it by enforcing
expected_attach_type in __bpf_prog_map_compatible().

Note that we only enforce this for tailcall maps, but not for BPF devmaps or
cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and
cpu_map_bpf_prog_run*() which set up a new environment / context and therefore
these situations are not prone to this issue.

Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time")
Reported-by: Yinhao Hu <[email-masked]>
Reported-by: Kaiyan Mei <[email-masked]>
Reviewed-by: Dongliang Mu <[email-masked]>
Signed-off-by: Daniel Borkmann <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexei Starovoitov <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 include/linux/bpf.h | 1 +
 kernel/bpf/core.c   | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 83da9c81fa86a..0af6b2a5273ad 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -269,6 +269,7 @@ struct bpf_map_owner {
 	bool xdp_has_frags;
 	u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE];
 	const struct btf_type *attach_func_proto;
+	enum bpf_attach_type expected_attach_type;
 };
 
 struct bpf_map {
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 3618be05fc352..a343248c35ded 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2279,6 +2279,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
 		map->owner->type  = prog_type;
 		map->owner->jited = fp->jited;
 		map->owner->xdp_has_frags = aux->xdp_has_frags;
+		map->owner->expected_attach_type = fp->expected_attach_type;
 		map->owner->attach_func_proto = aux->attach_func_proto;
 		for_each_cgroup_storage_type(i) {
 			map->owner->storage_cookie[i] =
@@ -2290,6 +2291,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
 		ret = map->owner->type  == prog_type &&
 		      map->owner->jited == fp->jited &&
 		      map->owner->xdp_has_frags == aux->xdp_has_frags;
+		if (ret &&
+		    map->map_type == BPF_MAP_TYPE_PROG_ARRAY &&
+		    map->owner->expected_attach_type != fp->expected_attach_type)
+			ret = false;
 		for_each_cgroup_storage_type(i) {
 			if (!ret)
 				break;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:20:17 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367581; cv=none; b=uDMLe48HzVxjD/161D5TaK9ScxD0WYf9dVcL0d9VdvihJ+9/MEEu7X7TblNcOkZze8GSeRjG6jkdDb8z1xedpb/fX0D9QPea6ApJBPKa7BCCAo2fJ4swPzXi/7DfUrgoe0Ezqq0JlGOgzH3ivLbYSf4pAVaQyKGZW1x4tY5zMyM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367581; c=relaxed/simple;
	bh=28Fa+r6r9ehmUSj2dWg5hKeOrat5OaNL+BJwUpXp3pw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=KmCrIstdlxsUo+eDnHW+oEztKiGVSGhVGJ7/x8XxjvYSSp6lHS1j67eb3sToh2XF7FKaXRbJwELn4uQC2FafT+BJ1aoEGVDfQascXIPA4fIVurNQ/SWUPMJ/xfAPaLM4iTxb41yexB5yVebVL/h/5gdq+dA9eBxHtC9689jT1ic=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2OAlCIx4; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Kohei Ito <[email-masked]>,
	Kunihiko Hayashi <[email-masked]>,
	Jarkko Nikula <[email-masked]>,
	Wolfram Sang <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 060/196] i2c: designware: Add disabling clocks when probe fails
Date: Mon, 13 Oct 2025 16:44:11 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kunihiko Hayashi <[email-masked]>

[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]

After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is
called. However, this function doesn't disable clocks and the clock-enable
count keeps increasing. Should disable these clocks explicitly.

Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
Co-developed-by: Kohei Ito <[email-masked]>
Signed-off-by: Kohei Ito <[email-masked]>
Signed-off-by: Kunihiko Hayashi <[email-masked]>
Acked-by: Jarkko Nikula <[email-masked]>
Signed-off-by: Wolfram Sang <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i2c/busses/i2c-designware-platdrv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index ca6e1991ad13f..e6fa6cb1011ab 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -394,6 +394,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
 
 exit_probe:
 	dw_i2c_plat_pm_cleanup(dev);
+	i2c_dw_prepare_clk(dev, false);
 exit_reset:
 	reset_control_assert(dev->rst);
 	return ret;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:20:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367578; cv=none; b=JtyKjR8wLRLJbw4By/tz7X1HOdnMvM0MFQTILn0jnyl8YBO90q5s3SG4gBmA7wM4RsZr5XEosfThpyTv72fWi6KpJNazBRTpU97O87WV9eU2lFhyN/Iys/vg4qvHJk1K5HJgmzEzkf0i3ICSks7DBaku9Gaj3TbPaC3W095Ivek=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367578; c=relaxed/simple;
	bh=XnuOr/RmAVBt5WijjpKFXlDIGoFNH89zU85Qo13jdRk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=O23hJUKRBn1JIkd7jw7i1U6Xo7zm7vu3I2P2G0wsMVSKQ/MLROBDWvBsJgw++D5Bl5rIG7fIw9XZ7M59snCcouVqJNEfr3ZLi1Xnk0U6hJdFwTnnaQ5xe+RAFMDl1DsRfKRGj/JEIsXJZDCteCDiIZAZbP6J6SCKW7zcU9kJ7gk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KxPPz8Vm; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Kohei Ito <[email-masked]>,
	Kunihiko Hayashi <[email-masked]>,
	Jarkko Nikula <[email-masked]>,
	Wolfram Sang <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 059/196] i2c: designware: Fix clock issue when PM is disabled
Date: Mon, 13 Oct 2025 16:44:10 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kunihiko Hayashi <[email-masked]>

[ Upstream commit 70e633bedeeb4a7290d3b1dd9d49cc2bae25a46f ]

When the driver is removed, the clocks are first enabled by
calling pm_runtime_get_sync(), and then disabled with
pm_runtime_put_sync().

If CONFIG_PM=y, clocks for this controller are disabled when it's in
the idle state. So the clocks are properly disabled when the driver
exits.

Othewise, the clocks are always enabled and the PM functions have
no effect. Therefore, the driver exits without disabling the clocks.

    # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
    18
    # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/bind
    # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
    20
    # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/unbind
    # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
    20

To ensure that the clocks can be disabled correctly even without
CONFIG_PM=y, should add the following fixes:

- Replace with pm_runtime_put_noidle(), which only decrements the runtime
  PM usage count.
- Call i2c_dw_prepare_clk(false) to explicitly disable the clocks.

Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
Co-developed-by: Kohei Ito <[email-masked]>
Signed-off-by: Kohei Ito <[email-masked]>
Signed-off-by: Kunihiko Hayashi <[email-masked]>
Tested-by: Jarkko Nikula <[email-masked]>
Acked-by: Jarkko Nikula <[email-masked]>
Signed-off-by: Wolfram Sang <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i2c/busses/i2c-designware-platdrv.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 1ebcf5673a06b..ca6e1991ad13f 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -411,9 +411,11 @@ static void dw_i2c_plat_remove(struct platform_device *pdev)
 	i2c_dw_disable(dev);
 
 	pm_runtime_dont_use_autosuspend(device);
-	pm_runtime_put_sync(device);
+	pm_runtime_put_noidle(device);
 	dw_i2c_plat_pm_cleanup(dev);
 
+	i2c_dw_prepare_clk(dev, false);
+
 	i2c_dw_remove_lock_support(dev);
 
 	reset_control_assert(dev->rst);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:20:04 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367575; cv=none; b=WvK7Z/jaI6kqvvvbqlcLVkNa9PXbDjtJl7oVZup1V7no6mW7RNJUFk3l6eOxid23uVgXTnKEzmgVTHkhPmuC5ZV0o8hqv/ZBQi3bz4q7wg2Q8YpG6wSk28omvaZaez0rwTcTtlvDaYmqgNyEMHhs79oMbvmRa7amZs+AjAVb1p8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367575; c=relaxed/simple;
	bh=jvjwU3UFKyakl6j35gy5D111aTt5mZEcu5Be5l1xUss=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=kRRLIJr4abvWxP+wmPHrVtWXO3FL7kwJj9DcjwHhItsuTHYDWJlLxSPkL9rhgaDGH9wUsOQL4mOhWSAEinGLmCTadydDkd8UejFSPWD+FbeNeHmYtET6rL3eieyHV8Ot03ji6ipzqqpgKvKiDBt9ZYxcnmG+nIX/vsmmSLmYRlU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=X+rZ3Fxu; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	"Leilk.Liu" <[email-masked]>,
	Chen-Yu Tsai <[email-masked]>,
	Wolfram Sang <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 058/196] i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
Date: Mon, 13 Oct 2025 16:44:09 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leilk.Liu <[email-masked]>

[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]

The old IC does not support the I2C_MASTER_WRRD (write-then-read)
function, but the current code’s handling of i2c->auto_restart may
potentially lead to entering the I2C_MASTER_WRRD software flow,
resulting in unexpected bugs.

Instead of repurposing the auto_restart flag, add a separate flag
to signal I2C_MASTER_WRRD operations.

Also fix handling of msgs. If the operation (i2c->op) is
I2C_MASTER_WRRD, then the msgs pointer is incremented by 2.
For all other operations, msgs is simply incremented by 1.

Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller")
Signed-off-by: Leilk.Liu <[email-masked]>
Suggested-by: Chen-Yu Tsai <[email-masked]>
Reviewed-by: Chen-Yu Tsai <[email-masked]>
Signed-off-by: Wolfram Sang <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
index 1a9b5a068ef1b..6b788bca64d54 100644
--- a/drivers/i2c/busses/i2c-mt65xx.c
+++ b/drivers/i2c/busses/i2c-mt65xx.c
@@ -1243,6 +1243,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
 {
 	int ret;
 	int left_num = num;
+	bool write_then_read_en = false;
 	struct mtk_i2c *i2c = i2c_get_adapdata(adap);
 
 	ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
@@ -1256,6 +1257,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
 		if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
 		    msgs[0].addr == msgs[1].addr) {
 			i2c->auto_restart = 0;
+			write_then_read_en = true;
 		}
 	}
 
@@ -1280,12 +1282,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
 		else
 			i2c->op = I2C_MASTER_WR;
 
-		if (!i2c->auto_restart) {
-			if (num > 1) {
-				/* combined two messages into one transaction */
-				i2c->op = I2C_MASTER_WRRD;
-				left_num--;
-			}
+		if (write_then_read_en) {
+			/* combined two messages into one transaction */
+			i2c->op = I2C_MASTER_WRRD;
+			left_num--;
 		}
 
 		/* always use DMA mode. */
@@ -1293,7 +1293,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
 		if (ret < 0)
 			goto err_exit;
 
-		msgs++;
+		if (i2c->op == I2C_MASTER_WRRD)
+			msgs += 2;
+		else
+			msgs++;
 	}
 	/* the return value is number of executed messages */
 	ret = num;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:19:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367569; cv=none; b=P+N+KJTW0abIgYEI9yqpWsZSdF2eauuiRfAJFz/oQZaWw8+zuAfAWrd0umWLeq8fohEEDM7XJWFRpsawyBHlm3jL56HMsUiuWiBxyXkZKHBMHy1EJBziJi30lYCC2AsKl738BssV12lFUO487glzo8z3/cPjt1dwUKGVaIXS9xQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367569; c=relaxed/simple;
	bh=T+Y+b0noHjUun1nrwhM7bNXOu88b/NrOK4CBDhMhOVg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=IlFD8yR5g2piITEOcupfIFR0bG4NcU8mC9qMP/ZzUHG/GyVuQtrqo43bysJXVg6XpIUUwdQx+SnkNbIcSKsKUxHqqDjuYdApWoqzFbjtDceYQDLsXeTwNqXHaO2xqUQoYnw3nqEiT/sVTLwuWoHZxFYj/w1gQgvygHVG4gIFvZ8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=udgr+1VL; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	kernel test robot <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Daniel Lezcano <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 057/196] thermal/drivers/qcom/lmh: Add missing IRQ includes
Date: Mon, 13 Oct 2025 16:44:08 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Baryshkov <[email-masked]>

[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ]

As reported by LKP, the Qualcomm LMH driver needs to include several
IRQ-related headers, which decrlare necessary IRQ functionality.
Currently driver builds on ARM64 platforms, where the headers are pulled
in implicitly by other headers, but fails to build on other platforms.

Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver")
Reported-by: kernel test robot <[email-masked]>
Closes: https://lore.kernel.org/oe-kbuild-all/[email-masked]/
Signed-off-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Daniel Lezcano <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/thermal/qcom/lmh.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c
index d2d49264cf83a..7c299184c59b1 100644
--- a/drivers/thermal/qcom/lmh.c
+++ b/drivers/thermal/qcom/lmh.c
@@ -5,6 +5,8 @@
  */
 #include <linux/module.h>
 #include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/irqdesc.h>
 #include <linux/irqdomain.h>
 #include <linux/err.h>
 #include <linux/platform_device.h>
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:15:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367566; cv=none; b=cWbmip9tcUPgiCZ43sfmYvfXJ61QAqZ6BLTEjhg3VKwiavX2lP96cHdxq3s1xqQ/YDloaSb5iyP6bjWt3HcYtCqgTFGROEXkPH8VgYVldA76RVWR2wi0DuuPfBhG/5VIKyQkgBrwVGWYCTD7jREwtuWkHBJTGZiCTcZpLDDDIFY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367566; c=relaxed/simple;
	bh=1UTQFgpw2MrrYKzUHdIZid8TNIAQZIhakzYqtn53Wvk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=GFRq/uqjjT6Z8JhoBPCRYgOpyt4cw8WSGezj9TV1Fsv7i6Qb5YZjxIwZqYz44OBw1luI2PXBg/GNBpNhIAz5CMJ5XIgyoFjOxAiwKGLOQC3u/4JQiBtkMZDyKCiOssltojXVJMAHYxkX3NIPVN2eQpHfNsKdpruh4XbqHdvuzK4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=kJT5B1BN; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dmitry Baryshkov <[email-masked]>,
	Daniel Lezcano <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 056/196] thermal/drivers/qcom: Make LMH select QCOM_SCM
Date: Mon, 13 Oct 2025 16:44:07 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Baryshkov <[email-masked]>

[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ]

The QCOM_SCM symbol is not user-visible, so it makes little sense to
depend on it. Make LMH driver select QCOM_SCM as all other drivers do
and, as the dependecy is now correctly handled, enable || COMPILE_TEST
in order to include the driver into broader set of build tests.

Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM")
Signed-off-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Daniel Lezcano <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/thermal/qcom/Kconfig | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig
index 2c7f3f9a26ebb..a6bb01082ec69 100644
--- a/drivers/thermal/qcom/Kconfig
+++ b/drivers/thermal/qcom/Kconfig
@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM
 
 config QCOM_LMH
 	tristate "Qualcomm Limits Management Hardware"
-	depends on ARCH_QCOM && QCOM_SCM
+	depends on ARCH_QCOM || COMPILE_TEST
+	select QCOM_SCM
 	help
 	  This enables initialization of Qualcomm limits management
 	  hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:15:44 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367563; cv=none; b=edBjn83TY2zCbP0THjiunsfa5lDap74oL4MNDhEoJgiA/NeRV/KhyOGUB1UFaSWzVGiPqPUGdo3T1bPBgcblrHMBF1ZHc9ORG9vR0uDYGQexr7YwFDdKiRF+wXiZ5ITZfNT9MC2hjnJb/imGE1cKL8uULlVFIZv/AUG4SNtBUzQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367563; c=relaxed/simple;
	bh=UvSLSIzLMmHkK4Z3x9au4R6fUeR7lF3Sjt8cSIv8mEc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=oxxRCQoAAXCBhZXiN5qVF4wczvuxGkaa5N+haNJmJMmhGyBU7QJR3PSw5wzyryewiOzPyvAgYwDvScisydnn9AcnzvMUVoE5OzKhN2fWff4wL+AWxetU1I5pLughOvKil4OCjoRSA8nLGqhQNxqJzgBRUCs70TCFD0Xu/8VC1/s=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Cm02bJLw; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Vadim Pasternak <[email-masked]>,
	Guenter Roeck <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 055/196] hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems
Date: Mon, 13 Oct 2025 16:44:06 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vadim Pasternak <[email-masked]>

[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ]

Distinct between fan speed setting request coming for hwmon and
thermal subsystems.

There are fields 'last_hwmon_state' and 'last_thermal_state' in the
structure 'mlxreg_fan_pwm', which respectively store the cooling state
set by the 'hwmon' and 'thermal' subsystem.
The purpose is to make arbitration of fan speed setting. For example, if
fan speed required to be not lower than some limit, such setting is to
be performed through 'hwmon' subsystem, thus 'thermal' subsystem will
not set fan below this limit.

Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing
cooling state to never be set to a lower value.

Eliminate update of 'last_thermal_state', when request is coming from
'hwmon' subsystem.

Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit")
Signed-off-by: Vadim Pasternak <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Guenter Roeck <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
index c25a54d5b39ad..0ba9195c9d713 100644
--- a/drivers/hwmon/mlxreg-fan.c
+++ b/drivers/hwmon/mlxreg-fan.c
@@ -113,8 +113,8 @@ struct mlxreg_fan {
 	int divider;
 };
 
-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
-				    unsigned long state);
+static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+				     unsigned long state, bool thermal);
 
 static int
 mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,
@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr,
 				 * last thermal state.
 				 */
 				if (pwm->last_hwmon_state >= pwm->last_thermal_state)
-					return mlxreg_fan_set_cur_state(pwm->cdev,
-									pwm->last_hwmon_state);
+					return _mlxreg_fan_set_cur_state(pwm->cdev,
+									 pwm->last_hwmon_state,
+									 false);
 				return 0;
 			}
 			return regmap_write(fan->regmap, pwm->reg, val);
@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev,
 	return 0;
 }
 
-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
-				    unsigned long state)
-
+static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+				     unsigned long state, bool thermal)
 {
 	struct mlxreg_fan_pwm *pwm = cdev->devdata;
 	struct mlxreg_fan *fan = pwm->fan;
@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
 		return -EINVAL;
 
 	/* Save thermal state. */
-	pwm->last_thermal_state = state;
+	if (thermal)
+		pwm->last_thermal_state = state;
 
 	state = max_t(unsigned long, state, pwm->last_hwmon_state);
 	err = regmap_write(fan->regmap, pwm->reg,
@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
 	return 0;
 }
 
+static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+				    unsigned long state)
+
+{
+	return _mlxreg_fan_set_cur_state(cdev, state, true);
+}
+
 static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {
 	.get_max_state	= mlxreg_fan_get_max_state,
 	.get_cur_state	= mlxreg_fan_get_cur_state,
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:27:29 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367561; cv=none; b=TlGeVgTTMBWm63lvY02wcJpZ/td4vXVAMwrOfIFmubMzOVYfEKZHyHe/r0vPLn2PyNlyJs6Ed4SP9OxxIwcmzsxjsjsBOo1yw+Wu9Xuwmm1ZZF35O09mOP3wRngzNmib6IHm89drus1qwGIPMLZnKSMiXDRT0oYDaj3R+AHwX/s=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367561; c=relaxed/simple;
	bh=n3SyVGj4VRI4m/jvFuSfXFIvL6F11XQ4rRWj6YFbbSU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=PwcCG9KeLNIB7tBiRziKyTAhrXsMSzV+1lBYnt+SbNhgERWiuAE4BygDqdHbgbpzXWRBptQewgE3YOdC4BJJK9d0QA1aSIZTly7PpDo8VXUQz5Ss6UXP5wAgC4d3qeBEpFn1RE2AlXhRxoSaFr78wlmv4hp4PA0A0CzqjUx0Re8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Z8Fz9aud; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Hulk Robot <[email-masked]>,
	Qi Xi <[email-masked]>,
	Arnd Bergmann <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 054/196] once: fix race by moving DO_ONCE to separate section
Date: Mon, 13 Oct 2025 16:44:05 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qi Xi <[email-masked]>

[ Upstream commit edcc8a38b5ac1a3dbd05e113a38a25b937ebefe5 ]

The commit c2c60ea37e5b ("once: use __section(".data.once")") moved
DO_ONCE's ___done variable to .data.once section, which conflicts with
DO_ONCE_LITE() that also uses the same section.

This creates a race condition when clear_warn_once is used:

Thread 1 (DO_ONCE)             Thread 2 (DO_ONCE)
__do_once_start
    read ___done (false)
    acquire once_lock
execute func
__do_once_done
    write ___done (true)      __do_once_start
    release once_lock             // Thread 3 clear_warn_once reset ___done
                                  read ___done (false)
                                  acquire once_lock
                              execute func
schedule once_work            __do_once_done
once_deferred: OK             write ___done (true)
static_branch_disable         release once_lock
                              schedule once_work
                              once_deferred:
                                  BUG_ON(!static_key_enabled)

DO_ONCE_LITE() in once_lite.h is used by WARN_ON_ONCE() and other warning
macros. Keep its ___done flag in the .data..once section and allow resetting
by clear_warn_once, as originally intended.

In contrast, DO_ONCE() is used for functions like get_random_once() and
relies on its ___done flag for internal synchronization. We should not reset
DO_ONCE() by clear_warn_once.

Fix it by isolating DO_ONCE's ___done into a separate .data..do_once section,
shielding it from clear_warn_once.

Fixes: c2c60ea37e5b ("once: use __section(".data.once")")
Reported-by: Hulk Robot <[email-masked]>
Signed-off-by: Qi Xi <[email-masked]>
Signed-off-by: Arnd Bergmann <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 include/asm-generic/vmlinux.lds.h | 1 +
 include/linux/once.h              | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index cf3f8b9bf43f0..010ac18c05916 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -351,6 +351,7 @@
 	__start_once = .;						\
 	*(.data..once)							\
 	__end_once = .;							\
+	*(.data..do_once)						\
 	STRUCT_ALIGN();							\
 	*(__tracepoints)						\
 	/* implement dynamic printk debug */				\
diff --git a/include/linux/once.h b/include/linux/once.h
index 30346fcdc7995..449a0e34ad5ad 100644
--- a/include/linux/once.h
+++ b/include/linux/once.h
@@ -46,7 +46,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
 #define DO_ONCE(func, ...)						     \
 	({								     \
 		bool ___ret = false;					     \
-		static bool __section(".data..once") ___done = false;	     \
+		static bool __section(".data..do_once") ___done = false;     \
 		static DEFINE_STATIC_KEY_TRUE(___once_key);		     \
 		if (static_branch_unlikely(&___once_key)) {		     \
 			unsigned long ___flags;				     \
@@ -64,7 +64,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
 #define DO_ONCE_SLEEPABLE(func, ...)						\
 	({									\
 		bool ___ret = false;						\
-		static bool __section(".data..once") ___done = false;		\
+		static bool __section(".data..do_once") ___done = false;	\
 		static DEFINE_STATIC_KEY_TRUE(___once_key);			\
 		if (static_branch_unlikely(&___once_key)) {			\
 			___ret = __do_once_sleepable_start(&___done);		\
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:42:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367558; cv=none; b=p3Fsnw78T4Z8WcCcjoYX+4w4HEcWXja0rcGUrPJK7yq5dMaTTg+l2iOIMzu+aVPDMqjiMsV7xJhvVk8iXmgGrhG+mdstEsKnEAo9o0Q6DjjHRQgi2cwzDTC0o4xyK9ugWDjZ0AuMBNK0qQhFYfTWaTPEVvMiXeT5sZw+UrZ8sGE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367558; c=relaxed/simple;
	bh=b6ASlOpD/jTo+cIPb2Gv+ygn+ksZ5qVlkPVU6x4v1gc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=XSXCKTzW7TyhmMcFPgJP0gewBZn1CRiZnYYwkXic2DU3SmeAIy86Y+tgViNnFv6xLnUoQ6eXNLL+TPXLixHsIsDAG6HuCjYefuM5jwIy1GMu6/tcy9COY//6KW5TjJASdKwZeVPa9D8QxM+w6PsV+IrPmHiA+jvvknWSACi46Ws=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=qjdbx7Rp; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhouyi Zhou <[email-masked]>,
	=?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 053/196] tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
Date: Mon, 13 Oct 2025 16:44:04 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhouyi Zhou <[email-masked]>

[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ]

Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of
__kernel_old_time_t") made nolibc use the kernel's time type so that
`time_t` matches `timespec::tv_sec` on all ABIs (notably x32).

But since __kernel_old_time_t is fairly new, notably from 2020 in commit
94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"),
nolibc builds that rely on host headers may fail.

Switch to __kernel_time_t, which is the same as __kernel_old_time_t and
has existed for longer.

Tested in PPC VM of Open Source Lab of Oregon State University
(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh)

Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t")
Signed-off-by: Zhouyi Zhou <[email-masked]>
[Thomas: Reformat commit and its message a bit]
Signed-off-by: Thomas Weißschuh <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/include/nolibc/std.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h
index a9d8b5b51f37f..f24953f8b949c 100644
--- a/tools/include/nolibc/std.h
+++ b/tools/include/nolibc/std.h
@@ -33,6 +33,6 @@ typedef unsigned long       nlink_t;
 typedef   signed long         off_t;
 typedef   signed long     blksize_t;
 typedef   signed long      blkcnt_t;
-typedef __kernel_old_time_t  time_t;
+typedef __kernel_time_t      time_t;
 
 #endif /* _NOLIBC_STD_H */
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:35:41 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367555; cv=none; b=gq6H6P6tSIBBUSWb23I7knJ8BG8ibWDgfKSmHKfGMedMj+jZvPzKCmK6UrL0uPrktaf147/9Cc48z6Gw9I4551o1ygSF5cvqq/d2gNbb3lhnCvp254vhBidDoqzRMPgeBtpgo9JUtl50C50Ad/0/H/xk1kl2DVTQ54cKEZRHHn0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367555; c=relaxed/simple;
	bh=ZFW2VZ7JVqK3R25+cb+EbL/2vM7Vsil5ZAgWLnIipVw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=dhcoaIL9ZWThXdrylTXhEngjscK7rDPiF3si5gKZj216U9JuUgIBEpgvoVgWqdouHNO4Sblz5cWvR8WsMSPQG6YxSHnPt7IgJXwp6/GMmdX01cI8+7lBQ0lie57Ii6A4i4M2LlrKBOP3ik1RJmXAG2CQjHR5/8Zi/NZu5gu/zxw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OzevZmZY; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	"Rafael J. Wysocki" <[email-masked]>,
	Thomas Gleixner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 052/196] smp: Fix up and expand the smp_call_function_many() kerneldoc
Date: Mon, 13 Oct 2025 16:44:03 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email-masked]>

[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ]

The smp_call_function_many() kerneldoc comment got out of sync with the
function definition (bool parameter "wait" is incorrectly described as a
bitmask in it), so fix it up by copying the "wait" description from the
smp_call_function() kerneldoc and add information regarding the handling
of the local CPU to it.

Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings")
Signed-off-by: Rafael J. Wysocki <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/smp.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/kernel/smp.c b/kernel/smp.c
index 3eeffeaf5450c..13b376c7296a5 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -862,16 +862,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask,
  * @mask: The set of cpus to run on (only runs on online subset).
  * @func: The function to run. This must be fast and non-blocking.
  * @info: An arbitrary pointer to pass to the function.
- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait
- *        (atomically) until function has completed on other CPUs. If
- *        %SCF_RUN_LOCAL is set, the function will also be run locally
- *        if the local CPU is set in the @cpumask.
- *
- * If @wait is true, then returns once @func has returned.
+ * @wait: If true, wait (atomically) until function has completed
+ *        on other CPUs.
  *
  * You must not call this function with disabled interrupts or from a
  * hardware interrupt handler or from a bottom half handler. Preemption
  * must be disabled when calling this function.
+ *
+ * @func is not called on the local CPU even if @mask contains it.  Consider
+ * using on_each_cpu_cond_mask() instead if this is not desirable.
  */
 void smp_call_function_many(const struct cpumask *mask,
 			    smp_call_func_t func, void *info, bool wait)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:34:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367552; cv=none; b=ee9vgvyuvtwWapHNDViN1ow2MtZIU5EDOeZ36RtSOLwoYXdqfGFaQXzLiXkr8iS12gy3JJe56Izba7yYFU+4KbnzEXFxfK5dkGjc0yXm+9eN6Dg3Yrq/1D3UUfUq6evke1QiOw0Igu4ajth2ypfG+okfdx6gjsQKizSBNCWZrDw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367552; c=relaxed/simple;
	bh=u5jr6tc03Zs8to21XcncneidQRWDx0qP/S5vWMn3aR0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=GtHd8oBU8L/qZ5F2Zeaegvt20wodB5FlDikLhIVj7A08L++j2mSlncrOoZLJ9WJlU6Hdd2ZaRf7H4hoWRn+MjztSdTiYHWbbpCnfVRuFUJTfIcQ5e6418YjZChDiK5KGvUHnDy8DQGJEI9vmV1XJbSI1HlNS8Wq1g7ElDr9RA80=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=A1X0ladP; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Paul Chaignon <[email-masked]>,
	Daniel Borkmann <[email-masked]>,
	Eduard Zingerman <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 051/196] bpf: Explicitly check accesses to bpf_sock_addr
Date: Mon, 13 Oct 2025 16:44:02 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: syzkaller.appspot.com]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paul Chaignon <[email-masked]>

[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]

Syzkaller found a kernel warning on the following sock_addr program:

    0: r0 = 0
    1: r2 = *(u32 *)(r1 +60)
    2: exit

which triggers:

    verifier bug: error during ctx access conversion (0)

This is happening because offset 60 in bpf_sock_addr corresponds to an
implicit padding of 4 bytes, right after msg_src_ip4. Access to this
padding isn't rejected in sock_addr_is_valid_access and it thus later
fails to convert the access.

This patch fixes it by explicitly checking the various fields of
bpf_sock_addr in sock_addr_is_valid_access.

I checked the other ctx structures and is_valid_access functions and
didn't find any other similar cases. Other cases of (properly handled)
padding are covered in new tests in a subsequent patch.

Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
Reported-by: [email-masked]
Signed-off-by: Paul Chaignon <[email-masked]>
Signed-off-by: Daniel Borkmann <[email-masked]>
Acked-by: Eduard Zingerman <[email-masked]>
Acked-by: Daniel Borkmann <[email-masked]>
Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
Link: https://lore.kernel.org/bpf/b5860[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/core/filter.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index 7afb7658c3883..b6dbcef649654 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -9156,13 +9156,17 @@ static bool sock_addr_is_valid_access(int off, int size,
 			return false;
 		info->reg_type = PTR_TO_SOCKET;
 		break;
-	default:
-		if (type == BPF_READ) {
-			if (size != size_default)
-				return false;
-		} else {
+	case bpf_ctx_range(struct bpf_sock_addr, user_family):
+	case bpf_ctx_range(struct bpf_sock_addr, family):
+	case bpf_ctx_range(struct bpf_sock_addr, type):
+	case bpf_ctx_range(struct bpf_sock_addr, protocol):
+		if (type != BPF_READ)
 			return false;
-		}
+		if (size != size_default)
+			return false;
+		break;
+	default:
+		return false;
 	}
 
 	return true;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:27:33 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367549; cv=none; b=nxQa52N+BsU1ThT2/zwAH/oPQ8Ru+OPf1XCFk1e9Tuzs/Qkg024FWHi1CwUCVW7cZs9KseUA3H5tnb4Y+YNJcXkrKa+ZJON8UvW/0XmlLz+9lD1seUCyP9hQ8aHiY05F54NIs6Q2FeYaimovukjg/yl0p+/ybdumssL36iAhv+4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367549; c=relaxed/simple;
	bh=EuPLMqcjXDyAnxblXxaQNEopbZ1aFD4LUJ3hS0JRhr0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=GHjD5PbVbIMqGWkHtDEmI4mYkm1c5RXSnXH0vqAK3PWGR+mJhqywnSOR01k/NIyZJLGo+nGmdurCG9461BzGcr90H1lNHWDJNfGtZ2eEXxdQAkpD5rgoWrjnyadyn/dDil3rq7IyyYkOqYI/mZ2t7KEOO1MCGlSU3yCF17R/DXQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=jaUsaePe; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Akhilesh Patil <[email-masked]>,
	Shuah Khan <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 050/196] selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
Date: Mon, 13 Oct 2025 16:44:01 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Akhilesh Patil <[email-masked]>

[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]

Check if watchdog device supports WDIOF_KEEPALIVEPING option before
entering keep_alive() ping test loop. Fix watchdog-test silently looping
if ioctl based ping is not supported by the device. Exit from test in
such case instead of getting stuck in loop executing failing keep_alive()

watchdog_info:
 identity:              m41t93 rtc Watchdog
 firmware_version:      0
Support/Status: Set timeout (in seconds)
Support/Status: Watchdog triggers a management or other external alarm not a reboot

Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.
WDIOC_KEEPALIVE not supported by this device

without this change
Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.
Watchdog Ticking Away!
(Where test stuck here forver silently)

Updated change log at commit time:
Shuah Khan <[email-masked]>

Link: https://lore.kernel.org/r/[email-masked]
Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path")
Signed-off-by: Akhilesh Patil <[email-masked]>
Signed-off-by: Shuah Khan <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
index a1f506ba55786..4f09c5db0c7f3 100644
--- a/tools/testing/selftests/watchdog/watchdog-test.c
+++ b/tools/testing/selftests/watchdog/watchdog-test.c
@@ -332,6 +332,12 @@ int main(int argc, char *argv[])
 	if (oneshot)
 		goto end;
 
+	/* Check if WDIOF_KEEPALIVEPING is supported */
+	if (!(info.options & WDIOF_KEEPALIVEPING)) {
+		printf("WDIOC_KEEPALIVE not supported by this device\n");
+		goto end;
+	}
+
 	printf("Watchdog Ticking Away!\n");
 
 	/*
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:33:28 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367546; cv=none; b=hdLPYxbgyoWNXLcxqYNQF9ki5rbHlFknYg3c/NbjsODIp140OXkrCrbmLfkGEoVbT8WlP4hOhAd7GWkcPYU5u+X9q0EzmiV8AuRz63a+0ZSkulqVvv1d4Kk/P0Rk5HLpDM68mh6f+f+k/yjrGQZb7ONelhVVZjzvurcK0fet49I=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367546; c=relaxed/simple;
	bh=Ycis8vmIwAzRvUPrJlfRIt6VjBJBwPS7+JBdlUzMr4E=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=P07S+ZoeV9tIeb+cgo/IktrJS71y4QtTdvejXf5kB1Y3WwEBxQZRZOQBCCU9OjNpslUcnIy3a4qjdjN1AfLyWktnrJ/2k8mTOPnTDM/P2nWCxIx0fx31b5KSeJ2Uby7lMkcSmZgxaitLYU+5DWST73xpA6FeQhRKVgUMmBzd5Uo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=r1CGzyFZ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Stanley Chu <[email-masked]>,
	Frank Li <[email-masked]>,
	Alexandre Belloni <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 049/196] i3c: master: svc: Recycle unused IBI slot
Date: Mon, 13 Oct 2025 16:44:00 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stanley Chu <[email-masked]>

[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ]

In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool
to store the IBI payload. However, when an error condition is encountered,
the function returns without recycling the IBI slot, resulting in an IBI
slot leak.

Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte")
Signed-off-by: Stanley Chu <[email-masked]>
Reviewed-by: Frank Li <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexandre Belloni <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i3c/master/svc-i3c-master.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index 1cfc8f480d15c..277884b5e1ca4 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -369,6 +369,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,
 						SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000);
 	if (ret) {
 		dev_err(master->dev, "Timeout when polling for COMPLETE\n");
+		i3c_generic_ibi_recycle_slot(data->ibi_pool, slot);
 		return ret;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:19:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367543; cv=none; b=L5cYo9/ejKUVbcMGwZ0MwfW4MYncUaTBA9v1ZeL9ritf++JqptA2LirVduTDbWXTtTTVBjQePV0B9eT6YF/r3cOAz6jt8YS94FhcsxMeRr9+G78/aQkxxqf2un6tiPK9CWsKka3P6mQayYm06xXh9jtFGzk5OWnvMKWpFn036Zs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367543; c=relaxed/simple;
	bh=AWYyWQGHJFQiRBnPvYrzJHTtPdsEi5SMrNah28WRMfk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ZfjN0JAoo9prYGVG2l99/mUBIRxbybdcdc6CWcIsL4qwNk8WoEnT7rBYhLGalh4BIGjxUO/JbuykOExM+VcfHlnKyr/DhAG1whLWum2k1UOOfx0fAdEWS4nEqVE0q9WyqTB7gzXrYTtXqHWBy+xkq8wg60HjpWYNyRyLGLax7/E=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aUFPkh6q; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Stanley Chu <[email-masked]>,
	Frank Li <[email-masked]>,
	Alexandre Belloni <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 048/196] i3c: master: svc: Use manual response for IBI events
Date: Mon, 13 Oct 2025 16:43:59 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stanley Chu <[email-masked]>

[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ]

Driver wants to nack the IBI request when the target is not in the
known address list. In below code, svc_i3c_master_nack_ibi() will
cause undefined behavior when using AUTOIBI with auto response rule,
because hw always auto ack the IBI request.

    switch (ibitype) {
    case SVC_I3C_MSTATUS_IBITYPE_IBI:
            dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
            if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
                    svc_i3c_master_nack_ibi(master);
            ...
            break;

AutoIBI has another issue that the controller doesn't quit AutoIBI state
after IBIWON polling timeout when there is a SDA glitch(high->low->high).
1. SDA high->low: raising an interrupt to execute IBI ISR
2. SDA low->high
3. Driver writes an AutoIBI request
4. AutoIBI process does not start because SDA is not low
5. IBIWON polling times out
6. Controller reamins in AutoIBI state and doesn't accept EmitStop request

Emitting broadcast address with IBIRESP_MANUAL avoids both issues.

Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
Signed-off-by: Stanley Chu <[email-masked]>
Reviewed-by: Frank Li <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexandre Belloni <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index d1630d47ef6fc..1cfc8f480d15c 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -430,9 +430,24 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
 	 */
 	writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS);
 
-	/* Acknowledge the incoming interrupt with the AUTOIBI mechanism */
-	writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI |
-	       SVC_I3C_MCTRL_IBIRESP_AUTO,
+	/*
+	 * Write REQUEST_START_ADDR request to emit broadcast address for arbitration,
+	 * instend of using AUTO_IBI.
+	 *
+	 * Using AutoIBI request may cause controller to remain in AutoIBI state when
+	 * there is a glitch on SDA line (high->low->high).
+	 * 1. SDA high->low, raising an interrupt to execute IBI isr.
+	 * 2. SDA low->high.
+	 * 3. IBI isr writes an AutoIBI request.
+	 * 4. The controller will not start AutoIBI process because SDA is not low.
+	 * 5. IBIWON polling times out.
+	 * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request.
+	 */
+	writel(SVC_I3C_MCTRL_REQUEST_START_ADDR |
+	       SVC_I3C_MCTRL_TYPE_I3C |
+	       SVC_I3C_MCTRL_IBIRESP_MANUAL |
+	       SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) |
+	       SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR),
 	       master->regs + SVC_I3C_MCTRL);
 
 	/* Wait for IBIWON, should take approximately 100us */
@@ -452,10 +467,15 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
 	switch (ibitype) {
 	case SVC_I3C_MSTATUS_IBITYPE_IBI:
 		dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
-		if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
+		if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) {
 			svc_i3c_master_nack_ibi(master);
-		else
+		} else {
+			if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD)
+				svc_i3c_master_ack_ibi(master, true);
+			else
+				svc_i3c_master_ack_ibi(master, false);
 			svc_i3c_master_handle_ibi(master, dev);
+		}
 		break;
 	case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN:
 		if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN))
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:41:59 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367538; cv=none; b=GMDXtoOyDbR7tmCf4Pwg0GVgOsOk9g0wyCYZvBoemob4cBlqtVdW+r7U8XgywaZStU1ZUFMxbzvDOETu7x4VRJE+eeCM+FTaGS9Eg25t0mC+AO07WqO9Zmbr4whw+ERQOKpx9Py1CruETsAUVKlX086rfiXzkY/quH3Azfm2eX8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367538; c=relaxed/simple;
	bh=x6xxSVgWsjtpbL8srsAucF6oelHQrGUGpm7jG+LGcKw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=ho9R/vRiEiD1n+Nn20KFN3QymL25+c65QRwOFD7SzQNrWuiAW0CuRP8ww91PBz266hlWJkKQ4W7SniuRyokCFJUsLW0aXD/EIVNU0T1wG66pfTYkJSOI7k/M6+wazorSH+4wJKeztYwvVVBJkpUwqvy7dJkwsPNoxIcSGJd6TyU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=RUuxUWil; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Hannes Reinecke <[email-masked]>,
	Daniel Wagner <[email-masked]>,
	Keith Busch <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 047/196] nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
Date: Mon, 13 Oct 2025 16:43:58 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Wagner <[email-masked]>

[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ]

It’s possible for more than one async command to be in flight from
__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.

In the current code, only one put work item is queued at a time, which
results in a leaked reference.

To fix this, move the work item to the nvmet_fc_ls_req_op struct, which
already tracks all resources related to the command.

Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path")
Reviewed-by: Hannes Reinecke <[email-masked]>
Signed-off-by: Daniel Wagner <[email-masked]>
Signed-off-by: Keith Busch <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/nvme/target/fc.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 570c58d2b5a58..a15e764bae35b 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op {		/* for an LS RQST XMT */
 	int				ls_error;
 	struct list_head		lsreq_list; /* tgtport->ls_req_list */
 	bool				req_queued;
+
+	struct work_struct		put_work;
 };

@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport {
 	struct nvmet_fc_port_entry	*pe;
 	struct kref			ref;
 	u32				max_sg_cnt;
-
-	struct work_struct		put_work;
 };
 
 struct nvmet_fc_port_entry {
@@ -236,12 +236,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc);
 static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
 static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
 static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
-static void nvmet_fc_put_tgtport_work(struct work_struct *work)
+static void nvmet_fc_put_lsop_work(struct work_struct *work)
 {
-	struct nvmet_fc_tgtport *tgtport =
-		container_of(work, struct nvmet_fc_tgtport, put_work);
+	struct nvmet_fc_ls_req_op *lsop =
+		container_of(work, struct nvmet_fc_ls_req_op, put_work);
 
-	nvmet_fc_tgtport_put(tgtport);
+	nvmet_fc_tgtport_put(lsop->tgtport);
+	kfree(lsop);
 }
 static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
 static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
@@ -368,7 +369,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
 				  DMA_BIDIRECTIONAL);
 
 out_putwork:
-	queue_work(nvmet_wq, &tgtport->put_work);
+	queue_work(nvmet_wq, &lsop->put_work);
 }
 
 static int
@@ -389,6 +390,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport,
 	lsreq->done = done;
 	lsop->req_queued = false;
 	INIT_LIST_HEAD(&lsop->lsreq_list);
+	INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work);
 
 	lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr,
 				  lsreq->rqstlen + lsreq->rsplen,
@@ -448,8 +450,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status)
 	__nvmet_fc_finish_ls_req(lsop);
 
 	/* fc-nvme target doesn't care about success or failure of cmd */
-
-	kfree(lsop);
 }
 
 /*
@@ -1407,7 +1407,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
 	kref_init(&newrec->ref);
 	ida_init(&newrec->assoc_cnt);
 	newrec->max_sg_cnt = template->max_sgl_segments;
-	INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work);
 
 	ret = nvmet_fc_alloc_ls_iodlist(newrec);
 	if (ret) {
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:19:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367535; cv=none; b=KFwHElNPcKUWQBy4MKbZQDXnOdlshjuSwKRLkerVziKtwshC2Sdy0nDbwzEXffP5lUwO/+zzft/oy+WrJsvuIavQsGhzFoRfYGZuNmXtqlvqNXcHmm9vIMG+VMpURc+pihByGUiNNTmwWXuqkVhswas9QIriDdciNlxFxwspJUI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367535; c=relaxed/simple;
	bh=zgOvPNs38PSfSX9EtnAjbn2NIpR8JAVTKW/dYPcB6NE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=FYTnFXz+m6SbiKKm4Yy1HBYDdqhoPRpzHm+WS/g493LUF1EG7DgpC20D1lt96hvJl6EmLbpSVMNynfpUcRyDOqdrlcFq2xqyEYAB7AkJ36kRFD/9ulnX9WeDFBtQ2Q5+aqyBNyIMV5fnluGDVhXKH1OWsCW6gMRirTK2nIcdVhA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DcWA2d5o; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dmitry Antipov <[email-masked]>,
	"Rafael J. Wysocki" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 046/196] ACPICA: Fix largest possible resource descriptor index
Date: Mon, 13 Oct 2025 16:43:57 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Antipov <[email-masked]>

[ Upstream commit 8ca944fea4d6d9019e01f2d6f6e766f315a9d73f ]

ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually
used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT).

Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be
clamped incorrectly and resulting value may issue an out-of-bounds
access for 'acpi_gbl_resource_types' array. Compile tested only.

Fixes: 520d4a0ee5b6 ("ACPICA: add support for ClockInput resource (v6.5)")
Link: https://github.com/acpica/acpica/commit/cf00116c
Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2
Signed-off-by: Dmitry Antipov <[email-masked]>
Signed-off-by: Rafael J. Wysocki <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/acpi/acpica/aclocal.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
index 82563b44af351..261dc8f87556d 100644
--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -1139,7 +1139,7 @@ struct acpi_port_info {
 #define ACPI_RESOURCE_NAME_PIN_GROUP_FUNCTION   0x91
 #define ACPI_RESOURCE_NAME_PIN_GROUP_CONFIG     0x92
 #define ACPI_RESOURCE_NAME_CLOCK_INPUT          0x93
-#define ACPI_RESOURCE_NAME_LARGE_MAX            0x94
+#define ACPI_RESOURCE_NAME_LARGE_MAX            0x93
 
 /*****************************************************************************
  *
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:24:44 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367532; cv=none; b=ULseDYuZH+Ge0PHqVNnKXKl+QpDAmh+WFBdCI3NkhoKN+C1PVZPpSMQti0nO138AqkZdRIBCCypZvzZNZ0riPgEjD1MLKiQKXuvVYJyHtcS42Ic1MOBUjb4BngmiP3ngiCqHGtps30eIwaT089R3DfS7r/miAzn3wegaYDYg2xg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367532; c=relaxed/simple;
	bh=ehu6//+Sr4NPwrEzedN5i0hS5MnYRw1R0B2wH5uhQF8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=nIvwOF4ZKK6gu82u7NMZHsbKqDkpkWMDP5iAFxas+jJiFUKkIlQeCtd3Xxnynb3hUjx+rdzDsxnj5xEXw+HDR1vSR0dVXK25yjPWIIRTaZolJG5q9DthZ3JmwCfVG4Ug4Pg7YbOBYyVWw0u7x0V30fE3CCn6d4CH+th3vbYySAg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WhzqkN4C; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <[email-masked]>,
	=?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 045/196] pwm: tiehrpwm: Fix corner case in clock divisor calculation
Date: Mon, 13 Oct 2025 16:43:56 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Uwe Kleine-König <[email-masked]>

[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]

The function set_prescale_div() is responsible for calculating the clock
divisor settings such that the input clock rate is divided down such that
the required period length is at most 0x10000 clock ticks. If period_cycles
is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is
good enough. So round up in the calculation of the required divisor and
compare it using >= instead of >.

Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
Signed-off-by: Uwe Kleine-König <[email-masked]>
Link: https://lore.kernel.org/r/8548861[email-masked]
Signed-off-by: Uwe Kleine-König <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pwm/pwm-tiehrpwm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index ecbfd7e954ecb..d693b2d65cccf 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -167,7 +167,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
 
 			*prescale_div = (1 << clkdiv) *
 					(hspclkdiv ? (hspclkdiv * 2) : 1);
-			if (*prescale_div > rqst_prescaler) {
+			if (*prescale_div >= rqst_prescaler) {
 				*tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) |
 					(hspclkdiv << TBCTL_HSPCLKDIV_SHIFT);
 				return 0;
@@ -266,7 +266,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
 	pc->period_cycles[pwm->hwpwm] = period_cycles;
 
 	/* Configure clock prescaler to support Low frequency PWM wave */
-	if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
+	if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval,
 			     &tb_divval)) {
 		dev_err(chip->dev, "Unsupported values\n");
 		return -EINVAL;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:15:29 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367529; cv=none; b=nAiva22Qpyh88ckTuAhNe1QQBNxzhQdzsJ8ja/mordZI79Zze3QYbflju8ZagQeIez5XUVWEdOo2FriDhvqThhg7Mrl/YWUgZEI08+x6yoWrh61yKS69vYaO0ewySDgTewhveI4TNEOehCeiKM4uGCzB2VKb0ISn+lfzia3N2C8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367529; c=relaxed/simple;
	bh=N0LrqlGhzPDpeiXeI9bRGdbCurTdZBDre7oOcNhuwcw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=fk2aCtP/X9dqG6Xmb5toRC3EvEorgmuK9oS2LDF5WVtBzw0Zu8TATmD2H6NfYgpEj6qCZU85b546c+J5ohSpWBuauSQD2GOQowJHqNAvyKuUCpr5mNm0czObFyrKnLDN1UbgK74hZUlcglDmXWGEHtL4xnh1de4xAnxva280dpg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=nLm0oHa5; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	AngeloGioacchino Del Regno <[email-masked]>,
	Fei Shao <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 044/196] arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
Date: Mon, 13 Oct 2025 16:43:55 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: AngeloGioacchino Del Regno <[email-masked]>

[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ]

This devicetree contained only the SoC compatible but lacked the
machine specific one: add a "mediatek,mt8516-pumpkin" compatible
to the list to fix dtbs_check warnings.

Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts")
Signed-off-by: AngeloGioacchino Del Regno <[email-masked]>
Reviewed-by: Fei Shao <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
index cce642c538128..3d3db33a64dc6 100644
--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
@@ -11,7 +11,7 @@
 
 / {
 	model = "Pumpkin MT8516";
-	compatible = "mediatek,mt8516";
+	compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516";
 
 	memory@40000000 {
 		device_type = "memory";
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:24:08 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367525; cv=none; b=iKM0HiMVMYY7YHILNVarVrzOePKWEjpZv7ip1zvH10cvpBQzTqAucPFnAPFv3ihYxHgnArvr3/v7j1hRk2GxT5E9xKkz9fgvzpqSj+mxaqAsaEHCwOLPqRGaSbl8PF9fq3EgLmi/40JwdfouCLfsvBbONDtY+dI7Ysbg2FJHTAU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367525; c=relaxed/simple;
	bh=VJsAv2zgDDaRV4mfkwKEzkZlAxZ6V3oFjH4anLdMGvk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=WvpVPMpF6H0tDRmQFEAxHbhboJBN7PjZ9Hd5H90DA2MXABYxy9D9+7oY8R5hllD0eLgrqyzF0Ge5a1jLSaSMQQp/g/URpHHkUHAw4bcSla2EgfOhnrVcLMAmytwQnzFqeo+Z+MZZ+Mp7iU5zkMqzaSvIgwd7ei7fcLpJInaqYnw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ikrhjKAh; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	AngeloGioacchino Del Regno <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 043/196] arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
Date: Mon, 13 Oct 2025 16:43:54 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: AngeloGioacchino Del Regno <[email-masked]>

[ Upstream commit 236681fb64102f25ed11df55999e6985c1bc2f7d ]

Change the latch-ck value from 0x14 to 4: as only bits [0-3] are
actually used, the final value that gets written to the register
field for DAT_LATCH_CK_SEL is just 0x4.

This also fixes dtbs_check warnings.

Fixes: 5a65dcccf483 ("arm64: dts: mediatek: mt6795-xperia-m5: Add eMMC, MicroSD slot, SDIO")
Signed-off-by: AngeloGioacchino Del Regno <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
index b5746e6d0b15a..110fae4ec11c9 100644
--- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
+++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
@@ -136,7 +136,7 @@ proximity@48 {
 
 &mmc0 {
 	/* eMMC controller */
-	mediatek,latch-ck = <0x14>; /* hs400 */
+	mediatek,latch-ck = <4>; /* hs400 */
 	mediatek,hs200-cmd-int-delay = <1>;
 	mediatek,hs400-cmd-int-delay = <1>;
 	mediatek,hs400-ds-dly3 = <0x1a>;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:23:19 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367522; cv=none; b=vF49Q7H5kiFIMOsIQ1aT65ehIRc5kBy3YmcJFyc/07DE1X6I2d2oDeMJ05iGApTHtuHQmW9P7/KV6r0UpGNA1yytEpbDMY6welfmKtkIo+7I1FHbaPDnNy2wvLvced+J8U08pukxqhUYgRhVL3/pCbAEP6Mpq4BNKLV+cUzA8DQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367522; c=relaxed/simple;
	bh=Nq/JbD0vUWFSStDuIONBq8zWdtZZT6uykw4K836VInk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=SHGvdfF6wT20Stz1Qn/8edmagXfDfpw5MkmWIMwuYts+6hrZ9Iw0T/7JtxNNo9C4CAhxRnKTS+Cz6C7XdhQBe5Le8Izor1Lw9CmzuLlu0vueOgC57K3wHEI83B66Dha2vdJ/qDXW/3Ho4yi1AlRglIFKZvYuyvVEvTk98DRvA1U=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Vo16G7Dc; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	AngeloGioacchino Del Regno <[email-masked]>,
	Fei Shao <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 042/196] arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names
Date: Mon, 13 Oct 2025 16:43:53 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: AngeloGioacchino Del Regno <[email-masked]>

[ Upstream commit 98967109c9c0e2de4140827628c63f96314099ab ]

The node names for "pmic", "regulators", "rtc", and "keys" are
dictated by the PMIC MFD binding: change those to adhere to it.

Fixes: aef783f3e0ca ("arm64: dts: mediatek: Add MT6331 PMIC devicetree")
Signed-off-by: AngeloGioacchino Del Regno <[email-masked]>
Reviewed-by: Fei Shao <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/mediatek/mt6331.dtsi | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
index d89858c73ab1b..243afbffa21fd 100644
--- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
@@ -6,12 +6,12 @@
 #include <dt-bindings/input/input.h>
 
 &pwrap {
-	pmic: mt6331 {
+	pmic: pmic {
 		compatible = "mediatek,mt6331";
 		interrupt-controller;
 		#interrupt-cells = <2>;
 
-		mt6331regulator: mt6331regulator {
+		mt6331regulator: regulators {
 			compatible = "mediatek,mt6331-regulator";
 
 			mt6331_vdvfs11_reg: buck-vdvfs11 {
@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc {
 			};
 
 			mt6331_vdig18_reg: ldo-vdig18 {
-				regulator-name = "dvdd18_dig";
+				regulator-name = "vdig18";
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <1800000>;
 				regulator-ramp-delay = <0>;
@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 {
 			};
 		};
 
-		mt6331rtc: mt6331rtc {
+		mt6331rtc: rtc {
 			compatible = "mediatek,mt6331-rtc";
 		};
 
-		mt6331keys: mt6331keys {
+		mt6331keys: keys {
 			compatible = "mediatek,mt6331-keys";
 			power {
 				linux,keycodes = <KEY_POWER>;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:29:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367520; cv=none; b=euevnnCw8DihoxHXW1EquJNaQSNGnN8jP7VlKaoYTdCIS4zjsIDcV4sTBlZ+MVP2zf8giVp0Qd6xiR4TtbWvkpCcShQpbpZVRYCIxILplZae/zcCJD3911T0dZB9QzD4i7l+AxQygATuVHix9Z3k2wYaCVtsmWbKZzLDpYD3BbA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367520; c=relaxed/simple;
	bh=ROcEf038plncaEgmhp3k/rT53Uj4lxj8PUkmCW5h7Bs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DO0hvoF/F4eSEZrHyNE75l06ULczKe63eGm2wWtHR+pEXB9yffy5DsfdkWPndK3SkIrPv2NHueKga1pqH2UVU55dQJg4JV9IXdLVopJX+rhm5uLo6tblMDS49mKSkTuQSZdbDIiWLpvariQf6C7OigU5tCoragtDIeofehmd4Gs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=F4VCw27x; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Johan Hovold <[email-masked]>,
	Konrad Dybcio <[email-masked]>,
	"Rafael J. Wysocki" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 041/196] cpuidle: qcom-spm: fix device and OF node leaks at probe
Date: Mon, 13 Oct 2025 16:43:52 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email-masked]>

[ Upstream commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 ]

Make sure to drop the reference to the saw device taken by
of_find_device_by_node() after retrieving its driver data during
probe().

Also drop the reference to the CPU node sooner to avoid leaking it in
case there is no saw node or device.

Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling")
Signed-off-by: Johan Hovold <[email-masked]>
Reviewed-by: Konrad Dybcio <[email-masked]>
Signed-off-by: Rafael J. Wysocki <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/cpuidle/cpuidle-qcom-spm.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c
index 1fc9968eae199..b6b06a510fd86 100644
--- a/drivers/cpuidle/cpuidle-qcom-spm.c
+++ b/drivers/cpuidle/cpuidle-qcom-spm.c
@@ -96,20 +96,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu)
 		return -ENODEV;
 
 	saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0);
+	of_node_put(cpu_node);
 	if (!saw_node)
 		return -ENODEV;
 
 	pdev = of_find_device_by_node(saw_node);
 	of_node_put(saw_node);
-	of_node_put(cpu_node);
 	if (!pdev)
 		return -ENODEV;
 
 	data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL);
-	if (!data)
+	if (!data) {
+		put_device(&pdev->dev);
 		return -ENOMEM;
+	}
 
 	data->spm = dev_get_drvdata(&pdev->dev);
+	put_device(&pdev->dev);
 	if (!data->spm)
 		return -EINVAL;
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:33:23 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367517; cv=none; b=WPml+NpxV+RIXrVgVRCLXODqLH3zr1gJxY0lwXAPGtGm0C8EN4VTNA51/LwdPSf6OJjUNuhhdBJtXLC2ZngS/yVJzzIuU9QnbL2SV2Llq2i//UvaAIo4LVFq2h25ymQtupcMsS2HtXzq+qWEfB2oSTLgnbrhTsZv101ezu6Sh1Q=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367517; c=relaxed/simple;
	bh=J1kci3dy8oEoEKHm8wWXgu0kxfMDFkrO2/M2kUPpbOI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ez4qEyqF/x74QzGSbwKa9Y+Ule9KjntbsAh3gOq8QStZeaUB0JVK9nY+jfFLA25nlrcvsO0VEeAIouhxLfbkBnSHed1JDEyeaI/qosWaa5gAl17DRs1reIamCkGGtxnYIneQkKqUYhX4ByevGuXT305gpeFU5r7qGNneUX1o7/o=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=VJMzKYZg; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Johan Hovold <[email-masked]>,
	Neil Armstrong <[email-masked]>,
	Martin Blumenstingl <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 040/196] firmware: firmware: meson-sm: fix compile-test default
Date: Mon, 13 Oct 2025 16:43:51 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email-masked]>

[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ]

Enabling compile testing should not enable every individual driver (we
have "allyesconfig" for that).

Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module")
Signed-off-by: Johan Hovold <[email-masked]>
Reviewed-by: Neil Armstrong <[email-masked]>
Reviewed-by: Martin Blumenstingl <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Neil Armstrong <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/firmware/meson/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig
index f2fdd37566482..179f5d46d8ddf 100644
--- a/drivers/firmware/meson/Kconfig
+++ b/drivers/firmware/meson/Kconfig
@@ -5,7 +5,7 @@
 config MESON_SM
 	tristate "Amlogic Secure Monitor driver"
 	depends on ARCH_MESON || COMPILE_TEST
-	default y
+	default ARCH_MESON
 	depends on ARM64_4K_PAGES
 	help
 	  Say y here to enable the Amlogic secure monitor driver
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:15:11 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367514; cv=none; b=kv7NDtL0zHNUxl68mpln3uq/2qsbw82R8V0Jly2w39QY0KcjXneglGcz234X2DpCvaIXgT8Xkcy1a06rm55boqeclxFN7pNeyaU5uRejWSGvijdAopghgRkFIHoct1YcVvkz92JCv2zGyuzwk1UunO2fqSjDXhz/zG4oiOIkNNQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367514; c=relaxed/simple;
	bh=7/6GbFERhTH+yGL94A/7UvmXfOTUjwQfbxkmJgUrViQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bW0W7hjmKle0HaaXFaW+jCj2VhmImsPPyTbZBbDN2MQIFTp5zU2KMW3ly+sP26NE8wD7H4sQAp4SEXtkuaLprgfQTDvc5ua6ZHpYxc2BOVrnIXzF2//AXSBiRNtjSiUgTmyKv6TNkPJy0as/183Gh2n8cEvbzZ1b+XQePaF6nsk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=oZ4nm5x4; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id EA9DAC4CEFE;
	Mon, 13 Oct 2025 14:58:33 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760367514;
	bh=7/6GbFERhTH+yGL94A/7UvmXfOTUjwQfbxkmJgUrViQ=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=oZ4nm5x4pm1SdHQSaVeOYkHkZk95hECpneUjdxzE4SM9QYSz6KTMzfxTEJ7PmsJUG
	 689Np+nQhgPvY9U94sJMaUSbMVmfXDLyJjtSOr1w7Oqvn/n0zL3XTXytUmLM/qXVeC
	 lyVtlo7Wv2M6aqG9UZscoxfdvgVPTZ8JX31B+O+I=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Eric Dumazet <[email-masked]>,
	Mike Christie <[email-masked]>,
	"Richard W.M. Jones" <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Yu Kuai <[email-masked]>,
	[email-masked],
	[email-masked],
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 039/196] nbd: restrict sockets to TCP and UDP
Date: Mon, 13 Oct 2025 16:43:50 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email-masked]>

[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ]

Recently, syzbot started to abuse NBD with all kinds of sockets.

Commit cf1b2326b734 ("nbd: verify socket is supported during setup")
made sure the socket supported a shutdown() method.

Explicitely accept TCP and UNIX stream sockets.

Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup")
Reported-by: [email-masked]
Closes: https://lore.kernel.org/netdev/[email-masked]/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154
Signed-off-by: Eric Dumazet <[email-masked]>
Cc: Mike Christie <[email-masked]>
Cc: Richard W.M. Jones <[email-masked]>
Cc: Jens Axboe <[email-masked]>
Cc: Yu Kuai <[email-masked]>
Cc: [email-masked]
Cc: [email-masked]
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/block/nbd.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 3742ddf46c55a..27a05b1521f69 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1128,6 +1128,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd,
 	if (!sock)
 		return NULL;
 
+	if (!sk_is_tcp(sock->sk) &&
+	    !sk_is_stream_unix(sock->sk)) {
+		dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n");
+		*err = -EINVAL;
+		sockfd_put(sock);
+		return NULL;
+	}
+
 	if (sock->ops->shutdown == sock_no_shutdown) {
 		dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n");
 		*err = -EINVAL;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:18:57 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367511; cv=none; b=D+knd1w5Bb7Pd/KHAZmUW/Yuab25rgxG9PyPj7kvsNAhUUai2NIqpxAM6cZqTP+xec3gVeefKRYo7c7yg/UdbEAQ/O243X/Casn1Pxjdo8idTdyBhGSoCMt6tb11InksQti1I9O9zUTQVntE2Ewr6ppQloJabUzwYzV4Y/Nyc/U=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367511; c=relaxed/simple;
	bh=VC4cNFj/BvMiMQy3lxUh4kQnN5K9KB0Tq7Ag584OQ1I=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=aquzSFt2Zaa3HkEO4pYPNze7QCwENCGJ2tgzp1vpanHkq8zfrpnuv5jzc3tfx0HxqPheG2yN4q7N0VPXQkIBUx/y2FSPLTCPooTapNYcKo3yQfrxpcw++O8g94l8BVVSmMhhB2Li+e+440mbfLoigo4dGB4nugABC41fB4V6ehI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=CyUKzTY6; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Guoqing Jiang <[email-masked]>,
	AngeloGioacchino Del Regno <[email-masked]>,
	Macpaul Lin <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 038/196] arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0
Date: Mon, 13 Oct 2025 16:43:49 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guoqing Jiang <[email-masked]>

[ Upstream commit 3374b5fb26b300809ecd6aed9f414987dd17c313 ]

When test suspend resume with 6.8 based kernel, system can't resume
and I got below error which can be also reproduced with 6.16 rc6+
kernel.

mtk-pcie-gen3 112f0000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x0)
mtk-pcie-gen3 112f0000.pcie: PM: dpm_run_callback(): genpd_resume_noirq returns -110
mtk-pcie-gen3 112f0000.pcie: PM: failed to resume noirq: error -110

After investigation, looks pcie0 has the same problem as pcie1 as
decribed in commit 3d7fdd8e38aa ("arm64: dts: mediatek: mt8195:
Remove suspend-breaking reset from pcie1").

Fixes: ecc0af6a3fe6 ("arm64: dts: mt8195: Add pcie and pcie phy nodes")
Signed-off-by: Guoqing Jiang <[email-masked]>
Reviewed-by: AngeloGioacchino Del Regno <[email-masked]>
Reviewed-by: Macpaul Lin <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
index 22604d3abde3b..4b701afe995e2 100644
--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
@@ -1524,9 +1524,6 @@ pcie0: pcie@112f0000 {
 
 			power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P0>;
 
-			resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P0_SWRST>;
-			reset-names = "mac";
-
 			#interrupt-cells = <1>;
 			interrupt-map-mask = <0 0 0 7>;
 			interrupt-map = <0 0 0 1 &pcie_intc0 0>,
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:24:47 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367607; cv=none; b=TnT//EyHTWLDU+lNkdmb6L22+5GWpsjGMeFb89jx8dSofVx24Q0ApiY1fEcd09Dx50XXDp8+CRJoyMtT0yPxE1C4+BJrkulKyPlO7R2f2w7OtSlpHuG9Utgjw+OrzSCHkA+tJZwSD/Jan38GBVrULsgAi8VcOD2ktv/SGUrXwnY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367607; c=relaxed/simple;
	bh=9vId8C9aEKj2AOh+ArfyskMtFtFvvcPZo1HJMFptqqw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=VgKTWFfPSZGT2SPLuxaTCL9uVehHZbYSWRusElVvWcjsbYL5FROqmDhBbxAwJft/pLPIVAd8Zoogo9jQ+YtRpK13uhS+DUfKjV3mhLdFeIc+8M/ZN7HJqXk0R0b09pXAa9dLVrta9YjzF4nyfc6sSiLInARC5l4fLBbeOwmphr4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=oejfimkX; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Genjian Zhang <[email-masked]>,
	Damien Le Moal <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 037/196] null_blk: Fix the description of the cache_size module argument
Date: Mon, 13 Oct 2025 16:43:48 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Genjian Zhang <[email-masked]>

[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ]

When executing modinfo null_blk, there is an error in the description
of module parameter mbps, and the output information of cache_size is
incomplete.The output of modinfo before and after applying this patch
is as follows:

Before:
[...]
parm:           cache_size:ulong
[...]
parm:           mbps:Cache size in MiB for memory-backed device.
		Default: 0 (none) (uint)
[...]

After:
[...]
parm:           cache_size:Cache size in MiB for memory-backed device.
		Default: 0 (none) (ulong)
[...]
parm:           mbps:Limit maximum bandwidth (in MiB/s).
		Default: 0 (no limit) (uint)
[...]

Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options")
Signed-off-by: Genjian Zhang <[email-masked]>
Reviewed-by: Damien Le Moal <[email-masked]>
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/block/null_blk/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index 97ed3bd9707f4..2dd254c720f5f 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -211,7 +211,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu
 
 static unsigned long g_cache_size;
 module_param_named(cache_size, g_cache_size, ulong, 0444);
-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)");
+MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)");
 
 static unsigned int g_mbps;
 module_param_named(mbps, g_mbps, uint, 0444);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:39:41 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367605; cv=none; b=QscUh4ApuR73LfDEw/d5YZDBO8yQviZ0Pdj/woa76EKPoFzpZzNsPenm7ayyfFUJLZ7PlOJTX1fUvxd2ltXM5TVBfEoDd/l46HrUXnvOkJO/u9bFX/Q3hGcz85zXguzkAG/XmGzppNyj9YuHfg42c9po4BNCK02IO1DVbtY50b8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367605; c=relaxed/simple;
	bh=FYJVcH03nAsCXLG8Ou3d9hVV0MwVUP3GOkjF3NBSxh0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=op/eVHX9YhijP7kUfOBGkfmlUPqtIMIaWwyVKoAWDZE9C8ApqLbJ3wLrHJRu05FEUX+ezviY7Q+zNJAmHdrHx5FQulkpJ5Dmby3R0I8kxisGs0TXylmGZtspc0PJwqDnU8Pe0fjFbjdyrnTMl1NPk/ztEJ9l3yho11ktrxBE6+w=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Fa9K8Svx; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 036/196] pinctrl: renesas: Use int type to store negative error codes
Date: Mon, 13 Oct 2025 16:43:47 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ]

Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned
int to int, as it needs to store either negative error codes or zero
returned by sh_pfc_pinconf_set().

No effect on runtime.

Signed-off-by: Qianfeng Rong <[email-masked]>
Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config")
Reviewed-by: Geert Uytterhoeven <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pinctrl/renesas/pinctrl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c
index 4d9d58fc1356f..852e179f9e383 100644
--- a/drivers/pinctrl/renesas/pinctrl.c
+++ b/drivers/pinctrl/renesas/pinctrl.c
@@ -730,7 +730,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
 	struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev);
 	const unsigned int *pins;
 	unsigned int num_pins;
-	unsigned int i, ret;
+	unsigned int i;
+	int ret;
 
 	pins = pmx->pfc->info->groups[group].pins;
 	num_pins = pmx->pfc->info->groups[group].nr_pins;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:45:34 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367601; cv=none; b=q3b4aWotfHsc1tyT3ysDve0/qGtpaFqm7vZgWD43eDUwnO10XlrL17TrIkVPClFS0zhi4V8hs4DRB/fHs/leIcrC9oSAitig2PwowSmrZ+b8IVznMMYDWalSNqKCaWEyYD/F7UQRTI57yBaUA3RXGQR7hqqzDflObuKBA5BT+rA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367601; c=relaxed/simple;
	bh=zmXQ+l14dXtm+84E9D78Xp2vzjOv3UHP/9vCyS32ZAo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=RFdZR1b+4wOV4XG0cA0BOMQCkNY4n5bkZziXiJVeLT9cVI97D9CGHQUF3fuUDMB1SzIjf86FLcCAl7hO4ac+/XqPQQEknBri+yS57L8K2/d7jKRnpFRhdZpYr+1UEJFZHLV90DH60tEyLwCFqWgToGYAIORzzrneREcAi/FRdSM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=sTdB59/7; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Andy Yan <[email-masked]>,
	Sebastian Reichel <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 035/196] power: supply: cw2015: Fix a alignment coding style issue
Date: Mon, 13 Oct 2025 16:43:46 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andy Yan <[email-masked]>

[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ]

Fix the checkpatch warning:
CHECK: Alignment should match open parenthesis

Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code")
Signed-off-by: Andy Yan <[email-masked]>
Signed-off-by: Sebastian Reichel <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/power/supply/cw2015_battery.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c
index 99f3ccdc30a6a..434e3233c9f8c 100644
--- a/drivers/power/supply/cw2015_battery.c
+++ b/drivers/power/supply/cw2015_battery.c
@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client)
 	if (!cw_bat->battery_workqueue)
 		return -ENOMEM;
 
-	devm_delayed_work_autocancel(&client->dev,
-							  &cw_bat->battery_delay_work, cw_bat_work);
+	devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work);
 	queue_delayed_work(cw_bat->battery_workqueue,
 			   &cw_bat->battery_delay_work, msecs_to_jiffies(10));
 	return 0;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:24:41 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367598; cv=none; b=BPQi/vw0bc0swGyWQUVA2bvuMVA9wyNVeIyu2N2Kcw6xIht99wkOAdLapbcpfD+z72kzZzsnwzj5qJHWv5/AklvuvXdkpV/qe/yy7koTTuB7S5aWiZrhbKfMdjUmi5pbLB5WGHotjzr2gy8TM3cZP7zdTs4f/cjuUFiCzcmLgzc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367598; c=relaxed/simple;
	bh=XDJlq+1PdtEwx7PXARcY3v+BoT34t66t/JNhmhB4uqc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=I1NxyQgXUwRusIti6KP+TW+3NzAAb0ad7bnhrJ+ACGabGzGwVADIyiUiyhHbNFQb7AQSjYn5CW26NnxK/ovwZMYruo9CsRKNegYwr+W6LdcZzrDtMjqfz5k83UGw7/LUAIQOctGUQg9i6wvYynqIc5H/xENaJtQ2fi/jw3Rvk/o=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=txZxXBHn; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	Chanwoo Choi <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 034/196] PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()
Date: Mon, 13 Oct 2025 16:43:45 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email-masked]>

[ Upstream commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 ]

The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which
would lead to a error pointer dereference.  Use IS_ERR_OR_NULL() to check
that the pointer is valid.

Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral")
Signed-off-by: Dan Carpenter <[email-masked]>
Signed-off-by: Chanwoo Choi <[email-masked]>
Link: https://patchwork.kernel.org/project/linux-pm/patch/[email-masked]/
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/devfreq/mtk-cci-devfreq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c
index 83a73f0ccd803..eff9b2c06aef4 100644
--- a/drivers/devfreq/mtk-cci-devfreq.c
+++ b/drivers/devfreq/mtk-cci-devfreq.c
@@ -385,7 +385,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev)
 out_free_resources:
 	if (regulator_is_enabled(drv->proc_reg))
 		regulator_disable(drv->proc_reg);
-	if (drv->sram_reg && regulator_is_enabled(drv->sram_reg))
+	if (!IS_ERR_OR_NULL(drv->sram_reg) &&
+	    regulator_is_enabled(drv->sram_reg))
 		regulator_disable(drv->sram_reg);
 
 	return ret;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:28:13 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367595; cv=none; b=MRpSbyDXA2UANkrjSkGbzJOWBlp34D203NeyaATi7XkaXzQ+ZGyIIikrQWjn6sFliUVJGdOto9DtpJTcP4aa8nl34r2QIPUuDNIlF1SbmohFJzESiTmSMZSLSP+xyWqZ/HWK3WUI5cDscT3l3jhX3xIj7pCw7L934aOJ+E+WIK0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367595; c=relaxed/simple;
	bh=1MJGGWFYDl+sZVjRIZNjgJuhuBUtLX+L7bHgeV8iKjE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Fg75QD+lxSV/rNgy1sFCS0GEAzmqioxXOgxg1yREm8R6MKPk94aaP4KyKVVBawC7cuLpsxhOKIyo0MNKtoMIaj+gFKzWXSuPErrxAmiRa0GhVGje3RupLY5ES8xsIKrpWKCmL7Iy6/OcoNszCclxujdNhUGHT8Xq3TJ2kTqll0s=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FEgipoLh; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jihed Chaibi <[email-masked]>,
	Kevin Hilman <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 033/196] ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property
Date: Mon, 13 Oct 2025 16:43:44 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jihed Chaibi <[email-masked]>

[ Upstream commit 27322753c8b913fba05250e7b5abb1da31e6ed23 ]

The dtbs_check validation for am335x-cm-t335.dtb flags an error
for an unevaluated 'num-serializer' property in the mcasp0 node.

This property is obsolete; it is not defined in the davinci-mcasp-audio
schema and is not used by the corresponding (or any) driver.

Remove this unused property to fix the schema validation warning.

Fixes: 48ab364478e77 ("ARM: dts: cm-t335: add audio support")
Signed-off-by: Jihed Chaibi <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Kevin Hilman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts | 2 --
 1 file changed, 2 deletions(-)

diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
index 72990e7ffe10e..44718a4cec474 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
@@ -483,8 +483,6 @@ &mcasp1 {
 
 		op-mode = <0>;          /* MCASP_IIS_MODE */
 		tdm-slots = <2>;
-		/* 16 serializers */
-		num-serializer = <16>;
 		serial-dir = <  /* 0: INACTIVE, 1: TX, 2: RX */
 			0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0
 		>;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:39:21 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367592; cv=none; b=QPTMGj3jSmTNJcIWLyf1FqgUjBh0sqyJMKInapRdQcZrZkZ4dCgpmBSHeF9o2wQW8dmE87EnaYZSw3EFP5Asj2/WnZoeaRlhoQO+vb1f6VhZ9QnPDZR6u6Q4eVyFfxOqKZXpFF6VR0VUxCr9gJsaSazSh7aut71OVqvg7x1QZN0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367592; c=relaxed/simple;
	bh=MXjHWmCaBM5WFaWXVtMuwXmsvIKN06X6Kxf67/A2b2E=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=h1m4P9WuovFW2XYmHctLJWkwTLokuiE/DWQ7E6YRTwG67PZ3Hnd85XVtuxsvTiTYmTke2zR7Tn+flObCN5LnDOmXypJaRFZEpT2nIqPKJJP9L2YXFo4ONCs/AGrBhuih+K/zmdwc4xW2v0t26z6f2u8AGXPsyhwwYDc195m5Y9Y=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=eaAD4WGe; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jihed Chaibi <[email-masked]>,
	Kevin Hilman <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 032/196] ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS
Date: Mon, 13 Oct 2025 16:43:43 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jihed Chaibi <[email-masked]>

[ Upstream commit 5af5b85505bc859adb338fe5d6e4842e72cdf932 ]

The ti,keep-vref-on property, defined as a boolean flag in the Device
Tree schema, was incorrectly assigned a value (<1>) in the DTS file,
causing a validation error: "size (4) error for type flag". Remove
the value to match the schema and ensure compatibility with the driver
using device_property_read_bool(). This fixes the dtbs_check error.

Fixes: ed05637c30e6 ("ARM: dts: omap3-devkit8000: Add ADS7846 Touchscreen support")
Signed-off-by: Jihed Chaibi <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Kevin Hilman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
index a7f99ae0c1fe9..78c657429f641 100644
--- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
+++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
@@ -65,7 +65,7 @@ ads7846@0 {
 		ti,debounce-max = /bits/ 16 <10>;
 		ti,debounce-tol = /bits/ 16 <5>;
 		ti,debounce-rep = /bits/ 16 <1>;
-		ti,keep-vref-on = <1>;
+		ti,keep-vref-on;
 		ti,settle-delay-usec = /bits/ 16 <150>;
 
 		wakeup-source;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:38:41 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367572; cv=none; b=V2SIJy2Sfh/MasgMxYXRWJtXcvhXuiqmJfphrQ5r37RpxvhvM58o/RIq/BzQzDUkuqkTmZAdwai08Ze2q9JtP3W9LzWdw8JDfdnpJesyrGWdLzgoQ8VhsVLBEdPfXQjTX/8rQ5bLEGjsYgKVyNNDtEifFDjcMHc6p+qGBOPq7i8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367572; c=relaxed/simple;
	bh=V+Lrfl/+0q4D3mfEQcr7p90DkwwV+lAIMQvzBMaTmb0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=N6vwu4UE7dFqmu1m6rdpEwz2obcpmc5f4rK4lMkG8riXcK1c1QOMineqUeZn4xSyn3m7Kqi2j/uo239zNtm31LuuOlX6F7f5AXm+/pRAw4lRJxUcUonUrFGrbkycBMwYiEXxf6KKcTI89WTT8uF41/ZRz9ValDurx4IGzcRZfOA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YINelSBe; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jihed Chaibi <[email-masked]>,
	Kevin Hilman <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 031/196] ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax
Date: Mon, 13 Oct 2025 16:43:42 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jihed Chaibi <[email-masked]>

[ Upstream commit 9658a92fad1889ff92fa4bd668cd61052687245a ]

The ti,en-ck32k-xtal property, defined as a boolean in the Device Tree
schema, was incorrectly assigned a value (<1>) in the DTS file, causing
a validation error: "size (4) error for type flag". The driver uses
of_property_read_bool(), expecting a boolean. Remove the value to fix
the dtbs_check error.

Fixes: 262178b6b8e5 ("ARM: dts: split am335x-baltos-ir5221 into dts and dtsi files")
Signed-off-by: Jihed Chaibi <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]/
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Kevin Hilman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
index c14d5b70c72f6..56f704082f94a 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
+++ b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
@@ -270,7 +270,7 @@ &tps {
 	vcc7-supply = <&vbat>;
 	vccio-supply = <&vbat>;
 
-	ti,en-ck32k-xtal = <1>;
+	ti,en-ck32k-xtal;
 
 	regulators {
 		vrtc_reg: regulator@0 {
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:35:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367540; cv=none; b=jSCMvoPxiDz/zqqGOiNiyUTZ0XcUCuuLQMmqsaNplRfWaLO2ql/UjV84HYOykDa0E7B++Em/9yHTKpykRoOUIgb/zWJvvhrH6vaA7snyLSaTnfOS9NlBkdpMaLuRC7RdSz/yLmlcwrAAA0OsfCPoas/bB7ZGSgknP0jyT3YZGUY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367540; c=relaxed/simple;
	bh=MJpMdQ+pUptFmgSUUp8XBLXCMbBR+pfBEGhN9jVfSjs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=jQ1W0o3E9jSPp55vYJxLYwjk33+A47pgbP3ciZS+0Z2Oa/lxiiV5X2zFyOVvqyvyEhWijYZrBP3Q00RZUWcZ3jEMOEEtZT3WKZ/NS8k0ul1sNS9bmfums9l8McXLdjalGKB7LMkWzWtZXEbD/QWIGCaguer4eP0gTZh6AsHH5iA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WsMx/euA; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	"Rafael J. Wysocki" <[email-masked]>,
	Ulf Hansson <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 030/196] PM: sleep: core: Clear power.must_resume in noirq suspend error path
Date: Mon, 13 Oct 2025 16:43:41 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email-masked]>

[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ]

If system suspend is aborted in the "noirq" phase (for instance, due to
an error returned by one of the device callbacks), power.is_noirq_suspended
will not be set for some devices and device_resume_noirq() will return
early for them.  Consequently, noirq resume callbacks will not run for
them at all because the noirq suspend callbacks have not run for them
yet.

If any of them has power.must_resume set and late suspend has been
skipped for it (due to power.smart_suspend), early resume should be
skipped for it either, or its state may become inconsistent (for
instance, if the early resume assumes that it will always follow
noirq resume).

Make that happen by clearing power.must_resume in device_resume_noirq()
for devices with power.is_noirq_suspended clear that have been left in
suspend by device_suspend_late(), which will subsequently cause
device_resume_early() to leave the device in suspend and avoid
changing its state.

Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag")
Link: https://lore.kernel.org/linux-pm/[email-masked]/
Signed-off-by: Rafael J. Wysocki <[email-masked]>
Reviewed-by: Ulf Hansson <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/base/power/main.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index baa31194cf20d..ef5157fc8dcc5 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -600,8 +600,20 @@ static void __device_resume_noirq(struct device *dev, pm_message_t state, bool a
 	if (dev->power.syscore || dev->power.direct_complete)
 		goto Out;
 
-	if (!dev->power.is_noirq_suspended)
+	if (!dev->power.is_noirq_suspended) {
+		/*
+		 * This means that system suspend has been aborted in the noirq
+		 * phase before invoking the noirq suspend callback for the
+		 * device, so if device_suspend_late() has left it in suspend,
+		 * device_resume_early() should leave it in suspend either in
+		 * case the early resume of it depends on the noirq resume that
+		 * has not run.
+		 */
+		if (dev_pm_skip_suspend(dev))
+			dev->power.must_resume = false;
+
 		goto Out;
+	}
 
 	if (!dpm_wait_for_superior(dev, async))
 		goto Out;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:22:03 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367509; cv=none; b=tORzrUyDgDRnCHdud8zwKaUzHZDgglbOT1QZIX4HYHWy2IZFaph5+BUEb9RtqaK5etwOHy2RStmZKxVa+8qwcVQ82MQcTPrHku8OK5dhhfEScAcDQIHBgLiN6djGwItwqrsA7CHLERMGOwbRelS/kHKcgJl9unxweOmPd89fzG4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367509; c=relaxed/simple;
	bh=axFZr0YFp7MZIBUSgrMFDvkoLrfCw6+V2WSqYtRNL+c=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=d2OnKu5qNcXgJCZ+jg8ya/uFTYtE8ILVP2Us8e/bof02wrgHvB3CVkoQgBdCz9K+ulHdp98mM0aYgJwtYOA0ThbtPrf17VoCGyk84K436jEjWgM/McLHhEqYtUGhg3EwhLyufpR0fZtBKOvcWP87dlPgVF30M6IxgEZrBAFxlXk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QWEyiBEZ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	John Garry <[email-masked]>,
	Bart Van Assche <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 029/196] block: use int to store blk_stack_limits() return value
Date: Mon, 13 Oct 2025 16:43:40 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]

Change the 'ret' variable in blk_stack_limits() from unsigned int to int,
as it needs to store negative value -1.

Storing the negative error codes in unsigned type, or performing equality
comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but
can be confusing.  Additionally, assigning negative error codes to unsigned
type may trigger a GCC warning when the -Wsign-conversion flag is enabled.

No effect on runtime.

Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1
Signed-off-by: Qianfeng Rong <[email-masked]>
Reviewed-by: John Garry <[email-masked]>
Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment")
Reviewed-by: Bart Van Assche <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/blk-settings.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/block/blk-settings.c b/block/blk-settings.c
index 021994f6d2d82..a891f27ff834d 100644
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -553,7 +553,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb
 int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
 		     sector_t start)
 {
-	unsigned int top, bottom, alignment, ret = 0;
+	unsigned int top, bottom, alignment;
+	int ret = 0;
 
 	t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors);
 	t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:33:33 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367610; cv=none; b=FtebP/8qoIcclf+a4dfpTPZPoTeuMEeN2sj37z8zw7r7NhqdBzu3ZyA3BhF5DCd5zIXNYYiSEkb1baWbIBjK4FOzMZj7BoR/NvyZhu/r/Rp+bRROkob8vB/lgcKNHzkEr9DFuTiK5QsrJAMKkJCspQa205e6wojNrBO5mPs3ySs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367610; c=relaxed/simple;
	bh=tALJ+MzZHsZL8Uf274h6k3gjlRiY+MCDcc5UAwqpezM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=KjDVWsMeNeAVkdO/hKbm8oCepzuMfxAeq2suTsCRtdPdQiOU4bgwlY7YOtltxarF9WIvLxmbVT3kF58v/jtDlvGqlFWb6vEjaoJBCAEoQOxWSEXhF2Yx5EOZVi1D9L9wSvGvW5ZI/LEXs/fwv7LR2L4n2BidgSurzQ+LGDbNqac=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xTElc4RL; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Benjamin Berg <[email-masked]>,
	=?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 028/196] selftests/nolibc: fix EXPECT_NZ macro
Date: Mon, 13 Oct 2025 16:43:39 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Benjamin Berg <[email-masked]>

[ Upstream commit 6d33ce3634f99e0c6c9ce9fc111261f2c411cb48 ]

The expect non-zero macro was incorrect and never used. Fix its
definition.

Fixes: 362aecb2d8cfa ("selftests/nolibc: add basic infrastructure to ease creation of nolibc tests")
Signed-off-by: Benjamin Berg <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Thomas Weißschuh <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/nolibc/nolibc-test.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c
index 4aaafbfc2f973..a019de995e5df 100644
--- a/tools/testing/selftests/nolibc/nolibc-test.c
+++ b/tools/testing/selftests/nolibc/nolibc-test.c
@@ -176,8 +176,8 @@ int expect_zr(int expr, int llen)
 }

-#define EXPECT_NZ(cond, expr, val)			\
-	do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0)
+#define EXPECT_NZ(cond, expr)				\
+	do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0)
 
 static __attribute__((unused))
 int expect_nz(int expr, int llen)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:27:25 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367483; cv=none; b=hOonGbiyItkbrVFHOEzUxePUDyExrRG1qz0Q5QGPvUTdBAyqhFn8/dQv2bmyjPvZqwjiTFHl5qPNouzbNduQilp6VuKr4Y+NULvy4z6Dka0XvNlZuShVUbulZ3QB5mG1qDKYWmCnRu8c1EI5cJikBPQTCimcndOKc/j6EvAd6Oo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367483; c=relaxed/simple;
	bh=g/OBgPtL4cfJmd78Y5/IFGnkf94C+MOLzLszuuacJG8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=jRgV1P1OESk6AfQ8yg3yxHregfyoWrwqNfpug7NDoN8gluwJQk63t8loeyOYQuR3+gbbtk1Xw1iwxKBHDoXg2ul8Olt838cTCeQWNRiV+IRTUJMAoMNFWj70BJHbapYILuAOeeoupVDOfWPwNLAEcttsvC6peELIEp0GrD9WaRw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ugT4Ok7t; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	Sudeep Holla <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 027/196] regulator: scmi: Use int type to store negative error codes
Date: Mon, 13 Oct 2025 16:43:38 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ]

Change the 'ret' variable from u32 to int to store negative error codes or
zero returned by of_property_read_u32().

Storing the negative error codes in unsigned type, doesn't cause an issue
at runtime but it's ugly as pants. Additionally, assigning negative error
codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
flag is enabled.

No effect on runtime.

Signed-off-by: Qianfeng Rong <[email-masked]>
Reviewed-by: Sudeep Holla <[email-masked]>
Fixes: 0fbeae70ee7c ("regulator: add SCMI driver")
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/regulator/scmi-regulator.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c
index 29ab217297d6d..432654fbd7a12 100644
--- a/drivers/regulator/scmi-regulator.c
+++ b/drivers/regulator/scmi-regulator.c
@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev,
 					  struct device_node *np,
 					  struct scmi_regulator_info *rinfo)
 {
-	u32 dom, ret;
+	u32 dom;
+	int ret;
 
 	ret = of_property_read_u32(np, "reg", &dom);
 	if (ret)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:25:02 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367479; cv=none; b=iODaDaCH4XKa4mGkOB92UX4yYb+SwoY0LDMUmTb2tK8tfbuQV+jdUCzzu3VrnM7CR+nf9OI1CSjDZh6d+RLnS6o9ym83Tep7AbxQDvWWupJwPpJ6Ot78VrtJdizpP89XnkqRjoMyQtIzod/Jcc+2zSPW3PnSXA+bFAnRtfATTXI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367479; c=relaxed/simple;
	bh=MDKcgoSxMKJMXpLag1LrLI5K6+EDyjSNEQ1ir+EW2bo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=qbf06I3pSQSYK8tQncrIp5MgFnw7ngIqVXt+C3N7+t5Q6oBj4xAK1optpuoPfIJ0IxdzY9c4kEjAuFfTRVsPuj5mHPsf1W/aoBpyQx8NmNQSO4AwG1YYpp/YoEPgl1+Qcx7KWCO7JuixfAjttId3MQ/OwYIYOqUlPLcdc5i5cuQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2iNKA5So; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Neal Gompa <[email-masked]>,
	Sven Peter <[email-masked]>,
	Janne Grunau <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 026/196] arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
Date: Mon, 13 Oct 2025 16:43:37 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Janne Grunau <[email-masked]>

[ Upstream commit 6e08cdd604edcec2c277af17c7d36caf827057ff ]

PCIe `port01` of t8103-j457 (iMac, M1, 2 USB-C ports, 2021) is unused
and disabled. Linux' PCI subsystem assigns the ethernet nic from
`port02` to bus 02. This results into assigning `pcie0_dart_1` from the
disabled port as iommu. The `pcie0_dart_1` instance is disabled and
probably fused off (it is on the M2 Pro Mac mini which has a disabled
PCIe port as well).
Without iommu the ethernet nic is not expected work.
Adjusts the "bus-range" and the PCIe devices "reg" property to PCI
subsystem's bus number.

Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices")
Reviewed-by: Neal Gompa <[email-masked]>
Reviewed-by: Sven Peter <[email-masked]>
Signed-off-by: Janne Grunau <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sven Peter <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/apple/t8103-j457.dts | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts
index 152f95fd49a21..7089ccf3ce556 100644
--- a/arch/arm64/boot/dts/apple/t8103-j457.dts
+++ b/arch/arm64/boot/dts/apple/t8103-j457.dts
@@ -21,6 +21,14 @@ aliases {
 	};
 };
 
+/*
+ * Adjust pcie0's iommu-map to account for the disabled port01.
+ */
+&pcie0 {
+	iommu-map = <0x100 &pcie0_dart_0 1 1>,
+			<0x200 &pcie0_dart_2 1 1>;
+};
+
 &bluetooth0 {
 	brcm,board-type = "apple,santorini";
 };
@@ -36,10 +44,10 @@ &wifi0 {
  */
 
 &port02 {
-	bus-range = <3 3>;
+	bus-range = <2 2>;
 	status = "okay";
 	ethernet0: ethernet@0,0 {
-		reg = <0x30000 0x0 0x0 0x0 0x0>;
+		reg = <0x20000 0x0 0x0 0x0 0x0>;
 		/* To be filled by the loader */
 		local-mac-address = [00 10 18 00 00 00];
 	};
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:24:19 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367477; cv=none; b=Fn0Hv/eIn2JG/pqXHXeQXVwxUrNxCxV9JUVFJH5ZmQEBWoqKFwYxeU3A3P/e+I9tWhvoMHQUkyuuhX+yrn8rYfPi3ohkg8A1pmVOKzPypJnanQH3DncOthvPVn9F65OVjnKzroQJ3R22gBxYDhXX9M0Llrt6XWbIwu/lOWIcyd0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367477; c=relaxed/simple;
	bh=kJT0S2Nz2CBmVdYYMPt9gMw4tbFY1/b4B+CIWuiivwg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pa235e2YtSuKyWZ427CPbp5AF9+FZkYS1+YRiHUYsUgRJalkz2o+obqP6i2snRHZGOSyMvsRa8tgspfXOTAVjvAV11kK00+vm+QKnl47f6sqt2yqYImO3ITVHJP+YT34DjWB0e2QhmRkkPXtNgKAdtG488aLOC8DCWd7cI/hqFg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=X/+bOrq1; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Nicolas Ferre <[email-masked]>,
	Alexandre Belloni <[email-masked]>,
	Claudiu Beznea <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 025/196] ARM: at91: pm: fix MCKx restore routine
Date: Mon, 13 Oct 2025 16:43:36 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolas Ferre <[email-masked]>

[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ]

The at91_mckx_ps_restore() assembly function is responsible for setting
back MCKx system bus clocks after exiting low power modes.

Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx
to previously saved state.
Tmp2 was used without the needed changes in CSS and DIV. Moreover the
required bit 7, telling that MCR register's content is to be changed
(CMD/write), was not set.

Fix function comment to match tmp variables actually used.

Signed-off-by: Nicolas Ferre <[email-masked]>
Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes")
Link: https://lore.kernel.org/r/[email-masked]
Reviewed-by: Alexandre Belloni <[email-masked]>
[claudiu.beznea: s/sate/state in commit description]
Signed-off-by: Claudiu Beznea <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm/mach-at91/pm_suspend.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
index e5869cca5e791..94dece1839af3 100644
--- a/arch/arm/mach-at91/pm_suspend.S
+++ b/arch/arm/mach-at91/pm_suspend.S
@@ -872,7 +872,7 @@ e_done:
 /**
  * at91_mckx_ps_restore: restore MCK1..4 settings
  *
- * Side effects: overwrites tmp1, tmp2
+ * Side effects: overwrites tmp1, tmp2 and tmp3
  */
 .macro at91_mckx_ps_restore
 #ifdef CONFIG_SOC_SAMA7
@@ -916,7 +916,7 @@ r_ps:
 	bic	tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK
 	orr	tmp3, tmp3, tmp1
 	orr	tmp3, tmp3, #AT91_PMC_MCR_V2_CMD
-	str	tmp2, [pmc, #AT91_PMC_MCR_V2]
+	str	tmp3, [pmc, #AT91_PMC_MCR_V2]
 
 	wait_mckrdy tmp1
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:38:10 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367474; cv=none; b=pj4tout4x26PBinKXovycaJM/pnqmpSzQEpMDnAo/U3X/toeZHJGNZE8u7PBjO3Hvvts6dSorHXiQDjAAzp974gB3wnNmM/aIHMLIqb7R1cUWYn9y3N/P9s3dhme+dLSUKEkM8cNKdrdqKpHml+eIKwhUZ/7/4GPh6F6U8NMMwg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367474; c=relaxed/simple;
	bh=P+jy2rSyQAzeON7lSSh/h+nVnl5iyz5Oi4qn5tAWZy4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ukixhg3lDoPZQKcNNamaSyRLHkgaOUho5ihepXitOsOQbNqxbHkHj338OqkmeqlpSTZiOVrGRvDVEA3+HgKqDqLSkigR7ZnbYtJo21d7TVnho1BzdMEIzwP0EFxDJgsOVZYrHK3UFcQ0d7YeGaCvb+DZwY2gN8GsdFK4yE7T1k0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EoDaWVff; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Li Nan <[email-masked]>,
	Yu Kuai <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 024/196] blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
Date: Mon, 13 Oct 2025 16:43:35 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Li Nan <[email-masked]>

[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]

In __blk_mq_update_nr_hw_queues() the return value of
blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx
fails, later changing the number of hw_queues or removing disk will
trigger the following warning:

  kernfs: can not remove 'nr_tags', no directory
  WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160
  Call Trace:
   remove_files.isra.1+0x38/0xb0
   sysfs_remove_group+0x4d/0x100
   sysfs_remove_groups+0x31/0x60
   __kobject_del+0x23/0xf0
   kobject_del+0x17/0x40
   blk_mq_unregister_hctx+0x5d/0x80
   blk_mq_sysfs_unregister_hctxs+0x94/0xd0
   blk_mq_update_nr_hw_queues+0x124/0x760
   nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
   nullb_device_submit_queues_store+0x92/0x120 [null_blk]

kobjct_del() was called unconditionally even if sysfs creation failed.
Fix it by checkig the kobject creation statusbefore deleting it.

Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues")
Signed-off-by: Li Nan <[email-masked]>
Reviewed-by: Yu Kuai <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/blk-mq-sysfs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
index 156e9bb07abf1..2fb234ab467b1 100644
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
 		return;
 
 	hctx_for_each_ctx(hctx, ctx, i)
-		kobject_del(&ctx->kobj);
+		if (ctx->kobj.state_in_sysfs)
+			kobject_del(&ctx->kobj);
 
-	kobject_del(&hctx->kobj);
+	if (hctx->kobj.state_in_sysfs)
+		kobject_del(&hctx->kobj);
 }
 
 static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:18:12 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367471; cv=none; b=qANlx+kXWKIdW88bgOZhIZmrHRjlpDYygjU3NBwN4xuv95g0wQp3mZhlxpiJmSnrSOju7FK6J3HqmYCvpL9NvUTQ1h662grU0mNPpuQKDLyN2M0JsQ4vxfJ38uZq/ZjxsmKnD7CT9/0r+60TZHl/Xu+0AQCM2PQFmebBfw9Ndzo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367471; c=relaxed/simple;
	bh=/Xn5P4ZvV4UgEiFYqCht+x244CmA/ep4dSt8YTf1BKY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=a6rVWekmYQeab1Jpvixyy4qf0SMarb8+3XeEM84uB3cSCDrkFlXMhIDpJluAdfYzmMQK8mAU1y1gEE/V3CfWlo6jn1cg90DmgOU3lrJSFmyRy+VjPjcmmYUkfNTY5asnb2lCfk++NzU9n/xFGci+NfRPyXUHfdQN8BC9THnuvaI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=b4BySYBD; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Da Xue <[email-masked]>,
	Linus Walleij <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 023/196] pinctrl: meson-gxl: add missing i2c_d pinmux
Date: Mon, 13 Oct 2025 16:43:34 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Da Xue <[email-masked]>

[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]

Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.

Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.

Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
Signed-off-by: Da Xue <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Linus Walleij <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
index 51408996255bd..e2601e45935e6 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[]	= { GPIODV_28 };
 static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 };
 static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 };
 
+static const unsigned int i2c_sck_d_pins[]	= { GPIOX_11 };
+static const unsigned int i2c_sda_d_pins[]	= { GPIOX_10 };
+
 static const unsigned int eth_mdio_pins[]	= { GPIOZ_0 };
 static const unsigned int eth_mdc_pins[]	= { GPIOZ_1 };
 static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 };
@@ -411,6 +414,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = {
 	GPIO_GROUP(GPIO_TEST_N),
 
 	/* Bank X */
+	GROUP(i2c_sda_d,	5,	5),
+	GROUP(i2c_sck_d,	5,	4),
 	GROUP(sdio_d0,		5,	31),
 	GROUP(sdio_d1,		5,	30),
 	GROUP(sdio_d2,		5,	29),
@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = {
 	"i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19",
 };
 
+static const char * const i2c_d_groups[] = {
+	"i2c_sck_d", "i2c_sda_d",
+};
+
 static const char * const eth_groups[] = {
 	"eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv",
 	"eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3",
@@ -777,6 +786,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = {
 	FUNCTION(i2c_a),
 	FUNCTION(i2c_b),
 	FUNCTION(i2c_c),
+	FUNCTION(i2c_d),
 	FUNCTION(eth),
 	FUNCTION(pwm_a),
 	FUNCTION(pwm_b),
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:33:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367468; cv=none; b=onGAecIZcv8YhyKI/19pdfCwhFfsnv8+3A/VO3R8H0RN7L4VqouFog/QyTtKRiZ++JGZLUvvTJnFM5GOyjCyhq1JF2BpBfmroYT+U31CtH5hWGzKcVMVmAtWpy1cMJ6Y9jTqhwB8t59qX4htmWtN2USIMeGWxN/R16XFmflw9fY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367468; c=relaxed/simple;
	bh=NG+kSPl+tKoxbbWbKWDSdmtxFouarvH8wJ0z4odU+p4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=r/6Z8uw9YMls8GqqZ0+85Gqdvba8xRrMpsN8bgjKD2thxRDeYnb+KE/EruYD4TkYdsQqtAmGf0z8518226b7Zt+IWSD/X4bncslARyHOp1KO6QRu5/h9bEiSRApyqSVl137LjPoGVqz203nyKhIBTVNCePXSyugs1D/q4oA6GxA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=AidcNs2k; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Sneh Mankad <[email-masked]>,
	Bjorn Andersson <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 022/196] soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
Date: Mon, 13 Oct 2025 16:43:33 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sneh Mankad <[email-masked]>

[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]

Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a
transaction completes. Previously this bit was only cleared when
a wake TCS was borrowed as an AMC TCS but not for dedicated
AMC TCS. Leaving this bit set for AMC TCS and entering deeper low
power modes can generate a false completion IRQ.

Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER
bit upon receiving a completion IRQ.

Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS")
Signed-off-by: Sneh Mankad <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Bjorn Andersson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/soc/qcom/rpmh-rsc.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
index 163a58eb02e0a..d0ec42ec0d041 100644
--- a/drivers/soc/qcom/rpmh-rsc.c
+++ b/drivers/soc/qcom/rpmh-rsc.c
@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
 
 		trace_rpmh_tx_done(drv, i, req);
 
-		/*
-		 * If wake tcs was re-purposed for sending active
-		 * votes, clear AMC trigger & enable modes and
+		/* Clear AMC trigger & enable modes and
 		 * disable interrupt for this TCS
 		 */
-		if (!drv->tcs[ACTIVE_TCS].num_tcs)
-			__tcs_set_trigger(drv, i, false);
+		__tcs_set_trigger(drv, i, false);
 skip:
 		/* Reclaim the TCS */
 		write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:18:09 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367465; cv=none; b=Tp3DY1d4rHSEGS+PJ66C+x4AlD3niwyFqVW0Na2MYMuLOQmlpTKAN2z8oV2Y0AyGYB1vfFPvrydVRoky6s+FVfg2Ucn+ZtNKOxLjCjzVZWik5z0e7uJdRIO4G6U23L1HWCK7EPc7uqf7nLbjc5Bp3iZxDDpQMpCUr6lZUaYKlmk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367465; c=relaxed/simple;
	bh=6pWfojyJ4sEtvlcsIgvtsb+is1+0WZTt+kkB0Dqoa/Y=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=kJphxe/CoK2sH1FAxaPXlQI/7oytT5LWFSvh25yG0OLJZRRIDy7HVXquZj/W9UmvK42ngfMuPi4r9DKNj9rzdYXDz6EcEXb7TaCTcSMwh0mPv0tY8uffrnVJfgGcumAcaRz4YanBSZNMjbMibFHnH7ZTAG7wIxuH8kzqSdAbnjc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dvhDS/ua; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Huisong Li <[email-masked]>,
	"Rafael J. Wysocki" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 021/196] ACPI: processor: idle: Fix memory leak when register cpuidle device failed
Date: Mon, 13 Oct 2025 16:43:32 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Huisong Li <[email-masked]>

[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]

The cpuidle device's memory is leaked when cpuidle device registration
fails in acpi_processor_power_init().  Free it as appropriate.

Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
Signed-off-by: Huisong Li <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
[ rjw: Changed the order of the new statements, added empty line after if () ]
[ rjw: Changelog edits ]
Signed-off-by: Rafael J. Wysocki <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/acpi/processor_idle.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 0888e4d618d53..b524cf27213d4 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -1410,6 +1410,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)
 		if (retval) {
 			if (acpi_processor_registered == 0)
 				cpuidle_unregister_driver(&acpi_idle_driver);
+
+			per_cpu(acpi_cpuidle_device, pr->id) = NULL;
+			kfree(dev);
 			return retval;
 		}
 		acpi_processor_registered++;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:28:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367462; cv=none; b=fpBkwN2D7MMb3ZELNzv/PahVY8f5jSoVt2zTgBEHbTuSiaNgtwdWyg8vejzd9o4GrLGQyjWHlH2Sirdu6GV/zcZQpGYk/tVyXwvCJQnOMtHEfB/lHCl8u5UexpTq/LKUKjGOPRC4HT0lWEP2vMoZqD5Bv1WANhAiN9a8xWTF2s0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367462; c=relaxed/simple;
	bh=lrpGl4umK9orrdoWIPi0fyp56X/j1/HLAZiR7XIzYCc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ZlmdRaKdRUwRD7M/a9L3A86S6fnqMjngQ6ekmBO1KQZ+jrQwb7D83R3jD1925+9whxlahLbx6wZWbJK8/op71SJuOvwoF6DdCnsCTbln0gJeip9ffzZY2mvIX+XN/YYL8AIC3Xno9Kzgz3i/u8c2GVrqJbah0XM755qpdWwXaC0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JKSq89h0; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Florian Fainelli <[email-masked]>,
	Sudeep Holla <[email-masked]>,
	Viresh Kumar <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 020/196] cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
Date: Mon, 13 Oct 2025 16:43:31 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Florian Fainelli <[email-masked]>

[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ]

Broadcom STB platforms were early adopters (2017) of the SCMI framework and as
a result, not all deployed systems have a Device Tree entry where SCMI
protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the
CPU Device Tree node(s) referencing protocol 0x13 as their clock
provider. This was clarified in commit e11c480b6df1 ("dt-bindings:
firmware: arm,scmi: Extend bindings for protocol@13") in 2023.

For those platforms, we allow the checks done by scmi_dev_used_by_cpus()
to continue, and in the event of not having done an early return, we key
off the documented compatible string and give them a pass to continue to
use scmi-cpufreq.

Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs")
Signed-off-by: Florian Fainelli <[email-masked]>
Reviewed-by: Sudeep Holla <[email-masked]>
Signed-off-by: Viresh Kumar <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
index 6ff77003a96ea..68325ebd56fe3 100644
--- a/drivers/cpufreq/scmi-cpufreq.c
+++ b/drivers/cpufreq/scmi-cpufreq.c
@@ -15,6 +15,7 @@
 #include <linux/energy_model.h>
 #include <linux/export.h>
 #include <linux/module.h>
+#include <linux/of.h>
 #include <linux/pm_opp.h>
 #include <linux/slab.h>
 #include <linux/scmi_protocol.h>
@@ -330,6 +331,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev)
 			return true;
 	}
 
+	/*
+	 * Older Broadcom STB chips had a "clocks" property for CPU node(s)
+	 * that did not match the SCMI performance protocol node, if we got
+	 * there, it means we had such an older Device Tree, therefore return
+	 * true to preserve backwards compatibility.
+	 */
+	if (of_machine_is_compatible("brcm,brcmstb"))
+		return true;
+
 	return false;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:18:03 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367457; cv=none; b=BZ6QYnvV3r44oenZsNSHNKdEda2krNff+FAD+KFzsYpIeSh2U8r7b80PopaAwkJNbjV/6GsLnRRUhf8Doswphsz19XzqL/LdTI7y4NVQjL2IRV8Ep7eqiuYjnhQZPs4QWnVWNxaJCkK3Dh2mqlbpl4+CYwHugow+B8Yfwq/S1NM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367457; c=relaxed/simple;
	bh=ARqsYD1o3WrFji041nkJIdJoEtdUmMjE7miSnROBb+g=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DxUgN74KnJ8IYVTp8tI1PLF1dm6LRtXLWDEiYBjA7tawup6Yosxy9PcRzDmBmzEx6zxNZOup8lewsEozWWqsmqC/+UVXBrjeyAmnHUs45lTTFpBleJJCCjEEcmExwlaDK/0aP6p5bkeeSs0QH4//yazXUiMou1BYdh4rq52TAYc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=R4dAetI9; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ilya Leoshkevich <[email-masked]>,
	Daniel Borkmann <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 019/196] s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
Date: Mon, 13 Oct 2025 16:43:30 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ilya Leoshkevich <[email-masked]>

[ Upstream commit bc3905a71f02511607d3ccf732360580209cac4c ]

The tailcall_bpf2bpf_hierarchy_fentry test hangs on s390. Its call
graph is as follows:

  entry()
    subprog_tail()
      trampoline()
        fentry()
        the rest of subprog_tail()  # via BPF_TRAMP_F_CALL_ORIG
        return to entry()

The problem is that the rest of subprog_tail() increments the tail call
counter, but the trampoline discards the incremented value. This
results in an astronomically large number of tail calls.

Fix by making the trampoline write the incremented tail call counter
back.

Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()")
Signed-off-by: Ilya Leoshkevich <[email-masked]>
Signed-off-by: Daniel Borkmann <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/s390/net/bpf_jit_comp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 31a4bbd2e7dc4..fe0354ad3bb96 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -2442,6 +2442,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
 		/* stg %r2,retval_off(%r15) */
 		EMIT6_DISP_LH(0xe3000000, 0x0024, REG_2, REG_0, REG_15,
 			      tjit->retval_off);
+		/* mvc tccnt_off(%r15),tail_call_cnt(4,%r15) */
+		_EMIT6(0xd203f000 | tjit->tccnt_off,
+		       0xf000 | offsetof(struct prog_frame, tail_call_cnt));
 
 		im->ip_after_call = jit->prg_buf + jit->prg;
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:14:10 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367454; cv=none; b=g3xcWr84g2VabbjpHzAofCSPW7OGgQLy/6ExShoSh41Pc97VMfxMcMDAjIU/f4URSVBlRYwsWMSmEejimeNaqBHYp8c4+FQ+PodO46pjlW+HtjuIpinUtDQjxe7YMIqLhfXQsFyYeMflVwVc6vefWzFLO7MxbYZQqmJz+Lxy9CA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367454; c=relaxed/simple;
	bh=o6YJmH/S3MqOzaATzJyzJGJFEYtjrHSzPhdqFVdl/WU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=d4tbndzKnM7/UWj2A9N95bShziGNRqNfvF6BO+zlF/0UyQu7OlNoRyBleJ39H36goeboRG8+9doUoaCb8zrvvTfCnLOYyJgX5HwBpx5W5Ju7L5BWhRFlOAvYSy2NMlmBjRlmqXOcgt/TmTPoXoyE0t74C8mBOGPFJMTs4vMUJF4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ashYBfat; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ilya Leoshkevich <[email-masked]>,
	Daniel Borkmann <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 018/196] s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
Date: Mon, 13 Oct 2025 16:43:29 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ilya Leoshkevich <[email-masked]>

[ Upstream commit c861a6b147137d10b5ff88a2c492ba376cd1b8b0 ]

The tailcall_bpf2bpf_hierarchy_1 test hangs on s390. Its call graph is
as follows:

  entry()
    subprog_tail()
      bpf_tail_call_static(0) -> entry + tail_call_start
    subprog_tail()
      bpf_tail_call_static(0) -> entry + tail_call_start

entry() copies its tail call counter to the subprog_tail()'s frame,
which then increments it. However, the incremented result is discarded,
leading to an astronomically large number of tail calls.

Fix by writing the incremented counter back to the entry()'s frame.

Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()")
Signed-off-by: Ilya Leoshkevich <[email-masked]>
Signed-off-by: Daniel Borkmann <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/s390/net/bpf_jit_comp.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 2d8facfd4e425..31a4bbd2e7dc4 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -1425,13 +1425,6 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 		jit->seen |= SEEN_FUNC;
 		/*
 		 * Copy the tail call counter to where the callee expects it.
-		 *
-		 * Note 1: The callee can increment the tail call counter, but
-		 * we do not load it back, since the x86 JIT does not do this
-		 * either.
-		 *
-		 * Note 2: We assume that the verifier does not let us call the
-		 * main program, which clears the tail call counter on entry.
 		 */
 		/* mvc STK_OFF_TCCNT(4,%r15),N(%r15) */
 		_EMIT6(0xd203f000 | STK_OFF_TCCNT,
@@ -1457,6 +1450,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 		call_r1(jit);
 		/* lgr %b0,%r2: load return value into %b0 */
 		EMIT4(0xb9040000, BPF_REG_0, REG_2);
+
+		/*
+		 * Copy the potentially updated tail call counter back.
+		 */
+
+		if (insn->src_reg == BPF_PSEUDO_CALL)
+			/*
+			 * mvc frame_off+tail_call_cnt(%r15),
+			 *     tail_call_cnt(4,%r15)
+			 */
+			_EMIT6(0xd203f000 | (jit->frame_off +
+					     offsetof(struct prog_frame,
+						      tail_call_cnt)),
+			       0xf000 | offsetof(struct prog_frame,
+						 tail_call_cnt));
+
 		break;
 	}
 	case BPF_JMP | BPF_TAIL_CALL: {
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:36:15 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367451; cv=none; b=OjuGJaR74lpCCNv1Er0Sb4Eu59A0/kNPTTw45OtNn8cDUB70H1dsOBiRhaptMS3siH9Ga33iSC2rHXPz6VjZikvcOeRYX5oEKtq0lnicJ1kjYpDWmCiOaaIVc3SCcfzUnjKpHMCzxVOKp0Y2g6TpPl20LM93fwGWWK3e8dSg7U0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367451; c=relaxed/simple;
	bh=wmCMb+cK7K9YNrNkjk+GUm+y9kWMxx/i8dA5QhL5xhU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=VRE3/Z2qW0pQ/6QyCLZ9QDiMIo0gtrYxfw+jfh3CKs8yTMBoPBSH/M+ZBUU1uB0KvDwBufNW7SzFOKB9X4QrH3l49Hd61OsWkGYGwXCbKwCC2grwWN6fOkrzjGvm7oduDuqRnwt7UCAg+wsC0lr927ILZzOiZgr6st+XkCQWtnQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=wKyV/FMX; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Fenglin Wu <[email-masked]>,
	Konrad Dybcio <[email-masked]>,
	Lee Jones <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 017/196] leds: flash: leds-qcom-flash: Update torch current clamp setting
Date: Mon, 13 Oct 2025 16:43:28 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Fenglin Wu <[email-masked]>

[ Upstream commit 5974e8f6c3e47ab097c3dd8ece7324d1f88fe739 ]

There is a register to clamp the flash current per LED channel when
safety timer is disabled. It needs to be updated according to the
maximum torch LED current setting to ensure the torch current won't
be clamped unexpectedly.

Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs")
Signed-off-by: Fenglin Wu <[email-masked]>
Reviewed-by: Konrad Dybcio <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Lee Jones <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/leds/flash/leds-qcom-flash.c | 62 ++++++++++++++++------------
 1 file changed, 36 insertions(+), 26 deletions(-)

diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c
index a619dbe015243..07ca3e32d4bec 100644
--- a/drivers/leds/flash/leds-qcom-flash.c
+++ b/drivers/leds/flash/leds-qcom-flash.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/bitfield.h>
@@ -114,36 +114,39 @@ enum {
 	REG_THERM_THRSH1,
 	REG_THERM_THRSH2,
 	REG_THERM_THRSH3,
+	REG_TORCH_CLAMP,
 	REG_MAX_COUNT,
 };
 
 static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = {
-	REG_FIELD(0x08, 0, 7),			/* status1	*/
-	REG_FIELD(0x09, 0, 7),                  /* status2	*/
-	REG_FIELD(0x0a, 0, 7),                  /* status3	*/
-	REG_FIELD_ID(0x40, 0, 7, 3, 1),         /* chan_timer	*/
-	REG_FIELD_ID(0x43, 0, 6, 3, 1),         /* itarget	*/
-	REG_FIELD(0x46, 7, 7),                  /* module_en	*/
-	REG_FIELD(0x47, 0, 5),                  /* iresolution	*/
-	REG_FIELD_ID(0x49, 0, 2, 3, 1),         /* chan_strobe	*/
-	REG_FIELD(0x4c, 0, 2),                  /* chan_en	*/
-	REG_FIELD(0x56, 0, 2),			/* therm_thrsh1 */
-	REG_FIELD(0x57, 0, 2),			/* therm_thrsh2 */
-	REG_FIELD(0x58, 0, 2),			/* therm_thrsh3 */
+	[REG_STATUS1]		= REG_FIELD(0x08, 0, 7),
+	[REG_STATUS2]		= REG_FIELD(0x09, 0, 7),
+	[REG_STATUS3]		= REG_FIELD(0x0a, 0, 7),
+	[REG_CHAN_TIMER]	= REG_FIELD_ID(0x40, 0, 7, 3, 1),
+	[REG_ITARGET]		= REG_FIELD_ID(0x43, 0, 6, 3, 1),
+	[REG_MODULE_EN]		= REG_FIELD(0x46, 7, 7),
+	[REG_IRESOLUTION]	= REG_FIELD(0x47, 0, 5),
+	[REG_CHAN_STROBE]	= REG_FIELD_ID(0x49, 0, 2, 3, 1),
+	[REG_CHAN_EN]		= REG_FIELD(0x4c, 0, 2),
+	[REG_THERM_THRSH1]	= REG_FIELD(0x56, 0, 2),
+	[REG_THERM_THRSH2]	= REG_FIELD(0x57, 0, 2),
+	[REG_THERM_THRSH3]	= REG_FIELD(0x58, 0, 2),
+	[REG_TORCH_CLAMP]	= REG_FIELD(0xec, 0, 6),
 };
 
 static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = {
-	REG_FIELD(0x06, 0, 7),			/* status1	*/
-	REG_FIELD(0x07, 0, 6),			/* status2	*/
-	REG_FIELD(0x09, 0, 7),			/* status3	*/
-	REG_FIELD_ID(0x3e, 0, 7, 4, 1),		/* chan_timer	*/
-	REG_FIELD_ID(0x42, 0, 6, 4, 1),		/* itarget	*/
-	REG_FIELD(0x46, 7, 7),			/* module_en	*/
-	REG_FIELD(0x49, 0, 3),			/* iresolution	*/
-	REG_FIELD_ID(0x4a, 0, 6, 4, 1),		/* chan_strobe	*/
-	REG_FIELD(0x4e, 0, 3),			/* chan_en	*/
-	REG_FIELD(0x7a, 0, 2),			/* therm_thrsh1 */
-	REG_FIELD(0x78, 0, 2),			/* therm_thrsh2 */
+	[REG_STATUS1]		= REG_FIELD(0x06, 0, 7),
+	[REG_STATUS2]		= REG_FIELD(0x07, 0, 6),
+	[REG_STATUS3]		= REG_FIELD(0x09, 0, 7),
+	[REG_CHAN_TIMER]	= REG_FIELD_ID(0x3e, 0, 7, 4, 1),
+	[REG_ITARGET]		= REG_FIELD_ID(0x42, 0, 6, 4, 1),
+	[REG_MODULE_EN]		= REG_FIELD(0x46, 7, 7),
+	[REG_IRESOLUTION]	= REG_FIELD(0x49, 0, 3),
+	[REG_CHAN_STROBE]	= REG_FIELD_ID(0x4a, 0, 6, 4, 1),
+	[REG_CHAN_EN]		= REG_FIELD(0x4e, 0, 3),
+	[REG_THERM_THRSH1]	= REG_FIELD(0x7a, 0, 2),
+	[REG_THERM_THRSH2]	= REG_FIELD(0x78, 0, 2),
+	[REG_TORCH_CLAMP]	= REG_FIELD(0xed, 0, 6),
 };
 
 struct qcom_flash_data {
@@ -156,6 +159,7 @@ struct qcom_flash_data {
 	u8			max_channels;
 	u8			chan_en_bits;
 	u8			revision;
+	u8			torch_clamp;
 };
 
 struct qcom_flash_led {
@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev,
 	u32 current_ua, timeout_us;
 	u32 channels[4];
 	int i, rc, count;
+	u8 torch_clamp;
 
 	count = fwnode_property_count_u32(node, "led-sources");
 	if (count <= 0) {
@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev,
 	current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count);
 	led->max_torch_current_ma = current_ua / UA_PER_MA;
 
+	torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA;
+	if (torch_clamp != 0)
+		torch_clamp--;
+
+	flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp);
+
 	if (fwnode_property_present(node, "flash-max-microamp")) {
 		flash->led_cdev.flags |= LED_DEV_CAP_FLASH;
 
@@ -918,8 +929,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev)
 		flash_data->leds_count++;
 	}
 
-	return 0;
-
+	return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp);
 release:
 	fwnode_handle_put(child);
 	while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count)
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:14:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367449; cv=none; b=he0MmDDia37R8VZtCUIBJEwMYJAdlCpQBABQN8ifXWN5h9KaokJuvrwg0vodqRo/CwI5g0Q4DxzR1Ps5UqYKXpCiVE+7Lt/zgJITIaoRPXeTr3rlOK3dH4YAjzgQqbZ5FGrWk28RmD9u8yKf6LnrnI/bPFkiVmu4gFftVS2L2mk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367449; c=relaxed/simple;
	bh=8s0w+i6rUoTGGdHzLxE8E4e4WHfZzKDOc/r7U+AMJ7g=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=mbU7NeT/WXIXHcS1uTH8iiflCbwTTOTdI0Ux21mxI49pYj2jl74+Q1G5aRvk5LObf0xVNEwdg6JoCrObvxAbZDbBGWJnzrN7yJXQ8aNBXekbiMCXZQxZrxnSwodMOsfRX+3zOpZH66oNJJ+k6OkSmXOopJFjkzaPYLkxZNRaqVs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=A+u6dULI; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 016/196] ARM: dts: renesas: porter: Fix CAN pin group
Date: Mon, 13 Oct 2025 16:43:27 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email-masked]>

[ Upstream commit 287066b295051729fb08c3cff12ae17c6fe66133 ]

According to the schematics, the CAN transceiver is connected to pins
GP7_3 and GP7_4, which correspond to CAN0 data group B.

Fixes: 0768fbad7fba1d27 ("ARM: shmobile: porter: add CAN0 DT support")
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Link: https://lore.kernel.org/70ad9[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm/boot/dts/renesas/r8a7791-porter.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
index fcc9a2313e1df..0cd08f7b8d8e0 100644
--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts
+++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
@@ -266,7 +266,7 @@ vin0_pins: vin0 {
 	};
 
 	can0_pins: can0 {
-		groups = "can0_data";
+		groups = "can0_data_b";
 		function = "can0";
 	};
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:33:33 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367445; cv=none; b=dUJzc3LNeomXU0ew4sGhFvomfeB239PUE/YJhwTGtnqvyQgMcks07R9QcvFmsFWM2GfaexuYIYyIgo03pKz3PFF5ByIiNBaM06GyfzhkU5eJiUi3ncA8gRPpPn4QOz4wxCZBeXf/eA7zE8TOyuIy6JX/8AhpOyWZ+ApplWghEmA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367445; c=relaxed/simple;
	bh=pIdHAC2T6E5pCn+CFIxlcndPeLQvhEM9G6Ny+PZfvBQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=N2tsfZh2vf6lz5pPTHrlg036o/Wk2/3+CEtA9dlhjFevrIg1zUYjBqeyNdWWhBN5cnVezyNI4/Ivc66rGrS+3BSJ4nvkFJtvZIQPuSXQZfgBfGKGZrZXUNlkTELNs170YbrHUjPd1G+EK4bWyeGKjYwK5gHI3JVFxKEHIMpCInY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DZ6zmeaW; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yureka Lilian <[email-masked]>,
	Andrii Nakryiko <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 015/196] libbpf: Fix reuse of DEVMAP
Date: Mon, 13 Oct 2025 16:43:26 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yureka Lilian <[email-masked]>

[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ]

Previously, re-using pinned DEVMAP maps would always fail, because
get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set,
but BPF_F_RDONLY_PROG being set on a map during creation is invalid.

Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
get_map_info when checking for compatibility with an existing DEVMAP.

The same problem is handled in a third-party ebpf library:
- https://github.com/cilium/ebpf/issues/925
- https://github.com/cilium/ebpf/pull/930

Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF")
Signed-off-by: Yureka Lilian <[email-masked]>
Signed-off-by: Andrii Nakryiko <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/lib/bpf/libbpf.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index aefbfa2df6207..95f2ffefff3ff 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -5013,6 +5013,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
 		return false;
 	}
 
+	/*
+	 * bpf_get_map_info_by_fd() for DEVMAP will always return flags with
+	 * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time.
+	 * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
+	 * bpf_get_map_info_by_fd() when checking for compatibility with an
+	 * existing DEVMAP.
+	 */
+	if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH)
+		map_info.map_flags &= ~BPF_F_RDONLY_PROG;
+
 	return (map_info.type == map->def.type &&
 		map_info.key_size == map->def.key_size &&
 		map_info.value_size == map->def.value_size &&
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:17:54 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367442; cv=none; b=swrjcpnV5Q+F7zw/fVHFiUaAZFKRKVi1cyS9rv0spLapeK81oop7GE6RslgzqzkDz7ODeOiu7Hzk7Wzgu5Q+3QQOkEVtAEPgqkUaBmywJtaQTwy5wEqVz9kW29EeOsaYSHKO3icvy4Hh169R2GQGPcXm9w15PkUc2nPj0ca3z+Y=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367442; c=relaxed/simple;
	bh=2gV+NKftCI2/i9KnmnZ5/vGrT8lT2gCvPF7G7B/N/DY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ORYm7YLxZA+0UbL89qlBIOR9QcH2l2ma3ClzO5T8lGmBRPIKn0I5JC65+zmqky0Zfk1eYb4qvv9h+g6tO7qL5LpfEhMu3DX7Pr56lG4/MxWGZMCZwLoqXv8rR/0YUwIkmzLKyZWxwU/cF+gJKbtoez5ChSHrwRDVLkH7lHZq1I4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xNkr/8bj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Tao Chen <[email-masked]>,
	Andrii Nakryiko <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 014/196] bpf: Remove migrate_disable in kprobe_multi_link_prog_run
Date: Mon, 13 Oct 2025 16:43:25 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tao Chen <[email-masked]>

[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ]

Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run
called all the way from graph tracer, which disables preemption in
function_graph_enter_regs, as Jiri and Yonghong suggested, there is no
need to use migrate_disable. As a result, some overhead may will be reduced.
And add cant_sleep check for __this_cpu_inc_return.

Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
Signed-off-by: Tao Chen <[email-masked]>
Signed-off-by: Andrii Nakryiko <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/trace/bpf_trace.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 8903db0b59602..a896b80252ae1 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2726,18 +2726,23 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link,
 	struct bpf_run_ctx *old_run_ctx;
 	int err;
 
+	/*
+	 * graph tracer framework ensures we won't migrate, so there is no need
+	 * to use migrate_disable for bpf_prog_run again. The check here just for
+	 * __this_cpu_inc_return.
+	 */
+	cant_sleep();
+
 	if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {
 		err = 0;
 		goto out;
 	}
 
-	migrate_disable();
 	rcu_read_lock();
 	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
 	err = bpf_prog_run(link->link.prog, regs);
 	bpf_reset_run_ctx(old_run_ctx);
 	rcu_read_unlock();
-	migrate_enable();
 
  out:
 	__this_cpu_dec(bpf_prog_active);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:17:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367440; cv=none; b=HJZEzunAvhxGBHyF9pldJN/HCE8XiMUqOLuCV4HmzKnEJW/zqz38sdg5AHxjX+/lQcEuz+vB47gz1CAMrN+h0dAclfW8DtHQI7odBkZwNgF0cwiYVj5cOxNN7V1pPp4mpxh9kgqXH+VLxbgs1nmROO9doYqYvMTtrR19NjjsS0w=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367440; c=relaxed/simple;
	bh=e7Zvv5H+Tal65UrapKCLCh2eySHRsnTuSPkGbQDA5cY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=jBt5X5/iGdSIPGiB8Bu8sEwwnVuRtKAWmSnQf7j3J/5HS9NVceC9T4jXLJ3llOViNfvKw6ILYRqIGtbjB6l0u6x1OJXGjjsafzD5z0csFs5DfxZHqXPfXMLmYtfUHmY/kRbUYqvcKUJ/RZauySfdhJnSYe1ARxWhpgSqZdNbSNU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XVfGVr8R; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Matt Bobrowski <[email-masked]>,
	Martin KaFai Lau <[email-masked]>,
	Stanislav Fomichev <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 013/196] bpf/selftests: Fix test_tcpnotify_user
Date: Mon, 13 Oct 2025 16:43:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Matt Bobrowski <[email-masked]>

[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ]

Based on a bisect, it appears that commit 7ee988770326 ("timers:
Implement the hierarchical pull model") has somehow inadvertently
broken BPF selftest test_tcpnotify_user. The error that is being
generated by this test is as follows:

	FAILED: Wrong stats Expected 10 calls, got 8

It looks like the change allows timer functions to be run on CPUs
different from the one they are armed on. The test had pinned itself
to CPU 0, and in the past the retransmit attempts also occurred on CPU
0. The test had set the max_entries attribute for
BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling
bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was
likely to be in range. With the change to allow timers to run on other
CPUs, the current CPU tasked with performing the retransmit might be
bumped and in turn fall out of range, as the event will be filtered
out via __bpf_perf_event_output() using:

    if (unlikely(index >= array->map.max_entries))
            return -E2BIG;

A possible change would be to explicitly set the max_entries attribute
for perf_event_map in test_tcpnotify_kern.c to a value that's at least
as large as the number of CPUs. As it turns out however, if the field
is left unset, then the libbpf will determine the number of CPUs available
on the underlying system and update the max_entries attribute accordingly
in map_set_def_max_entries().

A further problem with the test is that it has a thread that continues
running up until the program exits. The main thread cleans up some
LIBBPF data structures, while the other thread continues to use them,
which inevitably will trigger a SIGSEGV. This can be dealt with by
telling the thread to run for as long as necessary and doing a
pthread_join on it before exiting the program.

Finally, I don't think binding the process to CPU 0 is meaningful for
this test any more, so get rid of that.

Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification")
Signed-off-by: Matt Bobrowski <[email-masked]>
Signed-off-by: Martin KaFai Lau <[email-masked]>
Acked-by: Stanislav Fomichev <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../selftests/bpf/progs/test_tcpnotify_kern.c |  1 -
 .../selftests/bpf/test_tcpnotify_user.c       | 20 +++++++++----------
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
index 540181c115a85..ef00d38b0a8d2 100644
--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
+++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
@@ -23,7 +23,6 @@ struct {
 
 struct {
 	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
-	__uint(max_entries, 2);
 	__type(key, int);
 	__type(value, __u32);
 } perf_event_map SEC(".maps");
diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c
index 595194453ff8f..35b4893ccdf8a 100644
--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c
+++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c
@@ -15,20 +15,18 @@
 #include <bpf/libbpf.h>
 #include <sys/ioctl.h>
 #include <linux/rtnetlink.h>
-#include <signal.h>
 #include <linux/perf_event.h>
-#include <linux/err.h>
 
-#include "bpf_util.h"
 #include "cgroup_helpers.h"
 
 #include "test_tcpnotify.h"
-#include "trace_helpers.h"
 #include "testing_helpers.h"
 
 #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L)
 
 pthread_t tid;
+static bool exit_thread;
+
 int rx_callbacks;
 
 static void dummyfn(void *ctx, int cpu, void *data, __u32 size)
@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb)
 {
 	int err;
 
-	while (1) {
+	while (!exit_thread) {
 		err = perf_buffer__poll(pb, 100);
 		if (err < 0 && err != -EINTR) {
 			printf("failed perf_buffer__poll: %d\n", err);
@@ -78,15 +76,10 @@ int main(int argc, char **argv)
 	int error = EXIT_FAILURE;
 	struct bpf_object *obj;
 	char test_script[80];
-	cpu_set_t cpuset;
 	__u32 key = 0;
 
 	libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
 
-	CPU_ZERO(&cpuset);
-	CPU_SET(0, &cpuset);
-	pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset);
-
 	cg_fd = cgroup_setup_and_join(cg_path);
 	if (cg_fd < 0)
 		goto err;
@@ -151,6 +144,13 @@ int main(int argc, char **argv)
 
 	sleep(10);
 
+	exit_thread = true;
+	int ret = pthread_join(tid, NULL);
+	if (ret) {
+		printf("FAILED: pthread_join\n");
+		goto err;
+	}
+
 	if (verify_result(&g)) {
 		printf("FAILED: Wrong stats Expected %d calls, got %d\n",
 			g.ncalls, rx_callbacks);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:26:50 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367437; cv=none; b=I7O0ti+NZzcZNx0pnFcM4QiTTF/UqwP35eg1TGBLRngiV0QHxUO4e7efdTF9m5eVxL+dhM66xhHlK5uJf2wWEA6nAWzjq5AP9TTQntlR8NKQWby+4cLIQ2uWPie7zJiOE8gRUsD0uKxxpjRTo7MbbFuTtNzivw3L8z39cQd/rHo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367437; c=relaxed/simple;
	bh=KTGgZEAafyPgkshie/WXIpccFthq2NC5Aek0VLLdLH0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=dRi7aF6j5OZYMruR1ebyEQ6Ykzoc0bk6qe0SpDrxjV/0noM1o7i6ta3SDJ1YSeD18+gSlDfzyDkUAtRPCGDlUZTV2SfnNJMU9qteUn2bmp5Qem6JlOT8yue0ZoLVdZhXQyOV59v90KtfX7vN8xT/0YUkc14Ab2GbIK8cB5oMcX8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=w0H2xPIA; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Geert Uytterhoeven <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 012/196] regmap: Remove superfluous check for !config in __regmap_init()
Date: Mon, 13 Oct 2025 16:43:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email-masked]>

[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]

The first thing __regmap_init() do is check if config is non-NULL,
so there is no need to check for this again later.

Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config")
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Link: https://patch.msgid.link/a154d[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/base/regmap/regmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 1209e01f8c7f9..9603c28a3ed82 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -827,7 +827,7 @@ struct regmap *__regmap_init(struct device *dev,
 		map->read_flag_mask = bus->read_flag_mask;
 	}
 
-	if (config && config->read && config->write) {
+	if (config->read && config->write) {
 		map->reg_read  = _regmap_bus_read;
 		if (config->reg_update_bits)
 			map->reg_update_bits = config->reg_update_bits;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:32:40 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367434; cv=none; b=OExNRXK33ikh7rjRUyiczgTgEpovljcVUX0zQ6lX9iwOFwWqPkulcO+Hx8yIlx236zWQFrkOME6naKPjGpcS18AOr0ProuS094E2FpI3M4RvDQbypKoad+nFJ6pPZmASdf4qRXfRI2yOrvhQUiouSL4/dqEWTZiujYetSMJPhn4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367434; c=relaxed/simple;
	bh=/3wuewW+j1WqSHkuPe+CE4oqRJxAVkL5B8f5Cfb1XgY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=BZQS6AGjlmWzhaZsAyuVcDlwL7tDempUG6hgxlPHd1JUi3pMtsfMPfIUfHce0/H4odSGE9M10HYw1FZeRfTcIgDClg9wIL5k4ccMEkJ1Ws2luAGblumyIHwgWOBinwF+ZaH36gSQoD8owMIcNM0JqvC9SZb4e6zn0WW5Ff0EGi8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hbFVg9MW; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Biju Das <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 011/196] arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
Date: Mon, 13 Oct 2025 16:43:22 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Biju Das <[email-masked]>

[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ]

On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we
are deleting a wrong and nonexistent node.  Fixing the wrong node would
invoke a dtb warning message, as channel0 is a required property.
Disable CAN-FD channel0 instead of deleting the node.

Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1")
Signed-off-by: Biju Das <[email-masked]>
Reviewed-by: Geert Uytterhoeven <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
index 83fce96a25752..0234dbe95413c 100644
--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
@@ -38,7 +38,10 @@ hdmi_con_out: endpoint {
 #if (SW_SCIF_CAN || SW_RSPI_CAN)
 &canfd {
 	pinctrl-0 = <&can1_pins>;
-	/delete-node/ channel@0;
+
+	channel0 {
+		status = "disabled";
+	};
 };
 #else
 &canfd {
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:17:47 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367431; cv=none; b=KJ4qBStp9zToUIDgVCUUXAM15RikwexC8CzriKcnXAyDMOhvrXCoZlLbwV44Fie9kRmDausxbDw46Te8+sq3NqWNJiR4/NUcKSH5nOTJW8N663uq+aKwnS5lbnwlYYAa4tLDGdWvrU7g4sOQt40T1agJ4idrhU61heDwjal0hRA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367431; c=relaxed/simple;
	bh=+pHmcWU3lWPnZFE0cMJBKYHThSw1LVh1KqTGVQ1P/Ec=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=S496d8d4B+/1Swb6nxIVM2DeUNivajJbo2pp4eewOmNgsULiu7wL74lI20IoIADJfYJ1AMHzLMRKUJNo7F5kQWgZFbUAq3shLiMEECn7xZNle2KGFSnumTEaDRVAybR1NWG6IjgAVaWY+bz9eS8ZNXo/dLqyVgyf8o+SvGpCdPw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rqALPkDM; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Uros Bizjak <[email-masked]>,
	"Borislav Petkov (AMD)" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 010/196] x86/vdso: Fix output operand size of RDPID
Date: Mon, 13 Oct 2025 16:43:21 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Uros Bizjak <[email-masked]>

[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]

RDPID instruction outputs to a word-sized register (64-bit on x86_64 and
32-bit on x86_32). Use an unsigned long variable to store the correct size.

LSL outputs to 32-bit register, use %k operand prefix to always print the
32-bit name of the register.

Use RDPID insn mnemonic while at it as the minimum binutils version of
2.30 supports it.

  [ bp: Merge two patches touching the same function into a single one. ]

Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number")
Signed-off-by: Uros Bizjak <[email-masked]>
Signed-off-by: Borislav Petkov (AMD) <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/x86/include/asm/segment.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
index 9d6411c659205..00cefbb59fa98 100644
--- a/arch/x86/include/asm/segment.h
+++ b/arch/x86/include/asm/segment.h
@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)
 
 static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
 {
-	unsigned int p;
+	unsigned long p;
 
 	/*
 	 * Load CPU and node number from the GDT.  LSL is faster than RDTSCP
@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
 	 *
 	 * If RDPID is available, use it.
 	 */
-	alternative_io ("lsl %[seg],%[p]",
-			".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */
+	alternative_io ("lsl %[seg],%k[p]",
+			"rdpid %[p]",
 			X86_FEATURE_RDPID,
-			[p] "=a" (p), [seg] "r" (__CPUNODE_SEG));
+			[p] "=r" (p), [seg] "r" (__CPUNODE_SEG));
 
 	if (cpu)
 		*cpu = (p & VDSO_CPUNODE_MASK);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:26:38 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367503; cv=none; b=U4PFFxsqqw4wTQ7kd84TE2PXZRLruM/JDXmibglVe5j/tlIWmFE57azIXA35KpvA//bSAJ4mpdYcuUYZjmpl928GH5hr/i6UVSM7/yxphYvqLGuDktfnGizSoVTHbXag6n6d4DCo6GSWs77BnfL54YRJ35thQaPmPkw6/ikG2U4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367503; c=relaxed/simple;
	bh=/dvHdz7kjroIMlkmC6dINrkGVhIaskZxcxjFBNP7bnM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=rLTmJm1yO/kCI55gLkG6l89P1yFI0akPyrdUHHO7+GqjT0dmLb5KYiVrxBUJ5bSVn4ZxKp3UyMwzNbqwEMD1OLrNc7x/xlX/nc74o7so8+lLVIxzEjAtkHyGsTeMA+IBjH2SCBEimwziSo0JOCTasYW+wHrtbpqdJNsM3/m9kbU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=GW5VTyBB; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jose Jesus Ambriz Meza <[email-masked]>,
	"Chia-Lin Kao (AceLan)" <[email-masked]>,
	Qiuxu Zhuo <[email-masked]>,
	Tony Luck <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 009/196] EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
Date: Mon, 13 Oct 2025 16:43:20 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qiuxu Zhuo <[email-masked]>

[ Upstream commit 2e6fe1bbefd9c059c3787d1c620fe67343a94dff ]

When loading the i10nm_edac driver on some Intel Granite Rapids servers,
a call trace may appear as follows:

  UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16
  shift exponent -66 is negative
  ...
  __ubsan_handle_shift_out_of_bounds+0x1e3/0x390
  skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common]
  i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac]
  skx_register_mci+0x159/0x220 [skx_edac_common]
  i10nm_init+0xcb0/0x1ff0 [i10nm_edac]
  ...

This occurs because some BIOS may disable a memory controller if there
aren't any memory DIMMs populated on this memory controller. The DIMMMTR
register of this disabled memory controller contains the invalid value
~0, resulting in the call trace above.

Fix this call trace by skipping DIMM enumeration on a disabled memory
controller.

Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support")
Reported-by: Jose Jesus Ambriz Meza <[email-masked]>
Reported-by: Chia-Lin Kao (AceLan) <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]/
Signed-off-by: Qiuxu Zhuo <[email-masked]>
Signed-off-by: Tony Luck <[email-masked]>
Tested-by: Chia-Lin Kao (AceLan) <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/edac/i10nm_base.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
index 068597e8fce95..3c70d86074975 100644
--- a/drivers/edac/i10nm_base.c
+++ b/drivers/edac/i10nm_base.c
@@ -970,6 +970,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan)
 	return !!GET_BITFIELD(mcmtr, 2, 2);
 }
 
+static bool i10nm_channel_disabled(struct skx_imc *imc, int chan)
+{
+	u32 mcmtr = I10NM_GET_MCMTR(imc, chan);
+
+	edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr);
+
+	return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18));
+}
+
 static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
 				 struct res_config *cfg)
 {
@@ -983,6 +992,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
 		if (!imc->mbase)
 			continue;
 
+		if (i10nm_channel_disabled(imc, i)) {
+			edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i);
+			continue;
+		}
+
 		ndimms = 0;
 		amap = I10NM_GET_AMAP(imc, i);
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:39:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367500; cv=none; b=plYek6d4c9c3F5cjXo67AWeSK1wZCovSUKk2oMs9TxF7hiVd9mLT1MThrqkcUnMn4lhT52nmCRvQsZwALivLASj98WbcemJ17G4FSoZOkhxET+hsvaRZ3J10XmQpiG41MLdGr0DNGdmKi2tcLmhBnnGJkD0sDuCnPc5xyDA0ap0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367500; c=relaxed/simple;
	bh=AcHoyMvXd7YQTNbf4AbjMjuRvwF+rz53tWVME8AfVK4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=oGlhJg04axr0T8gvi/w9Wg11FU4YPvGITAjdlFUonCFYH7fcAylYmAXYclsbnH+DMIbqp3k8st3F+HUvpeBx3MXB3jgjf2BALXmCArRktOCU2+C9HRPwMNe50ITGybjPxBRjC618YlJhE+AU2blpbcsx6P3+L4PogXZudS6vwTk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hlQxfkU+; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 58977C4CEFE;
	Mon, 13 Oct 2025 14:58:19 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760367499;
	bh=AcHoyMvXd7YQTNbf4AbjMjuRvwF+rz53tWVME8AfVK4=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=hlQxfkU+ZFuQDGYs+tpzDf4i6hDVmt6XxsFbiPqg23l/1rShzVvG8V2/KJQX7LESV
	 Rlcsue0UeTf3f/EyGOKWVG96fKdf7ciBo43uwmslGw46BvIcsrSo8B/A2RQNUizK58
	 K7mgueQHaiwRDUg/WZbz7P4XSWvQAAeypjuDzODE=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Namjae Jeon <[email-masked]>,
	Steve French <[email-masked]>,
	Tom Talpey <[email-masked]>,
	[email-masked],
	[email-masked],
	[email-masked],
	Stefan Metzmacher <[email-masked]>,
	Steve French <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 008/196] smb: server: fix IRD/ORD negotiation with the client
Date: Mon, 13 Oct 2025 16:43:19 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Metzmacher <[email-masked]>

[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ]

Already do real negotiation in smb_direct_handle_connect_request()
where we see the requested initiator_depth and responder_resources
from the client.

We should detect legacy iwarp clients using MPA v1
with the custom IRD/ORD negotiation.

We need to send the custom IRD/ORD in big endian,
but we need to try to let clients with broken requests
using little endian (older cifs.ko) to work.

Note the reason why this uses u8 for
initiator_depth and responder_resources is
that the rdma layer also uses it.

Acked-by: Namjae Jeon <[email-masked]>
Cc: Steve French <[email-masked]>
Cc: Tom Talpey <[email-masked]>
Cc: [email-masked]
Cc: [email-masked]
Cc: [email-masked]
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Signed-off-by: Stefan Metzmacher <[email-masked]>
Signed-off-by: Steve French <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++-----
 1 file changed, 85 insertions(+), 14 deletions(-)

diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index 504e2a1cf33b8..31c1ac256e1be 100644
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -152,6 +152,10 @@ struct smb_direct_transport {
 	struct work_struct	disconnect_work;
 
 	bool			negotiation_requested;
+
+	bool			legacy_iwarp;
+	u8			initiator_depth;
+	u8			responder_resources;
 };
 
 #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))
@@ -346,6 +350,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
 	t->cm_id = cm_id;
 	cm_id->context = t;
 
+	t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH;
+	t->responder_resources = 1;
+
 	t->status = SMB_DIRECT_CS_NEW;
 	init_waitqueue_head(&t->wait_status);
 
@@ -1623,21 +1630,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t,
 static int smb_direct_accept_client(struct smb_direct_transport *t)
 {
 	struct rdma_conn_param conn_param;
-	struct ib_port_immutable port_immutable;
-	u32 ird_ord_hdr[2];
+	__be32 ird_ord_hdr[2];
 	int ret;
 
+	/*
+	 * smb_direct_handle_connect_request()
+	 * already negotiated t->initiator_depth
+	 * and t->responder_resources
+	 */
 	memset(&conn_param, 0, sizeof(conn_param));
-	conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom,
-					   SMB_DIRECT_CM_INITIATOR_DEPTH);
-	conn_param.responder_resources = 0;
-
-	t->cm_id->device->ops.get_port_immutable(t->cm_id->device,
-						 t->cm_id->port_num,
-						 &port_immutable);
-	if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) {
-		ird_ord_hdr[0] = conn_param.responder_resources;
-		ird_ord_hdr[1] = 1;
+	conn_param.initiator_depth = t->initiator_depth;
+	conn_param.responder_resources = t->responder_resources;
+
+	if (t->legacy_iwarp) {
+		ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources);
+		ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth);
 		conn_param.private_data = ird_ord_hdr;
 		conn_param.private_data_len = sizeof(ird_ord_hdr);
 	} else {
@@ -2023,10 +2030,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs)
 	return true;
 }
 
-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
+static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id,
+					     struct rdma_cm_event *event)
 {
 	struct smb_direct_transport *t;
 	struct task_struct *handler;
+	u8 peer_initiator_depth;
+	u8 peer_responder_resources;
 	int ret;
 
 	if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) {
@@ -2040,6 +2050,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
 	if (!t)
 		return -ENOMEM;
 
+	peer_initiator_depth = event->param.conn.initiator_depth;
+	peer_responder_resources = event->param.conn.responder_resources;
+	if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) &&
+	    event->param.conn.private_data_len == 8) {
+		/*
+		 * Legacy clients with only iWarp MPA v1 support
+		 * need a private blob in order to negotiate
+		 * the IRD/ORD values.
+		 */
+		const __be32 *ird_ord_hdr = event->param.conn.private_data;
+		u32 ird32 = be32_to_cpu(ird_ord_hdr[0]);
+		u32 ord32 = be32_to_cpu(ird_ord_hdr[1]);
+
+		/*
+		 * cifs.ko sends the legacy IRD/ORD negotiation
+		 * event if iWarp MPA v2 was used.
+		 *
+		 * Here we check that the values match and only
+		 * mark the client as legacy if they don't match.
+		 */
+		if ((u32)event->param.conn.initiator_depth != ird32 ||
+		    (u32)event->param.conn.responder_resources != ord32) {
+			/*
+			 * There are broken clients (old cifs.ko)
+			 * using little endian and also
+			 * struct rdma_conn_param only uses u8
+			 * for initiator_depth and responder_resources,
+			 * so we truncate the value to U8_MAX.
+			 *
+			 * smb_direct_accept_client() will then
+			 * do the real negotiation in order to
+			 * select the minimum between client and
+			 * server.
+			 */
+			ird32 = min_t(u32, ird32, U8_MAX);
+			ord32 = min_t(u32, ord32, U8_MAX);
+
+			t->legacy_iwarp = true;
+			peer_initiator_depth = (u8)ird32;
+			peer_responder_resources = (u8)ord32;
+		}
+	}
+
+	/*
+	 * First set what the we as server are able to support
+	 */
+	t->initiator_depth = min_t(u8, t->initiator_depth,
+				   new_cm_id->device->attrs.max_qp_rd_atom);
+
+	/*
+	 * negotiate the value by using the minimum
+	 * between client and server if the client provided
+	 * non 0 values.
+	 */
+	if (peer_initiator_depth != 0)
+		t->initiator_depth = min_t(u8, t->initiator_depth,
+					   peer_initiator_depth);
+	if (peer_responder_resources != 0)
+		t->responder_resources = min_t(u8, t->responder_resources,
+					       peer_responder_resources);
+
 	ret = smb_direct_connect(t);
 	if (ret)
 		goto out_err;
@@ -2064,7 +2135,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id,
 {
 	switch (event->event) {
 	case RDMA_CM_EVENT_CONNECT_REQUEST: {
-		int ret = smb_direct_handle_connect_request(cm_id);
+		int ret = smb_direct_handle_connect_request(cm_id, event);
 
 		if (ret) {
 			pr_err("Can't create transport: %d\n", ret);
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:18:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367497; cv=none; b=jz1wpWZPsR0qNqexUaN1pmqjywFO24m/2d3yUkvXuU+5bc4JOx/NJWnGuOUDiKwcuylEf+qvbA2qD/pIfpNkwHbGZ6SVY2tINr/cRw5Ib3KQVxrtuW3BVrntu1PrSGShKAioS1S3IDV6txRWeiFzlixZDrspHqMa2Yr6uvwoPqs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367497; c=relaxed/simple;
	bh=ulR/uo+jd0OzY+86jgezxg9ShASWWGeRVvPvJcIcVmo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ulvnfuz5bjCpqMxXp9J9xhabOE6Vf9kO0VEQxPJ8ZwgRFP2bxrElB1KjPWYwhwGrSpffTP45WKTKhY3lEkDgbjZg46EvENyfL4L0eJ/IhP6p0f9yjWHu23KZtjYB18GdmEXtxbk5k3K5eR/KJJc7K3E/NKPVh3q87YFaTZBWPeQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hT1BNJkQ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Leo Yan <[email-masked]>,
	Will Deacon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 007/196] perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
Date: Mon, 13 Oct 2025 16:43:18 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leo Yan <[email-masked]>

[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]

Cast nr_pages to unsigned long to avoid overflow when handling large
AUX buffer sizes (>= 2 GiB).

Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
Signed-off-by: Leo Yan <[email-masked]>
Signed-off-by: Will Deacon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/perf/arm_spe_pmu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
index 2bec2e3af0bd6..affa78376b6a8 100644
--- a/drivers/perf/arm_spe_pmu.c
+++ b/drivers/perf/arm_spe_pmu.c
@@ -96,7 +96,8 @@ struct arm_spe_pmu {
 #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu))
 
 /* Convert a free-running index from perf into an SPE buffer offset */
-#define PERF_IDX2OFF(idx, buf)	((idx) % ((buf)->nr_pages << PAGE_SHIFT))
+#define PERF_IDX2OFF(idx, buf) \
+	((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
 
 /* Keep track of our dynamic hotplug state */
 static enum cpuhp_state arm_spe_pmu_online;
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:18:37 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367494; cv=none; b=Wo29IisjAI0qvCGv/qXOLD40rvyGazr0YqVl5vtW/k+dw+3koOnK+7C4EOr562e0GwzEbToXYyZOuhGEOF0g3LWp/EYOAwBs0W9S8M3IfY3gWaDN6fyhOmD0YCdu9NiKwSO1uPE6zZpxM2twawnCods1lVSM4RG5/6c4RTX5b2E=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367494; c=relaxed/simple;
	bh=09aH5h9Iu9XMh5ZWg+XEBazBKb5I2fa4HRaKHV+aECg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=dHdaK07NsqXpIxXo2KmhVHuBwnIPYYB4zVBA7TTRtk/0TDEeOMNSD0SMu1FQozQnjc0bk8pAhvJl5412/rP0eQ1VCjXKl18VzMrkp3zRX9xCkQbRlxFjbHC/jlXvV7ddNTEfyB9smiKqdj1sR1abBP7AD0dMefJOpbMQX9/zF8o=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0TS3HNyI; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Leo Yan <[email-masked]>,
	Will Deacon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 006/196] coresight: trbe: Prevent overflow in PERF_IDX2OFF()
Date: Mon, 13 Oct 2025 16:43:17 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leo Yan <[email-masked]>

[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ]

Cast nr_pages to unsigned long to avoid overflow when handling large
AUX buffer sizes (>= 2 GiB).

Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
Signed-off-by: Leo Yan <[email-masked]>
Signed-off-by: Will Deacon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-trbe.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
index e20c1c6acc731..7f91b1ffe66a5 100644
--- a/drivers/hwtracing/coresight/coresight-trbe.c
+++ b/drivers/hwtracing/coresight/coresight-trbe.c
@@ -21,7 +21,8 @@
 #include "coresight-self-hosted-trace.h"
 #include "coresight-trbe.h"
 
-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
+#define PERF_IDX2OFF(idx, buf) \
+	((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
 
 /*
  * A padding packet that will help the user space tools
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:38:42 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367491; cv=none; b=H6OqtzYtjA2DHves6edYMk8iuYGTzSmpC0A7U4ptwP+uYIchtmUuMc1a20BzVEwg7myPwejCDIp6zc8Bqd9QJHyqCQPDuiEGQJ60eWPGppgLXcesNx7Zma/ujkpCQXNbnI3u3my0NGTROZocuN39dU0RrbO4duDuFRsxQKRTkcY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367491; c=relaxed/simple;
	bh=4j9BRhMW9uF4Xk5qLOopVfG7Sad98plYXTCUXLGmkxo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=rw2FhK7P1x1reFSWkjLiX4zo3r0W5KEraaUq1tbvbzkfuE6LQQHKNP9O1ZMIOMn6m+XGuivyAa3FzOeNVu6rFWW0gMLY8GJ32MAIwzoL80qk6365iCwI6EgoMmp3SnApAYAQlHkS7fJHL9JG/YCDcnPqVAXKXvP07VOsXHGC0nU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=qW/iLWhu; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Andreas Gruenbacher <[email-masked]>,
	Andrew Price <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 005/196] gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
Date: Mon, 13 Oct 2025 16:43:16 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andreas Gruenbacher <[email-masked]>

[ Upstream commit 061df28b82af6b22fb5fa529a8f2ef00474ee004 ]

Commit 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
added a statement to do_xmote() to clear the GLF_INVALIDATE_IN_PROGRESS
flag a second time after it has already been cleared.  Fix that.

Fixes: 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
Signed-off-by: Andreas Gruenbacher <[email-masked]>
Reviewed-by: Andrew Price <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/gfs2/glock.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 687670075d225..c4bc86c3535ba 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -811,8 +811,6 @@ __acquires(&gl->gl_lockref.lock)
 			clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags);
 			gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD);
 			return;
-		} else {
-			clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags);
 		}
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:18:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367489; cv=none; b=ePRGE+8W7rcrxuc8kzGZ6N4mGo8w1IvCz9Mzm2QK+67vcNx9WxaTbt8qCnvwLv8+3DVRKRQBY9WWkvzmDxJ0+3HLDDWiLadEnM83+h4J2andFXyk4+Bv47yhdjpMWxZHts4gMBhx8Su68krFQ+ZE+1kTyPOyqHKDoKwJQykn+r4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367489; c=relaxed/simple;
	bh=pFti+lEhgzue0vGnNzPgenNVZ1p0HSonIF9e17OCpAo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=CxOJf1BGylRzQNZTasD3FJP2Fc6+IJvLCWi/3hjDgLV0roiJ4ZNkZi8+8nLOpgveBFueBjPW9LU981f9jJgFQY6QbK3b1/UgOw4rgxrPN8zFmRBMdj31J6tberAlTX+JKeF186q26HI5U1wf8OFBTconXzUgseWgbr/lti1KMXo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=to3adsO8; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Bala-Vignesh-Reddy <[email-masked]>,
	Mark Brown <[email-masked]>,
	Will Deacon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 004/196] selftests: arm64: Check fread return value in exec_target
Date: Mon, 13 Oct 2025 16:43:15 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bala-Vignesh-Reddy <[email-masked]>

[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]

Fix -Wunused-result warning generated when compiled with gcc 13.3.0,
by checking fread's return value and handling errors, preventing
potential failures when reading from stdin.

Fixes compiler warning:
warning: ignoring return value of 'fread' declared with attribute
'warn_unused_result' [-Wunused-result]

Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys")

Signed-off-by: Bala-Vignesh-Reddy <[email-masked]>
Reviewed-by: Mark Brown <[email-masked]>
Signed-off-by: Will Deacon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c
index 4435600ca400d..e597861b26d6b 100644
--- a/tools/testing/selftests/arm64/pauth/exec_target.c
+++ b/tools/testing/selftests/arm64/pauth/exec_target.c
@@ -13,7 +13,12 @@ int main(void)
 	unsigned long hwcaps;
 	size_t val;
 
-	fread(&val, sizeof(size_t), 1, stdin);
+	size_t size = fread(&val, sizeof(size_t), 1, stdin);
+
+	if (size != 1) {
+		fprintf(stderr, "Could not read input from stdin\n");
+		return EXIT_FAILURE;
+	}
 
 	/* don't try to execute illegal (unimplemented) instructions) caller
 	 * should have checked this and keep worker simple
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:25:23 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367485; cv=none; b=T89oHbn+0JDgXk1sOqbwVknTkHm6dXnHueCRWzqVlkV3AXDvyubeU+J9gN4+A1lWOqxC4YEe57IL0b1Y0pqjWv1xMWunVZDQhGbSvNzOM/7YtDQ7BjbLI5JH8a6ZvhMb29IC153uNNjaWq2J+ZJKAr3JwLTNOE+m0OWXvRYYeZE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367485; c=relaxed/simple;
	bh=vos9G9lutMyPuszJ1TMwvI9B+z819HFXlN6v62VJ5GM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=tnD2VibttVyWUa5rQBRM/NR3U4uTv+YtuZw5CqvIfFx3mGeHXpoH0izLv+PRAzUXYLVuVAflIw+N76KB7feewFcnfPL/SNMJFzRTMABBGuckvStW0+wAUVLBlhD+wvCjzWNtB0J5pbn4xqKTuBGq7iY+EsLP2FxWUxfhu3qNTTw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JB6vjrJH; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ali Polatel <[email-masked]>,
	Johannes Nixdorf <[email-masked]>,
	Kees Cook <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 003/196] seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
Date: Mon, 13 Oct 2025 16:43:14 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johannes Nixdorf <[email-masked]>

[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ]

Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an
event to the tracer, and starts to wait interruptibly. With
SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the
message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting
and is subsequently interrupted, the tracee begins to wait again
uninterruptibly (but killable).

This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee
is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a
condition to begin waiting again. In this case the tracee is interrupted
even though the tracer already acted on its behalf. This breaks the
assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure,
namely that the tracer can be sure the syscall is not interrupted or
restarted on the tracee after it is received on the tracer. Fix this
by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to
switch to uninterruptible waiting.

With the condition changed the loop in seccomp_do_user_notification()
would exit immediately after deciding that noninterruptible waiting
is required if the operation already reached SECCOMP_NOTIFY_REPLIED,
skipping the code that processes pending addfd commands first. Prevent
this by executing the remaining loop body one last time in this case.

Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier")
Reported-by: Ali Polatel <[email-masked]>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291
Signed-off-by: Johannes Nixdorf <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Kees Cook <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/seccomp.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 255999ba9190a..1d26a0e978f26 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1099,7 +1099,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn
 static bool should_sleep_killable(struct seccomp_filter *match,
 				  struct seccomp_knotif *n)
 {
-	return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT;
+	return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT;
 }
 
 static int seccomp_do_user_notification(int this_syscall,
@@ -1146,13 +1146,11 @@ static int seccomp_do_user_notification(int this_syscall,
 
 		if (err != 0) {
 			/*
-			 * Check to see if the notifcation got picked up and
-			 * whether we should switch to wait killable.
+			 * Check to see whether we should switch to wait
+			 * killable. Only return the interrupted error if not.
 			 */
-			if (!wait_killable && should_sleep_killable(match, &n))
-				continue;
-
-			goto interrupted;
+			if (!(!wait_killable && should_sleep_killable(match, &n)))
+				goto interrupted;
 		}
 
 		addfd = list_first_entry_or_null(&n.addfd,
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:18:04 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367460; cv=none; b=iT0EL2WPvMAkqObxtilIeIpXRLNK6MxEDdiknkzSxPm8gp7DMh0iEZiWcnZmD9wHhwLtBGy+2ArBAO592y5sMv/uaa6W/GPJeQNzLJTz9kAZTnxJIHuh2H4Cg8eZNKdzxpF/0ieFUlXnAny7dbgCIMh1kbSgzLiE8vI39mtcrss=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367460; c=relaxed/simple;
	bh=gsvY83+6RnqglEN/DjpCp5AZNvFRsrU4robCg0i4k74=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=OOEBMfyl7bINtZUoBRsbKxHk6ImcklZwZrjD6Quo6JGvUjKahAQvbeg3kWRaY67FYg5r/SQKIBZZgK5jAToBzAeHL6doY9fV1bn+XqmODfMIe16hF2xClibkNr8LtewTM/DsuSzUvEGmgzWlnxPlihglT1WD7JrPFmbhShYTY7A=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=c86MBTi/; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Geert Uytterhoeven <[email-masked]>,
	Martin Wilck <[email-masked]>,
	David Disseldorp <[email-masked]>,
	Christian Brauner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 002/196] init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
Date: Mon, 13 Oct 2025 16:43:13 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email-masked]>

[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ]

INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and
init/initramfs_test.c.  Hence add a dependency on BLK_DEV_INITRD, to
prevent asking the user about this feature when configuring a kernel
without initramfs support.

Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option")
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Reviewed-by: Martin Wilck <[email-masked]>
Reviewed-by: David Disseldorp <[email-masked]>
Signed-off-by: Christian Brauner <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 init/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/init/Kconfig b/init/Kconfig
index 8b630143c720f..461591503bf43 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1367,6 +1367,7 @@ config BOOT_CONFIG_EMBED_FILE
 
 config INITRAMFS_PRESERVE_MTIME
 	bool "Preserve cpio archive mtimes in initramfs"
+	depends on BLK_DEV_INITRD
 	default y
 	help
 	  Each entry in an initramfs cpio archive carries an mtime value. When
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:29:58 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367428; cv=none; b=FSIfqoGu6hVLNaSW1rr8EVOGeNDNOJa4NWnOzzkSFG1SGrM+orY3Z1aC/uzLiuyr78hnYtpMVByBQ4foj1fcY7C76QAHzKZMJVXZPg66rt+GF7dWvLG6Bssqjkln3c6qi34WxoOTBR9q6KkCJdprXaq74wWc5yBMLS8jzu1Gjw8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367428; c=relaxed/simple;
	bh=UmJZt8XDlH0uy9nn4SeSNU3MW0UOqi6Hh4FIoeLwE/4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=LPACYTaU/ZuxnNnvt7ruhHAlYUdWejgtt+Lw2fmKgEUK+zd3YT+A4Re87G7y+8XxnrrWQcb9LrrmZfFAMpSnlWoE7p1vEbuxl4DVe2ZG0ZD8kB1WgnZmMLnkOpsk+oUG86r7CU6nSo/Lmx+fCqzEG+k2nnhPBb4vowq05uHqF08=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=CU6BLKam; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jeff Layton <[email-masked]>,
	Christian Brauner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.6 001/196] filelock: add FL_RECLAIM to show_fl_flags() macro
Date: Mon, 13 Oct 2025 16:43:12 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jeff Layton <[email-masked]>

[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]

Show the FL_RECLAIM flag symbolically in tracepoints.

Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims")
Signed-off-by: Jeff Layton <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Christian Brauner <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 include/trace/events/filelock.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h
index 1646dadd7f37c..3b1c8d93b2654 100644
--- a/include/trace/events/filelock.h
+++ b/include/trace/events/filelock.h
@@ -27,7 +27,8 @@
 		{ FL_SLEEP,		"FL_SLEEP" },			\
 		{ FL_DOWNGRADE_PENDING,	"FL_DOWNGRADE_PENDING" },	\
 		{ FL_UNLOCK_PENDING,	"FL_UNLOCK_PENDING" },		\
-		{ FL_OFDLCK,		"FL_OFDLCK" })
+		{ FL_OFDLCK,		"FL_OFDLCK" },			\
+		{ FL_RECLAIM,		"FL_RECLAIM"})
 
 #define show_fl_type(val)				\
 	__print_symbolic(val,				\
-- 
2.51.0

From - Mon Oct 13 15:56:29 2025
Delivery-date: Mon, 13 Oct 2025 15:26:40 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367506; cv=none; b=VujO+t73ykFWlmmk34zBhReDOUnwtF4Ji4OURzT1uUhvuUlPFyyl6jph5ObvJjAHl5zMbnw0GsoMpr9CGMwtfcks9gyl1zRjcVaJ+RU1kgtzHmo0p2klaaCHxA1a5+CtyXfgxng5gi9Ky2ATR5gwJKgKpEQkPpqrvN/RNrvsPY0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367506; c=relaxed/simple;
	bh=BX7lAFzbHVDqlDr4tVNPgeXrsE7KTKycB8kObW/apfs=;
	h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=cGBU5SVtqYj9nrqGWyNbsANIviLJTTDpEbKMZai/EFKaUu8b2QpIoexw7NDcdXPGOhaJkiEQKXwa8YkZH7xoFVQjnJkLANRxrDKnfNPXLE6/X4u31NyaFL+EE21H6ZkSWmZQRkiromNNqwK2YBQZavsXei6bfa7gmwshkl0Eti4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=04534Sai; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked]
Subject: [PATCH 6.6 000/196] 6.6.112-rc1 review
Date: Mon, 13 Oct 2025 16:43:11 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

This is the start of the stable review cycle for the 6.6.112 release.
There are 196 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.112-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email-masked]>
    Linux 6.6.112-rc1

Miaoqian Lin <[email-masked]>
    usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call

Konrad Dybcio <[email-masked]>
    arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode

Sven Peter <[email-masked]>
    usb: typec: tipd: Clear interrupts first

Oleksij Rempel <[email-masked]>
    net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock

Salah Triki <[email-masked]>
    bus: fsl-mc: Check return value of platform_get_resource()

Bartosz Golaszewski <[email-masked]>
    pinctrl: check the return value of pinmux_ops::get_function_name()

Zhen Ni <[email-masked]>
    remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()

Lei Lu <[email-masked]>
    sunrpc: fix null pointer dereference on zero-length checksum

Zhen Ni <[email-masked]>
    Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak

Marek Vasut <[email-masked]>
    Input: atmel_mxt_ts - allow reset GPIO to sleep

Ling Xu <[email-masked]>
    misc: fastrpc: Skip reference for DMA handles

Ling Xu <[email-masked]>
    misc: fastrpc: fix possible map leak in fastrpc_put_args

Ling Xu <[email-masked]>
    misc: fastrpc: Fix fastrpc_map_lookup operation

Guangshuo Li <[email-masked]>
    nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()

Yang Shi <[email-masked]>
    mm: hugetlb: avoid soft lockup when mprotect to large memory area

Jan Kara <[email-masked]>
    ext4: fix checks for orphan inodes

Matvey Kovalev <[email-masked]>
    ksmbd: fix error code overwriting in smb2_get_info_filesystem()

Youling Tang <[email-masked]>
    LoongArch: Automatically disable kaslr if boot from kexec_file

Zheng Qixing <[email-masked]>
    dm: fix NULL pointer dereference in __dm_suspend()

Zheng Qixing <[email-masked]>
    dm: fix queue start/stop imbalance under suspend/load/resume races

Bartosz Golaszewski <[email-masked]>
    mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()

Cosmin Tanislav <[email-masked]>
    mfd: rz-mtu3: Fix MTU5 NFCR register offset

Deepak Sharma <[email-masked]>
    net: nfc: nci: Add parameter validation for packet data

Larshin Sergey <[email-masked]>
    fs: udf: fix OOB read in lengthAllocDescs handling

Ranjani Sridharan <[email-masked]>
    ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down

Ma Ke <[email-masked]>
    ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()

Naman Jain <[email-masked]>
    uio_hv_generic: Let userspace take care of interrupt mask

Phillip Lougher <[email-masked]>
    Squashfs: fix uninit-value in squashfs_get_parent

Yazhou Tang <[email-masked]>
    bpf: Reject negative offsets for ALU ops

zhang jiao <[email-masked]>
    vhost: vringh: Modify the return value check

Jakub Kicinski <[email-masked]>
    Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"

Enzo Matsumiya <[email-masked]>
    smb: client: fix crypto buffers in non-linear memory

Moshe Shemesh <[email-masked]>
    net/mlx5: fw reset, add reset timeout work

Shay Drory <[email-masked]>
    net/mlx5: pagealloc: Fix reclaim race during command interface teardown

Moshe Shemesh <[email-masked]>
    net/mlx5: Stop polling for command response if interface goes down

Yeounsu Moon <[email-masked]>
    net: dlink: handle copy_thresh allocation failure

Kohei Enju <[email-masked]>
    net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable

Kohei Enju <[email-masked]>
    nfp: fix RSS hash key size when RSS is not supported

Erick Karanja <[email-masked]>
    mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands

Donet Tom <[email-masked]>
    drivers/base/node: fix double free in register_one_node()

Dan Carpenter <[email-masked]>
    ocfs2: fix double free in user_cluster_connect()

Nishanth Menon <[email-masked]>
    hwrng: ks-sa - fix division by zero in ks_sa_rng_init

Fan Wu <[email-masked]>
    KEYS: X.509: Fix Basic Constraints CA flag parsing

Luiz Augusto von Dentz <[email-masked]>
    Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements

Pauli Virtanen <[email-masked]>
    Bluetooth: ISO: don't leak skb in ISO_CONT RX

Luiz Augusto von Dentz <[email-masked]>
    Bluetooth: ISO: Fix possible UAF on iso_conn_free

Luiz Augusto von Dentz <[email-masked]>
    Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO

Michael S. Tsirkin <[email-masked]>
    vhost: vringh: Fix copy_to_iter return value check

I Viswanath <[email-masked]>
    net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast

Bernard Metzler <[email-masked]>
    RDMA/siw: Always report immediate post SQ errors

Cristian Ciocaltea <[email-masked]>
    usb: vhci-hcd: Prevent suspending virtually attached devices

Ranjan Kumar <[email-masked]>
    scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()

Slavin Liu <[email-masked]>
    ipvs: Defer ip_vs_ftp unregister during netns cleanup

Anthony Iliopoulos <[email-masked]>
    NFSv4.1: fix backchannel max_resp_sz verification check

Leo Yan <[email-masked]>
    coresight: trbe: Return NULL pointer for allocation failures

Leo Yan <[email-masked]>
    coresight: etm4x: Support atclk

Yuanfang Zhang <[email-masked]>
    coresight-etm4x: Conditionally access register TRCEXTINSELR

Stephan Gerhold <[email-masked]>
    remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice

Nagarjuna Kristam <[email-masked]>
    PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert()

Fedor Pchelkin <[email-masked]>
    wifi: rtw89: avoid circular locking dependency in ser_state_run()

Gui-Dong Han <[email-masked]>
    RDMA/rxe: Fix race in do_task() when draining

Chenghai Huang <[email-masked]>
    crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs

Zilin Guan <[email-masked]>
    vfio/pds: replace bitmap_free with vfree

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_{from,to}_user for M7

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_to_user for Niagara 4

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC

Aditya Kumar Singh <[email-masked]>
    wifi: mac80211: fix Rx packet handling when pubsta information is not available

Baochen Qiang <[email-masked]>
    wifi: ath10k: avoid unnecessary wait for service ready message

Bagas Sanjaya <[email-masked]>
    Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram

Vlad Dumitrescu <[email-masked]>
    IB/sa: Fix sa_local_svc_timeout_ms read race

Parav Pandit <[email-masked]>
    RDMA/core: Resolve MAC of next-hop device without ARP support

Michal Pecio <[email-masked]>
    Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"

wangzijie <[email-masked]>
    f2fs: fix zero-sized extent for precache extents

Qianfeng Rong <[email-masked]>
    scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()

Qianfeng Rong <[email-masked]>
    scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()

Qianfeng Rong <[email-masked]>
    scsi: qla2xxx: edif: Fix incorrect sign of error code

Colin Ian King <[email-masked]>
    ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message

Chao Yu <[email-masked]>
    f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()

Chao Yu <[email-masked]>
    f2fs: fix to truncate first page in error path of f2fs_truncate()

Chao Yu <[email-masked]>
    f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()

Abdun Nihaal <[email-masked]>
    wifi: mt76: fix potential memory leak in mt76_wmac_probe()

Håkon Bugge <[email-masked]>
    RDMA/cm: Rate limit destroy CM ID timeout error message

Donet Tom <[email-masked]>
    drivers/base/node: handle error properly in register_one_node()

Christophe Leroy <[email-masked]>
    watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog

Zhang Tengfei <[email-masked]>
    ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable

Zhen Ni <[email-masked]>
    netfilter: ipset: Remove unused htable_bits in macro ahash_region

Hans de Goede <[email-masked]>
    iio: consumers: Fix offset handling in iio_convert_raw_to_processed()

Hans de Goede <[email-masked]>
    iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed()

Moon Hee Lee <[email-masked]>
    fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist

Vitaly Grigoryev <[email-masked]>
    fs: ntfs3: Fix integer overflow in run_unpack()

Qianfeng Rong <[email-masked]>
    drm/msm/dpu: fix incorrect type for ret

Takashi Iwai <[email-masked]>
    ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping

Takashi Iwai <[email-masked]>
    ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping

Takashi Iwai <[email-masked]>
    ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping

Wang Liang <[email-masked]>
    pps: fix warning in pps_register_cdev when register device fail

Colin Ian King <[email-masked]>
    misc: genwqe: Fix incorrect cmd field being reported in error

Seppo Takalo <[email-masked]>
    tty: n_gsm: Don't block input queue by waiting MSC

William Wu <[email-masked]>
    usb: gadget: configfs: Correctly set use_os_string at bind

Xichao Zhao <[email-masked]>
    usb: phy: twl6030: Fix incorrect type for ret

Qianfeng Rong <[email-masked]>
    drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()

Eric Dumazet <[email-masked]>
    tcp: fix __tcp_close() to only send RST when required

Alok Tiwari <[email-masked]>
    PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation

Stefan Kerkmann <[email-masked]>
    wifi: mwifiex: send world regulatory domain to driver

Timur Kristóf <[email-masked]>
    drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Adjust si_upload_smc_data register programming (v3)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Fix si_upload_smc_data (v3)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Disable ULV even if unsupported (v3)

Timur Kristóf <[email-masked]>
    drm/amdgpu: Power up UVD 3 for FW validation (v2)

Yuanfang Zhang <[email-masked]>
    coresight: Only register perf symlink for sinks with alloc_buffer

Eric Dumazet <[email-masked]>
    inet: ping: check sock_net() in ping_get_port() and ping_lookup()

Zhushuai Yin <[email-masked]>
    crypto: hisilicon/qm - check whether the input function and PF are on the same device

Chenghai Huang <[email-masked]>
    crypto: hisilicon - re-enable address prefetch after device resuming

Chenghai Huang <[email-masked]>
    crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations

Arnd Bergmann <[email-masked]>
    media: st-delta: avoid excessive stack usage

Qianfeng Rong <[email-masked]>
    ALSA: lx_core: use int type to store negative error codes

Patrisious Haddad <[email-masked]>
    RDMA/mlx5: Fix vport loopback forcing for MPV device

Zhang Shurong <[email-masked]>
    media: rj54n1cb0c: Fix memleak in rj54n1_probe()

Thomas Fourier <[email-masked]>
    scsi: myrs: Fix dma_alloc_coherent() error check

Niklas Cassel <[email-masked]>
    scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod

Arnd Bergmann <[email-masked]>
    hwrng: nomadik - add ARM_AMBA dependency

Thomas Fourier <[email-masked]>
    crypto: keembay - Add missing check after sg_nents_for_len()

Liao Yuanhong <[email-masked]>
    drm/amd/display: Remove redundant semicolons

Dan Carpenter <[email-masked]>
    serial: max310x: Add error checking in probe()

Komal Bajaj <[email-masked]>
    usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls

Dan Carpenter <[email-masked]>
    usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup

Jonas Karlman <[email-masked]>
    phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568

Jacopo Mondi <[email-masked]>
    media: zoran: Remove zoran_fh structure

Chia-I Wu <[email-masked]>
    drm/bridge: it6505: select REGMAP_I2C

Chao Yu <[email-masked]>
    f2fs: fix condition in __allow_reserved_blocks()

Brahmajit Das <[email-masked]>
    drm/radeon/r600_cs: clean up of dead code in r600_cs

Brigham Campbell <[email-masked]>
    drm/panel: novatek-nt35560: Fix invalid return value

Daniel Borkmann <[email-masked]>
    bpf: Enforce expected_attach_type for tailcall compatibility

Kunihiko Hayashi <[email-masked]>
    i2c: designware: Add disabling clocks when probe fails

Kunihiko Hayashi <[email-masked]>
    i2c: designware: Fix clock issue when PM is disabled

Leilk.Liu <[email-masked]>
    i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD

Dmitry Baryshkov <[email-masked]>
    thermal/drivers/qcom/lmh: Add missing IRQ includes

Dmitry Baryshkov <[email-masked]>
    thermal/drivers/qcom: Make LMH select QCOM_SCM

Vadim Pasternak <[email-masked]>
    hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems

Qi Xi <[email-masked]>
    once: fix race by moving DO_ONCE to separate section

Zhouyi Zhou <[email-masked]>
    tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers

Rafael J. Wysocki <[email-masked]>
    smp: Fix up and expand the smp_call_function_many() kerneldoc

Paul Chaignon <[email-masked]>
    bpf: Explicitly check accesses to bpf_sock_addr

Akhilesh Patil <[email-masked]>
    selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported

Stanley Chu <[email-masked]>
    i3c: master: svc: Recycle unused IBI slot

Stanley Chu <[email-masked]>
    i3c: master: svc: Use manual response for IBI events

Daniel Wagner <[email-masked]>
    nvmet-fc: move lsop put work to nvmet_fc_ls_req_op

Dmitry Antipov <[email-masked]>
    ACPICA: Fix largest possible resource descriptor index

Uwe Kleine-König <[email-masked]>
    pwm: tiehrpwm: Fix corner case in clock divisor calculation

AngeloGioacchino Del Regno <[email-masked]>
    arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible

AngeloGioacchino Del Regno <[email-masked]>
    arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value

AngeloGioacchino Del Regno <[email-masked]>
    arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names

Johan Hovold <[email-masked]>
    cpuidle: qcom-spm: fix device and OF node leaks at probe

Johan Hovold <[email-masked]>
    firmware: firmware: meson-sm: fix compile-test default

Eric Dumazet <[email-masked]>
    nbd: restrict sockets to TCP and UDP

Guoqing Jiang <[email-masked]>
    arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0

Genjian Zhang <[email-masked]>
    null_blk: Fix the description of the cache_size module argument

Qianfeng Rong <[email-masked]>
    pinctrl: renesas: Use int type to store negative error codes

Andy Yan <[email-masked]>
    power: supply: cw2015: Fix a alignment coding style issue

Dan Carpenter <[email-masked]>
    PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()

Jihed Chaibi <[email-masked]>
    ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property

Jihed Chaibi <[email-masked]>
    ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS

Jihed Chaibi <[email-masked]>
    ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax

Rafael J. Wysocki <[email-masked]>
    PM: sleep: core: Clear power.must_resume in noirq suspend error path

Qianfeng Rong <[email-masked]>
    block: use int to store blk_stack_limits() return value

Benjamin Berg <[email-masked]>
    selftests/nolibc: fix EXPECT_NZ macro

Qianfeng Rong <[email-masked]>
    regulator: scmi: Use int type to store negative error codes

Janne Grunau <[email-masked]>
    arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map

Nicolas Ferre <[email-masked]>
    ARM: at91: pm: fix MCKx restore routine

Li Nan <[email-masked]>
    blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx

Da Xue <[email-masked]>
    pinctrl: meson-gxl: add missing i2c_d pinmux

Sneh Mankad <[email-masked]>
    soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS

Huisong Li <[email-masked]>
    ACPI: processor: idle: Fix memory leak when register cpuidle device failed

Florian Fainelli <[email-masked]>
    cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()

Ilya Leoshkevich <[email-masked]>
    s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG

Ilya Leoshkevich <[email-masked]>
    s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL

Fenglin Wu <[email-masked]>
    leds: flash: leds-qcom-flash: Update torch current clamp setting

Geert Uytterhoeven <[email-masked]>
    ARM: dts: renesas: porter: Fix CAN pin group

Yureka Lilian <[email-masked]>
    libbpf: Fix reuse of DEVMAP

Tao Chen <[email-masked]>
    bpf: Remove migrate_disable in kprobe_multi_link_prog_run

Matt Bobrowski <[email-masked]>
    bpf/selftests: Fix test_tcpnotify_user

Geert Uytterhoeven <[email-masked]>
    regmap: Remove superfluous check for !config in __regmap_init()

Biju Das <[email-masked]>
    arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0

Uros Bizjak <[email-masked]>
    x86/vdso: Fix output operand size of RDPID

Qiuxu Zhuo <[email-masked]>
    EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller

Stefan Metzmacher <[email-masked]>
    smb: server: fix IRD/ORD negotiation with the client

Leo Yan <[email-masked]>
    perf: arm_spe: Prevent overflow in PERF_IDX2OFF()

Leo Yan <[email-masked]>
    coresight: trbe: Prevent overflow in PERF_IDX2OFF()

Andreas Gruenbacher <[email-masked]>
    gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote

Bala-Vignesh-Reddy <[email-masked]>
    selftests: arm64: Check fread return value in exec_target

Johannes Nixdorf <[email-masked]>
    seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast

Geert Uytterhoeven <[email-masked]>
    init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD

Jeff Layton <[email-masked]>
    filelock: add FL_RECLAIM to show_fl_flags() macro

-------------

Diffstat:

 Documentation/trace/histogram-design.rst           |   4 +-
 Makefile                                           |   4 +-
 arch/arm/boot/dts/renesas/r8a7791-porter.dts       |   2 +-
 arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi       |   2 +-
 arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts       |   2 -
 .../dts/ti/omap/omap3-devkit8000-lcd-common.dtsi   |   2 +-
 arch/arm/mach-at91/pm_suspend.S                    |   4 +-
 arch/arm64/boot/dts/apple/t8103-j457.dts           |  12 +-
 arch/arm64/boot/dts/mediatek/mt6331.dtsi           |  10 +-
 .../boot/dts/mediatek/mt6795-sony-xperia-m5.dts    |   2 +-
 arch/arm64/boot/dts/mediatek/mt8195.dtsi           |   3 -
 arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts    |   2 +-
 arch/arm64/boot/dts/qcom/qcm2290.dtsi              |   1 +
 arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi      |   5 +-
 arch/loongarch/kernel/relocate.c                   |   4 +
 arch/s390/net/bpf_jit_comp.c                       |  26 ++--
 arch/sparc/lib/M7memcpy.S                          |  20 +--
 arch/sparc/lib/Memcpy_utils.S                      |   9 ++
 arch/sparc/lib/NG4memcpy.S                         |   2 +-
 arch/sparc/lib/NGmemcpy.S                          |  29 +++--
 arch/sparc/lib/U1memcpy.S                          |  19 +--
 arch/sparc/lib/U3memcpy.S                          |   2 +-
 arch/x86/include/asm/segment.h                     |   8 +-
 block/blk-mq-sysfs.c                               |   6 +-
 block/blk-settings.c                               |   3 +-
 crypto/asymmetric_keys/x509_cert_parser.c          |  16 ++-
 drivers/acpi/acpica/aclocal.h                      |   2 +-
 drivers/acpi/nfit/core.c                           |   2 +-
 drivers/acpi/processor_idle.c                      |   3 +
 drivers/base/node.c                                |   4 +
 drivers/base/power/main.c                          |  14 ++-
 drivers/base/regmap/regmap.c                       |   2 +-
 drivers/block/nbd.c                                |   8 ++
 drivers/block/null_blk/main.c                      |   2 +-
 drivers/bus/fsl-mc/fsl-mc-bus.c                    |   3 +
 drivers/char/hw_random/Kconfig                     |   1 +
 drivers/char/hw_random/ks-sa-rng.c                 |   4 +
 drivers/cpufreq/scmi-cpufreq.c                     |  10 ++
 drivers/cpuidle/cpuidle-qcom-spm.c                 |   7 +-
 drivers/crypto/hisilicon/debugfs.c                 |   1 +
 drivers/crypto/hisilicon/hpre/hpre_main.c          |   3 +-
 drivers/crypto/hisilicon/qm.c                      |   7 +-
 drivers/crypto/hisilicon/sec2/sec_main.c           |  80 ++++++------
 drivers/crypto/hisilicon/zip/zip_main.c            |  17 +--
 .../crypto/intel/keembay/keembay-ocs-hcu-core.c    |   5 +-
 drivers/devfreq/mtk-cci-devfreq.c                  |   3 +-
 drivers/edac/i10nm_base.c                          |  14 +++
 drivers/firmware/meson/Kconfig                     |   2 +-
 drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c              |  29 ++++-
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c               |   2 +-
 .../display/dc/dml/dcn32/display_rq_dlg_calc_32.c  |   1 -
 drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c       |   7 ++
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c         |  92 +++++++++-----
 drivers/gpu/drm/bridge/Kconfig                     |   1 +
 .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c    |   2 +-
 drivers/gpu/drm/panel/panel-novatek-nt35560.c      |   2 +-
 drivers/gpu/drm/radeon/r600_cs.c                   |   4 +-
 drivers/hwmon/mlxreg-fan.c                         |  24 ++--
 drivers/hwtracing/coresight/coresight-core.c       |   5 +-
 drivers/hwtracing/coresight/coresight-etm4x-core.c |  31 +++--
 drivers/hwtracing/coresight/coresight-etm4x.h      |   6 +-
 drivers/hwtracing/coresight/coresight-trbe.c       |   9 +-
 drivers/i2c/busses/i2c-designware-platdrv.c        |   5 +-
 drivers/i2c/busses/i2c-mt65xx.c                    |  17 +--
 drivers/i3c/master/svc-i3c-master.c                |  31 ++++-
 drivers/iio/inkern.c                               |  30 ++---
 drivers/infiniband/core/addr.c                     |  10 +-
 drivers/infiniband/core/cm.c                       |   4 +-
 drivers/infiniband/core/sa_query.c                 |   6 +-
 drivers/infiniband/hw/mlx5/main.c                  |  19 ++-
 drivers/infiniband/hw/mlx5/mlx5_ib.h               |   1 +
 drivers/infiniband/sw/rxe/rxe_task.c               |   8 +-
 drivers/infiniband/sw/siw/siw_verbs.c              |  25 ++--
 drivers/input/misc/uinput.c                        |   1 +
 drivers/input/touchscreen/atmel_mxt_ts.c           |   2 +-
 drivers/leds/flash/leds-qcom-flash.c               |  62 ++++++----
 drivers/md/dm-core.h                               |   1 +
 drivers/md/dm.c                                    |  13 +-
 drivers/media/i2c/rj54n1cb0c.c                     |   9 +-
 drivers/media/pci/zoran/zoran.h                    |   6 -
 drivers/media/pci/zoran/zoran_driver.c             |   3 +-
 .../media/platform/st/sti/delta/delta-mjpeg-dec.c  |  20 +--
 drivers/mfd/rz-mtu3.c                              |   2 +-
 drivers/mfd/vexpress-sysreg.c                      |   6 +-
 drivers/misc/fastrpc.c                             |  62 ++++++----
 drivers/misc/genwqe/card_ddcb.c                    |   2 +-
 drivers/mtd/nand/raw/atmel/nand-controller.c       |   4 +-
 drivers/net/ethernet/amazon/ena/ena_ethtool.c      |   5 +-
 drivers/net/ethernet/dlink/dl2k.c                  |   7 +-
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c      |   6 +-
 .../ethernet/mellanox/mlx5/core/en/port_buffer.h   |  12 --
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |  17 +--
 drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c |  24 ++++
 .../net/ethernet/mellanox/mlx5/core/pagealloc.c    |   7 +-
 .../net/ethernet/netronome/nfp/nfp_net_ethtool.c   |   2 +-
 drivers/net/usb/asix_devices.c                     |  29 +++++
 drivers/net/usb/rtl8150.c                          |   2 -
 drivers/net/wireless/ath/ath10k/wmi.c              |  39 +++---
 drivers/net/wireless/marvell/mwifiex/cfg80211.c    |   7 +-
 drivers/net/wireless/mediatek/mt76/mt7603/soc.c    |   2 +-
 drivers/net/wireless/realtek/rtw89/ser.c           |   3 +-
 drivers/nvme/target/fc.c                           |  19 ++-
 drivers/pci/controller/dwc/pcie-tegra194.c         |   4 +-
 drivers/pci/controller/pci-tegra.c                 |   2 +-
 drivers/perf/arm_spe_pmu.c                         |   3 +-
 drivers/phy/rockchip/phy-rockchip-naneng-combphy.c |  12 ++
 drivers/pinctrl/meson/pinctrl-meson-gxl.c          |  10 ++
 drivers/pinctrl/pinmux.c                           |   2 +-
 drivers/pinctrl/renesas/pinctrl.c                  |   3 +-
 drivers/power/supply/cw2015_battery.c              |   3 +-
 drivers/pps/kapi.c                                 |   5 +-
 drivers/pps/pps.c                                  |   5 +-
 drivers/pwm/pwm-tiehrpwm.c                         |   4 +-
 drivers/regulator/scmi-regulator.c                 |   3 +-
 drivers/remoteproc/pru_rproc.c                     |   3 +-
 drivers/remoteproc/qcom_q6v5.c                     |   3 -
 drivers/scsi/mpt3sas/mpt3sas_transport.c           |   8 +-
 drivers/scsi/myrs.c                                |   8 +-
 drivers/scsi/pm8001/pm8001_sas.c                   |   9 +-
 drivers/scsi/qla2xxx/qla_edif.c                    |   4 +-
 drivers/scsi/qla2xxx/qla_init.c                    |   4 +-
 drivers/scsi/qla2xxx/qla_nvme.c                    |   2 +-
 drivers/soc/qcom/rpmh-rsc.c                        |   7 +-
 drivers/thermal/qcom/Kconfig                       |   3 +-
 drivers/thermal/qcom/lmh.c                         |   2 +
 drivers/tty/n_gsm.c                                |  25 +++-
 drivers/tty/serial/max310x.c                       |   2 +
 drivers/uio/uio_hv_generic.c                       |   7 +-
 drivers/usb/cdns3/cdnsp-pci.c                      |   5 +-
 drivers/usb/gadget/configfs.c                      |   2 +
 drivers/usb/host/max3421-hcd.c                     |   2 +-
 drivers/usb/host/xhci-ring.c                       |  11 +-
 drivers/usb/misc/Kconfig                           |   1 +
 drivers/usb/misc/qcom_eud.c                        |  33 +++--
 drivers/usb/phy/phy-twl6030-usb.c                  |   3 +-
 drivers/usb/typec/tipd/core.c                      |  24 ++--
 drivers/usb/usbip/vhci_hcd.c                       |  22 ++++
 drivers/vfio/pci/pds/dirty.c                       |   2 +-
 drivers/vhost/vringh.c                             |  14 ++-
 drivers/watchdog/mpc8xxx_wdt.c                     |   2 +
 fs/ext4/ext4.h                                     |  10 ++
 fs/ext4/file.c                                     |   2 +-
 fs/ext4/inode.c                                    |   2 +-
 fs/ext4/orphan.c                                   |   6 +-
 fs/ext4/super.c                                    |   4 +-
 fs/f2fs/data.c                                     |   9 +-
 fs/f2fs/f2fs.h                                     |   4 +-
 fs/f2fs/file.c                                     |  49 ++++----
 fs/gfs2/glock.c                                    |   2 -
 fs/nfs/nfs4proc.c                                  |   2 +-
 fs/ntfs3/index.c                                   |  10 ++
 fs/ntfs3/run.c                                     |  12 +-
 fs/ocfs2/stack_user.c                              |   1 +
 fs/smb/client/smb2ops.c                            |  17 +--
 fs/smb/server/smb2pdu.c                            |   3 +-
 fs/smb/server/transport_rdma.c                     |  97 +++++++++++++--
 fs/squashfs/inode.c                                |   7 ++
 fs/squashfs/squashfs_fs_i.h                        |   2 +-
 fs/udf/inode.c                                     |   3 +
 include/asm-generic/vmlinux.lds.h                  |   1 +
 include/linux/bpf.h                                |   1 +
 include/linux/once.h                               |   4 +-
 include/trace/events/filelock.h                    |   3 +-
 init/Kconfig                                       |   1 +
 kernel/bpf/core.c                                  |   5 +
 kernel/bpf/verifier.c                              |   4 +-
 kernel/seccomp.c                                   |  12 +-
 kernel/smp.c                                       |  11 +-
 kernel/trace/bpf_trace.c                           |   9 +-
 mm/hugetlb.c                                       |   2 +
 net/bluetooth/hci_sync.c                           |  10 +-
 net/bluetooth/iso.c                                |   9 +-
 net/bluetooth/mgmt.c                               |  10 +-
 net/core/filter.c                                  |  16 ++-
 net/ipv4/ping.c                                    |  14 ++-
 net/ipv4/tcp.c                                     |   9 +-
 net/mac80211/rx.c                                  |  28 ++++-
 net/netfilter/ipset/ip_set_hash_gen.h              |   8 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |   4 +-
 net/netfilter/ipvs/ip_vs_core.c                    |  11 +-
 net/netfilter/ipvs/ip_vs_ctl.c                     |   6 +-
 net/netfilter/ipvs/ip_vs_est.c                     |  16 +--
 net/netfilter/ipvs/ip_vs_ftp.c                     |   4 +-
 net/nfc/nci/ntf.c                                  | 135 +++++++++++++++------
 net/sunrpc/auth_gss/svcauth_gss.c                  |   2 +-
 sound/pci/lx6464es/lx_core.c                       |   4 +-
 sound/soc/codecs/wcd934x.c                         |  17 ++-
 sound/soc/intel/boards/bytcht_es8316.c             |  20 ++-
 sound/soc/intel/boards/bytcr_rt5640.c              |   7 +-
 sound/soc/intel/boards/bytcr_rt5651.c              |  26 +++-
 sound/soc/sof/ipc3-topology.c                      |  10 +-
 tools/include/nolibc/std.h                         |   2 +-
 tools/lib/bpf/libbpf.c                             |  10 ++
 tools/testing/nvdimm/test/ndtest.c                 |  13 +-
 tools/testing/selftests/arm64/pauth/exec_target.c  |   7 +-
 .../selftests/bpf/progs/test_tcpnotify_kern.c      |   1 -
 tools/testing/selftests/bpf/test_tcpnotify_user.c  |  20 +--
 tools/testing/selftests/nolibc/nolibc-test.c       |   4 +-
 tools/testing/selftests/watchdog/watchdog-test.c   |   6 +
 199 files changed, 1405 insertions(+), 721 deletions(-)

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:56:43 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369765; cv=none; b=W80/gISqbM24D+jXsJ7zv2n2Y2xIpmIhIUWSlA2MXejvLY6wN1ysC8LVrYLWA/vReXpzl768ujccYwKwkwxVwdnnTSncAbcaVaTH8chyreuh078+BvxcvEc2842WeusSxWRc2cPmu4pzsWWysevDq0au1M4XfmkwG21TXtXAn7I=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369765; c=relaxed/simple;
	bh=xgOAbMF/yQgKeqxHjss2EKmHCQQbVvqh4oYiuZt3o+E=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=E5VtTR99qqxQtm/zlenBsZQkiIIkUHLNku979Y5Pyy7wxMil6gT5Gd5wS3VvbZ2bxUxvBBuOwit18PGf7h1Y5Xl9cpXfqf0Q5TEvQcI0YRA5GyeHv6p/smo+PBfV/RNTz+oxywbNfbIGg8UW/rEuTBDN5OwiOTEd6hHCKSDbNu8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=cUH6aXW0; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Lorenzo Bianconi <[email-masked]>,
	Felix Fietkau <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 360/563] wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
Date: Mon, 13 Oct 2025 16:43:41 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lorenzo Bianconi <[email-masked]>

[ Upstream commit 809054a60d613ccca6e7f243bc68966b58044163 ]

Do not use bitmask in mt7996_wed_rro_addr DMA descriptor in order to not
break endianness

Fixes: 950d0abb5cd94 ("wifi: mt76: mt7996: add wed rx support")
Signed-off-by: Lorenzo Bianconi <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Felix Fietkau <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/mediatek/mt76/mt7996/init.c   |  8 +++++---
 drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 11 +++++------
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
index be729db5b75c1..84015ab24af62 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
@@ -734,6 +734,7 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
 static int mt7996_wed_rro_init(struct mt7996_dev *dev)
 {
 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
+	u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff);
 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
 	u32 reg = MT_RRO_ADDR_ELEM_SEG_ADDR0;
 	struct mt7996_wed_rro_addr *addr;
@@ -773,7 +774,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
 
 		addr = dev->wed_rro.addr_elem[i].ptr;
 		for (j = 0; j < MT7996_RRO_WINDOW_MAX_SIZE; j++) {
-			addr->signature = 0xff;
+			addr->data = cpu_to_le32(val);
 			addr++;
 		}
 
@@ -791,7 +792,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
 	dev->wed_rro.session.ptr = ptr;
 	addr = dev->wed_rro.session.ptr;
 	for (i = 0; i < MT7996_RRO_WINDOW_MAX_LEN; i++) {
-		addr->signature = 0xff;
+		addr->data = cpu_to_le32(val);
 		addr++;
 	}
 
@@ -891,6 +892,7 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev)
 static void mt7996_wed_rro_work(struct work_struct *work)
 {
 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
+	u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff);
 	struct mt7996_dev *dev;
 	LIST_HEAD(list);
 
@@ -927,7 +929,7 @@ static void mt7996_wed_rro_work(struct work_struct *work)
 				MT7996_RRO_WINDOW_MAX_LEN;
 reset:
 			elem = ptr + elem_id * sizeof(*elem);
-			elem->signature = 0xff;
+			elem->data |= cpu_to_le32(val);
 		}
 		mt7996_mcu_wed_rro_reset_sessions(dev, e->id);
 out:
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index b98cfe6e5be8c..048d9a9898c6e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -277,13 +277,12 @@ struct mt7996_hif {
 	int irq;
 };
 
+#define WED_RRO_ADDR_SIGNATURE_MASK	GENMASK(31, 24)
+#define WED_RRO_ADDR_COUNT_MASK		GENMASK(14, 4)
+#define WED_RRO_ADDR_HEAD_HIGH_MASK	GENMASK(3, 0)
 struct mt7996_wed_rro_addr {
-	u32 head_low;
-	u32 head_high : 4;
-	u32 count: 11;
-	u32 oor: 1;
-	u32 rsv : 8;
-	u32 signature : 8;
+	__le32 head_low;
+	__le32 data;
 };
 
 struct mt7996_wed_rro_session_id {
-- 
2.51.0

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:56:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369150; cv=none; b=gq0A5h2UxIucF6dmtj0Of8N0rXomPjnJuWzwBE+OZx5f8BF8N9DEqV0wi4+aH0K2xi4MwNMfXRORb3ixSbFzVsVrgp1NpJ5wSGE8l/0nLLI+FdChEMfOKA77/qzq0NiYM3P5LlxcGExdZ/19T/un0XLtgwpENTnHZOASLf5vOFw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369150; c=relaxed/simple;
	bh=wizedKyOPueUY5OwKYjb6Gh2Zdnu/y6O4j0ce4eGqFI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=fCtE6HVH07adLLbC0GTQ3M78ZVJcGp0npn3G7zEO+gh7Tk7/yl8t3lhbPksAwHQYrvSPJe5DNC7b/rqIPdzpX7VcDAxTwcIvI41rU3G9Y/une9u1l+kOGZGCn9Jsg+InOHodVJyOhWB/20bNOGL8gAJ6MP2A6u0R82ET3OdxuXo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Qysb+Jqv; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	AngeloGioacchino Del Regno <[email-masked]>,
	Fei Shao <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 145/563] arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names
Date: Mon, 13 Oct 2025 16:40:06 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: AngeloGioacchino Del Regno <[email-masked]>

[ Upstream commit 98967109c9c0e2de4140827628c63f96314099ab ]

The node names for "pmic", "regulators", "rtc", and "keys" are
dictated by the PMIC MFD binding: change those to adhere to it.

Fixes: aef783f3e0ca ("arm64: dts: mediatek: Add MT6331 PMIC devicetree")
Signed-off-by: AngeloGioacchino Del Regno <[email-masked]>
Reviewed-by: Fei Shao <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/mediatek/mt6331.dtsi | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
index d89858c73ab1b..243afbffa21fd 100644
--- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
@@ -6,12 +6,12 @@
 #include <dt-bindings/input/input.h>
 
 &pwrap {
-	pmic: mt6331 {
+	pmic: pmic {
 		compatible = "mediatek,mt6331";
 		interrupt-controller;
 		#interrupt-cells = <2>;
 
-		mt6331regulator: mt6331regulator {
+		mt6331regulator: regulators {
 			compatible = "mediatek,mt6331-regulator";
 
 			mt6331_vdvfs11_reg: buck-vdvfs11 {
@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc {
 			};
 
 			mt6331_vdig18_reg: ldo-vdig18 {
-				regulator-name = "dvdd18_dig";
+				regulator-name = "vdig18";
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <1800000>;
 				regulator-ramp-delay = <0>;
@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 {
 			};
 		};
 
-		mt6331rtc: mt6331rtc {
+		mt6331rtc: rtc {
 			compatible = "mediatek,mt6331-rtc";
 		};
 
-		mt6331keys: mt6331keys {
+		mt6331keys: keys {
 			compatible = "mediatek,mt6331-keys";
 			power {
 				linux,keycodes = <KEY_POWER>;
-- 
2.51.0

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:56:33 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760369007; cv=none; b=MKY8KK8nY08AnzHBUIhhAaOXPppyDBAF46r6vZWlWEumFZWNLa/miuAV6yLTu3w/aN+byoTrvoBxDdGiYYc2VG+L4k4pnpXN+GKZIaiY98BYBHJrxyO+Kb8UW6xqM8pRVQi8CF1tQ0XgZHCon4k3tD+gFSwrmh5sXVanoj+5YAA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760369007; c=relaxed/simple;
	bh=9JywpnzZXaa/49m8N1gmf85DylaKj3cAiFpfJa68gcU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=UyneaRZI4tFXaXsErSUM2eRE92WJSWm/wcFIlsXvmu77XPEmtRtWLPu+B7im7/DHpigJzvWwC2TN0psPD3W7RvkiEUt/URzw7x9sOYJL4jOy3UJwo4NCcus7T78soCB3LCZYt66tk3ob/ajCXAXAdzIREl1R6WF4+msy1CXrOdI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=RmGGnOQ2; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Len Bao <[email-masked]>,
	Lee Jones <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.17 052/563] leds: max77705: Function return instead of variable assignment
Date: Mon, 13 Oct 2025 16:38:33 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Len Bao <[email-masked]>

[ Upstream commit 6e3779e3c6f9dcc9267bf98bef70773a0b13dcbb ]

Coverity noticed that assigning value -EINVAL to 'ret' in the if
statement is useless because 'ret' is overwritten a few lines later.
However, after inspect the code, this warning reveals that we need to
return -EINVAL instead of the variable assignment. So, fix it.

Coverity-id: 1646104
Fixes: aebb5fc9a0d8 ("leds: max77705: Add LEDs support")
Signed-off-by: Len Bao <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Lee Jones <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/leds/leds-max77705.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/leds/leds-max77705.c b/drivers/leds/leds-max77705.c
index 933cb4f19be9b..b7403b3fcf5e7 100644
--- a/drivers/leds/leds-max77705.c
+++ b/drivers/leds/leds-max77705.c
@@ -180,7 +180,7 @@ static int max77705_add_led(struct device *dev, struct regmap *regmap, struct fw
 
 		ret = fwnode_property_read_u32(np, "reg", &reg);
 		if (ret || reg >= MAX77705_LED_NUM_LEDS)
-			ret = -EINVAL;
+			return -EINVAL;
 
 		info = devm_kcalloc(dev, num_channels, sizeof(*info), GFP_KERNEL);
 		if (!info)
-- 
2.51.0

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:32:28 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368726; cv=none; b=ZqA9UqtNHtUJV+OYWHqDPIP96lBhOx0JZA4RydAZyA0Goi5gDHkp9W5E2dt8pi2bADBaOyBs0fR63OEHIRiUk7FgSt0bzg21u1kEhRfpphQYKV26387eyi6iPJQ6JjkZMfghmteh9U12LFR4onOZqwNo//Qvnr0RC5hmg0o7aoc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368726; c=relaxed/simple;
	bh=9+48S6rTdat7QWbgRZHQ5U9WKwtaCHVlr9cXSk26b30=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=rlnpZwsB/IahoLXj9sBxyJFkAQaVEN6DJIlr13YiFMcCCCcc27tc20oRFm03bFtoNgll4dgNqfGlk/AnzV1Tn7sdvSQx+i+ioEECRaD4X4V3jlJKmhICX3RSYWq7tITmIIl4K1Me95TiMvXCdNJUYCRdA8unGVHXjmeCCt9mxZo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DVaxGejz; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Miaoqian Lin <[email-masked]>
Subject: [PATCH 6.12 262/262] usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
Date: Mon, 13 Oct 2025 16:46:44 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miaoqian Lin <[email-masked]>

commit e9c206324eeb213957a567a9d066bdeb355c7491 upstream.

The cdnsp-pci driver uses pcim_enable_device() to enable a PCI device,
which means the device will be automatically disabled on driver detach
through the managed device framework. The manual pci_disable_device()
call in the error path is therefore redundant.

Found via static anlaysis and this is similar to commit 99ca0b57e49f
("thermal: intel: int340x: processor: Fix warning during module unload").

Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
Cc: [email-masked]
Signed-off-by: Miaoqian Lin <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/usb/cdns3/cdnsp-pci.c |    5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

--- a/drivers/usb/cdns3/cdnsp-pci.c
+++ b/drivers/usb/cdns3/cdnsp-pci.c
@@ -91,7 +91,7 @@ static int cdnsp_pci_probe(struct pci_de
 		cdnsp = kzalloc(sizeof(*cdnsp), GFP_KERNEL);
 		if (!cdnsp) {
 			ret = -ENOMEM;
-			goto disable_pci;
+			goto put_pci;
 		}
 	}
 
@@ -174,9 +174,6 @@ free_cdnsp:
 	if (!pci_is_enabled(func))
 		kfree(cdnsp);
 
-disable_pci:
-	pci_disable_device(pdev);
-
 put_pci:
 	pci_dev_put(func);

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:34:33 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368724; cv=none; b=sKfIqRAx3K3Voed0vySurblqq538xMey1T4sy3/hxgrw8pO8Ztzk+rXsoLQQ5ENBLxK2MsI0K5g5aLqxT61Vm+XnTitXbsQhMMqZYY5uujjHxW94X/sicehNE5i/Y/MmbZ9+gMoojiIm+JRkMkp7k5UI+lwjsN4c0RfqnwyDHew=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368724; c=relaxed/simple;
	bh=WRINBG5sbQHnZxXSN9tKb/8hOtwMuP9+twPu47z0efc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=IocBT+v/kxk/+cJjU/hKJL9RISIS6Yqk0tmp8gLvwM9/OW6iN+ECorrnGF6xWS2CxmOM9Ma/wXibJn+m6uu/vKq1WMay6ax38147XfNke02KQsmQAgwnLRKiTgg562978uoFrQij5dHbx3DCF3iJkKAv3OVfrF/6oCcrVKegYQY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=r/GR4JsS; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Rob Clark <[email-masked]>,
	Konrad Dybcio <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Bjorn Andersson <[email-masked]>
Subject: [PATCH 6.12 261/262] arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode
Date: Mon, 13 Oct 2025 16:46:43 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Konrad Dybcio <[email-masked]>

commit 27f94b71532203b079537180924023a5f636fca1 upstream.

2290 was found in the field to also require this quirk, as long &
high-bandwidth workloads (e.g. USB ethernet) are consistently able to
crash the controller otherwise.

The same change has been made for a number of SoCs in [1], but QCM2290
somehow escaped the list (even though the very closely related SM6115
was there).

Upon a controller crash, the log would read:

xhci-hcd.12.auto: xHCI host not responding to stop endpoint command
xhci-hcd.12.auto: xHCI host controller not responding, assume dead
xhci-hcd.12.auto: HC died; cleaning up

Add snps,parkmode-disable-ss-quirk to the DWC3 instance in order to
prevent the aforementioned breakage.

[1] https://lore.kernel.org/all/[email-masked]/

Cc: [email-masked]
Reported-by: Rob Clark <[email-masked]>
Fixes: a64a0192b70c ("arm64: dts: qcom: Add initial QCM2290 device tree")
Signed-off-by: Konrad Dybcio <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Bjorn Andersson <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 arch/arm64/boot/dts/qcom/qcm2290.dtsi |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/arm64/boot/dts/qcom/qcm2290.dtsi
+++ b/arch/arm64/boot/dts/qcom/qcm2290.dtsi
@@ -1405,6 +1405,7 @@
 				snps,has-lpm-erratum;
 				snps,hird-threshold = /bits/ 8 <0x10>;
 				snps,usb3_lpm_capable;
+				snps,parkmode-disable-ss-quirk;
 				maximum-speed = "super-speed";
 				dr_mode = "otg";
 				usb-role-switch;

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:43:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368717; cv=none; b=GULdmb6bwOXgdOLIp86xL6l1VkhAitiwDbpU5+Vkv1UFTpUEyBgheXnaYgIW3qpEdqc/l3s7Nbai5LrE2/3b8PHKMSayvnQcNIw2/Vh4hotAvAZQ04s24n9JtL1LYrpUNxsW6qPR+l8M2/HweVM+Cs1UJ++R5OMaKh4ooVmPFPc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368717; c=relaxed/simple;
	bh=o5QrofD7a4BRKwEs5cTvr58q3lL9xvw6uV0B3xrp6sA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=ANpmda1Z/AsY2gzQZamd2jMxMJ4uf1wnsDCMRLSat59WQT2sGZtH4agcq2PO+BuzPftHruFXgBCF1LsbFAfyfHxsyGiNGBGPftoB5hcjlhpOaKbYWiQe0uO4kzPcxNQG2xuEyT01G66u5XPEmPWkwFoBirl5n1aQZ+MKgjbBIjc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zOE+x//u; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Hubert=20Wi=C5=9Bniewski?= <[email-masked]>,
	Marek Szyprowski <[email-masked]>,
	Oleksij Rempel <[email-masked]>,
	Paolo Abeni <[email-masked]>
Subject: [PATCH 6.12 259/262] net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
Date: Mon, 13 Oct 2025 16:46:41 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Oleksij Rempel <[email-masked]>

commit 3d3c4cd5c62f24bb3cb4511b7a95df707635e00a upstream.

Prevent USB runtime PM (autosuspend) for AX88772* in bind.

usbnet enables runtime PM (autosuspend) by default, so disabling it via
the usb_driver flag is ineffective. On AX88772B, autosuspend shows no
measurable power saving with current driver (no link partner, admin
up/down). The ~0.453 W -> ~0.248 W drop on v6.1 comes from phylib powering
the PHY off on admin-down, not from USB autosuspend.

The real hazard is that with runtime PM enabled, ndo_open() (under RTNL)
may synchronously trigger autoresume (usb_autopm_get_interface()) into
asix_resume() while the USB PM lock is held. Resume paths then invoke
phylink/phylib and MDIO, which also expect RTNL, leading to possible
deadlocks or PM lock vs MDIO wake issues.

To avoid this, keep the device runtime-PM active by taking a usage
reference in ax88772_bind() and dropping it in unbind(). A non-zero PM
usage count blocks runtime suspend regardless of userspace policy
(.../power/control - pm_runtime_allow/forbid), making this approach
robust against sysfs overrides.

Holding a runtime-PM usage ref does not affect system-wide suspend;
system sleep/resume callbacks continue to run as before.

Fixes: 4a2c7217cd5a ("net: usb: asix: ax88772: manage PHY PM from MAC")
Reported-by: Hubert Wiśniewski <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]
Tested-by: Hubert Wiśniewski <[email-masked]>
Reported-by: Marek Szyprowski <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]
Cc: [email-masked]
Signed-off-by: Oleksij Rempel <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Paolo Abeni <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/net/usb/asix_devices.c |   29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -625,6 +625,21 @@ static void ax88772_suspend(struct usbne
 		   asix_read_medium_status(dev, 1));
 }
 
+/* Notes on PM callbacks and locking context:
+ *
+ * - asix_suspend()/asix_resume() are invoked for both runtime PM and
+ *   system-wide suspend/resume. For struct usb_driver the ->resume()
+ *   callback does not receive pm_message_t, so the resume type cannot
+ *   be distinguished here.
+ *
+ * - The MAC driver must hold RTNL when calling phylink interfaces such as
+ *   phylink_suspend()/resume(). Those calls will also perform MDIO I/O.
+ *
+ * - Taking RTNL and doing MDIO from a runtime-PM resume callback (while
+ *   the USB PM lock is held) is fragile. Since autosuspend brings no
+ *   measurable power saving here, we block it by holding a PM usage
+ *   reference in ax88772_bind().
+ */
 static int asix_suspend(struct usb_interface *intf, pm_message_t message)
 {
 	struct usbnet *dev = usb_get_intfdata(intf);
@@ -919,6 +934,13 @@ static int ax88772_bind(struct usbnet *d
 	if (ret)
 		goto initphy_err;
 
+	/* Keep this interface runtime-PM active by taking a usage ref.
+	 * Prevents runtime suspend while bound and avoids resume paths
+	 * that could deadlock (autoresume under RTNL while USB PM lock
+	 * is held, phylink/MDIO wants RTNL).
+	 */
+	pm_runtime_get_noresume(&intf->dev);
+
 	return 0;
 
 initphy_err:
@@ -948,6 +970,8 @@ static void ax88772_unbind(struct usbnet
 	phylink_destroy(priv->phylink);
 	ax88772_mdio_unregister(priv);
 	asix_rx_fixup_common_free(dev->driver_priv);
+	/* Drop the PM usage ref taken in bind() */
+	pm_runtime_put(&intf->dev);
 }
 
 static void ax88178_unbind(struct usbnet *dev, struct usb_interface *intf)
@@ -1600,6 +1624,11 @@ static struct usb_driver asix_driver = {
 	.resume =	asix_resume,
 	.reset_resume =	asix_resume,
 	.disconnect =	usbnet_disconnect,
+	/* usbnet enables autosuspend by default (supports_autosuspend=1).
+	 * We keep runtime-PM active for AX88772* by taking a PM usage
+	 * reference in ax88772_bind() (pm_runtime_get_noresume()) and
+	 * dropping it in unbind(), which effectively blocks autosuspend.
+	 */
 	.supports_autosuspend = 1,
 	.disable_hub_initiated_lpm = 1,
 };

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:34:30 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368715; cv=none; b=BnOS2Hns9gVZWh/QFAIO70Pv9wmgR2HxVXEaeScffI9D8fbJ4B4TxuEonUBzagaOowSdRhiOEntDWSsDXBIuTqepwdUVP0Eez6Cja8/ceDqrqM1Tzd8nUNOG6O/9oMPy3lc+UpzecSBLgQAChWWL+AO7YK5tNbktNrMSoPJWhws=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368715; c=relaxed/simple;
	bh=x5rdQJqWvaw5kSkWsaJ8nuSHegAfZF8hmE1MgNpj21Q=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=GOwztItUQir5GVWctDGkQULPiO1NpC4E+eTCYs3KnYXWHwJHSljyNBx4W/NJYGdFR3ldjOmiWQVj1j7UdA21B6SGopUjLmK+8LHPqIN4X0ymoRsW4nTMppMJoPGJrLeNib2KMh06JKh6xxMiZZo5esJG/1HlwPAfChm1vdi+H68=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=W/uvH8VT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yuhao Jiang <[email-masked]>,
	Dominique Martinet <[email-masked]>
Subject: [PATCH 6.12 258/262] net/9p: Fix buffer overflow in USB transport layer
Date: Mon, 13 Oct 2025 16:46:40 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dominique Martinet <[email-masked]>

commit c04db81cd0288dfc68b7a0f7d09bd49b40bba451 upstream.

A buffer overflow vulnerability exists in the USB 9pfs transport layer
where inconsistent size validation between packet header parsing and
actual data copying allows a malicious USB host to overflow heap buffers.

The issue occurs because:
- usb9pfs_rx_header() validates only the declared size in packet header
- usb9pfs_rx_complete() uses req->actual (actual received bytes) for
memcpy

This allows an attacker to craft packets with small declared size
(bypassing validation) but large actual payload (triggering overflow
in memcpy).

Add validation in usb9pfs_rx_complete() to ensure req->actual does not
exceed the buffer capacity before copying data.

Reported-by: Yuhao Jiang <[email-masked]>
Closes: https://lkml.kernel.org/r/[email-masked]
Fixes: a3be076dc174 ("net/9p/usbg: Add new usb gadget function transport")
Cc: [email-masked]
Message-ID: <[email-masked]>
Signed-off-by: Dominique Martinet <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 net/9p/trans_usbg.c |   16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

--- a/net/9p/trans_usbg.c
+++ b/net/9p/trans_usbg.c
@@ -231,6 +231,8 @@ static void usb9pfs_rx_complete(struct u
 	struct f_usb9pfs *usb9pfs = ep->driver_data;
 	struct usb_composite_dev *cdev = usb9pfs->function.config->cdev;
 	struct p9_req_t *p9_rx_req;
+	unsigned int req_size = req->actual;
+	int status = REQ_STATUS_RCVD;
 
 	if (req->status) {
 		dev_err(&cdev->gadget->dev, "%s usb9pfs complete --> %d, %d/%d\n",
@@ -242,11 +244,19 @@ static void usb9pfs_rx_complete(struct u
 	if (!p9_rx_req)
 		return;
 
-	memcpy(p9_rx_req->rc.sdata, req->buf, req->actual);
+	if (req_size > p9_rx_req->rc.capacity) {
+		dev_err(&cdev->gadget->dev,
+			"%s received data size %u exceeds buffer capacity %zu\n",
+			ep->name, req_size, p9_rx_req->rc.capacity);
+		req_size = 0;
+		status = REQ_STATUS_ERROR;
+	}
+
+	memcpy(p9_rx_req->rc.sdata, req->buf, req_size);
 
-	p9_rx_req->rc.size = req->actual;
+	p9_rx_req->rc.size = req_size;
 
-	p9_client_cb(usb9pfs->client, p9_rx_req, REQ_STATUS_RCVD);
+	p9_client_cb(usb9pfs->client, p9_rx_req, status);
 	p9_req_put(usb9pfs->client, p9_rx_req);
 
 	complete(&usb9pfs->received);

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:39:42 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368712; cv=none; b=pz21hlQuvmEGqRQxlyDJf4gR4urHnABfMlIK+S3MZFlAzSRf78lueHBjQVUVDfNpheD5td/DDlIE4zFSW/LPa1+Sf+yzaMv7V/MUNek6KTf1bkMDslOcBjELmT+T8dX9oaRR5kjTD/uFhL+IFkqZQZ38ATDJAySyKkJygLqgwTI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368712; c=relaxed/simple;
	bh=44kPqm/oX1aN8GGsDwWCJI4AMt70EV332CLE6x3zyf8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=lS7UO5Cxsuxyb/JnJovwrGOd0W9cxYcUhD1/XhrbVvK8Id7TvVRVtqjTZyXNPK9rUfu48eDK5oZu2xu4v2hoCPe9ScCWYC7Tbn6r8W+SZO/1oYFkNfsDdRXZ5Asi/DYjmdP8t9JQ0QbMIR/qaAoPuPsHtGX6NVK7/9+qW4RnUZE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lIEwwUn/; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Salah Triki <[email-masked]>,
	Ioana Ciornei <[email-masked]>,
	Christophe Leroy <[email-masked]>
Subject: [PATCH 6.12 257/262] bus: fsl-mc: Check return value of platform_get_resource()
Date: Mon, 13 Oct 2025 16:46:39 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Salah Triki <[email-masked]>

commit 25f526507b8ccc6ac3a43bc094d09b1f9b0b90ae upstream.

platform_get_resource() returns NULL in case of failure, so check its
return value and propagate the error in order to prevent NULL pointer
dereference.

Fixes: 6305166c8771 ("bus: fsl-mc: Add ACPI support for fsl-mc")
Cc: [email-masked]
Signed-off-by: Salah Triki <[email-masked]>
Acked-by: Ioana Ciornei <[email-masked]>
Link: https://lore.kernel.org/r/aKwuK6TRr5XNYQ8u@pc
Signed-off-by: Christophe Leroy <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/bus/fsl-mc/fsl-mc-bus.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
@@ -1103,6 +1103,9 @@ static int fsl_mc_bus_probe(struct platf
 	 * Get physical address of MC portal for the root DPRC:
 	 */
 	plat_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!plat_res)
+		return -EINVAL;
+
 	mc_portal_phys_addr = plat_res->start;
 	mc_portal_size = resource_size(plat_res);
 	mc_portal_base_phys_addr = mc_portal_phys_addr & ~0x3ffffff;

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:55:30 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368709; cv=none; b=uxLxuah/tbbm3nZ+HGvihbbLjWnL7IxSS2vZWcSWKp2fLPyEfEan19G7mg8wUDP9a3pVGL7jVbjEoJxUmzyGvmB6crjciU14DtKiLZDAW0nwpmt7h4upeJoL6P8nvDhpZYzqemgEI69/1YM5gtyOCaBoWeZ0Bv3973Z8PKoCiYY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368709; c=relaxed/simple;
	bh=JwBaw6JHTUllkPIpDjd8wmRreb0QRhsJZtpDMQ7ssfc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=CdRWmtRK1ZVbekzPZJxc4HkLzGr+Z7ZJNdjPQXtn2Xyv9VoJbAlZDUruCo7FCZi8ngBDUHZjdAcl4eSsPwb7hWMTcZccA/5Iou7JbhQ1C5WcrAcmdFT0AcBgn6PJWZv+0sfUf4eSwZRJT1MbApObStl3EByFD+/+q2ylc2ogYss=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ncEKfYtm; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Neil Armstrong <[email-masked]>,
	Bartosz Golaszewski <[email-masked]>,
	Linus Walleij <[email-masked]>
Subject: [PATCH 6.12 256/262] pinctrl: check the return value of pinmux_ops::get_function_name()
Date: Mon, 13 Oct 2025 16:46:38 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bartosz Golaszewski <[email-masked]>

commit 4002ee98c022d671ecc1e4a84029e9ae7d8a5603 upstream.

While the API contract in docs doesn't specify it explicitly, the
generic implementation of the get_function_name() callback from struct
pinmux_ops - pinmux_generic_get_function_name() - can fail and return
NULL. This is already checked in pinmux_check_ops() so add a similar
check in pinmux_func_name_to_selector() instead of passing the returned
pointer right down to strcmp() where the NULL can get dereferenced. This
is normal operation when adding new pinfunctions.

Cc: [email-masked]
Tested-by: Neil Armstrong <[email-masked]>
Signed-off-by: Bartosz Golaszewski <[email-masked]>
Signed-off-by: Linus Walleij <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/pinctrl/pinmux.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/pinctrl/pinmux.c
+++ b/drivers/pinctrl/pinmux.c
@@ -337,7 +337,7 @@ static int pinmux_func_name_to_selector(
 	while (selector < nfuncs) {
 		const char *fname = ops->get_function_name(pctldev, selector);
 
-		if (!strcmp(function, fname))
+		if (fname && !strcmp(function, fname))
 			return selector;
 
 		selector++;

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:34:44 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368751; cv=none; b=I71iUExn5bbwSX7Q1JGfsetUfIl6gvPT4tp0926n2IXXfc+O2kZUFjvnLfyhaCZJJtLyimZoK80mVE/9DazrastBm7FBRMqZQNDX8TMqcGwjHosGAQKSs1H6chc0fu4LVL0jq4WJV+Gx9SRGUXWkn/GbLaEYfW4PFpf0T4PYSIo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368751; c=relaxed/simple;
	bh=gCG/bMa82WBCH9tHm/xlBTRdOypZ1INjdAFqt+W0P3Q=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=uMrRA5CQ4ARCR1JiCV2pAplgN2niwXvAXV97mSnJk9xYmincGHu7JLbkIw/+dF/okFiXkroa1jPK8LfGCChbX42FUOchiFr7kEZSSP6JFNgQRMowq78iKsL6SlG8px9nkvTiPsBH/diW4Jz5T/ncHn5ac3l3HxYfFqDkZhdZNeA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YAXaHSUB; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Masami Ichikawa <[email-masked]>,
	Jens Wiklander <[email-masked]>
Subject: [PATCH 6.12 255/262] tee: fix register_shm_helper()
Date: Mon, 13 Oct 2025 16:46:37 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jens Wiklander <[email-masked]>

commit d5cf5b37064b1699d946e8b7ab4ac7d7d101814c upstream.

In register_shm_helper(), fix incorrect error handling for a call to
iov_iter_extract_pages(). A case is missing for when
iov_iter_extract_pages() only got some pages and return a number larger
than 0, but not the requested amount.

This fixes a possible NULL pointer dereference following a bad input from
ioctl(TEE_IOC_SHM_REGISTER) where parts of the buffer isn't mapped.

Cc: [email-masked]
Reported-by: Masami Ichikawa <[email-masked]>
Closes: https://lore.kernel.org/op-tee/CACOXgS-Bo2W72Nj1_44c7bntyNYOavnTjJAvUbEiQfq=[email-masked]/
Tested-by: Masami Ichikawa <[email-masked]>
Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration")
Signed-off-by: Jens Wiklander <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/tee/tee_shm.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -321,6 +321,14 @@ register_shm_helper(struct tee_context *
 	if (unlikely(len <= 0)) {
 		ret = len ? ERR_PTR(len) : ERR_PTR(-ENOMEM);
 		goto err_free_shm_pages;
+	} else if (DIV_ROUND_UP(len + off, PAGE_SIZE) != num_pages) {
+		/*
+		 * If we only got a few pages, update to release the
+		 * correct amount below.
+		 */
+		shm->num_pages = len / PAGE_SIZE;
+		ret = ERR_PTR(-ENOMEM);
+		goto err_put_shm_pages;
 	}
 
 	/*

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:34:41 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368743; cv=none; b=Q6knH4ZmDcZ7QHbKepfzvOs6Z8Rx0E2VejgkRoA38WUSIZgtl3BYIyEZHJeT9ttvPwHZUktUydHq6pH1ViOyLdUnn3XxUIzYwSotuGYDe4Vnl70Q36k7DoWkDr6uz5h4oK3BLUCGkNJEtd0QXbfKcnWyhEFdzUz4BZBwMVRlt+o=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368743; c=relaxed/simple;
	bh=je06jWST3nUjqb9QTTaoW4abR2Asd5vf0MxWv/DSTH0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=HftZEkDZMUYYk6iuzyIpZiZSzCeDGr3qcP++qSr+1VrJ39cYtKT6RZhO+koir4G01gyj+RfWKI9d+1nNWkCdGeu81KPaJPF6RC9S3C7HSA8cudWZyYRNoC4yeDodFtOeTj8UV2YJ7pkpZYumOL9GEG6cLmOak1Hz5QDdh62h0OE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=P+wO4+HU; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Lei Lu <[email-masked]>,
	Chuck Lever <[email-masked]>
Subject: [PATCH 6.12 253/262] sunrpc: fix null pointer dereference on zero-length checksum
Date: Mon, 13 Oct 2025 16:46:35 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lei Lu <[email-masked]>

commit 6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42 upstream.

In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes
checksum.data to be set to NULL. This triggers a NPD when accessing
checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that
the value of checksum.len is not less than XDR_UNIT.

Fixes: 0653028e8f1c ("SUNRPC: Convert gss_verify_header() to use xdr_stream")
Cc: [email-masked]
Signed-off-by: Lei Lu <[email-masked]>
Signed-off-by: Chuck Lever <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 net/sunrpc/auth_gss/svcauth_gss.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -724,7 +724,7 @@ svcauth_gss_verify_header(struct svc_rqs
 		rqstp->rq_auth_stat = rpc_autherr_badverf;
 		return SVC_DENIED;
 	}
-	if (flavor != RPC_AUTH_GSS) {
+	if (flavor != RPC_AUTH_GSS || checksum.len < XDR_UNIT) {
 		rqstp->rq_auth_stat = rpc_autherr_badverf;
 		return SVC_DENIED;
 	}

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:52:49 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368741; cv=none; b=NVqHObQQfm8J8z/4p4k+K9OGXN6UWdSINBzkD+6GFYlH4OilB1kEoBfcZyk83xmRuBJ2sV5np1wHvZaaEf8Xu0FALLUhf3GrcH2GU9BmV3sqX2AiAuE3VZac5qSBlJGvOhxTpTZYUeMiAsu4Oe8ARwZLCgNGaF9CR7GTemIMZnw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368741; c=relaxed/simple;
	bh=wM8hTHAZ6bE/gOYmyDWNjMxE2xZcRTTAcssTbIKvXU4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ATsHfveyOxPxBy2ekr4WllkN5AKYPQlNBbUgHPu2j/pgVstG7UnZEXM4apPumcJdT2WT48R4LeRZZztY1SScpeGVnd6R0grfsrH+F0xruJDLOw/+7iZPdbNIPPmQ9HbNbECtWuIhxCgGwjiTaI6WoeQEX9Ajlw6XKAgqesMBj1M=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=V7yB3Ifa; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhen Ni <[email-masked]>,
	Dmitry Torokhov <[email-masked]>
Subject: [PATCH 6.12 252/262] Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
Date: Mon, 13 Oct 2025 16:46:34 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhen Ni <[email-masked]>

commit d3366a04770eea807f2826cbdb96934dd8c9bf79 upstream.

Struct ff_effect_compat is embedded twice inside
uinput_ff_upload_compat, contains internal padding. In particular, there
is a hole after struct ff_replay to satisfy alignment requirements for
the following union member. Without clearing the structure,
copy_to_user() may leak stack data to userspace.

Initialize ff_up_compat to zero before filling valid fields.

Fixes: 2d56f3a32c0e ("Input: refactor evdev 32bit compat to be shareable with uinput")
Cc: [email-masked]
Signed-off-by: Zhen Ni <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Dmitry Torokhov <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/input/misc/uinput.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -775,6 +775,7 @@ static int uinput_ff_upload_to_user(char
 	if (in_compat_syscall()) {
 		struct uinput_ff_upload_compat ff_up_compat;
 
+		memset(&ff_up_compat, 0, sizeof(ff_up_compat));
 		ff_up_compat.request_id = ff_up->request_id;
 		ff_up_compat.retval = ff_up->retval;
 		/*

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:32:33 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368738; cv=none; b=gi66+hg6gW9UdFlM2Az9tqm1r4x+utoNE+7rnsvBmzBIQQ3wv7TsyofsSAsq32R0+KoJMZNUOKAYExVJIGEoOJyNtUif4aoiObzm6y2J7SXXSuJ+QEXMUPf8g18Z7Y8R8Rd8kup/6XHVmI1DzUGS0LtdHTrUCMcuWIJI23i6ufE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368738; c=relaxed/simple;
	bh=wogoRCOl7GyFm0ggRkKiTVn+wuEddQ3ETk4K/S5GyCU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=JsKktUadmemAbeXDKHBXDIIsswgv64Gtpg7HxWKbULfehCMQunkLGPFXbUs/1C07CijJMc72eEBV7FFpQh8W/sjK3q8+zqJLYZ8G7lSgy8iHQoiKl0JexsG2K3Zf4MsdemppMmcAlobLdNtaWiK+QjQWWv1ERAwRSO13vlo5qyo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Xz0ZyD4H; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Marek Vasut <[email-masked]>,
	Dmitry Torokhov <[email-masked]>
Subject: [PATCH 6.12 251/262] Input: atmel_mxt_ts - allow reset GPIO to sleep
Date: Mon, 13 Oct 2025 16:46:33 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marek Vasut <[email-masked]>

commit c7866ee0a9ddd9789faadf58cdac6abd7aabf045 upstream.

The reset GPIO is not toggled in any critical section where it couldn't
sleep, allow the reset GPIO to sleep. This allows the driver to operate
reset GPIOs connected to I2C GPIO expanders.

Signed-off-by: Marek Vasut <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Cc: [email-masked]
Signed-off-by: Dmitry Torokhov <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/input/touchscreen/atmel_mxt_ts.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -3319,7 +3319,7 @@ static int mxt_probe(struct i2c_client *
 	if (data->reset_gpio) {
 		/* Wait a while and then de-assert the RESET GPIO line */
 		msleep(MXT_RESET_GPIO_TIME);
-		gpiod_set_value(data->reset_gpio, 0);
+		gpiod_set_value_cansleep(data->reset_gpio, 0);
 		msleep(MXT_RESET_INVALID_CHG);
 	}

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:34:37 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368735; cv=none; b=Rt5ZIcdck9j/nWavO1kFPueJOgjx+XMvuGC70ZRI6X75mUz/GC6Z8Uu5MXVu1ZUwfStpeJd3Z7sWwltgKp0L439ziNqrOAbv9nG908YxbhCPUkKdZMDBRCA6yLJvjEKYZhf0of/RDJfO/B8KzlJgxflXQGzeIC/mW7ese7S6XZs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368735; c=relaxed/simple;
	bh=tAnqS3HtAVLBlCT9epBbMksJ2ysgUARIaSY2Ueh9Mxk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ZrGoZN269LjdCpnuKgPFelASis/dyCuZLDroyJkvWg/VPqCtx2CEBsSz/dbDZnecjo18LWi4aV+SCJxXfVoieGQNmuGPdFA3DJ9mDf1ZAvsBuhEhRPp5hL4cwJhIxTilm2Zlhm4aEfFQPUu/gQz6sgtQ/UvsR/WAg3TCDqCF8IE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PMDyLf3o; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Ekansh Gupta <[email-masked]>,
	Ling Xu <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Srinivas Kandagatla <[email-masked]>
Subject: [PATCH 6.12 250/262] misc: fastrpc: Skip reference for DMA handles
Date: Mon, 13 Oct 2025 16:46:32 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ling Xu <[email-masked]>

commit 10df039834f84a297c72ec962c0f9b7c8c5ca31a upstream.

If multiple dma handles are passed with same fd over a remote call
the kernel driver takes a reference and expects that put for the
map will be called as many times to free the map. But DSP only
updates the fd one time in the fd list when the DSP refcount
goes to zero and hence kernel make put call only once for the
fd. This can cause SMMU fault issue as the same fd can be used
in future for some other call.

Fixes: 35a82b87135d ("misc: fastrpc: Add dma handle implementation")
Cc: [email-masked]
Co-developed-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ling Xu <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Srinivas Kandagatla <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/misc/fastrpc.c |   45 +++++++++++++++++++++++++++------------------
 1 file changed, 27 insertions(+), 18 deletions(-)

--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -363,9 +363,8 @@ static int fastrpc_map_get(struct fastrp

 static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd,
-			    struct fastrpc_map **ppmap, bool take_ref)
+			    struct fastrpc_map **ppmap)
 {
-	struct fastrpc_session_ctx *sess = fl->sctx;
 	struct fastrpc_map *map = NULL;
 	struct dma_buf *buf;
 	int ret = -ENOENT;
@@ -379,15 +378,6 @@ static int fastrpc_map_lookup(struct fas
 		if (map->fd != fd || map->buf != buf)
 			continue;
 
-		if (take_ref) {
-			ret = fastrpc_map_get(map);
-			if (ret) {
-				dev_dbg(sess->dev, "%s: Failed to get map fd=%d ret=%d\n",
-					__func__, fd, ret);
-				break;
-			}
-		}
-
 		*ppmap = map;
 		ret = 0;
 		break;
@@ -757,7 +747,7 @@ static const struct dma_buf_ops fastrpc_
 	.release = fastrpc_release,
 };
 
-static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
+static int fastrpc_map_attach(struct fastrpc_user *fl, int fd,
 			      u64 len, u32 attr, struct fastrpc_map **ppmap)
 {
 	struct fastrpc_session_ctx *sess = fl->sctx;
@@ -766,9 +756,6 @@ static int fastrpc_map_create(struct fas
 	struct scatterlist *sgl = NULL;
 	int err = 0, sgl_index = 0;
 
-	if (!fastrpc_map_lookup(fl, fd, ppmap, true))
-		return 0;
-
 	map = kzalloc(sizeof(*map), GFP_KERNEL);
 	if (!map)
 		return -ENOMEM;
@@ -853,6 +840,24 @@ get_err:
 	return err;
 }
 
+static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
+			      u64 len, u32 attr, struct fastrpc_map **ppmap)
+{
+	struct fastrpc_session_ctx *sess = fl->sctx;
+	int err = 0;
+
+	if (!fastrpc_map_lookup(fl, fd, ppmap)) {
+		if (!fastrpc_map_get(*ppmap))
+			return 0;
+		dev_dbg(sess->dev, "%s: Failed to get map fd=%d\n",
+			__func__, fd);
+	}
+
+	err = fastrpc_map_attach(fl, fd, len, attr, ppmap);
+
+	return err;
+}
+
 /*
  * Fastrpc payload buffer with metadata looks like:
  *
@@ -925,8 +930,12 @@ static int fastrpc_create_maps(struct fa
 		    ctx->args[i].length == 0)
 			continue;
 
-		err = fastrpc_map_create(ctx->fl, ctx->args[i].fd,
-			 ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
+		if (i < ctx->nbufs)
+			err = fastrpc_map_create(ctx->fl, ctx->args[i].fd,
+				 ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
+		else
+			err = fastrpc_map_attach(ctx->fl, ctx->args[i].fd,
+				 ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
 		if (err) {
 			dev_err(dev, "Error Creating map %d\n", err);
 			return -EINVAL;
@@ -1116,7 +1125,7 @@ cleanup_fdlist:
 	for (i = 0; i < FASTRPC_MAX_FDLIST; i++) {
 		if (!fdlist[i])
 			break;
-		if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap, false))
+		if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap))
 			fastrpc_map_put(mmap);
 	}

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:49:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368732; cv=none; b=An0tDasPFDPfsO9CgL6RgrCAwfLuaA/I9ODjsw3csNog9oYaukX6ve7FxQ19hyOtKz8Q9KzYNumTi8q4fGy8F7zNrfHvxLjD3DsZAr8XEIIzUsvnil2MAxwyKYS0mVhfCE7eOxTQIP9KKk2jp4zX7POFk1PZdmeSsiZ8KN3MEfE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368732; c=relaxed/simple;
	bh=r4slTj/as8ygRiHfUJvK0Krxz5msInM/pghMKKSf8jA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=SvxYN+Cw41yl+9fTK0N4pcXiWviRPDPpUrItWAsDmumhrNn1SL061WGktewucqpiUPb0wtHRqSXw8o+LITQmu/hHSBWDewqaW4J/fke7uIMMw2B5HCNBAsfJZhzqT+cKfKmfZ9hfDnwzRrT/xk/0PJQDxOVuR+uQ2VSFffoj0+4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Gc1l1u4G; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Ekansh Gupta <[email-masked]>,
	Ling Xu <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Srinivas Kandagatla <[email-masked]>
Subject: [PATCH 6.12 249/262] misc: fastrpc: fix possible map leak in fastrpc_put_args
Date: Mon, 13 Oct 2025 16:46:31 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ling Xu <[email-masked]>

commit da1ba64176e0138f2bfa96f9e43e8c3640d01e1e upstream.

copy_to_user() failure would cause an early return without cleaning up
the fdlist, which has been updated by the DSP. This could lead to map
leak. Fix this by redirecting to a cleanup path on failure, ensuring
that all mapped buffers are properly released before returning.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: [email-masked]
Co-developed-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ling Xu <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Srinivas Kandagatla <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/misc/fastrpc.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1085,6 +1085,7 @@ static int fastrpc_put_args(struct fastr
 	struct fastrpc_phy_page *pages;
 	u64 *fdlist;
 	int i, inbufs, outbufs, handles;
+	int ret = 0;
 
 	inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);
 	outbufs = REMOTE_SCALARS_OUTBUFS(ctx->sc);
@@ -1100,14 +1101,17 @@ static int fastrpc_put_args(struct fastr
 			u64 len = rpra[i].buf.len;
 
 			if (!kernel) {
-				if (copy_to_user((void __user *)dst, src, len))
-					return -EFAULT;
+				if (copy_to_user((void __user *)dst, src, len)) {
+					ret = -EFAULT;
+					goto cleanup_fdlist;
+				}
 			} else {
 				memcpy(dst, src, len);
 			}
 		}
 	}
 
+cleanup_fdlist:
 	/* Clean up fdlist which is updated by DSP */
 	for (i = 0; i < FASTRPC_MAX_FDLIST; i++) {
 		if (!fdlist[i])
@@ -1116,7 +1120,7 @@ static int fastrpc_put_args(struct fastr
 			fastrpc_map_put(mmap);
 	}
 
-	return 0;
+	return ret;
 }
 
 static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx,

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:34:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368729; cv=none; b=oej4UAEABwIzHcDON3CznHgltTBel/KWYv4U2UWQ4lJ5IdO5tJGjbMrq+pynHIA2TZfapOL9AS8i8BuStQ7XG/+EJY/dFvMe5uuxdUPv4gDv3pw2TAd276fZWGqAZ0e6VFr0TMRODXiuwVHmo5h3TEGO2rnviMChZlwdwSO5lsY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368729; c=relaxed/simple;
	bh=hYSpS6HD/YbHmiGzshUpepi9P0PQIfUPpUWariizyhk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=tDxMUnVLUgA/VedR0QA1plp54uhzunMi6asP1A3+UPjGfDi0vqGIPLpfvDjwOmQrb/CLJp7hEBaQ2pCqsUatsGxVifEsKAhtWABWNScG3LoSlK7ypDKKjeARM04OWSeDfqKF28wl7HKRlw44I8jnryl7k6RR53xr+Fzk7+q/oTI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=HT9R53mo; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Ekansh Gupta <[email-masked]>,
	Ling Xu <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Srinivas Kandagatla <[email-masked]>
Subject: [PATCH 6.12 248/262] misc: fastrpc: Fix fastrpc_map_lookup operation
Date: Mon, 13 Oct 2025 16:46:30 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ling Xu <[email-masked]>

commit 9031626ade38b092b72638dfe0c6ffce8d8acd43 upstream.

Fastrpc driver creates maps for user allocated fd buffers. Before
creating a new map, the map list is checked for any already existing
maps using map fd. Checking with just map fd is not sufficient as the
user can pass offsetted buffer with less size when the map is created
and then a larger size the next time which could result in memory
issues. Check for dma_buf object also when looking up for the map.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: [email-masked]
Co-developed-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ling Xu <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Srinivas Kandagatla <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/misc/fastrpc.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -367,11 +367,16 @@ static int fastrpc_map_lookup(struct fas
 {
 	struct fastrpc_session_ctx *sess = fl->sctx;
 	struct fastrpc_map *map = NULL;
+	struct dma_buf *buf;
 	int ret = -ENOENT;
 
+	buf = dma_buf_get(fd);
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);
+
 	spin_lock(&fl->lock);
 	list_for_each_entry(map, &fl->maps, node) {
-		if (map->fd != fd)
+		if (map->fd != fd || map->buf != buf)
 			continue;
 
 		if (take_ref) {

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:49:34 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368707; cv=none; b=e4vYEdyyhOhbEoPH90EVjFkija/qze0dHdOpJRO3n2IozSTe0zMm8oB0QZo1CFvBszOYfPfBq4JXKw0deL1b5ybBhLK+JAfWrhgEBuWknyjlqeVq8CJ7fFvM7GSDl7Fu3DjpgZx3cVjxcZmsu0JzhlsrQCpouFcrFmhZHj/GKNg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368707; c=relaxed/simple;
	bh=Re3nb0bWzHssVecQsjFJKLp1AgjSA/rKXPbeduxtcz8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=uVCU4/zpRIJOoVgYCtO39TuDpIIwDiYF4ZVwTaKuv1YEyiyk2JwCcL2MstUV7+V4iL0++2BwQW5WT/6WkqO6PHIlUSvUa5u6WyLoKkj5iYl+4hTMuWZngHlEWj0/CRzCFS/dAbvYjUrU4GWbGzNRWPCdOYQuC0Q60y2xUd50TLc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=q661xT1s; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Dmitry Baryshkov <[email-masked]>,
	Ekansh Gupta <[email-masked]>,
	Ling Xu <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Srinivas Kandagatla <[email-masked]>
Subject: [PATCH 6.12 247/262] misc: fastrpc: Save actual DMA size in fastrpc_map structure
Date: Mon, 13 Oct 2025 16:46:29 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ling Xu <[email-masked]>

commit 8b5b456222fd604079b5cf2af1f25ad690f54a25 upstream.

For user passed fd buffer, map is created using DMA calls. The
map related information is stored in fastrpc_map structure. The
actual DMA size is not stored in the structure. Store the actual
size of buffer and check it against the user passed size.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: [email-masked]
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Co-developed-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ling Xu <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Srinivas Kandagatla <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/misc/fastrpc.c |   27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -323,11 +323,11 @@ static void fastrpc_free_map(struct kref
 
 			perm.vmid = QCOM_SCM_VMID_HLOS;
 			perm.perm = QCOM_SCM_PERM_RWX;
-			err = qcom_scm_assign_mem(map->phys, map->size,
+			err = qcom_scm_assign_mem(map->phys, map->len,
 				&src_perms, &perm, 1);
 			if (err) {
 				dev_err(map->fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d\n",
-						map->phys, map->size, err);
+						map->phys, map->len, err);
 				return;
 			}
 		}
@@ -758,7 +758,8 @@ static int fastrpc_map_create(struct fas
 	struct fastrpc_session_ctx *sess = fl->sctx;
 	struct fastrpc_map *map = NULL;
 	struct sg_table *table;
-	int err = 0;
+	struct scatterlist *sgl = NULL;
+	int err = 0, sgl_index = 0;
 
 	if (!fastrpc_map_lookup(fl, fd, ppmap, true))
 		return 0;
@@ -798,7 +799,15 @@ static int fastrpc_map_create(struct fas
 		map->phys = sg_dma_address(map->table->sgl);
 		map->phys += ((u64)fl->sctx->sid << 32);
 	}
-	map->size = len;
+	for_each_sg(map->table->sgl, sgl, map->table->nents,
+		sgl_index)
+		map->size += sg_dma_len(sgl);
+	if (len > map->size) {
+		dev_dbg(sess->dev, "Bad size passed len 0x%llx map size 0x%llx\n",
+				len, map->size);
+		err = -EINVAL;
+		goto map_err;
+	}
 	map->va = sg_virt(map->table->sgl);
 	map->len = len;
 
@@ -815,10 +824,10 @@ static int fastrpc_map_create(struct fas
 		dst_perms[1].vmid = fl->cctx->vmperms[0].vmid;
 		dst_perms[1].perm = QCOM_SCM_PERM_RWX;
 		map->attr = attr;
-		err = qcom_scm_assign_mem(map->phys, (u64)map->size, &src_perms, dst_perms, 2);
+		err = qcom_scm_assign_mem(map->phys, (u64)map->len, &src_perms, dst_perms, 2);
 		if (err) {
 			dev_err(sess->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d\n",
-					map->phys, map->size, err);
+					map->phys, map->len, err);
 			goto map_err;
 		}
 	}
@@ -2044,7 +2053,7 @@ static int fastrpc_req_mem_map(struct fa
 	args[0].length = sizeof(req_msg);
 
 	pages.addr = map->phys;
-	pages.size = map->size;
+	pages.size = map->len;
 
 	args[1].ptr = (u64) (uintptr_t) &pages;
 	args[1].length = sizeof(pages);
@@ -2059,7 +2068,7 @@ static int fastrpc_req_mem_map(struct fa
 	err = fastrpc_internal_invoke(fl, true, FASTRPC_INIT_HANDLE, sc, &args[0]);
 	if (err) {
 		dev_err(dev, "mem mmap error, fd %d, vaddr %llx, size %lld\n",
-			req.fd, req.vaddrin, map->size);
+			req.fd, req.vaddrin, map->len);
 		goto err_invoke;
 	}
 
@@ -2072,7 +2081,7 @@ static int fastrpc_req_mem_map(struct fa
 	if (copy_to_user((void __user *)argp, &req, sizeof(req))) {
 		/* unmap the memory and release the buffer */
 		req_unmap.vaddr = (uintptr_t) rsp_msg.vaddr;
-		req_unmap.length = map->size;
+		req_unmap.length = map->len;
 		fastrpc_req_mem_unmap_impl(fl, &req_unmap);
 		return -EFAULT;
 	}

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:54:00 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368752; cv=none; b=VPsYy7UZBVW9BzO/KtBP/BanouL/+ROXBGpxwzOt9IujkpcV0HxD1RqKdYMhr0l/fx3aVtE8OuUvqroEv/mwMGynO0tgMsrouejXYKmqtONs+R6bnTqX8roc7Cf/ATVqT6CPd/rTtHbmauEhrNfu+nyY006SnXFELqajGGg+1oM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368752; c=relaxed/simple;
	bh=6RAqLPfosLsFnfTUtjtlL9nUIxjVcHyV/A8Tz4byi2g=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=tWnzDcSvHY6d16zCfzECmooPunBvW7m/7v1VVnkhYHc38ndNkSd7CumN5OD9/pn/DRpGJAoIKhDUA784gHalll7NMXMJhxMe6AAxQxGmE5IkC5qr6ZXvpNGma7TtbhjXoHITSlGyYArP+kA+FZdd2OPU9DzUPLf8wvGHsH2S0dQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JZcBbIMT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Guangshuo Li <[email-masked]>,
	Alison Schofield <[email-masked]>,
	Ira Weiny <[email-masked]>,
	Dave Jiang <[email-masked]>
Subject: [PATCH 6.12 246/262] nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
Date: Mon, 13 Oct 2025 16:46:28 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guangshuo Li <[email-masked]>

commit a9e6aa994917ee602798bbb03180a194b37865bb upstream.

devm_kcalloc() may fail. ndtest_probe() allocates three DMA address
arrays (dcr_dma, label_dma, dimm_dma) and later unconditionally uses
them in ndtest_nvdimm_init(), which can lead to a NULL pointer
dereference under low-memory conditions.

Check all three allocations and return -ENOMEM if any allocation fails,
jumping to the common error path. Do not emit an extra error message
since the allocator already warns on allocation failure.

Fixes: 9399ab61ad82 ("ndtest: Add dimms to the two buses")
Cc: [email-masked]
Signed-off-by: Guangshuo Li <[email-masked]>
Reviewed-by: Alison Schofield <[email-masked]>
Reviewed-by: Ira Weiny <[email-masked]>
Reviewed-by: Dave Jiang <[email-masked]>
Signed-off-by: Ira Weiny <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 tools/testing/nvdimm/test/ndtest.c |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

--- a/tools/testing/nvdimm/test/ndtest.c
+++ b/tools/testing/nvdimm/test/ndtest.c
@@ -850,11 +850,22 @@ static int ndtest_probe(struct platform_
 
 	p->dcr_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR,
 				 sizeof(dma_addr_t), GFP_KERNEL);
+	if (!p->dcr_dma) {
+		rc = -ENOMEM;
+		goto err;
+	}
 	p->label_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR,
 				   sizeof(dma_addr_t), GFP_KERNEL);
+	if (!p->label_dma) {
+		rc = -ENOMEM;
+		goto err;
+	}
 	p->dimm_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR,
 				  sizeof(dma_addr_t), GFP_KERNEL);
-
+	if (!p->dimm_dma) {
+		rc = -ENOMEM;
+		goto err;
+	}
 	rc = ndtest_nvdimm_init(p);
 	if (rc)
 		goto err;

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:31:06 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368684; cv=none; b=To4E6SkkAkRF/IezqBr3ome9CoLve+HAPCdTnI147qCvNHAdRNO/8adC9XF6Ag0mENC0WMi1K4EJFXPamUcDhX3G+Puhkb0K4fPQ+ndHNubt3xFUNUmYdlprrOHMcFbX7mckRVPU1AWbNujfBiROUeotny8QahawDyl1xw583Y4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368684; c=relaxed/simple;
	bh=43eQ89aQIidh/S4YulGO/7r5mFB9KyXIZE1H9U6QwnY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=CcE6gQzFV+L5PkCWddI/D4Xc/N0phFC8kQJzfoKmmoacaSXXBcKKLkYbF+99uZFcfjYNdV989dVIiL3NztoNg/Pb/MENSeYw8pdQ9J6o2CIB9wf9tO2XbKZq+yzhIg9l/M8G5LrzAnW8fYSmoKmf8zigDCB7dW6uEXDAoUBh8u0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lPEFq+oN; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 425D3C19422;
	Mon, 13 Oct 2025 15:18:03 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760368683;
	bh=43eQ89aQIidh/S4YulGO/7r5mFB9KyXIZE1H9U6QwnY=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=lPEFq+oN+q+mGqdskjiPRuuTg9jaVgrBa8qEWe1fUfvdy1PJWULQgrbavP9GwdyxK
	 z7zIVJnxWs1vABe9fvBF1QSNddBGNAvuno+F0wrsaqK1PvbxwEtBOKVtWYfs2fOw/C
	 1QFv1Y5atd74Z9YL5REE7d4au8slNwuih2hpYHSA=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yang Shi <[email-masked]>,
	Carl Worth <[email-masked]>,
	"Christoph Lameter (Ampere)" <[email-masked]>,
	Catalin Marinas <[email-masked]>,
	David Hildenbrand <[email-masked]>,
	Oscar Salvador <[email-masked]>,
	Anshuman Khandual <[email-masked]>,
	Dev Jain <[email-masked]>,
	Muchun Song <[email-masked]>,
	Will Deacon <[email-masked]>,
	Andrew Morton <[email-masked]>
Subject: [PATCH 6.12 245/262] mm: hugetlb: avoid soft lockup when mprotect to large memory area
Date: Mon, 13 Oct 2025 16:46:27 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yang Shi <[email-masked]>

commit f52ce0ea90c83a28904c7cc203a70e6434adfecb upstream.

When calling mprotect() to a large hugetlb memory area in our customer's
workload (~300GB hugetlb memory), soft lockup was observed:

watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916]

CPU: 98 PID: 126916 Comm: t2_new_sysv Kdump: loaded Not tainted 6.17-rc7
Hardware name: GIGACOMPUTING R2A3-T40-AAV1/Jefferson CIO, BIOS 5.4.4.1 07/15/2025
pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : mte_clear_page_tags+0x14/0x24
lr : mte_sync_tags+0x1c0/0x240
sp : ffff80003150bb80
x29: ffff80003150bb80 x28: ffff00739e9705a8 x27: 0000ffd2d6a00000
x26: 0000ff8e4bc00000 x25: 00e80046cde00f45 x24: 0000000000022458
x23: 0000000000000000 x22: 0000000000000004 x21: 000000011b380000
x20: ffff000000000000 x19: 000000011b379f40 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc875e0aa5e2c
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : fffffc01ce7a5c00 x4 : 00000000046cde00 x3 : fffffc0000000000
x2 : 0000000000000004 x1 : 0000000000000040 x0 : ffff0046cde7c000

Call trace:
  mte_clear_page_tags+0x14/0x24
  set_huge_pte_at+0x25c/0x280
  hugetlb_change_protection+0x220/0x430
  change_protection+0x5c/0x8c
  mprotect_fixup+0x10c/0x294
  do_mprotect_pkey.constprop.0+0x2e0/0x3d4
  __arm64_sys_mprotect+0x24/0x44
  invoke_syscall+0x50/0x160
  el0_svc_common+0x48/0x144
  do_el0_svc+0x30/0xe0
  el0_svc+0x30/0xf0
  el0t_64_sync_handler+0xc4/0x148
  el0t_64_sync+0x1a4/0x1a8

Soft lockup is not triggered with THP or base page because there is
cond_resched() called for each PMD size.

Although the soft lockup was triggered by MTE, it should be not MTE
specific.  The other processing which takes long time in the loop may
trigger soft lockup too.

So add cond_resched() for hugetlb to avoid soft lockup.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: 8f860591ffb2 ("[PATCH] Enable mprotect on huge pages")
Signed-off-by: Yang Shi <[email-masked]>
Tested-by: Carl Worth <[email-masked]>
Reviewed-by: Christoph Lameter (Ampere) <[email-masked]>
Reviewed-by: Catalin Marinas <[email-masked]>
Acked-by: David Hildenbrand <[email-masked]>
Acked-by: Oscar Salvador <[email-masked]>
Reviewed-by: Anshuman Khandual <[email-masked]>
Reviewed-by: Dev Jain <[email-masked]>
Cc: Muchun Song <[email-masked]>
Cc: Will Deacon <[email-masked]>
Cc: <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 mm/hugetlb.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -6886,6 +6886,8 @@ long hugetlb_change_protection(struct vm
 						psize);
 		}
 		spin_unlock(ptl);
+
+		cond_resched();
 	}
 	/*
 	 * Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:47:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368681; cv=none; b=HElH+8K1BMonJGZ5w9TFrAPkDq11maXQ5sZykeJIDi2BKQ5C+hp//blbt+gMkugYtm4+gQRIbo1oHTE1UEuKZMKnn4dOtrUf2p0nNaQIyESaVXt9jOOQcjTVSymUopLKY8bqsnCqw69HvxRrdr7RD1KV0kGNsbhZyhuRYOQpHVc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368681; c=relaxed/simple;
	bh=Uwt1n9daUZkQWYdvzqd+g7xEcUqnvutGycEsCAtT+gM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=HoURfU6eehadTTsiDyA3V7fTvYX5Jon54y1IAAjX2IwifvREg++BgVCNlsgQcs2hOkNhd4YT4/4eOENE1nN+wOOD84kwgYS91/sSRhn/B9Xlmauba4NJAOdIPti2MieN6rQQkEm1Puinx9itwjDBgT3GH3QIJX5RIVIQk8fRXvU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=GAC97F6L; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Daniel Huhardeaux <[email-masked]>,
	Janne Grunau <[email-masked]>,
	Hans de Goede <[email-masked]>,
	Helge Deller <[email-masked]>
Subject: [PATCH 6.12 244/262] fbdev: simplefb: Fix use after free in simplefb_detach_genpds()
Date: Mon, 13 Oct 2025 16:46:26 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Janne Grunau <[email-masked]>

commit da1bb9135213744e7ec398826c8f2e843de4fb94 upstream.

The pm_domain cleanup can not be devres managed as it uses struct
simplefb_par which is allocated within struct fb_info by
framebuffer_alloc(). This allocation is explicitly freed by
unregister_framebuffer() in simplefb_remove().
Devres managed cleanup runs after the device remove call and thus can no
longer access struct simplefb_par.
Call simplefb_detach_genpds() explicitly from simplefb_destroy() like
the cleanup functions for clocks and regulators.

Fixes an use after free on M2 Mac mini during
aperture_remove_conflicting_devices() using the downstream asahi kernel
with Debian's kernel config. For unknown reasons this started to
consistently dereference an invalid pointer in v6.16.3 based kernels.

[    6.736134] BUG: KASAN: slab-use-after-free in simplefb_detach_genpds+0x58/0x220
[    6.743545] Read of size 4 at addr ffff8000304743f0 by task (udev-worker)/227
[    6.750697]
[    6.752182] CPU: 6 UID: 0 PID: 227 Comm: (udev-worker) Tainted: G S                  6.16.3-asahi+ #16 PREEMPTLAZY
[    6.752186] Tainted: [S]=CPU_OUT_OF_SPEC
[    6.752187] Hardware name: Apple Mac mini (M2, 2023) (DT)
[    6.752189] Call trace:
[    6.752190]  show_stack+0x34/0x98 (C)
[    6.752194]  dump_stack_lvl+0x60/0x80
[    6.752197]  print_report+0x17c/0x4d8
[    6.752201]  kasan_report+0xb4/0x100
[    6.752206]  __asan_report_load4_noabort+0x20/0x30
[    6.752209]  simplefb_detach_genpds+0x58/0x220
[    6.752213]  devm_action_release+0x50/0x98
[    6.752216]  release_nodes+0xd0/0x2c8
[    6.752219]  devres_release_all+0xfc/0x178
[    6.752221]  device_unbind_cleanup+0x28/0x168
[    6.752224]  device_release_driver_internal+0x34c/0x470
[    6.752228]  device_release_driver+0x20/0x38
[    6.752231]  bus_remove_device+0x1b0/0x380
[    6.752234]  device_del+0x314/0x820
[    6.752238]  platform_device_del+0x3c/0x1e8
[    6.752242]  platform_device_unregister+0x20/0x50
[    6.752246]  aperture_detach_platform_device+0x1c/0x30
[    6.752250]  aperture_detach_devices+0x16c/0x290
[    6.752253]  aperture_remove_conflicting_devices+0x34/0x50
...
[    6.752343]
[    6.967409] Allocated by task 62:
[    6.970724]  kasan_save_stack+0x3c/0x70
[    6.974560]  kasan_save_track+0x20/0x40
[    6.978397]  kasan_save_alloc_info+0x40/0x58
[    6.982670]  __kasan_kmalloc+0xd4/0xd8
[    6.986420]  __kmalloc_noprof+0x194/0x540
[    6.990432]  framebuffer_alloc+0xc8/0x130
[    6.994444]  simplefb_probe+0x258/0x2378
...
[    7.054356]
[    7.055838] Freed by task 227:
[    7.058891]  kasan_save_stack+0x3c/0x70
[    7.062727]  kasan_save_track+0x20/0x40
[    7.066565]  kasan_save_free_info+0x4c/0x80
[    7.070751]  __kasan_slab_free+0x6c/0xa0
[    7.074675]  kfree+0x10c/0x380
[    7.077727]  framebuffer_release+0x5c/0x90
[    7.081826]  simplefb_destroy+0x1b4/0x2c0
[    7.085837]  put_fb_info+0x98/0x100
[    7.089326]  unregister_framebuffer+0x178/0x320
[    7.093861]  simplefb_remove+0x3c/0x60
[    7.097611]  platform_remove+0x60/0x98
[    7.101361]  device_remove+0xb8/0x160
[    7.105024]  device_release_driver_internal+0x2fc/0x470
[    7.110256]  device_release_driver+0x20/0x38
[    7.114529]  bus_remove_device+0x1b0/0x380
[    7.118628]  device_del+0x314/0x820
[    7.122116]  platform_device_del+0x3c/0x1e8
[    7.126302]  platform_device_unregister+0x20/0x50
[    7.131012]  aperture_detach_platform_device+0x1c/0x30
[    7.136157]  aperture_detach_devices+0x16c/0x290
[    7.140779]  aperture_remove_conflicting_devices+0x34/0x50
...

Reported-by: Daniel Huhardeaux <[email-masked]>
Cc: [email-masked]
Fixes: 92a511a568e44 ("fbdev/simplefb: Add support for generic power-domains")
Signed-off-by: Janne Grunau <[email-masked]>
Reviewed-by: Hans de Goede <[email-masked]>
Signed-off-by: Helge Deller <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/video/fbdev/simplefb.c |   31 +++++++++++++++++++++++--------
 1 file changed, 23 insertions(+), 8 deletions(-)

--- a/drivers/video/fbdev/simplefb.c
+++ b/drivers/video/fbdev/simplefb.c
@@ -93,6 +93,7 @@ struct simplefb_par {
 
 static void simplefb_clocks_destroy(struct simplefb_par *par);
 static void simplefb_regulators_destroy(struct simplefb_par *par);
+static void simplefb_detach_genpds(void *res);
 
 /*
  * fb_ops.fb_destroy is called by the last put_fb_info() call at the end
@@ -105,6 +106,7 @@ static void simplefb_destroy(struct fb_i
 
 	simplefb_regulators_destroy(info->par);
 	simplefb_clocks_destroy(info->par);
+	simplefb_detach_genpds(info->par);
 	if (info->screen_base)
 		iounmap(info->screen_base);
 
@@ -454,13 +456,14 @@ static void simplefb_detach_genpds(void
 		if (!IS_ERR_OR_NULL(par->genpds[i]))
 			dev_pm_domain_detach(par->genpds[i], true);
 	}
+	par->num_genpds = 0;
 }
 
 static int simplefb_attach_genpds(struct simplefb_par *par,
 				  struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	unsigned int i;
+	unsigned int i, num_genpds;
 	int err;
 
 	err = of_count_phandle_with_args(dev->of_node, "power-domains",
@@ -474,26 +477,35 @@ static int simplefb_attach_genpds(struct
 		return err;
 	}
 
-	par->num_genpds = err;
+	num_genpds = err;
 
 	/*
 	 * Single power-domain devices are handled by the driver core, so
 	 * nothing to do here.
 	 */
-	if (par->num_genpds <= 1)
+	if (num_genpds <= 1) {
+		par->num_genpds = num_genpds;
 		return 0;
+	}
 
-	par->genpds = devm_kcalloc(dev, par->num_genpds, sizeof(*par->genpds),
+	par->genpds = devm_kcalloc(dev, num_genpds, sizeof(*par->genpds),
 				   GFP_KERNEL);
 	if (!par->genpds)
 		return -ENOMEM;
 
-	par->genpd_links = devm_kcalloc(dev, par->num_genpds,
+	par->genpd_links = devm_kcalloc(dev, num_genpds,
 					sizeof(*par->genpd_links),
 					GFP_KERNEL);
 	if (!par->genpd_links)
 		return -ENOMEM;
 
+	/*
+	 * Set par->num_genpds only after genpds and genpd_links are allocated
+	 * to exit early from simplefb_detach_genpds() without full
+	 * initialisation.
+	 */
+	par->num_genpds = num_genpds;
+
 	for (i = 0; i < par->num_genpds; i++) {
 		par->genpds[i] = dev_pm_domain_attach_by_id(dev, i);
 		if (IS_ERR(par->genpds[i])) {
@@ -515,9 +527,10 @@ static int simplefb_attach_genpds(struct
 			dev_warn(dev, "failed to link power-domain %u\n", i);
 	}
 
-	return devm_add_action_or_reset(dev, simplefb_detach_genpds, par);
+	return 0;
 }
 #else
+static void simplefb_detach_genpds(void *res) { }
 static int simplefb_attach_genpds(struct simplefb_par *par,
 				  struct platform_device *pdev)
 {
@@ -631,18 +644,20 @@ static int simplefb_probe(struct platfor
 	ret = devm_aperture_acquire_for_platform_device(pdev, par->base, par->size);
 	if (ret) {
 		dev_err(&pdev->dev, "Unable to acquire aperture: %d\n", ret);
-		goto error_regulators;
+		goto error_genpds;
 	}
 	ret = register_framebuffer(info);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "Unable to register simplefb: %d\n", ret);
-		goto error_regulators;
+		goto error_genpds;
 	}
 
 	dev_info(&pdev->dev, "fb%d: simplefb registered!\n", info->node);
 
 	return 0;
 
+error_genpds:
+	simplefb_detach_genpds(par);
 error_regulators:
 	simplefb_regulators_destroy(par);
 error_clocks:

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:32:47 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368678; cv=none; b=TP1g+ETFu1rk6OiaMRJX83vOgE7d4EG+2UCHJolL4Zv519xVJPhAVF1YHUWOmXZH2mfDpeb5BkBwP+DZJwhcVcBErccLCFzqiMOjQ3BkosHmkiUqMk3I08PCxlDdF93Z5N1YrcpA3aRiE2pvJ9Ur/Or37ere7InrWot9uYx0eRM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368678; c=relaxed/simple;
	bh=2bTBrIJJ46mdcT2DGtbFI6VGcKZZyFMkC26EU8pZckI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=TIF0432nVrHxYrf2xJaSEhtw7p1mvMLk3Wnvm7hFZb/TBNPXs7XSek8ihv0OXPg3oWJeA6BKwRvetnnEvFfUcsn40GGcofrZSvGJTEePYVqKLNoLu2aIjH8gHOO0nVfAUim99KZ3JNsCKRWAkxH1WTn/OTeFhviiTwapssJbfiY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=17Y6RYod; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Sean Christopherson <[email-masked]>
Subject: [PATCH 6.12 243/262] KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isnt valid
Date: Mon, 13 Oct 2025 16:46:25 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sean Christopherson <[email-masked]>

commit 0910dd7c9ad45a2605c45fd2bf3d1bcac087687c upstream.

Skip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP
isn't valid, e.g. because KVM is running with nrips=false.  SVM must
decode and emulate to skip the instruction if the CPU doesn't provide the
next RIP, and getting the instruction bytes to decode requires reading
guest memory.  Reading guest memory through the emulator can fault, i.e.
can sleep, which is disallowed since the fastpath handlers run with IRQs
disabled.

 BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106
 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu
 preempt_count: 1, expected: 0
 INFO: lockdep is turned off.
 irq event stamp: 30580
 hardirqs last  enabled at (30579): [<ffffffffc08b2527>] vcpu_run+0x1787/0x1db0 [kvm]
 hardirqs last disabled at (30580): [<ffffffffb4f62e32>] __schedule+0x1e2/0xed0
 softirqs last  enabled at (30570): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210
 softirqs last disabled at (30568): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210
 CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G     U              6.16.0-smp--e6c618b51cfe-sleep #782 NONE
 Tainted: [U]=USER
 Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025
 Call Trace:
  <TASK>
  dump_stack_lvl+0x7d/0xb0
  __might_resched+0x271/0x290
  __might_fault+0x28/0x80
  kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm]
  kvm_fetch_guest_virt+0x92/0xc0 [kvm]
  __do_insn_fetch_bytes+0xf3/0x1e0 [kvm]
  x86_decode_insn+0xd1/0x1010 [kvm]
  x86_emulate_instruction+0x105/0x810 [kvm]
  __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd]
  handle_fastpath_invd+0xc4/0x1a0 [kvm]
  vcpu_run+0x11a1/0x1db0 [kvm]
  kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm]
  kvm_vcpu_ioctl+0x578/0x6a0 [kvm]
  __se_sys_ioctl+0x6d/0xb0
  do_syscall_64+0x8a/0x2c0
  entry_SYSCALL_64_after_hwframe+0x4b/0x53
 RIP: 0033:0x7f479d57a94b
  </TASK>

Note, this is essentially a reapply of commit 5c30e8101e8d ("KVM: SVM:
Skip WRMSR fastpath on VM-Exit if next RIP isn't valid"), but with
different justification (KVM now grabs SRCU when skipping the instruction
for other reasons).

Fixes: b439eb8ab578 ("Revert "KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid"")
Cc: [email-masked]
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sean Christopherson <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 arch/x86/kvm/svm/svm.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -4237,13 +4237,21 @@ static int svm_vcpu_pre_run(struct kvm_v
 static fastpath_t svm_exit_handlers_fastpath(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_svm *svm = to_svm(vcpu);
+	struct vmcb_control_area *control = &svm->vmcb->control;
+
+	/*
+	 * Next RIP must be provided as IRQs are disabled, and accessing guest
+	 * memory to decode the instruction might fault, i.e. might sleep.
+	 */
+	if (!nrips || !control->next_rip)
+		return EXIT_FASTPATH_NONE;
 
 	if (is_guest_mode(vcpu))
 		return EXIT_FASTPATH_NONE;
 
-	switch (svm->vmcb->control.exit_code) {
+	switch (control->exit_code) {
 	case SVM_EXIT_MSR:
-		if (!svm->vmcb->control.exit_info_1)
+		if (!control->exit_info_1)
 			break;
 		return handle_fastpath_set_msr_irqoff(vcpu);
 	case SVM_EXIT_HLT:

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:32:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368675; cv=none; b=dywgekSFgSUehjJJsk2gdbOm9nQT6dnbiepN9bwsvkXQO8H1nGTbRow+aowWgS/NxqjlSW68Kgpo80vxpzM2MrVSq9H1VVrHsVBHTnpzjSpjDPMXCftr/3JT9wR/YtR8TWze4UHLec8CMb3DeiumgehWxp0+OsibY3KD8oVaLTU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368675; c=relaxed/simple;
	bh=70CN2zRpWN3c0RxvflXcjVfZLBcR0buAC15C7gTSJqo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=hvM6B5rSy4j6PGIWVuBCh6OPrkXYGkuYiFEsx7lKH0QNNgLC2ZDWsWg/q+BsHzROx+bMicOYkV1TnDwDSXRuNQjh+aP1q3mZ/8nFgbipn7wbtWR+PwVuUJIYYk3v16EsKH6lvdow8o0oQwHUVKoQUKbESvktKpdcFpty1DfWR3Q=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IfEnn1Z6; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Jan Kara <[email-masked]>,
	Zhang Yi <[email-masked]>,
	Theodore Tso <[email-masked]>
Subject: [PATCH 6.12 242/262] ext4: fix checks for orphan inodes
Date: Mon, 13 Oct 2025 16:46:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jan Kara <[email-masked]>

commit acf943e9768ec9d9be80982ca0ebc4bfd6b7631e upstream.

When orphan file feature is enabled, inode can be tracked as orphan
either in the standard orphan list or in the orphan file. The first can
be tested by checking ei->i_orphan list head, the second is recorded by
EXT4_STATE_ORPHAN_FILE inode state flag. There are several places where
we want to check whether inode is tracked as orphan and only some of
them properly check for both possibilities. Luckily the consequences are
mostly minor, the worst that can happen is that we track an inode as
orphan although we don't need to and e2fsck then complains (resulting in
occasional ext4/307 xfstest failures). Fix the problem by introducing a
helper for checking whether an inode is tracked as orphan and use it in
appropriate places.

Fixes: 4a79a98c7b19 ("ext4: Improve scalability of ext4 orphan file handling")
Cc: [email-masked]
Signed-off-by: Jan Kara <[email-masked]>
Reviewed-by: Zhang Yi <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Theodore Ts'o <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 fs/ext4/ext4.h   |   10 ++++++++++
 fs/ext4/file.c   |    2 +-
 fs/ext4/inode.c  |    2 +-
 fs/ext4/orphan.c |    6 +-----
 fs/ext4/super.c  |    4 ++--
 5 files changed, 15 insertions(+), 9 deletions(-)

--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1970,6 +1970,16 @@ static inline bool ext4_verity_in_progre
 #define NEXT_ORPHAN(inode) EXT4_I(inode)->i_dtime
 
 /*
+ * Check whether the inode is tracked as orphan (either in orphan file or
+ * orphan list).
+ */
+static inline bool ext4_inode_orphan_tracked(struct inode *inode)
+{
+	return ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) ||
+		!list_empty(&EXT4_I(inode)->i_orphan);
+}
+
+/*
  * Codes for operating systems
  */
 #define EXT4_OS_LINUX		0
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -354,7 +354,7 @@ static void ext4_inode_extension_cleanup
 	 * to cleanup the orphan list in ext4_handle_inode_extension(). Do it
 	 * now.
 	 */
-	if (!list_empty(&EXT4_I(inode)->i_orphan) && inode->i_nlink) {
+	if (ext4_inode_orphan_tracked(inode) && inode->i_nlink) {
 		handle_t *handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
 
 		if (IS_ERR(handle)) {
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4330,7 +4330,7 @@ static int ext4_fill_raw_inode(struct in
 		 * old inodes get re-used with the upper 16 bits of the
 		 * uid/gid intact.
 		 */
-		if (ei->i_dtime && list_empty(&ei->i_orphan)) {
+		if (ei->i_dtime && !ext4_inode_orphan_tracked(inode)) {
 			raw_inode->i_uid_high = 0;
 			raw_inode->i_gid_high = 0;
 		} else {
--- a/fs/ext4/orphan.c
+++ b/fs/ext4/orphan.c
@@ -109,11 +109,7 @@ int ext4_orphan_add(handle_t *handle, st
 
 	WARN_ON_ONCE(!(inode->i_state & (I_NEW | I_FREEING)) &&
 		     !inode_is_locked(inode));
-	/*
-	 * Inode orphaned in orphan file or in orphan list?
-	 */
-	if (ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) ||
-	    !list_empty(&EXT4_I(inode)->i_orphan))
+	if (ext4_inode_orphan_tracked(inode))
 		return 0;
 
 	/*
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1461,9 +1461,9 @@ static void ext4_free_in_core_inode(stru
 
 static void ext4_destroy_inode(struct inode *inode)
 {
-	if (!list_empty(&(EXT4_I(inode)->i_orphan))) {
+	if (ext4_inode_orphan_tracked(inode)) {
 		ext4_msg(inode->i_sb, KERN_ERR,
-			 "Inode %lu (%p): orphan list check failed!",
+			 "Inode %lu (%p): inode tracked as orphan!",
 			 inode->i_ino, EXT4_I(inode));
 		print_hex_dump(KERN_INFO, "", DUMP_PREFIX_ADDRESS, 16, 4,
 				EXT4_I(inode), sizeof(struct ext4_inode_info),

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:30:13 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368672; cv=none; b=h5LI+63BHZ19VLJASgHbh/HkkPMXQ6LDQSFGmwYP1W2kye9gEps5ilf2srmJnzziXeHukMuxAQuuO2HvRdW4DJ2nN17cgiAGJU+ST8acclp/DKQ+ZRsdt9omj5TAL44YEiERxCFJkeeneht3CtcMauuTXkSRqIP1sbR2kl0peDU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368672; c=relaxed/simple;
	bh=CaRjqS6/XZjyxgBn60rQY4UtjuJRZK2igvV3sQf1McE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=WyCymd5KlyM4CeQ8dCFSnQh38621FDLIiNSMeQOx4BSabCKPnUP29eE1t+2e8LVis2C1GBaM06w6mJpObaa1ERE89JvxRiiWEWYYRLYBURolA8zp3ySl0b1FbiZnYaHl7d4TAqQmkExX49/g5/SQVcaMcBVpfGTA1KyrK5LSmGo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ST4pghMS; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Namjae Jeon <[email-masked]>,
	Steve French <[email-masked]>
Subject: [PATCH 6.12 241/262] ksmbd: add max ip connections parameter
Date: Mon, 13 Oct 2025 16:46:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Namjae Jeon <[email-masked]>

commit d8b6dc9256762293048bf122fc11c4e612d0ef5d upstream.

This parameter set the maximum number of connections per ip address.
The default is 8.

Cc: [email-masked]
Fixes: c0d41112f1a5 ("ksmbd: extend the connection limiting mechanism to support IPv6")
Signed-off-by: Namjae Jeon <[email-masked]>
Signed-off-by: Steve French <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 fs/smb/server/ksmbd_netlink.h |    5 +++--
 fs/smb/server/server.h        |    1 +
 fs/smb/server/transport_ipc.c |    3 +++
 fs/smb/server/transport_tcp.c |   27 ++++++++++++++++-----------
 4 files changed, 23 insertions(+), 13 deletions(-)

--- a/fs/smb/server/ksmbd_netlink.h
+++ b/fs/smb/server/ksmbd_netlink.h
@@ -112,10 +112,11 @@ struct ksmbd_startup_request {
 	__u32	smbd_max_io_size;	/* smbd read write size */
 	__u32	max_connections;	/* Number of maximum simultaneous connections */
 	__s8	bind_interfaces_only;
-	__s8	reserved[503];		/* Reserved room */
+	__u32	max_ip_connections;	/* Number of maximum connection per ip address */
+	__s8	reserved[499];		/* Reserved room */
 	__u32	ifc_list_sz;		/* interfaces list size */
 	__s8	____payload[];
-};
+} __packed;
 
 #define KSMBD_STARTUP_CONFIG_INTERFACES(s)	((s)->____payload)
 
--- a/fs/smb/server/server.h
+++ b/fs/smb/server/server.h
@@ -43,6 +43,7 @@ struct ksmbd_server_config {
 	unsigned int		auth_mechs;
 	unsigned int		max_connections;
 	unsigned int		max_inflight_req;
+	unsigned int		max_ip_connections;
 
 	char			*conf[SERVER_CONF_WORK_GROUP + 1];
 	struct task_struct	*dh_task;
--- a/fs/smb/server/transport_ipc.c
+++ b/fs/smb/server/transport_ipc.c
@@ -335,6 +335,9 @@ static int ipc_server_config_on_startup(
 	if (req->max_connections)
 		server_conf.max_connections = req->max_connections;
 
+	if (req->max_ip_connections)
+		server_conf.max_ip_connections = req->max_ip_connections;
+
 	ret = ksmbd_set_netbios_name(req->netbios_name);
 	ret |= ksmbd_set_server_string(req->server_string);
 	ret |= ksmbd_set_work_group(req->work_group);
--- a/fs/smb/server/transport_tcp.c
+++ b/fs/smb/server/transport_tcp.c
@@ -240,6 +240,7 @@ static int ksmbd_kthread_fn(void *p)
 	struct interface *iface = (struct interface *)p;
 	struct ksmbd_conn *conn;
 	int ret;
+	unsigned int max_ip_conns;
 
 	while (!kthread_should_stop()) {
 		mutex_lock(&iface->sock_release_lock);
@@ -257,34 +258,38 @@ static int ksmbd_kthread_fn(void *p)
 			continue;
 		}
 
+		if (!server_conf.max_ip_connections)
+			goto skip_max_ip_conns_limit;
+
 		/*
 		 * Limits repeated connections from clients with the same IP.
 		 */
+		max_ip_conns = 0;
 		down_read(&conn_list_lock);
-		list_for_each_entry(conn, &conn_list, conns_list)
+		list_for_each_entry(conn, &conn_list, conns_list) {
 #if IS_ENABLED(CONFIG_IPV6)
 			if (client_sk->sk->sk_family == AF_INET6) {
 				if (memcmp(&client_sk->sk->sk_v6_daddr,
-					   &conn->inet6_addr, 16) == 0) {
-					ret = -EAGAIN;
-					break;
-				}
+					   &conn->inet6_addr, 16) == 0)
+					max_ip_conns++;
 			} else if (inet_sk(client_sk->sk)->inet_daddr ==
-				 conn->inet_addr) {
-				ret = -EAGAIN;
-				break;
-			}
+				 conn->inet_addr)
+				max_ip_conns++;
 #else
 			if (inet_sk(client_sk->sk)->inet_daddr ==
-			    conn->inet_addr) {
+			    conn->inet_addr)
+				max_ip_conns++;
+#endif
+			if (server_conf.max_ip_connections <= max_ip_conns) {
 				ret = -EAGAIN;
 				break;
 			}
-#endif
+		}
 		up_read(&conn_list_lock);
 		if (ret == -EAGAIN)
 			continue;
 
+skip_max_ip_conns_limit:
 		if (server_conf.max_connections &&
 		    atomic_inc_return(&active_num_conn) >= server_conf.max_connections) {
 			pr_info_ratelimited("Limit the maximum number of connections(%u)\n",

From - Mon Oct 13 15:56:46 2025
Delivery-date: Mon, 13 Oct 2025 15:37:48 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368670; cv=none; b=ht3xwxEfhySIPTyU0gj/lcTYWoGf/JCZ6AT3sLFBIKq9JrnBLfRr9wPELNefMdE1SJw+9gJ6Iv5rTFeVN5QCcdZq/slpKs2+G164M0P8f187fQ3wlCkYTb0IooRLY6/AoHhaH144SClTPte5AuJbk1WQbWD3zF65rCDULl1ct1E=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368670; c=relaxed/simple;
	bh=xLi/MnsewopkYbgdb04AaLD89EieCnHYB2xrjY3w8Zg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=S4DoM5BMOvJjwHfhst8fUEYPFra0IY6OH+CKYt1Jn2NsB6qszFTvQpqDqst2YlPoytdSMEUn51QVY0wUTJIA+/YxzghKaLCFkqU0vcZ/pjG6pr5nHGMa/0UiR/lGN4aq7pMSJPBjO0oaAwtiUf7qmohegVi1j/HwqYuYZUxV2e8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=HKjT4ntW; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Matvey Kovalev <[email-masked]>,
	Namjae Jeon <[email-masked]>,
	Steve French <[email-masked]>
Subject: [PATCH 6.12 240/262] ksmbd: fix error code overwriting in smb2_get_info_filesystem()
Date: Mon, 13 Oct 2025 16:46:22 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Matvey Kovalev <[email-masked]>

commit 88daf2f448aad05a2e6df738d66fe8b0cf85cee0 upstream.

If client doesn't negotiate with SMB3.1.1 POSIX Extensions,
then proper error code won't be returned due to overwriting.

Return error immediately.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: e2f34481b24db ("cifsd: add server-side procedures for SMB3")
Cc: [email-masked]
Signed-off-by: Matvey Kovalev <[email-masked]>
Acked-by: Namjae Jeon <[email-masked]>
Signed-off-by: Steve French <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 fs/smb/server/smb2pdu.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -5600,7 +5600,8 @@ static int smb2_get_info_filesystem(stru
 
 		if (!work->tcon->posix_extensions) {
 			pr_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n");
-			rc = -EOPNOTSUPP;
+			path_put(&path);
+			return -EOPNOTSUPP;
 		} else {
 			info = (struct filesystem_posix_info *)(rsp->Buffer);
 			info->OptimalTransferSize = cpu_to_le32(stfs.f_bsize);

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 14:52:59 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366375; cv=none; b=hbRbuLqm4r8KSgA6hFR0Qt/5/svv4bctBTfQ8TliFEPTYYjkTH9Z0NWjEHnzu5AEmOVQRqpLigESGblTuRYwM7pmIqYg8WbcHA0JM2SSiYf/EbZUqxp5pdLo1DDb2LrLZdll4I586NsuyQqwC1xiReN3VrbaLiEUk4ujmHSZaQo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366375; c=relaxed/simple;
	bh=zeFDGLCA+TZtniD9v/vACQyM7ZcLBp8owxX3yibDynI=;
	h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References:
	 Content-Type:MIME-Version; b=gNlj9zZgQn8r72nQ2wmFtNpucPSjwYUsTZUIG4EIeCsrH8BshGzhfNGYr2tUU5/Nf7xy5hJNBpykwxI5ZLC9ejc/0Ks9H63I6/JeSMDLiybjo3rP7Laj9U0tOVYQKH5TKn4QhaoMlDdYRH/Mi8w2PAGm9ssO5oseXRF8U4ZHvUM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=mailbox.org; spf=pass smtp.mailfrom=mailbox.org; dkim=pass (2048-bit key) header.d=mailbox.org header.i=@mailbox.org header.b=SrRq5RWk; arc=none smtp.client-ip=80.241.56.161
Subject: Re: [PATCH] drm/sched: Fix potential double free in
 drm_sched_job_add_resv_dependencies
From: Philipp Stanner <[email-masked]>
Reply-To: [email-masked]
To: Tvrtko Ursulin <[email-masked]>, 
	[email-masked]
Cc: [email-masked], Dan Carpenter <[email-masked]>, 
 Christian =?ISO-8859-1?Q?K=F6nig?= <[email-masked]>, Rob Clark
 <[email-masked]>, Daniel Vetter <[email-masked]>, Matthew
 Brost <[email-masked]>, Danilo Krummrich <[email-masked]>,
 Philipp Stanner <[email-masked]>, Christian =?ISO-8859-1?Q?K=F6nig?=
 <[email-masked]>, [email-masked]
Date: Mon, 13 Oct 2025 16:39:25 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: mailbox.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
SpamTally: Final spam score: 4

On Fri, 2025-10-03 at 10:26 +0100, Tvrtko Ursulin wrote:
> Drm_sched_job_add_dependency() consumes the fence reference both on

s/D/d

> success and failure, so in the latter case the dma_fence_put() on the
> error path (xarray failed to expand) is a double free.
>=20
> Interestingly this bug appears to have been present ever since
> ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code back
> then looked like this:
>=20
> drm_sched_job_add_implicit_dependencies():
> ...
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 for (i =3D 0; i < fence_count; i++) =
{
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 ret =3D drm_sched_job_add_dependency(job, fences[i]);
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 if (ret)
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 break;
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 }
>=20
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 for (; i < fence_count; i++)
> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 dma_fence_put(fences[i]);
>=20
> Which means for the failing 'i' the dma_fence_put was already a double
> free. Possibly there were no users at that time, or the test cases were
> insufficient to hit it.
>=20
> The bug was then only noticed and fixed after
> 9c2ba265352a ("drm/scheduler: use new iterator in drm_sched_job_add_impli=
cit_dependencies v2")
> landed, with its fixup of
> 4eaf02d6076c ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies=
").
>=20
> At that point it was a slightly different flavour of a double free, which
> 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies=
 harder")
> noticed and attempted to fix.
>=20
> But it only moved the double free from happening inside the
> drm_sched_job_add_dependency(), when releasing the reference not yet
> obtained, to the caller, when releasing the reference already released by
> the former in the failure case.

That's certainly interesting, but is there a specific reason why you
include all of that?

The code is as is, and AFAICS it's just a bug stemming from original
bugs present and then refactorings happening.

I would at least remove the old 'implicit_dependencies' function from
the commit message. It's just confusing and makes one look for that in
the current code or patch.

>=20
> As such it is not easy to identify the right target for the fixes tag so
> lets keep it simple and just continue the chain.
>=20
> We also drop the misleading comment about additional reference, since it
> is not additional but the only one from the point of view of dependency
> tracking.

IMO that comment is nonsense. It's useless, too, because I can *see*
that a reference is being taken there, but not *why*.

Argh, these comments. See also my commit 72ebc18b34993

Anyways. Removing it is fine, but adding a better comment is better.
See below.

>=20
> Signed-off-by: Tvrtko Ursulin <[email-masked]>
> Fixes: 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_depen=
dencies harder")
> Reported-by: Dan Carpenter <[email-masked]>

Is there an error report that could be included here with a Closes:
tag?

> Cc: Christian K=C3=B6nig <[email-masked]>
> Cc: Rob Clark <[email-masked]>
> Cc: Daniel Vetter <[email-masked]>
> Cc: Matthew Brost <[email-masked]>
> Cc: Danilo Krummrich <[email-masked]>
> Cc: Philipp Stanner <[email-masked]>
> Cc: "Christian K=C3=B6nig" <[email-masked]>
> Cc: [email-masked]
> Cc: <[email-masked]> # v5.16+
> ---
> =C2=A0drivers/gpu/drm/scheduler/sched_main.c | 14 +++++---------
> =C2=A01 file changed, 5 insertions(+), 9 deletions(-)
>=20
> diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/sch=
eduler/sched_main.c
> index 46119aacb809..aff34240f230 100644
> --- a/drivers/gpu/drm/scheduler/sched_main.c
> +++ b/drivers/gpu/drm/scheduler/sched_main.c
> @@ -960,20 +960,16 @@ int drm_sched_job_add_resv_dependencies(struct drm_=
sched_job *job,
> =C2=A0{
> =C2=A0	struct dma_resv_iter cursor;
> =C2=A0	struct dma_fence *fence;
> -	int ret;
> +	int ret =3D 0;
> =C2=A0
> =C2=A0	dma_resv_assert_held(resv);
> =C2=A0
> =C2=A0	dma_resv_for_each_fence(&cursor, resv, usage, fence) {
> -		/* Make sure to grab an additional ref on the added fence */
> -		dma_fence_get(fence);
> -		ret =3D drm_sched_job_add_dependency(job, fence);
> -		if (ret) {
> -			dma_fence_put(fence);
> -			return ret;
> -		}
> +		ret =3D drm_sched_job_add_dependency(job, dma_fence_get(fence));

You still take a reference as before, but there is no comment anymore.
Can you add one explaining why a new reference is taken here?

I guess it will be something like "This needs a new reference for the
job", since you cannot rely on the one from resv.

> +		if (ret)
> +			break;
> =C2=A0	}
> -	return 0;
> +	return ret;

That's an unnecessarily enlargement of the git diff because of style,
isn't it? Better keep the diff minimal here for git blame.

P.

> =C2=A0}
> =C2=A0EXPORT_SYMBOL(drm_sched_job_add_resv_dependencies);
> =C2=A0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 12:21:34 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760358090; cv=none; b=GdQpPOQrj/TS2sAiOjQRKNbkPWBz8oLUUpeDXiRMo6ePn+mcl1a8Lv9Kz1+Ndh9wTajDZz0gIVMzn9hXNzbxkEw67Z1x4bzgKTCVQbPPEPWh9+oycLJ9NlR1knzgIBjvwxft/n2smnnLGPOlR7zv4OfOp04onElqo1r5XLcw2m4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760358090; c=relaxed/simple;
	bh=zIQotQXJ4iPtkTZRN2oDsVw+JvRj5ypvEyNyoQC1oFs=;
	h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From:
	 In-Reply-To:Content-Type; b=rvHj/SHZql67imsZoiSa1gR556lDRVYpyiHSmDknqtqcwVOrs3gvsfXfv5/XLwwkL+pyi0FHFX/AFvn9+jH8QCXveMVm4Y4IHxXLkxLdoBMLOXZMLYYlphAOcXBwOz0i1IC0T+9BDTRqEgUVIrUpsR5V8X+Nw4Znk9ZbYKh/J+Q=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ursulin.net; spf=none smtp.mailfrom=ursulin.net; dkim=pass (2048-bit key) header.d=ursulin-net.20230601.gappssmtp.com header.i=@ursulin-net.20230601.gappssmtp.com header.b=k0ul/v93; arc=none smtp.client-ip=209.85.128.48
Date: Mon, 13 Oct 2025 13:21:25 +0100
Subject: Re: [PATCH] drm/sched: Fix potential double free in
 drm_sched_job_add_resv_dependencies
To: Tvrtko Ursulin <[email-masked]>,
 [email-masked]
Cc: [email-masked], Dan Carpenter <[email-masked]>,
 =?UTF-8?Q?Christian_K=C3=B6nig?= <[email-masked]>,
 Rob Clark <[email-masked]>, Daniel Vetter <[email-masked]>,
 Matthew Brost <[email-masked]>, Danilo Krummrich <[email-masked]>,
 Philipp Stanner <[email-masked]>,
 =?UTF-8?Q?Christian_K=C3=B6nig?= <[email-masked]>,
 [email-masked]
From: Tvrtko Ursulin <[email-masked]>
DKIMCheck: Server passes DKIM test, 0 Spam score
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
SpamTally: Final spam score: 5

A gentle ping - any takers to double check my analysis and review the below?

Regards,

Tvrtko

On 03/10/2025 10:26, Tvrtko Ursulin wrote:
> Drm_sched_job_add_dependency() consumes the fence reference both on
> success and failure, so in the latter case the dma_fence_put() on the
> error path (xarray failed to expand) is a double free.
> 
> Interestingly this bug appears to have been present ever since
> ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code back
> then looked like this:
> 
> drm_sched_job_add_implicit_dependencies():
> ...
>         for (i = 0; i < fence_count; i++) {
>                 ret = drm_sched_job_add_dependency(job, fences[i]);
>                 if (ret)
>                         break;
>         }
> 
>         for (; i < fence_count; i++)
>                 dma_fence_put(fences[i]);
> 
> Which means for the failing 'i' the dma_fence_put was already a double
> free. Possibly there were no users at that time, or the test cases were
> insufficient to hit it.
> 
> The bug was then only noticed and fixed after
> 9c2ba265352a ("drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2")
> landed, with its fixup of
> 4eaf02d6076c ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies").
> 
> At that point it was a slightly different flavour of a double free, which
> 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder")
> noticed and attempted to fix.
> 
> But it only moved the double free from happening inside the
> drm_sched_job_add_dependency(), when releasing the reference not yet
> obtained, to the caller, when releasing the reference already released by
> the former in the failure case.
> 
> As such it is not easy to identify the right target for the fixes tag so
> lets keep it simple and just continue the chain.
> 
> We also drop the misleading comment about additional reference, since it
> is not additional but the only one from the point of view of dependency
> tracking.
> 
> Signed-off-by: Tvrtko Ursulin <[email-masked]>
> Fixes: 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder")
> Reported-by: Dan Carpenter <[email-masked]>
> Cc: Christian König <[email-masked]>
> Cc: Rob Clark <[email-masked]>
> Cc: Daniel Vetter <[email-masked]>
> Cc: Matthew Brost <[email-masked]>
> Cc: Danilo Krummrich <[email-masked]>
> Cc: Philipp Stanner <[email-masked]>
> Cc: "Christian König" <[email-masked]>
> Cc: [email-masked]
> Cc: <[email-masked]> # v5.16+
> ---
>   drivers/gpu/drm/scheduler/sched_main.c | 14 +++++---------
>   1 file changed, 5 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
> index 46119aacb809..aff34240f230 100644
> --- a/drivers/gpu/drm/scheduler/sched_main.c
> +++ b/drivers/gpu/drm/scheduler/sched_main.c
> @@ -960,20 +960,16 @@ int drm_sched_job_add_resv_dependencies(struct drm_sched_job *job,
>   {
>   	struct dma_resv_iter cursor;
>   	struct dma_fence *fence;
> -	int ret;
> +	int ret = 0;
>   
>   	dma_resv_assert_held(resv);
>   
>   	dma_resv_for_each_fence(&cursor, resv, usage, fence) {
> -		/* Make sure to grab an additional ref on the added fence */
> -		dma_fence_get(fence);
> -		ret = drm_sched_job_add_dependency(job, fence);
> -		if (ret) {
> -			dma_fence_put(fence);
> -			return ret;
> -		}
> +		ret = drm_sched_job_add_dependency(job, dma_fence_get(fence));
> +		if (ret)
> +			break;
>   	}
> -	return 0;
> +	return ret;
>   }
>   EXPORT_SYMBOL(drm_sched_job_add_resv_dependencies);
>   

From - Mon Oct 13 15:56:51 2025
Delivery-date: Fri, 03 Oct 2025 09:27:19 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1759483633; cv=none; b=DbLQIvZC68YdUM94kctJ1B3y3y54Y9buTlKQWSGrWHvK31CEIC0EGN/bzwacgTjfg//pxBNQstLTTCQxjVOT1ilKVUxkwdAPzpFtZNYZcRVKeq1kmZPy7CcSwUw3Y2g/b20tVRQ1M+H85+4Fi0iFrIiheYn59uPDh1gFxN7cVaQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1759483633; c=relaxed/simple;
	bh=FduCMGB8ugAL+afmkEoxLRdDMDJ7SAHjAAtwCadxfBw=;
	h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=aLILyZvCSRceRNb/wnz6MQ3xShjLpo3K6dfeqcbvcR/v3l5CLFLNZlUVhFEFE16XdxO7eYm/V/VxOQs65A4bVOXy6WVYjcRi05evDk/W2NFTHeR5kpis9w8XKOb33gERM2way6fYBhV5MOF6nb/vV5sFx8tZhPzsubZfZ4HguvI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=igalia.com; spf=pass smtp.mailfrom=igalia.com; dkim=pass (2048-bit key) header.d=igalia.com header.i=@igalia.com header.b=nHfOpo/E; arc=none smtp.client-ip=213.97.179.56
From: Tvrtko Ursulin <[email-masked]>
To: [email-masked]
Cc: [email-masked],
	Tvrtko Ursulin <[email-masked]>,
	Dan Carpenter <[email-masked]>,
	=?UTF-8?q?Christian=20K=C3=B6nig?= <[email-masked]>,
	Rob Clark <[email-masked]>,
	Daniel Vetter <[email-masked]>,
	Matthew Brost <[email-masked]>,
	Danilo Krummrich <[email-masked]>,
	Philipp Stanner <[email-masked]>,
	=?UTF-8?q?Christian=20K=C3=B6nig?= <[email-masked]>,
	[email-masked]
Subject: [PATCH] drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
Date: Fri,  3 Oct 2025 10:26:41 +0100
DKIMCheck: Server failed DKIM test, 50 Spam score
                             query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                             [142.0.200.124 listed in bl.score.senderscore.com]
  0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE:
                             The query to Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                          [142.0.200.124 listed in sa-trusted.bondedsender.org]
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: igalia.com]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
  0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
SpamTally: Final spam score: 57

Drm_sched_job_add_dependency() consumes the fence reference both on
success and failure, so in the latter case the dma_fence_put() on the
error path (xarray failed to expand) is a double free.

Interestingly this bug appears to have been present ever since
ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code back
then looked like this:

drm_sched_job_add_implicit_dependencies():
...
       for (i = 0; i < fence_count; i++) {
               ret = drm_sched_job_add_dependency(job, fences[i]);
               if (ret)
                       break;
       }

       for (; i < fence_count; i++)
               dma_fence_put(fences[i]);

Which means for the failing 'i' the dma_fence_put was already a double
free. Possibly there were no users at that time, or the test cases were
insufficient to hit it.

The bug was then only noticed and fixed after
9c2ba265352a ("drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2")
landed, with its fixup of
4eaf02d6076c ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies").

At that point it was a slightly different flavour of a double free, which
963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder")
noticed and attempted to fix.

But it only moved the double free from happening inside the
drm_sched_job_add_dependency(), when releasing the reference not yet
obtained, to the caller, when releasing the reference already released by
the former in the failure case.

As such it is not easy to identify the right target for the fixes tag so
lets keep it simple and just continue the chain.

We also drop the misleading comment about additional reference, since it
is not additional but the only one from the point of view of dependency
tracking.

Signed-off-by: Tvrtko Ursulin <[email-masked]>
Fixes: 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder")
Reported-by: Dan Carpenter <[email-masked]>
Cc: Christian König <[email-masked]>
Cc: Rob Clark <[email-masked]>
Cc: Daniel Vetter <[email-masked]>
Cc: Matthew Brost <[email-masked]>
Cc: Danilo Krummrich <[email-masked]>
Cc: Philipp Stanner <[email-masked]>
Cc: "Christian König" <[email-masked]>
Cc: [email-masked]
Cc: <[email-masked]> # v5.16+
---
 drivers/gpu/drm/scheduler/sched_main.c | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
index 46119aacb809..aff34240f230 100644
--- a/drivers/gpu/drm/scheduler/sched_main.c
+++ b/drivers/gpu/drm/scheduler/sched_main.c
@@ -960,20 +960,16 @@ int drm_sched_job_add_resv_dependencies(struct drm_sched_job *job,
 {
 	struct dma_resv_iter cursor;
 	struct dma_fence *fence;
-	int ret;
+	int ret = 0;
 
 	dma_resv_assert_held(resv);
 
 	dma_resv_for_each_fence(&cursor, resv, usage, fence) {
-		/* Make sure to grab an additional ref on the added fence */
-		dma_fence_get(fence);
-		ret = drm_sched_job_add_dependency(job, fence);
-		if (ret) {
-			dma_fence_put(fence);
-			return ret;
-		}
+		ret = drm_sched_job_add_dependency(job, dma_fence_get(fence));
+		if (ret)
+			break;
 	}
-	return 0;
+	return ret;
 }
 EXPORT_SYMBOL(drm_sched_job_add_resv_dependencies);
 
-- 
2.48.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:30:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368664; cv=none; b=L5qAtOdPaPz45EZBU9DpQXofLzCYH4BbG11XGxCE7cfBOuf2v1kjrbdifgpMg9QwCjVVrkJfiGPgmpFGYrlUJZXCI6ube7R8gnhzVkGRI2vN1bXlzWjaxPAiLlUNn5kEPDrAi8lgW9eCDQfNiG5TUhsTc/D2TB1Jr5nZ4mq89C0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368664; c=relaxed/simple;
	bh=0YZYuMZRTqljUxQV1k7DjQ8FTs/muD1Q2hdZX7GxBIc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ONKL+dIIqmoInbzXmwXRXNY8S4oRPbZ4Y9FgBHlVH+aWhJkyYp92BbF9Ttg3RCfKunqSfvhHxjqfRg/uQ3RnnScqD8s9wrC0nrlUPGEeEiJDUrQKJCigoKS2EUHhCju9EiI9u6Bxu0qZNyoZYs51ufylFAGONFqxA8f3rn/3V3s=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=J2gipGxC; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yunseong Kim <[email-masked]>,
	Namjae Jeon <[email-masked]>,
	Steve French <[email-masked]>
Subject: [PATCH 6.12 239/262] ksmbd: Fix race condition in RPC handle list access
Date: Mon, 13 Oct 2025 16:46:21 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yunseong Kim <[email-masked]>

commit 305853cce379407090a73b38c5de5ba748893aee upstream.

The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd
session. Access to this list is intended to be protected by
'sess->rpc_lock' (an rw_semaphore). However, the locking implementation was
flawed, leading to potential race conditions.

In ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock
before calling xa_store() and xa_erase(). Since these operations modify
the XArray structure, a write lock is required to ensure exclusive access
and prevent data corruption from concurrent modifications.

Furthermore, ksmbd_session_rpc_method() accessed the list using xa_load()
without holding any lock at all. This could lead to reading inconsistent
data or a potential use-after-free if an entry is concurrently removed and
the pointer is dereferenced.

Fix these issues by:
1. Using down_write() and up_write() in ksmbd_session_rpc_open()
   to ensure exclusive access during XArray modification, and ensuring
   the lock is correctly released on error paths.
2. Adding down_read() and up_read() in ksmbd_session_rpc_method()
   to safely protect the lookup.

Fixes: a1f46c99d9ea ("ksmbd: fix use-after-free in ksmbd_session_rpc_open")
Fixes: b685757c7b08 ("ksmbd: Implements sess->rpc_handle_list as xarray")
Cc: [email-masked]
Signed-off-by: Yunseong Kim <[email-masked]>
Acked-by: Namjae Jeon <[email-masked]>
Signed-off-by: Steve French <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 fs/smb/server/mgmt/user_session.c |   26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -104,29 +104,32 @@ int ksmbd_session_rpc_open(struct ksmbd_
 	if (!entry)
 		return -ENOMEM;
 
-	down_read(&sess->rpc_lock);
 	entry->method = method;
 	entry->id = id = ksmbd_ipc_id_alloc();
 	if (id < 0)
 		goto free_entry;
+
+	down_write(&sess->rpc_lock);
 	old = xa_store(&sess->rpc_handle_list, id, entry, KSMBD_DEFAULT_GFP);
-	if (xa_is_err(old))
+	if (xa_is_err(old)) {
+		up_write(&sess->rpc_lock);
 		goto free_id;
+	}
 
 	resp = ksmbd_rpc_open(sess, id);
-	if (!resp)
-		goto erase_xa;
+	if (!resp) {
+		xa_erase(&sess->rpc_handle_list, entry->id);
+		up_write(&sess->rpc_lock);
+		goto free_id;
+	}
 
-	up_read(&sess->rpc_lock);
+	up_write(&sess->rpc_lock);
 	kvfree(resp);
 	return id;
-erase_xa:
-	xa_erase(&sess->rpc_handle_list, entry->id);
 free_id:
 	ksmbd_rpc_id_free(entry->id);
 free_entry:
 	kfree(entry);
-	up_read(&sess->rpc_lock);
 	return -EINVAL;
 }
 
@@ -144,9 +147,14 @@ void ksmbd_session_rpc_close(struct ksmb
 int ksmbd_session_rpc_method(struct ksmbd_session *sess, int id)
 {
 	struct ksmbd_session_rpc *entry;
+	int method;
 
+	down_read(&sess->rpc_lock);
 	entry = xa_load(&sess->rpc_handle_list, id);
-	return entry ? entry->method : 0;
+	method = entry ? entry->method : 0;
+	up_read(&sess->rpc_lock);
+
+	return method;
 }
 
 void ksmbd_session_destroy(struct ksmbd_session *sess)

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:53:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368661; cv=none; b=lDHB8fYMecO3jpovdpzQF0im2s8YVKC42R9BQstkjbY/IHaUlWyEW8+C5a4ERg4DGlGrxpHV2vIo8Y53XqVknT5T0nC4oDemaim6C64FuSiWQmPS9MtT+xAUpXM9x4puFvrBPi8+MlVce+IOs9PpQoSbwGQfjzdgrfOC+cJ5SNA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368661; c=relaxed/simple;
	bh=0Z8UL2GhDJSI19a3Y1AzZSMsUVmigrZxRxSJB6psBNQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Tit7RBbgsbeMjMtEpIVLmirUowMlTIvEXaEToIKu6xZJr6Bdq3Md9QQhm9lD3U2qK9IpNyMmu07c9xI4nTbxoPQFLyAUCzfANwOMYzj86EL/aS/XxrlGB6nPeA37SD+Vra2ONxV3NfRrp8aai3+IOPEddLgobqO6dyfVMiRmG+g=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uQUVynzF; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Youling Tang <[email-masked]>,
	Huacai Chen <[email-masked]>
Subject: [PATCH 6.12 238/262] LoongArch: Automatically disable kaslr if boot from kexec_file
Date: Mon, 13 Oct 2025 16:46:20 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Youling Tang <[email-masked]>

commit c8168b4faf1d62cbb320a3e518ad31cdd567cb05 upstream.

Automatically disable kaslr when the kernel loads from kexec_file.

kexec_file loads the secondary kernel image to a non-linked address,
inherently providing KASLR-like randomization.

However, on LoongArch where System RAM may be non-contiguous, enabling
KASLR for the second kernel may relocate it to an invalid memory region
and cause a boot failure. Thus, we disable KASLR when "kexec_file" is
detected in the command line.

To ensure compatibility with older kernels loaded via kexec_file, this
patch should be backported to stable branches.

Cc: [email-masked]
Signed-off-by: Youling Tang <[email-masked]>
Signed-off-by: Huacai Chen <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 arch/loongarch/kernel/relocate.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/arch/loongarch/kernel/relocate.c
+++ b/arch/loongarch/kernel/relocate.c
@@ -166,6 +166,10 @@ static inline __init bool kaslr_disabled
 		return true;
 #endif
 
+	str = strstr(boot_command_line, "kexec_file");
+	if (str == boot_command_line || (str > boot_command_line && *(str - 1) == ' '))
+		return true;
+
 	return false;
 }

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:48:49 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368658; cv=none; b=a9CZslxysO9SxbZ7ofE5a0r0w5CeHFYFa5vsMhltu7QWOnBY2k2NvuEp0ywBpl2wxvfJt00Q8HyMpiBlMSUybKjFXzitKM02Ylz1eHFK2IaxHN9bT+y14sXouLgH8CP5samlneRIUoKfyFP8LCY8YHfMfk9o3zIXM+fHhpNtqzk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368658; c=relaxed/simple;
	bh=0MdTiZ/rJ6QN1hS1u1TI7ZaoJ0t/E6PpsWPlWnu5hEg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ooaTYEn2QZxN4N95u3Sl6C3DPVSlRPOrc5hPLeOPsOLmdmv9yOgWnURxU9DzNO/ALUQZRnejt3IvQigX3Lh/RQh9RczF2TIqkUusBixYWRSyMYw69+npCbfjvlmTMbIvFEgo8wIEZAwWaUrlob6eZ6qcLzkea6PLPWrkFksauLk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=U14p3vPq; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zheng Qixing <[email-masked]>,
	Mikulas Patocka <[email-masked]>
Subject: [PATCH 6.12 237/262] dm: fix NULL pointer dereference in __dm_suspend()
Date: Mon, 13 Oct 2025 16:46:19 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zheng Qixing <[email-masked]>

commit 8d33a030c566e1f105cd5bf27f37940b6367f3be upstream.

There is a race condition between dm device suspend and table load that
can lead to null pointer dereference. The issue occurs when suspend is
invoked before table load completes:

BUG: kernel NULL pointer dereference, address: 0000000000000054
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
RIP: 0010:blk_mq_wait_quiesce_done+0x0/0x50
Call Trace:
  <TASK>
  blk_mq_quiesce_queue+0x2c/0x50
  dm_stop_queue+0xd/0x20
  __dm_suspend+0x130/0x330
  dm_suspend+0x11a/0x180
  dev_suspend+0x27e/0x560
  ctl_ioctl+0x4cf/0x850
  dm_ctl_ioctl+0xd/0x20
  vfs_ioctl+0x1d/0x50
  __se_sys_ioctl+0x9b/0xc0
  __x64_sys_ioctl+0x19/0x30
  x64_sys_call+0x2c4a/0x4620
  do_syscall_64+0x9e/0x1b0

The issue can be triggered as below:

T1 						T2
dm_suspend					table_load
__dm_suspend					dm_setup_md_queue
						dm_mq_init_request_queue
						blk_mq_init_allocated_queue
						=> q->mq_ops = set->ops; (1)
dm_stop_queue / dm_wait_for_completion
=> q->tag_set NULL pointer!	(2)
						=> q->tag_set = set; (3)

Fix this by checking if a valid table (map) exists before performing
request-based suspend and waiting for target I/O. When map is NULL,
skip these table-dependent suspend steps.

Even when map is NULL, no I/O can reach any target because there is
no table loaded; I/O submitted in this state will fail early in the
DM layer. Skipping the table-dependent suspend logic in this case
is safe and avoids NULL pointer dereferences.

Fixes: c4576aed8d85 ("dm: fix request-based dm's use of dm_wait_for_completion")
Cc: [email-masked]
Signed-off-by: Zheng Qixing <[email-masked]>
Signed-off-by: Mikulas Patocka <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/md/dm.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2918,7 +2918,7 @@ static int __dm_suspend(struct mapped_de
 {
 	bool do_lockfs = suspend_flags & DM_SUSPEND_LOCKFS_FLAG;
 	bool noflush = suspend_flags & DM_SUSPEND_NOFLUSH_FLAG;
-	int r;
+	int r = 0;
 
 	lockdep_assert_held(&md->suspend_lock);
 
@@ -2970,7 +2970,7 @@ static int __dm_suspend(struct mapped_de
 	 * Stop md->queue before flushing md->wq in case request-based
 	 * dm defers requests to md->wq from md->queue.
 	 */
-	if (dm_request_based(md)) {
+	if (map && dm_request_based(md)) {
 		dm_stop_queue(md->queue);
 		set_bit(DMF_QUEUE_STOPPED, &md->flags);
 	}
@@ -2982,7 +2982,8 @@ static int __dm_suspend(struct mapped_de
 	 * We call dm_wait_for_completion to wait for all existing requests
 	 * to finish.
 	 */
-	r = dm_wait_for_completion(md, task_state);
+	if (map)
+		r = dm_wait_for_completion(md, task_state);
 	if (!r)
 		set_bit(dmf_suspended_flag, &md->flags);

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:32:13 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368655; cv=none; b=gxPjN63tL4hw4DXS5V/9oBmAVbTZ/P1W0gEJ8CmbXdHt3J1deMEiw2AVm61pE3rmSjuYiKjqK3OX/5vKo9ObhDhcswqHqIQIhqeyjEP1NWzX6qzT4UyBgbikBcE1Lq9MmFFyzSzZbxIUlcDbZUvOcZcPeloV6co/La31V0FBQPI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368655; c=relaxed/simple;
	bh=iltlVvoBnA/qqkT+Im2rNcnQHxqwphyuc6yZX5ErzPg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ZBeBBjIq4w5hSlLXrUyak4zus9kq0gq/0Oe7PoSQnA5sWJSEkYZzEptBnp1tLON3XrPzRsVaXkhTvzYCi2q8/4KgaaiDoDvAeHtjf4b2gYhqxq7UrjQvBdXN0YVCi861Zows9yxIAb3gnWkr2eKZ8gOydMWTcXzEAm8KUKigHc8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=S/ZPvQ5s; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zheng Qixing <[email-masked]>,
	Mikulas Patocka <[email-masked]>
Subject: [PATCH 6.12 236/262] dm: fix queue start/stop imbalance under suspend/load/resume races
Date: Mon, 13 Oct 2025 16:46:18 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zheng Qixing <[email-masked]>

commit 7f597c2cdb9d3263a6fce07c4fc0a9eaa8e8fc43 upstream.

When suspend and load run concurrently, before q->mq_ops is set in
blk_mq_init_allocated_queue(), __dm_suspend() skip dm_stop_queue(). As a
result, the queue's quiesce depth is not incremented.

Later, once table load has finished and __dm_resume() runs, which triggers
q->quiesce_depth ==0 warning in blk_mq_unquiesce_queue():
Call Trace:
 <TASK>
 dm_start_queue+0x16/0x20 [dm_mod]
 __dm_resume+0xac/0xb0 [dm_mod]
 dm_resume+0x12d/0x150 [dm_mod]
 do_resume+0x2c2/0x420 [dm_mod]
 dev_suspend+0x30/0x130 [dm_mod]
 ctl_ioctl+0x402/0x570 [dm_mod]
 dm_ctl_ioctl+0x23/0x30 [dm_mod]

Fix this by explicitly tracking whether the request queue was
stopped in __dm_suspend() via a new DMF_QUEUE_STOPPED flag.
Only call dm_start_queue() in __dm_resume() if the queue was
actually stopped.

Fixes: e70feb8b3e68 ("blk-mq: support concurrent queue quiesce/unquiesce")
Cc: [email-masked]
Signed-off-by: Zheng Qixing <[email-masked]>
Signed-off-by: Mikulas Patocka <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/md/dm-core.h |    1 +
 drivers/md/dm.c      |    8 +++++---
 2 files changed, 6 insertions(+), 3 deletions(-)

--- a/drivers/md/dm-core.h
+++ b/drivers/md/dm-core.h
@@ -162,6 +162,7 @@ struct mapped_device {
 #define DMF_SUSPENDED_INTERNALLY 7
 #define DMF_POST_SUSPENDING 8
 #define DMF_EMULATE_ZONE_APPEND 9
+#define DMF_QUEUE_STOPPED 10
 
 void disable_discard(struct mapped_device *md);
 void disable_write_zeroes(struct mapped_device *md);
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2970,8 +2970,10 @@ static int __dm_suspend(struct mapped_de
 	 * Stop md->queue before flushing md->wq in case request-based
 	 * dm defers requests to md->wq from md->queue.
 	 */
-	if (dm_request_based(md))
+	if (dm_request_based(md)) {
 		dm_stop_queue(md->queue);
+		set_bit(DMF_QUEUE_STOPPED, &md->flags);
+	}
 
 	flush_workqueue(md->wq);
 
@@ -2993,7 +2995,7 @@ static int __dm_suspend(struct mapped_de
 	if (r < 0) {
 		dm_queue_flush(md);
 
-		if (dm_request_based(md))
+		if (test_and_clear_bit(DMF_QUEUE_STOPPED, &md->flags))
 			dm_start_queue(md->queue);
 
 		unlock_fs(md);
@@ -3077,7 +3079,7 @@ static int __dm_resume(struct mapped_dev
 	 * so that mapping of targets can work correctly.
 	 * Request-based dm is queueing the deferred I/Os in its request_queue.
 	 */
-	if (dm_request_based(md))
+	if (test_and_clear_bit(DMF_QUEUE_STOPPED, &md->flags))
 		dm_start_queue(md->queue);
 
 	unlock_fs(md);

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:38:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368652; cv=none; b=J49eqOuuLMc4qC6mF30jprQyY09AHYG3BIvwuIYia1cSULiLumKCvSCPWEM+MbpjS/MaoP9MHmQrCoFnMWtS+ssGtM1VB3v9Kjfu8ZseDqN29m0A6aQ+uFzvglBzhfQuTt49jPdkaCGGMajGssuqQgPYGse45axKeuEhOOCzzoE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368652; c=relaxed/simple;
	bh=Oe/4ipeL1qKLTfyRUdy7OeJ2pN2E5BYpoB88YH+SY5M=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=MEMUpNQLz0xFVYpfibpjN0DQZkVK/yDefJf4VBG3QqKg7f08IInUCFlrx6Yq6KCDB0sGxgHPQwrASnAEk5Jf4dZ3Gy0vjVDCZA6NUqxqQoFquCmiTGC0X4sveYk6V5CaBkQVG8PL3Kw5kvJrNa/yBpsi+aZ8OjtQ00M6voq+cgc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rU34jCZZ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Bartosz Golaszewski <[email-masked]>,
	Linus Walleij <[email-masked]>,
	Lee Jones <[email-masked]>
Subject: [PATCH 6.12 235/262] mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
Date: Mon, 13 Oct 2025 16:46:17 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bartosz Golaszewski <[email-masked]>

commit 1efbee6852f1ff698a9981bd731308dd027189fb upstream.

Commit 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
removed the return value check from the call to gpiochip_add_data() (or
rather gpiochip_add() back then and later converted to devres) with no
explanation. This function however can still fail, so check the return
value and bail-out if it does.

Cc: [email-masked]
Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
Signed-off-by: Bartosz Golaszewski <[email-masked]>
Reviewed-by: Linus Walleij <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Lee Jones <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/mfd/vexpress-sysreg.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/mfd/vexpress-sysreg.c
+++ b/drivers/mfd/vexpress-sysreg.c
@@ -90,6 +90,7 @@ static int vexpress_sysreg_probe(struct
 	struct resource *mem;
 	void __iomem *base;
 	struct gpio_chip *mmc_gpio_chip;
+	int ret;
 
 	mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (!mem)
@@ -110,7 +111,10 @@ static int vexpress_sysreg_probe(struct
 	bgpio_init(mmc_gpio_chip, &pdev->dev, 0x4, base + SYS_MCI,
 			NULL, NULL, NULL, NULL, 0);
 	mmc_gpio_chip->ngpio = 2;
-	devm_gpiochip_add_data(&pdev->dev, mmc_gpio_chip, NULL);
+
+	ret = devm_gpiochip_add_data(&pdev->dev, mmc_gpio_chip, NULL);
+	if (ret)
+		return ret;
 
 	return devm_mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO,
 			vexpress_sysreg_cells,

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:29:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368649; cv=none; b=OkjgQW3WD/HmIh2j6i1k8zpeyEu0MUiWY2fdkGeQ4cpJKJQidnJylLAK9bAsO7Z1nvVQygH2UICwSTkSkT/oKrXRnI/KDSH1TrPa2/daVsKiXLQqkahBRjyWcz9+nBS1HlwfaMJ6sCMVDRasrs5NuXzuEXz8EZWCyltgeNGjaqk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368649; c=relaxed/simple;
	bh=uayys/hC22+hC/BpNmpX4tBcoXIexyHhyarWVeoZx8U=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=kmB6ut2vkCJMOHSdHID9DVmbZnOlxzWOVdHg6dXvMx0Fi9pn4FqsgvYd1IaDjxB6YaJNYKPtlAnsL13TbnDhHjb/6U6GBM+XjpQuraeHHgCjDBO5/YtZ0dV3uYhUDJ2ZOn+Ru4XgEbelB61U495toz/9+n3W5TqVs+TL/VxDTNg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IU4dy9g2; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Cosmin Tanislav <[email-masked]>,
	Biju Das <[email-masked]>,
	Lee Jones <[email-masked]>
Subject: [PATCH 6.12 234/262] mfd: rz-mtu3: Fix MTU5 NFCR register offset
Date: Mon, 13 Oct 2025 16:46:16 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Cosmin Tanislav <[email-masked]>

commit da32b0e82c523b76265ba1ad25d7ea74f0ece402 upstream.

The NFCR register for MTU5 is at 0x1a95 offset according to Datasheet
Page 725, Table 16.4. The address of all registers is offset by 0x1200,
making the proper address of MTU5 NFCR register be 0x895.

Cc: [email-masked]
Fixes: 654c293e1687 ("mfd: Add Renesas RZ/G2L MTU3a core driver")
Signed-off-by: Cosmin Tanislav <[email-masked]>
Reviewed-by: Biju Das <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Lee Jones <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/mfd/rz-mtu3.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/mfd/rz-mtu3.c
+++ b/drivers/mfd/rz-mtu3.c
@@ -32,7 +32,7 @@ static const unsigned long rz_mtu3_8bit_
 	[RZ_MTU3_CHAN_2] = MTU_8BIT_CH_1_2(0x204, 0x092, 0x205, 0x200, 0x20c, 0x201, 0x202),
 	[RZ_MTU3_CHAN_3] = MTU_8BIT_CH_3_4_6_7(0x008, 0x093, 0x02c, 0x000, 0x04c, 0x002, 0x004, 0x005, 0x038),
 	[RZ_MTU3_CHAN_4] = MTU_8BIT_CH_3_4_6_7(0x009, 0x094, 0x02d, 0x001, 0x04d, 0x003, 0x006, 0x007, 0x039),
-	[RZ_MTU3_CHAN_5] = MTU_8BIT_CH_5(0xab2, 0x1eb, 0xab4, 0xab6, 0xa84, 0xa85, 0xa86, 0xa94, 0xa95, 0xa96, 0xaa4, 0xaa5, 0xaa6),
+	[RZ_MTU3_CHAN_5] = MTU_8BIT_CH_5(0xab2, 0x895, 0xab4, 0xab6, 0xa84, 0xa85, 0xa86, 0xa94, 0xa95, 0xa96, 0xaa4, 0xaa5, 0xaa6),
 	[RZ_MTU3_CHAN_6] = MTU_8BIT_CH_3_4_6_7(0x808, 0x893, 0x82c, 0x800, 0x84c, 0x802, 0x804, 0x805, 0x838),
 	[RZ_MTU3_CHAN_7] = MTU_8BIT_CH_3_4_6_7(0x809, 0x894, 0x82d, 0x801, 0x84d, 0x803, 0x806, 0x807, 0x839),
 	[RZ_MTU3_CHAN_8] = MTU_8BIT_CH_8(0x404, 0x098, 0x400, 0x406, 0x401, 0x402, 0x403)

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:32:06 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368640; cv=none; b=PecZk4vnd1BFWtNdT910EHTuZQr/OxXoEtzPiq2IW7OabI7YK742WpicZu3Xa6DkCuNlKK6lIvbv0Wpwyji2jSHe5EIja1QPYPPi25S7m/4DX7x8nCKR+ewMmH1mBCRnvIzkjwZzt4VBeYRmJHnOQEbYTMlaJqNiCnfKsbtSPAQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368640; c=relaxed/simple;
	bh=CLrgn/UB2VfqB9xMRz3ZT1Yov0Ad5srV/pixfath5rk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=UfiGXgYzE+NsWDERK3Otz/vYkU/4yiXnYvj9sGMCY9odAEa/DIlczirMIv7lZuHfytLtIinq/DNi0xpCQ/NArKlJ2CJv7d82+DKTQELxUTXixKtGieAPjveJvn6WQuNsyaNSJ+993utEV4cepymSxAhLyQ9shRfUqggKF1GSCFk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Qw0a3gS9; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Srinivas Kandagatla <[email-masked]>,
	Mark Brown <[email-masked]>
Subject: [PATCH 6.12 231/262] ASoC: codecs: wcd937x: make stub functions inline
Date: Mon, 13 Oct 2025 16:46:13 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Srinivas Kandagatla <[email-masked]>

commit c4bb62eb594418a6bd05ff03bb9072ee1fef29c2 upstream.

For some reason we ended up with stub functions that are not inline,
this can result in build error if its included multiple places, as we will
be redefining the same function

Fixes: c99a515ff153 ("ASoC: codecs: wcd937x-sdw: add SoundWire driver")
Cc: [email-masked]
Signed-off-by: Srinivas Kandagatla <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 sound/soc/codecs/wcd937x.h |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/sound/soc/codecs/wcd937x.h
+++ b/sound/soc/codecs/wcd937x.h
@@ -548,21 +548,21 @@ int wcd937x_sdw_hw_params(struct wcd937x
 struct device *wcd937x_sdw_device_get(struct device_node *np);
 
 #else
-int wcd937x_sdw_free(struct wcd937x_sdw_priv *wcd,
+static inline int wcd937x_sdw_free(struct wcd937x_sdw_priv *wcd,
 		     struct snd_pcm_substream *substream,
 		     struct snd_soc_dai *dai)
 {
 	return -EOPNOTSUPP;
 }
 
-int wcd937x_sdw_set_sdw_stream(struct wcd937x_sdw_priv *wcd,
+static inline int wcd937x_sdw_set_sdw_stream(struct wcd937x_sdw_priv *wcd,
 			       struct snd_soc_dai *dai,
 			       void *stream, int direction)
 {
 	return -EOPNOTSUPP;
 }
 
-int wcd937x_sdw_hw_params(struct wcd937x_sdw_priv *wcd,
+static inline int wcd937x_sdw_hw_params(struct wcd937x_sdw_priv *wcd,
 			  struct snd_pcm_substream *substream,
 			  struct snd_pcm_hw_params *params,
 			  struct snd_soc_dai *dai)

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:29:30 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368638; cv=none; b=NVXUMJVcudqvq/lYdFh9PDvTTMNgiFp7WsbfMiEg2twjrhPegC4DouZ4igAoa4K2L19iueAzq/IG0fLuKIk0RAgheRKJBVKijc+/z8dbyLzI3PnuPk3cr1i366Y+PHJ4Ncd0lHTuiztk3NSXS0+uB7H2tlIBudwhQFXD0YHKBO8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368638; c=relaxed/simple;
	bh=cJ2uQvmTgbrVNw0Ov1wP5XUqfz4CuScEhFRuU+py4/U=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=t32Tu6D+196BjRyNxJCwsZsycYnY7W6bRotsql0/TsBpOntifWsidnKLVvG4noE3VrSppPtsloiX8FkIG9pXRR1oRFZNm/bedG1NIOXpkeBLUkmymO4UuR08/o170cMTTXvY2UM9c1lSHQpJyAT+72cf4qBHWjfjwrOCzIOXLjk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=LomPWMe2; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Srinivas Kandagatla <[email-masked]>,
	Alexey Klimov <[email-masked]>,
	Mark Brown <[email-masked]>
Subject: [PATCH 6.12 230/262] ASoC: codecs: wcd937x: set the comp soundwire port correctly
Date: Mon, 13 Oct 2025 16:46:12 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Srinivas Kandagatla <[email-masked]>

commit 66a940b1bf48a7095162688332d725ba160154eb upstream.

For some reason we endup with setting soundwire port for
HPHL_COMP and HPHR_COMP as zero, this can potentially result
in a memory corruption due to accessing and setting -1 th element of
port_map array.

Fixes: 82be8c62a38c ("ASoC: codecs: wcd937x: add basic controls")
Cc: [email-masked]
Signed-off-by: Srinivas Kandagatla <[email-masked]>
Reviewed-by: Alexey Klimov <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 sound/soc/codecs/wcd937x.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/soc/codecs/wcd937x.c
+++ b/sound/soc/codecs/wcd937x.c
@@ -2039,9 +2039,9 @@ static const struct snd_kcontrol_new wcd
 	SOC_ENUM_EXT("RX HPH Mode", rx_hph_mode_mux_enum,
 		     wcd937x_rx_hph_mode_get, wcd937x_rx_hph_mode_put),
 
-	SOC_SINGLE_EXT("HPHL_COMP Switch", SND_SOC_NOPM, 0, 1, 0,
+	SOC_SINGLE_EXT("HPHL_COMP Switch", WCD937X_COMP_L, 0, 1, 0,
 		       wcd937x_get_compander, wcd937x_set_compander),
-	SOC_SINGLE_EXT("HPHR_COMP Switch", SND_SOC_NOPM, 1, 1, 0,
+	SOC_SINGLE_EXT("HPHR_COMP Switch", WCD937X_COMP_R, 1, 1, 0,
 		       wcd937x_get_compander, wcd937x_set_compander),
 
 	SOC_SINGLE_TLV("HPHL Volume", WCD937X_HPH_L_EN, 0, 20, 1, line_gain),

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:43:10 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368632; cv=none; b=HPQ22lNT8yh/ixpcddBixnW3/M42+RN14TCi4hm6LT2q3lri6zYU1gwJv7TmgIiLrT5H1RM1UDUaNeWbp/SDYO0jpEnDUHh5mWL1FT7hiPNbB8DrgPxRg/QF+EcyqYgXDhCufx6hVy+CFYAgVA7HCfkbJqk0JsNt4htXobLWJxY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368632; c=relaxed/simple;
	bh=i+fqnV+t/vhL0JjPY2CB1jRLrXGOUkpOq91vqy2/xHI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=epLvAnSSoP/koxJLjatYMqCw35MbeGxA3bav35kmzXnVRPQlmQx+32EA/6VOWdDeF5dToYtiTGbLEWioDAxrGl6OLpRLiI2rHBKUAkwO/D27hcjfVMmE1hkAL4eBA14d4Es4aPUbB31SZtrgGASKpUW8L3Avxlz2mOpBXe7ie5M=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JG3r97A7; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ranjani Sridharan <[email-masked]>,
	=?UTF-8?q?P=C3=A9ter=20Ujfalusi?= <[email-masked]>,
	Kai Vehmanen <[email-masked]>,
	Mark Brown <[email-masked]>
Subject: [PATCH 6.12 229/262] ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down
Date: Mon, 13 Oct 2025 16:46:11 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ranjani Sridharan <[email-masked]>

commit 59abe7bc7e7c70e9066b3e46874d1b7e6a13de14 upstream.

In the case of static pipelines, freeing the widgets in the pipelines
that were not suspended after freeing the scheduler widgets results in
errors because the secondary cores are powered off when the scheduler
widgets are freed. Fix this by tearing down the leftover pipelines before
powering off the secondary cores.

Cc: [email-masked]
Fixes: d7332c4a4f1a ("ASoC: SOF: ipc3-topology: Fix pipeline tear down logic")
Signed-off-by: Ranjani Sridharan <[email-masked]>
Reviewed-by: Péter Ujfalusi <[email-masked]>
Reviewed-by: Kai Vehmanen <[email-masked]>
Signed-off-by: Peter Ujfalusi <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 sound/soc/sof/ipc3-topology.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/sound/soc/sof/ipc3-topology.c
+++ b/sound/soc/sof/ipc3-topology.c
@@ -2485,11 +2485,6 @@ static int sof_ipc3_tear_down_all_pipeli
 	if (ret < 0)
 		return ret;
 
-	/* free all the scheduler widgets now */
-	ret = sof_ipc3_free_widgets_in_list(sdev, true, &dyn_widgets, verify);
-	if (ret < 0)
-		return ret;
-
 	/*
 	 * Tear down all pipelines associated with PCMs that did not get suspended
 	 * and unset the prepare flag so that they can be set up again during resume.
@@ -2505,6 +2500,11 @@ static int sof_ipc3_tear_down_all_pipeli
 		}
 	}
 
+	/* free all the scheduler widgets now. This will also power down the secondary cores */
+	ret = sof_ipc3_free_widgets_in_list(sdev, true, &dyn_widgets, verify);
+	if (ret < 0)
+		return ret;
+
 	list_for_each_entry(sroute, &sdev->route_list, list)
 		sroute->setup = false;

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:37:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368629; cv=none; b=jFPpvgUXgPV//0x4oscdqDLQzkq67Obf9N+oPMoEKjOMKm8ykAS67OhZeNPrQ/+RjUTXr4cb2a3IVnWnlERrWrGwlrytaU/mWViYd5kLu9S9WDHRfrk1z2xJSFgaX7SdrIkQVQh7mDAJbzlONprGle8xw6tGqmsSLpzASaimoVo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368629; c=relaxed/simple;
	bh=7ul8iymBdpSJtfHZb2Z9KBfBvjIsrSDGEJHKt0nnfeQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=X/SUT2lkfiOKu6BUSrc/MWj87jDZnMIrn/MujnChTu5YEZYDwwIprTMp8dJ+KNu4b0Q3/Ofnm7s8Tuyf2rQefIDU5FEGQbC/Qz4A3LMNxmp2JKwNx2Loqz3fPsmARbnvMiUcWIwZnkQtuSqipRJ8MPsVj6FA4CFPi4OLhZspdsc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OJvjgGJp; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ma Ke <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Mark Brown <[email-masked]>
Subject: [PATCH 6.12 228/262] ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
Date: Mon, 13 Oct 2025 16:46:10 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ma Ke <[email-masked]>

commit 4e65bda8273c938039403144730923e77916a3d7 upstream.

wcd934x_codec_parse_data() contains a device reference count leak in
of_slim_get_device() where device_find_child() increases the reference
count of the device but this reference is not properly decreased in
the success path. Add put_device() in wcd934x_codec_parse_data() and
add devm_add_action_or_reset() in the probe function, which ensures
that the reference count of the device is correctly managed.

Memory leak in regmap_init_slimbus() as the allocated regmap is not
released when the device is removed. Using devm_regmap_init_slimbus()
instead of regmap_init_slimbus() to ensure automatic regmap cleanup on
device removal.

Calling path: of_slim_get_device() -> of_find_slim_device() ->
device_find_child(). As comment of device_find_child() says, 'NOTE:
you will need to drop the reference with put_device() after use.'.

Found by code review.

Cc: [email-masked]
Fixes: a61f3b4f476e ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec")
Signed-off-by: Ma Ke <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 sound/soc/codecs/wcd934x.c |   17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

--- a/sound/soc/codecs/wcd934x.c
+++ b/sound/soc/codecs/wcd934x.c
@@ -5845,6 +5845,13 @@ static const struct snd_soc_component_dr
 	.endianness = 1,
 };
 
+static void wcd934x_put_device_action(void *data)
+{
+	struct device *dev = data;
+
+	put_device(dev);
+}
+
 static int wcd934x_codec_parse_data(struct wcd934x_codec *wcd)
 {
 	struct device *dev = &wcd->sdev->dev;
@@ -5861,11 +5868,13 @@ static int wcd934x_codec_parse_data(stru
 		return dev_err_probe(dev, -EINVAL, "Unable to get SLIM Interface device\n");
 
 	slim_get_logical_addr(wcd->sidev);
-	wcd->if_regmap = regmap_init_slimbus(wcd->sidev,
+	wcd->if_regmap = devm_regmap_init_slimbus(wcd->sidev,
 				  &wcd934x_ifc_regmap_config);
-	if (IS_ERR(wcd->if_regmap))
+	if (IS_ERR(wcd->if_regmap)) {
+		put_device(&wcd->sidev->dev);
 		return dev_err_probe(dev, PTR_ERR(wcd->if_regmap),
 				     "Failed to allocate ifc register map\n");
+	}
 
 	of_property_read_u32(dev->parent->of_node, "qcom,dmic-sample-rate",
 			     &wcd->dmic_sample_rate);
@@ -5907,6 +5916,10 @@ static int wcd934x_codec_probe(struct pl
 	if (ret)
 		return ret;
 
+	ret = devm_add_action_or_reset(dev, wcd934x_put_device_action, &wcd->sidev->dev);
+	if (ret)
+		return ret;
+
 	/* set default rate 9P6MHz */
 	regmap_update_bits(wcd->regmap, WCD934X_CODEC_RPM_CLK_MCLK_CFG,
 			   WCD934X_CODEC_RPM_CLK_MCLK_CFG_MCLK_MASK,

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:58 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368627; cv=none; b=hgeXjbZP5JbDcjkrhUDohNiXlw6OOlAMCQ9pWcBG3k8ciBFkxLdqJdMr9sR8tOvuXw96zAs3l5owvrw46sXcSGYB/C6DAn38nw3c1WZ0Qfm0hP2Trn3HsDJ/Y7qN3LDsBdnazApZ/bgSCODbcdraA5vqEjL3yI5Few/77D8hRpE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368627; c=relaxed/simple;
	bh=6znLhvq8TCo6NQ7VrSGWVTKkX4dMPFFlDvz9AlAzqNw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=MTEriLMabGxPX0NHCTh6ZBF8YN0rhIcBcTPBw/w3Cyp2jwEQHd+B0++cCuiqZgHYqV552f5haVlN8T+lGLB90yanTOwPcLFKrdVux9uXZVexC6fBE2q30utTMUgxlmx+aD3FD7MIEL9y1H0wzB+z83zgFVSysysQaw4QnmVW7R8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uivy4isq; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Jens Axboe <[email-masked]>
Subject: [PATCH 6.12 227/262] io_uring/waitid: always prune wait queue entry in io_waitid_wait()
Date: Mon, 13 Oct 2025 16:46:09 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jens Axboe <[email-masked]>

commit 2f8229d53d984c6a05b71ac9e9583d4354e3b91f upstream.

For a successful return, always remove our entry from the wait queue
entry list. Previously this was skipped if a cancelation was in
progress, but this can race with another invocation of the wait queue
entry callback.

Cc: [email-masked]
Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support")
Reported-by: [email-masked]
Tested-by: [email-masked]
Link: https://lore.kernel.org/io-uring/[email-masked]/
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 io_uring/waitid.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/io_uring/waitid.c
+++ b/io_uring/waitid.c
@@ -272,13 +272,14 @@ static int io_waitid_wait(struct wait_qu
 	if (!pid_child_should_wake(wo, p))
 		return 0;
 
+	list_del_init(&wait->entry);
+
 	/* cancel is in progress */
 	if (atomic_fetch_inc(&iw->refs) & IO_WAITID_REF_MASK)
 		return 1;
 
 	req->io_task_work.func = io_waitid_cb;
 	io_req_task_work_add(req);
-	list_del_init(&wait->entry);
 	return 1;
 }

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:58 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368624; cv=none; b=ubUy9Y5rqgz5yRHGJx0lq6R0+x+jF/VsbicCNa4cT/q2nRZQazmqQMB5JmFmZpop6/MMkHngtdwr1+k97hZ2/vqXeex/zkJl2OlXZDPDfGwTTZXon4bWd83m6rDal7o5/ZOCitObVyCWbD1FMtEelVJN97q9HF+3qlOUQ5M/Gew=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368624; c=relaxed/simple;
	bh=Ss+M/2ILMZXyG0xx/sDJzX7DgSHQy6O5klgSDmZAFtc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=SLvcfgEtNJ267v0ZGTrlJpje3WnzjPS78kxFmFTKmG/8BGqNE1jK2SHxPQlDpe7dezQoLubZyMFOEBBwJfXCOEDRa3UL7gls1tjb9ZTDMp8w6TzuIqrYH4BFTTrkrHRtYFAlQcfBEcIxe8lDUwCFh/tZzUbtxgSVrwUg8hnxbiE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=w/XtU20Z; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	John Starks <[email-masked]>,
	Naman Jain <[email-masked]>,
	Michael Kelley <[email-masked]>,
	Long Li <[email-masked]>,
	Tianyu Lan <[email-masked]>
Subject: [PATCH 6.12 226/262] uio_hv_generic: Let userspace take care of interrupt mask
Date: Mon, 13 Oct 2025 16:46:08 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Naman Jain <[email-masked]>

commit b15b7d2a1b09ef5428a8db260251897405a19496 upstream.

Remove the logic to set interrupt mask by default in uio_hv_generic
driver as the interrupt mask value is supposed to be controlled
completely by the user space. If the mask bit gets changed
by the driver, concurrently with user mode operating on the ring,
the mask bit may be set when it is supposed to be clear, and the
user-mode driver will miss an interrupt which will cause a hang.

For eg- when the driver sets inbound ring buffer interrupt mask to 1,
the host does not interrupt the guest on the UIO VMBus channel.
However, setting the mask does not prevent the host from putting a
message in the inbound ring buffer. So let’s assume that happens,
the host puts a message into the ring buffer but does not interrupt.

Subsequently, the user space code in the guest sets the inbound ring
buffer interrupt mask to 0, saying “Hey, I’m ready for interrupts”.
User space code then calls pread() to wait for an interrupt.
Then one of two things happens:

* The host never sends another message. So the pread() waits forever.
* The host does send another message. But because there’s already a
  message in the ring buffer, it doesn’t generate an interrupt.
  This is the correct behavior, because the host should only send an
  interrupt when the inbound ring buffer transitions from empty to
  not-empty. Adding an additional message to a ring buffer that is not
  empty is not supposed to generate an interrupt on the guest.
  Since the guest is waiting in pread() and not removing messages from
  the ring buffer, the pread() waits forever.

This could be easily reproduced in hv_fcopy_uio_daemon if we delay
setting interrupt mask to 0.

Similarly if hv_uio_channel_cb() sets the interrupt_mask to 1,
there’s a race condition. Once user space empties the inbound ring
buffer, but before user space sets interrupt_mask to 0, the host could
put another message in the ring buffer but it wouldn’t interrupt.
Then the next pread() would hang.

Fix these by removing all instances where interrupt_mask is changed,
while keeping the one in set_event() unchanged to enable userspace
control the interrupt mask by writing 0/1 to /dev/uioX.

Fixes: 95096f2fbd10 ("uio-hv-generic: new userspace i/o driver for VMBus")
Suggested-by: John Starks <[email-masked]>
Signed-off-by: Naman Jain <[email-masked]>
Cc: [email-masked]
Reviewed-by: Michael Kelley <[email-masked]>
Reviewed-by: Long Li <[email-masked]>
Reviewed-by: Tianyu Lan <[email-masked]>
Tested-by: Tianyu Lan <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/uio/uio_hv_generic.c |    7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

--- a/drivers/uio/uio_hv_generic.c
+++ b/drivers/uio/uio_hv_generic.c
@@ -98,7 +98,6 @@ static void hv_uio_channel_cb(void *cont
 	struct hv_device *hv_dev = chan->device_obj;
 	struct hv_uio_private_data *pdata = hv_get_drvdata(hv_dev);
 
-	chan->inbound.ring_buffer->interrupt_mask = 1;
 	virt_mb();
 
 	uio_event_notify(&pdata->info);
@@ -163,8 +162,6 @@ hv_uio_new_channel(struct vmbus_channel
 		return;
 	}
 
-	/* Disable interrupts on sub channel */
-	new_sc->inbound.ring_buffer->interrupt_mask = 1;
 	set_channel_read_mode(new_sc, HV_CALL_ISR);
 	ret = hv_create_ring_sysfs(new_sc, hv_uio_ring_mmap);
 	if (ret) {
@@ -207,9 +204,7 @@ hv_uio_open(struct uio_info *info, struc
 
 	ret = vmbus_connect_ring(dev->channel,
 				 hv_uio_channel_cb, dev->channel);
-	if (ret == 0)
-		dev->channel->inbound.ring_buffer->interrupt_mask = 1;
-	else
+	if (ret)
 		atomic_dec(&pdata->refcnt);
 
 	return ret;

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:56 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368621; cv=none; b=llhKKafMF9Gh0yU0u6DoGn4ZcVPuiN2dh2MeeLYitjrUGZvSJAwjq6u/aiVJJ9t917Wv+AfZ3uB3hnV7kuQRljOj6/jnTcnZ0U7Do7tq92wgWlmeXzTuGzZIfvVjGK39d6srcLSMotjzeUS/sFCtA0qltUjJSLY9GaR23n7SVfM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368621; c=relaxed/simple;
	bh=C6Jlmiv3pBPfFWw/xJDk3060RX4Rp2YuMT29jYhC40o=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=daIjdW4tN0vChzsXlLHFXE3+RJpVpW2DFFPR1W+tk7jkXf9F4BoI2OOxRgyghDbsAr2l6ga0V3rFMAcetIeQBzQd5WEAaxjn0KJOcqtEkLR81Kr+LYFb8+Aui9QQ2+Js0xoy+whQoiAkdb84aL2MG35/+bzTDpMiuhv2Xgx6yGo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=w54ugplE; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Phillip Lougher <[email-masked]>,
	[email-masked],
	Andrew Morton <[email-masked]>
Subject: [PATCH 6.12 225/262] Squashfs: fix uninit-value in squashfs_get_parent
Date: Mon, 13 Oct 2025 16:46:07 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Phillip Lougher <[email-masked]>

commit 74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf upstream.

Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug.

This is caused by open_by_handle_at() being called with a file handle
containing an invalid parent inode number.  In particular the inode number
is that of a symbolic link, rather than a directory.

Squashfs_get_parent() gets called with that symbolic link inode, and
accesses the parent member field.

	unsigned int parent_ino = squashfs_i(inode)->parent;

Because non-directory inodes in Squashfs do not have a parent value, this
is uninitialised, and this causes an uninitialised value access.

The fix is to initialise parent with the invalid inode 0, which will cause
an EINVAL error to be returned.

Regular inodes used to share the parent field with the block_list_start
field.  This is removed in this commit to enable the parent field to
contain the invalid inode number 0.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: 122601408d20 ("Squashfs: export operations")
Signed-off-by: Phillip Lougher <[email-masked]>
Reported-by: [email-masked]
Closes: https://lore.kernel.org/all/[email-masked]/
Cc: <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 fs/squashfs/inode.c         |    7 +++++++
 fs/squashfs/squashfs_fs_i.h |    2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

--- a/fs/squashfs/inode.c
+++ b/fs/squashfs/inode.c
@@ -165,6 +165,7 @@ int squashfs_read_inode(struct inode *in
 		squashfs_i(inode)->start = le32_to_cpu(sqsh_ino->start_block);
 		squashfs_i(inode)->block_list_start = block;
 		squashfs_i(inode)->offset = offset;
+		squashfs_i(inode)->parent = 0;
 		inode->i_data.a_ops = &squashfs_aops;
 
 		TRACE("File inode %x:%x, start_block %llx, block_list_start "
@@ -212,6 +213,7 @@ int squashfs_read_inode(struct inode *in
 		squashfs_i(inode)->start = le64_to_cpu(sqsh_ino->start_block);
 		squashfs_i(inode)->block_list_start = block;
 		squashfs_i(inode)->offset = offset;
+		squashfs_i(inode)->parent = 0;
 		inode->i_data.a_ops = &squashfs_aops;
 
 		TRACE("File inode %x:%x, start_block %llx, block_list_start "
@@ -292,6 +294,7 @@ int squashfs_read_inode(struct inode *in
 		inode->i_mode |= S_IFLNK;
 		squashfs_i(inode)->start = block;
 		squashfs_i(inode)->offset = offset;
+		squashfs_i(inode)->parent = 0;
 
 		if (type == SQUASHFS_LSYMLINK_TYPE) {
 			__le32 xattr;
@@ -329,6 +332,7 @@ int squashfs_read_inode(struct inode *in
 		set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
 		rdev = le32_to_cpu(sqsh_ino->rdev);
 		init_special_inode(inode, inode->i_mode, new_decode_dev(rdev));
+		squashfs_i(inode)->parent = 0;
 
 		TRACE("Device inode %x:%x, rdev %x\n",
 				SQUASHFS_INODE_BLK(ino), offset, rdev);
@@ -353,6 +357,7 @@ int squashfs_read_inode(struct inode *in
 		set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
 		rdev = le32_to_cpu(sqsh_ino->rdev);
 		init_special_inode(inode, inode->i_mode, new_decode_dev(rdev));
+		squashfs_i(inode)->parent = 0;
 
 		TRACE("Device inode %x:%x, rdev %x\n",
 				SQUASHFS_INODE_BLK(ino), offset, rdev);
@@ -373,6 +378,7 @@ int squashfs_read_inode(struct inode *in
 			inode->i_mode |= S_IFSOCK;
 		set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
 		init_special_inode(inode, inode->i_mode, 0);
+		squashfs_i(inode)->parent = 0;
 		break;
 	}
 	case SQUASHFS_LFIFO_TYPE:
@@ -392,6 +398,7 @@ int squashfs_read_inode(struct inode *in
 		inode->i_op = &squashfs_inode_ops;
 		set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
 		init_special_inode(inode, inode->i_mode, 0);
+		squashfs_i(inode)->parent = 0;
 		break;
 	}
 	default:
--- a/fs/squashfs/squashfs_fs_i.h
+++ b/fs/squashfs/squashfs_fs_i.h
@@ -16,6 +16,7 @@ struct squashfs_inode_info {
 	u64		xattr;
 	unsigned int	xattr_size;
 	int		xattr_count;
+	int		parent;
 	union {
 		struct {
 			u64		fragment_block;
@@ -27,7 +28,6 @@ struct squashfs_inode_info {
 			u64		dir_idx_start;
 			int		dir_idx_offset;
 			int		dir_idx_cnt;
-			int		parent;
 		};
 	};
 	struct inode	vfs_inode;

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:55 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368618; cv=none; b=sQEaTsazBN+00yi6KaJ6yrd1soOAwbv6q+yie9Z/qMiCWB/pW1qpbM64s7tweOnEE021gohOPXUlhNqYH5owpCEaSjkndb+96fvEe1LdmZ29RADZSt7k6051wybDrdAR6kdT4o+WLe+4rLNowb/2Q33V9AK8hJe+u/FELKDGxRs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368618; c=relaxed/simple;
	bh=Pi38RafzL2WE6Q5yWJEy4mqxcvbiMXRRTe7UtVsNVrM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=d+DCcfk7So5mf6IsVb1xa2Ao4KgiDOzc/AvV7Am60k2QKWsN/jHHlDCD8LLHdlDHRNsuDy1LOjyM1EiI1Dk06k9HbeyGulCB57nKy0sJiEbWaF+5UlfQc5TYwSVlWL+mpufXlJQjJuqUUpHy8doX+/UsCI5xoTtAm/M2TExlAFw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=d4d6kFUG; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chris Fenner <[email-masked]>,
	Jarkko Sakkinen <[email-masked]>,
	[email-masked]
Subject: [PATCH 6.12 224/262] tpm: Disable TPM2_TCG_HMAC by default
Date: Mon, 13 Oct 2025 16:46:06 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jarkko Sakkinen <[email-masked]>

commit 4bddf4587c131d7b8ce8952cd32b284dcda0dd1f upstream.

After reading all the feedback, right now disabling the TPM2_TCG_HMAC
is the right call.

Other views discussed:

A. Having a kernel command-line parameter or refining the feature
   otherwise. This goes to the area of improvements.  E.g., one
   example is my own idea where the null key specific code would be
   replaced with a persistent handle parameter (which can be
   *unambigously* defined as part of attestation process when
   done correctly).

B. Removing the code. I don't buy this because that is same as saying
   that HMAC encryption cannot work at all (if really nitpicking) in
   any form. Also I disagree on the view that the feature could not
   be refined to something more reasoable.

Also, both A and B are worst options in terms of backporting.

Thuss, this is the best possible choice.

Cc: [email-masked] # v6.10+
Fixes: d2add27cf2b8 ("tpm: Add NULL primary creation")
Suggested-by: Chris Fenner <[email-masked]>
Signed-off-by: Jarkko Sakkinen <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/char/tpm/Kconfig |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -29,7 +29,7 @@ if TCG_TPM
 
 config TCG_TPM2_HMAC
 	bool "Use HMAC and encrypted transactions on the TPM bus"
-	default X86_64
+	default n
 	select CRYPTO_ECDH
 	select CRYPTO_LIB_AESCFB
 	select CRYPTO_LIB_SHA256

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:48:41 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368612; cv=none; b=IqUNiTCgihEeHTzeKTrpfWioCWmIzORK8kdClN89WJMGOGVE3a6mlwhbK5gjUarkIUoLeD5+23rxcPnPOt0s5IAnollEuCtdy0iZ4lj4oF4KK4gI8VI9w6thYjB/qEqygoe/oFhyzTEfGyD11vugtdRLlZQ161rYffPNNggNH9I=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368612; c=relaxed/simple;
	bh=ihIb1d3M8qT/oCM3pQVvM40GTuMRfZj8WYdOzbAayDI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=WJY1WkXNhVDgZmKYz7/IfBiDS1ASRc08lJYaHsQNZYXk3lQ2z0iG7gFQsQCuw3l1vdliV9XxtKdZmhpPUCj3tP0p6JMHvKuFry+8cjtfyHApfagDiUXFkg5eezbwWaPdPV69esc42v2Ei9wRzUO8uoqoT1rS0DZzkD5Zq4njJ3c=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hUozcsr9; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	"Stefano Garzarella" <[email-masked]>,
	zhang jiao <[email-masked]>,
	"Michael S. Tsirkin" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 222/262] vhost: vringh: Modify the return value check
Date: Mon, 13 Oct 2025 16:46:04 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: zhang jiao <[email-masked]>

[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ]

The return value of copy_from_iter and copy_to_iter can't be negative,
check whether the copied lengths are equal.

Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
Cc: "Stefano Garzarella" <[email-masked]>
Signed-off-by: zhang jiao <[email-masked]>
Message-Id: <[email-masked]>
Signed-off-by: Michael S. Tsirkin <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/vhost/vringh.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 0db4f3babe961..781731eb95cfe 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -1191,6 +1191,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
 		struct iov_iter iter;
 		u64 translated;
 		int ret;
+		size_t size;
 
 		ret = iotlb_translate(vrh, (u64)(uintptr_t)src,
 				      len - total_translated, &translated,
@@ -1208,9 +1209,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
 				      translated);
 		}
 
-		ret = copy_from_iter(dst, translated, &iter);
-		if (ret < 0)
-			return ret;
+		size = copy_from_iter(dst, translated, &iter);
+		if (size != translated)
+			return -EFAULT;
 
 		src += translated;
 		dst += translated;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:32:14 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368698; cv=none; b=EXJ5UKSVqGclLZeXmUG79clirB6bGAI726kVFsOnVyVN/4ouGjOUO5kN5MXlZUFnBA+FYzRqnvwavoeEwhQPCpbMrov+e854ZGrS9hYb1c6IiNjbAZmVwWPsQyXnR5vWjfkHT2CGXTW5rsiIcqAndttKXJgzZ1wKHMSeBVIdjRQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368698; c=relaxed/simple;
	bh=D4HfO59nSRc2DDqFPC+cg07zikyuy+PfV3V7qpwa2VA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=tIPwel0SZRCjvL96OBT6DgnoOJsn378QOQGbJcY3fGVij23PNVUTXw8XZNlzClFukGwiR0D1sfWVHaVN0/xGhNsB7oLDcR3J+Fr5nRQLTducMTEi6Yml/sDaLNaJyPYJ7srBigc2bwd56vT/vsochEDaiipQmhV1ujr7RhP8nYw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0ql4IITw; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Shay Drory <[email-masked]>,
	Moshe Shemesh <[email-masked]>,
	Tariq Toukan <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 218/262] net/mlx5: pagealloc: Fix reclaim race during command interface teardown
Date: Mon, 13 Oct 2025 16:46:00 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Shay Drory <[email-masked]>

[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ]

The reclaim_pages_cmd() function sends a command to the firmware to
reclaim pages if the command interface is active.

A race condition can occur if the command interface goes down (e.g., due
to a PCI error) while the mlx5_cmd_do() call is in flight. In this
case, mlx5_cmd_do() will return an error. The original code would
propagate this error immediately, bypassing the software-based page
reclamation logic that is supposed to run when the command interface is
down.

Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark
that command interface is down. If this is the case, fall through to
the software reclamation path. If the command failed for any another
reason, or finished successfully, return as before.

Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
Signed-off-by: Shay Drory <[email-masked]>
Reviewed-by: Moshe Shemesh <[email-masked]>
Signed-off-by: Tariq Toukan <[email-masked]>
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
index 9bc9bd83c2324..cd68c4b2c0bf9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
 	u32 func_id;
 	u32 npages;
 	u32 i = 0;
+	int err;
 
-	if (!mlx5_cmd_is_down(dev))
-		return mlx5_cmd_do(dev, in, in_size, out, out_size);
+	err = mlx5_cmd_do(dev, in, in_size, out, out_size);
+	/* If FW is gone (-ENXIO), proceed to forceful reclaim */
+	if (err != -ENXIO)
+		return err;
 
 	/* No hard feelings, we want our pages back! */
 	npages = MLX5_GET(manage_pages_in, in, input_num_entries);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:34:23 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368693; cv=none; b=obP9BQHw31shzVbzlnYlwJVRFgzk4mcnOOpvEvR0mR9vZ94czFVQBOTzEZKERLEtMjTrNIdoKpve4ePX1+9s6oMatXAAHeefl+l5a7OU1koDBDcCccFU/+SqUGNTrkfnD9nOLni28ek9nzOZg2FRlLXlxCm2OmIx2xYqRC/A7c0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368693; c=relaxed/simple;
	bh=efIPciUUja163d1fAgnDKDo1P5MJXN40eA6A9gC9jYo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=KVBPLW5YejbqqtwwbX/mMOcUN3L4f43WrH/PAQCM1QppQOxVS64NzJXSaMzr7CmhcH8HPFQSwvc15nFBsSHEfFr+lYLeBeRmGj4uhNXrPPe/dxZpcuo9xOnmvX5QLzJUkKFmPP08Sd+pVgdGz1tfj0o/rm/ifWVuvPg7zkVuCfY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=VcLhSmET; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jakub Kicinski <[email-masked]>,
	Yeounsu Moon <[email-masked]>,
	Andrew Lunn <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 216/262] net: dlink: handle copy_thresh allocation failure
Date: Mon, 13 Oct 2025 16:45:58 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yeounsu Moon <[email-masked]>

[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ]

The driver did not handle failure of `netdev_alloc_skb_ip_align()`.
If the allocation failed, dereferencing `skb->protocol` could lead to
a NULL pointer dereference.

This patch tries to allocate `skb`. If the allocation fails, it falls
back to the normal path.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Suggested-by: Jakub Kicinski <[email-masked]>
Tested-on: D-Link DGE-550T Rev-A3
Signed-off-by: Yeounsu Moon <[email-masked]>
Reviewed-by: Andrew Lunn <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/dlink/dl2k.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
index 2c1b551e14423..92856cf387c76 100644
--- a/drivers/net/ethernet/dlink/dl2k.c
+++ b/drivers/net/ethernet/dlink/dl2k.c
@@ -953,15 +953,18 @@ receive_packet (struct net_device *dev)
 		} else {
 			struct sk_buff *skb;
 
+			skb = NULL;
 			/* Small skbuffs for short packets */
-			if (pkt_len > copy_thresh) {
+			if (pkt_len <= copy_thresh)
+				skb = netdev_alloc_skb_ip_align(dev, pkt_len);
+			if (!skb) {
 				dma_unmap_single(&np->pdev->dev,
 						 desc_to_dma(desc),
 						 np->rx_buf_sz,
 						 DMA_FROM_DEVICE);
 				skb_put (skb = np->rx_skbuff[entry], pkt_len);
 				np->rx_skbuff[entry] = NULL;
-			} else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) {
+			} else {
 				dma_sync_single_for_cpu(&np->pdev->dev,
 							desc_to_dma(desc),
 							np->rx_buf_sz,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:53:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368690; cv=none; b=qL9wia052hc7H4cfZKb4dwwtngclKF8OiZVxf5GR8TCaXBpkDrmGH9sgI3UNu590Fc5SCNZziCq5l0yuvI4ukpKEUwz9NLlNR9qy1U0AWIA5LmsBJL154j/RPQQWOdAO6HmSMcCenUsmMqvqDLJpgScm4hNF1oIvx2uY8x2jOwM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368690; c=relaxed/simple;
	bh=jiSViDFd+WizyWgRqMkj2Dsr9UhRYbOB0p9HOoYt898=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=hEQj+phvojNjNBQmKoQVKSadLCLGpbqeGuqd0BP1gwlXcuYfps1mAhdpw1rrfH5Nzq25vBGeEl9v4D31G5LGlANhy2IQeZrbtymx9tnrIdg0TLl3/8SQ4rukUhhQfEgOKEnd4i2RWtzZ+I0eXj78dB/YpHMWr2I3FsCD/ZycPBk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dburz5Bb; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Kohei Enju <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 215/262] net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
Date: Mon, 13 Oct 2025 16:45:57 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kohei Enju <[email-masked]>

[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]

In EC2 instances where the RSS hash key is not configurable, ethtool
shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally
returns ENA_HASH_KEY_SIZE.

Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not
supported") added proper handling for devices that don't support RSS
hash key configuration, but ena_get_rxfh_key_size() has been unchanged.

When the RSS hash key is not configurable, return 0 instead of
ENA_HASH_KEY_SIZE to clarify getting the value is not supported.

Tested on m5 instance families.

Without patch:
 # ethtool -x ens5 | grep -A 1 "RSS hash key"
 RSS hash key:
 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00

With patch:
 # ethtool -x ens5 | grep -A 1 "RSS hash key"
 RSS hash key:
 Operation not supported

Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported")
Signed-off-by: Kohei Enju <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
index 60fb35ec4b15a..0b2e257b591f0 100644
--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
@@ -869,7 +869,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)
 
 static u32 ena_get_rxfh_key_size(struct net_device *netdev)
 {
-	return ENA_HASH_KEY_SIZE;
+	struct ena_adapter *adapter = netdev_priv(netdev);
+	struct ena_rss *rss = &adapter->ena_dev->rss;
+
+	return rss->hash_key ? ENA_HASH_KEY_SIZE : 0;
 }
 
 static int ena_indirection_table_set(struct ena_adapter *adapter,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:55:30 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368687; cv=none; b=CAaiAlYrsV0Rj9yePsJC57mbIAWonDw3rNo3vZLoMJvoGwqdyeP+vJiBGYnbOupZ2518aAiGPnRcTzMbl+lBUkPUQnk2/tSQ0AACj1D6PeKt/Dg37uPhJQkFspCtLsHQChzjO2BZCNQGutXJDFLKjqyH5G9mKp5548pdJdwdyVw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368687; c=relaxed/simple;
	bh=I/BT/54XkTh3ScBCx9ujDJBgbR74HE0Ii7Dj4T4sU2k=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=uUv+1Gy/zdbRL/oYf3UnDVoF+SSjFs2ChtYbTQepOXncCuiSOEakrQgRNLPwL1EqHISeb4hc/jrU4UvUrOX0hICi9gokETUHJ0TpR3r87JjUhO/hV1eKLzNfO624ZDoJ22t/YDkLQBW3qB4st1Qxe596dmrhSQxiWQ4rxbvvZlU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=x/o0Q2pP; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Kohei Enju <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 214/262] nfp: fix RSS hash key size when RSS is not supported
Date: Mon, 13 Oct 2025 16:45:56 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kohei Enju <[email-masked]>

[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]

The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when
devices don't support RSS, and callers treat the negative value as a
large positive value since the return type is u32.

Return 0 when devices don't support RSS, aligning with the ethtool
interface .get_rxfh_key_size() that requires returning 0 in such cases.

Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function")
Signed-off-by: Kohei Enju <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
index fbca8d0efd858..37a46596268a0 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
@@ -1789,7 +1789,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)
 	struct nfp_net *nn = netdev_priv(netdev);
 
 	if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY))
-		return -EOPNOTSUPP;
+		return 0;
 
 	return nfp_net_rss_key_sz(nn);
 }
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:30:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368667; cv=none; b=gASPkJuz5MWIitQR6Nr+QLeXzWCqpF5bt410qd30hIucihU9vdZ5dOmJO4u5jFk6pTsD2A7Ce0LIjvc/NHqXYcQKhoKuD33tBCSpuFXMCy9LGIkCgIJG7YPScmH4cOebRW4OMNShQyGjOWGBTUR+eUME9y4Zlhdj79NLGiH7Mw0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368667; c=relaxed/simple;
	bh=ADvhm+VkO019plS7ru1m4pHLxOxECyX/NZld75surPo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=p6T6KGDZsE+C4Vrevl8ooRW6YPDGVviF3oW2P1vQuO36ihSxpX9p1w8v+JkG9KwvVcBbhXUaD/WuDIuV7gx4gvy99WncDelf84hxLcTirSD1Yfd9kvH//6xkfIoSoFr6z7F7Zza/xG5ZldxZO0+poDxlUdW5U4eYPrVIVLNKdwM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Tu38Ai9j; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alok Tiwari <[email-masked]>,
	Simon Horman <[email-masked]>,
	Aleksandr Loktionov <[email-masked]>,
	Jacob Keller <[email-masked]>,
	Madhu Chittim <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 213/262] idpf: fix mismatched free function for dma_alloc_coherent
Date: Mon, 13 Oct 2025 16:45:55 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alok Tiwari <[email-masked]>

[ Upstream commit b9bd25f47eb79c9eb275e3d9ac3983dc88577dd4 ]

The mailbox receive path allocates coherent DMA memory with
dma_alloc_coherent(), but frees it with dmam_free_coherent().
This is incorrect since dmam_free_coherent() is only valid for
buffers allocated with dmam_alloc_coherent().

Fix the mismatch by using dma_free_coherent() instead of
dmam_free_coherent

Fixes: e54232da1238 ("idpf: refactor idpf_recv_mb_msg")
Signed-off-by: Alok Tiwari <[email-masked]>
Reviewed-by: Simon Horman <[email-masked]>
Reviewed-by: Aleksandr Loktionov <[email-masked]>
Reviewed-by: Jacob Keller <[email-masked]>
Reviewed-by: Madhu Chittim <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
index f27a8cf3816db..d1f374da00981 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
@@ -727,9 +727,9 @@ int idpf_recv_mb_msg(struct idpf_adapter *adapter)
 		/* If post failed clear the only buffer we supplied */
 		if (post_err) {
 			if (dma_mem)
-				dmam_free_coherent(&adapter->pdev->dev,
-						   dma_mem->size, dma_mem->va,
-						   dma_mem->pa);
+				dma_free_coherent(&adapter->pdev->dev,
+						  dma_mem->size, dma_mem->va,
+						  dma_mem->pa);
 			break;
 		}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:29:29 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368635; cv=none; b=BpV396ywERG7g0EdAXiqd8lL7esm3KHbPuugedsOsn2abPWlydioaNBizmmkgtBSSc3J0JCLQgbpShUmVe+aGTHNVM+SmXd0r37Ki12tKYXexIOEisDFFwBpFnOGj3JKbZ/TyBHu6CDub2aZSHYZLfbffIHXbcjpA0D4kUKrJWM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368635; c=relaxed/simple;
	bh=rnWGzEBAAYxCTwWfZQnoWLyr+je+iYsOago3w7uvGAs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=LQ7eqDOFbsLFqdZEgQriQ5faNOiCdQDAk+1nK1pHuM+5T5SQ/euej6OwkDtsRKoWgUD8VbovTHDfKpzbzxhhO4dIwNsry8wooCm/Pg1aFLsRSjKgA0C3JY5/OjIgCOSS4KUeprmSaDqgbSsZBfuvWrx1Tlz73MoJJ9ZPwW1gIUw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=k/Rbq4Ww; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alok Tiwari <[email-masked]>,
	Manivannan Sadhasivam <[email-masked]>,
	Siddharth Vadapalli <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 212/262] PCI: j721e: Fix incorrect error message in probe()
Date: Mon, 13 Oct 2025 16:45:54 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alok Tiwari <[email-masked]>

[ Upstream commit cfcd6cab2f33c24a68517f9e3131480b4000c2be ]

The probe() function prints "pm_runtime_get_sync failed" when
j721e_pcie_ctrl_init() returns an error. This is misleading since
the failure is not from pm_runtime, but from the controller init
routine. Update the error message to correctly reflect the source.

No functional changes.

Fixes: f3e25911a430 ("PCI: j721e: Add TI J721E PCIe driver")
Signed-off-by: Alok Tiwari <[email-masked]>
Signed-off-by: Manivannan Sadhasivam <[email-masked]>
Reviewed-by: Siddharth Vadapalli <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pci/controller/cadence/pci-j721e.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
index bae829ac759e1..eb772c18d44ed 100644
--- a/drivers/pci/controller/cadence/pci-j721e.c
+++ b/drivers/pci/controller/cadence/pci-j721e.c
@@ -531,7 +531,7 @@ static int j721e_pcie_probe(struct platform_device *pdev)
 
 	ret = j721e_pcie_ctrl_init(pcie);
 	if (ret < 0) {
-		dev_err_probe(dev, ret, "pm_runtime_get_sync failed\n");
+		dev_err_probe(dev, ret, "j721e_pcie_ctrl_init failed\n");
 		goto err_get_sync;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:51:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368604; cv=none; b=HwfmNUC7zMZqcOP9JiXhzMT2S4z1Ds2PdTVM9eIQ4Lt3qXcC8HEZm4DLRTy0NmMGBj3ud6jAgX9vl0H5J9iIUxuShv2VtCgephm81HQY4qhxxvDJrGZZnW74UZTpL1GKLZb0o865J6n32m0tpdtVIWr+8PnPEI2PSSLlAm49gjo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368604; c=relaxed/simple;
	bh=zUNQ3Dg+ZcKDe7zvWyYHJrrfgwibo3lZk59eELRkZkk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=V+cPf9vscPJwCYYms/1F2LxXB+ZAml2UijvYQcbBSVI/wuhqZgDP3e2k8+eF5+HYfQHUKEQa2HDTv6hWeJVbZM1DLRbpJEMOybZ8cRJ/ewoYAno+Ekzqj8bes2GlsH5iXbXT+emVpbZdzQZ0COIeCNb01k/ptgo20tv23U0o6+s=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mwIVUMBI; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Erick Karanja <[email-masked]>,
	Miquel Raynal <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 211/262] mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands
Date: Mon, 13 Oct 2025 16:45:53 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Erick Karanja <[email-masked]>

[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ]

In case of a jump to the  err label due to atmel_nand_create() or
atmel_nand_controller_add_nand() failure, the reference to nand_np
need to be released

Use for_each_child_of_node_scoped() to fix the issue.

Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")

Signed-off-by: Erick Karanja <[email-masked]>
Signed-off-by: Miquel Raynal <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
index 5b02119d8ba23..543a0be9dc645 100644
--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
@@ -1858,7 +1858,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc)
 
 static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
 {
-	struct device_node *np, *nand_np;
+	struct device_node *np;
 	struct device *dev = nc->dev;
 	int ret, reg_cells;
 	u32 val;
@@ -1885,7 +1885,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
 
 	reg_cells += val;
 
-	for_each_child_of_node(np, nand_np) {
+	for_each_child_of_node_scoped(np, nand_np) {
 		struct atmel_nand *nand;
 
 		nand = atmel_nand_create(nc, nand_np, reg_cells);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368581; cv=none; b=uT8peIFYSa/t+Ljwn/XgqW7R5YhxKUf+cYpNf8bcf0v2BzQxy7P64bFdmVz4QqEfOm+jiG3cdlS2Znpi7gMOpEDswePKgCTQ9fDshJsnUhkDrQ2HQA8xZP1FjGGt7hnH4ur6M/QH+rJVLSky92f6veWAT99JmER6//g6oCz1nQ8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368581; c=relaxed/simple;
	bh=5mIzBpzqu3ZmtHBvvRG5yynm1078mL4kNLqpfiiCLyI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=g0KwIy7qkH6aitlDhqSY7ePjLg4VJWOZdA081ZU8nYe5/juexNvTlLikcSiGWBFRUOdFVbRJ2Jlp8Fl+nDPBVpWtZRNpNRCwxyi77IBsY365dQ7WU2AfegiJtZ9SlY9swfNbbBNzk+XjtlXHUzJM/08lees1AAbD6FDTbHJJwJY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ehy0FRMr; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id E3E69C4CEE7;
	Mon, 13 Oct 2025 15:16:20 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760368581;
	bh=5mIzBpzqu3ZmtHBvvRG5yynm1078mL4kNLqpfiiCLyI=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=ehy0FRMrfoCXQD2YSSHniIRTC636x1zoWeVzMRIjd+BMylVsHtYL02PG5neat9NrS
	 9szMrzQQa+XBD3WpLKlCjKUPFuucPvVKK3k7L0qfxnO639pmKKEFE2HrYa8FS9cKRL
	 1a6ub1TxFvUocMMvrA2a1RsZhjLWWfTFoJFOdbYg=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	Joseph Qi <[email-masked]>,
	Goldwyn Rodrigues <[email-masked]>,
	Mark Fasheh <[email-masked]>,
	Joel Becker <[email-masked]>,
	Junxiao Bi <[email-masked]>,
	Changwei Ge <[email-masked]>,
	Jun Piao <[email-masked]>,
	Andrew Morton <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 209/262] ocfs2: fix double free in user_cluster_connect()
Date: Mon, 13 Oct 2025 16:45:51 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email-masked]>

[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]

user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then
the error handling frees "lc" a second time.  Set "lc" to NULL on this
path to avoid a double free.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace")
Signed-off-by: Dan Carpenter <[email-masked]>
Reviewed-by: Joseph Qi <[email-masked]>
Reviewed-by: Goldwyn Rodrigues <[email-masked]>
Cc: Mark Fasheh <[email-masked]>
Cc: Joel Becker <[email-masked]>
Cc: Junxiao Bi <[email-masked]>
Cc: Changwei Ge <[email-masked]>
Cc: Jun Piao <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/ocfs2/stack_user.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index 77edcd70f72c2..c5236b3ed168f 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -1018,6 +1018,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)
 			printk(KERN_ERR "ocfs2: Could not determine"
 					" locking version\n");
 			user_cluster_disconnect(conn);
+			lc = NULL;
 			goto out;
 		}
 		wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0));
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:42:59 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368575; cv=none; b=dGdl3SLyItPTpNOlqXzyjvS4ftHC2D1AP7IJmQj7aactVQRC3TDUALh0BtfyF06eoKSvwIWCnELNUdljMdl1cjvd3RCq0k9kuIRLpm9TtIRuWRHAcz6noVigPdEr7XWVzWQMdqs6nnxMWkjz51EuDICuInDk4Rvo6/344Onwjuo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368575; c=relaxed/simple;
	bh=K7qkCE45sdGFY6EpjoLksXgWxksJD8Pde0ITqXW5itg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=fXcc1SfIfXd5C/7uIPLHdsEZqgABxjtrJzT+h7B/niOJ7pAA1XX6mO9ciN0kFvQ9mm9kny9ET7L7XemkFXfGPKYIeUroeR5oklq4+poWPL+a+EcY0TVafnqanhOxO4b0SBI/wAi43guN28I7vQnSMOeTTfmUEHYuBV4eD+/3HRQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=1A152ncK; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Fan Wu <[email-masked]>,
	Lukas Wunner <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 207/262] KEYS: X.509: Fix Basic Constraints CA flag parsing
Date: Mon, 13 Oct 2025 16:45:49 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Fan Wu <[email-masked]>

[ Upstream commit 5851afffe2ab323a53e184ba5a35fddf268f096b ]

Fix the X.509 Basic Constraints CA flag parsing to correctly handle
the ASN.1 DER encoded structure. The parser was incorrectly treating
the length field as the boolean value.

Per RFC 5280 section 4.1, X.509 certificates must use ASN.1 DER encoding.
According to ITU-T X.690, a DER-encoded BOOLEAN is represented as:

Tag (0x01), Length (0x01), Value (0x00 for FALSE, 0xFF for TRUE)

The basicConstraints extension with CA:TRUE is encoded as:

  SEQUENCE (0x30) | Length | BOOLEAN (0x01) | Length (0x01) | Value (0xFF)
                             ^-- v[2]         ^-- v[3]        ^-- v[4]

The parser was checking v[3] (the length field, always 0x01) instead
of v[4] (the actual boolean value, 0xFF for TRUE in DER encoding).

Also handle the case where the extension is an empty SEQUENCE (30 00),
which is valid for CA:FALSE when the default value is omitted as
required by DER encoding rules (X.690 section 11.5).

Per ITU-T X.690-0207:
- Section 11.5: Default values must be omitted in DER
- Section 11.1: DER requires TRUE to be encoded as 0xFF

Link: https://datatracker.ietf.org/doc/html/rfc5280
Link: https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
Fixes: 30eae2b037af ("KEYS: X.509: Parse Basic Constraints for CA")
Signed-off-by: Fan Wu <[email-masked]>
Reviewed-by: Lukas Wunner <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 crypto/asymmetric_keys/x509_cert_parser.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index ee2fdab42334f..7e0ce7bf68c99 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -611,11 +611,14 @@ int x509_process_extension(void *context, size_t hdrlen,
 		/*
 		 * Get hold of the basicConstraints
 		 * v[1] is the encoding size
-		 *	(Expect 0x2 or greater, making it 1 or more bytes)
+		 *	(Expect 0x00 for empty SEQUENCE with CA:FALSE, or
+		 *	0x03 or greater for non-empty SEQUENCE)
 		 * v[2] is the encoding type
 		 *	(Expect an ASN1_BOOL for the CA)
-		 * v[3] is the contents of the ASN1_BOOL
-		 *      (Expect 1 if the CA is TRUE)
+		 * v[3] is the length of the ASN1_BOOL
+		 *	(Expect 1 for a single byte boolean)
+		 * v[4] is the contents of the ASN1_BOOL
+		 *	(Expect 0xFF if the CA is TRUE)
 		 * vlen should match the entire extension size
 		 */
 		if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ))
@@ -624,8 +627,13 @@ int x509_process_extension(void *context, size_t hdrlen,
 			return -EBADMSG;
 		if (v[1] != vlen - 2)
 			return -EBADMSG;
-		if (vlen >= 4 && v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1)
+		/* Empty SEQUENCE means CA:FALSE (default value omitted per DER) */
+		if (v[1] == 0)
+			return 0;
+		if (vlen >= 5 && v[2] == ASN1_BOOL && v[3] == 1 && v[4] == 0xFF)
 			ctx->cert->pub->key_eflags |= 1 << KEY_EFLAG_CA;
+		else
+			return -EBADMSG;
 		return 0;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:37 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368573; cv=none; b=bpbIJHVrgIWIEZDqwZu8btg3mzX6iikiRi13A5f8+dM2wiwxBAHrx2623UOJEhLH2WjJ0DTTD3SZDDay9UXmu+xuwtAlUTnKTXwIfXOcU1cEgKyqlIk1Ki3s7QdUNJpBCqLRx5+DhJboPg1m3bNw3ATlrvkANDabHU+MnWJrBjg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368573; c=relaxed/simple;
	bh=QL2G0q7JYoaf5JAwYZtPkQvBaczV7X45pdMs0UYJT9s=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=eSYIjuXOxocMF6WDXCdaNy/KcM6Osn6JA71b/TYQA2HceavZyN+CsRsL/vCpjkAjlBRBaTuYG0mWqThnOVqJd7xrd41K4pGnpqfOjvkOwwiRC4oDdBBS1W22fBgzcHDGj6VKquk9y4lP4hf/3IBvZoGFcpkSZx70u3oqncy/Wi8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=e7aaKGTQ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Luiz Augusto von Dentz <[email-masked]>,
	Paul Menzel <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 206/262] Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
Date: Mon, 13 Oct 2025 16:45:48 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Luiz Augusto von Dentz <[email-masked]>

[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ]

When creating an advertisement for BIG the address shall not be
non-resolvable since in case of acting as BASS/Broadcast Assistant the
address must be the same as the connection in order to use the PAST
method and even when PAST/BASS are not in the picture a Periodic
Advertisement can still be synchronized thus the same argument as to
connectable advertisements still stand.

Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections")
Signed-off-by: Luiz Augusto von Dentz <[email-masked]>
Reviewed-by: Paul Menzel <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/bluetooth/hci_sync.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 333f32a9fd219..853acfa8e9433 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -1325,7 +1325,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
 {
 	struct hci_cp_le_set_ext_adv_params cp;
 	struct hci_rp_le_set_ext_adv_params rp;
-	bool connectable;
+	bool connectable, require_privacy;
 	u32 flags;
 	bdaddr_t random_addr;
 	u8 own_addr_type;
@@ -1363,10 +1363,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
 		return -EPERM;
 
 	/* Set require_privacy to true only when non-connectable
-	 * advertising is used. In that case it is fine to use a
-	 * non-resolvable private address.
+	 * advertising is used and it is not periodic.
+	 * In that case it is fine to use a non-resolvable private address.
 	 */
-	err = hci_get_random_address(hdev, !connectable,
+	require_privacy = !connectable && !(adv && adv->periodic);
+
+	err = hci_get_random_address(hdev, require_privacy,
 				     adv_use_rpa(hdev, flags), adv,
 				     &own_addr_type, &random_addr);
 	if (err < 0)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368570; cv=none; b=Jdz7e7/YWqxcskTmx8OUJibalJoNa2bQ05xytHQZKMyYzrM5TfKbSzDKVrw14AhokwHDl20k+7JT7qQV0uFjY6fzDyK1nOftWZtNzWzyJRupnQi6gmXD1rkJpSvp1UJNYzpvqH0iuhRsO0ND/uceotfVu34RQf0OyUcOKTthMeg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368570; c=relaxed/simple;
	bh=sbKwKH41tuopmMchn5Jq4WPnqMNu16Lx4wop7FNRQS0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=PfjLdcFeb3Ta1vq9roBITk0SYQ8EWqJ8bGwkJ2c81sZXsnYrnSTlqukw16e/jebHhMV7hqj3WZjK4kHovCr8hTBB6TmKjwtuC+ALYU+X5I7D4Y4Zw4m5pLYjnh5KKinOQGg4YE/V5FjUN2YnK17P4m8MyNKMiSA8jfm0UuEoEks=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=CFCeAjEu; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Pauli Virtanen <[email-masked]>,
	Luiz Augusto von Dentz <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 205/262] Bluetooth: ISO: dont leak skb in ISO_CONT RX
Date: Mon, 13 Oct 2025 16:45:47 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Pauli Virtanen <[email-masked]>

[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ]

For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the
skb is leaked.

Free skb after copying its data.

Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Pauli Virtanen <[email-masked]>
Signed-off-by: Luiz Augusto von Dentz <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/bluetooth/iso.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index e38f52638627d..2cd0b963c96bd 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -2304,7 +2304,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
 		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
 					  skb->len);
 		conn->rx_len -= skb->len;
-		return;
+		break;
 
 	case ISO_END:
 		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:34 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368564; cv=none; b=XoD0obDiJuCwMgcGWY8DcuhHinTtqBMbrTxit0BB65gxgbmEt+WaW54QXNiOsiiGEuX9qezpk20Vw6BJc3GonAmrmWTEQILPX7c28w3YC5CY5zZHiyDuLdEI8vgfXozrdKdAUR5s/pL0fibsc27UFqbzj1ssubzWEVu2DRFOfLY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368564; c=relaxed/simple;
	bh=ixIYP91m5OrsNUyym9BmDO+P3O/dKDkl+qJaYLUBqSI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Hjhys0vc/TvNbAijMJ4SbBw7a+P92Se4ougAcw8vSo3mHqKISjiQDkAlPTUP17KT+RBu3y3ChNQvT3nLT87mt+9R76Uncw3+FLZ+pyi7NlYYQzVT8T+ASAt+u5V3KWY7TnW4MSvVfoNO5bPnaumytbvIuZm06oxXiUQ15GLaPm0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=UrXGDk/z; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Pauli Virtanen <[email-masked]>,
	Luiz Augusto von Dentz <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 204/262] Bluetooth: ISO: free rx_skb if not consumed
Date: Mon, 13 Oct 2025 16:45:46 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Pauli Virtanen <[email-masked]>

[ Upstream commit 6ba85da5804efffe15c89b03742ea868f20b4172 ]

If iso_conn is freed when RX is incomplete, free any leftover skb piece.

Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn")
Signed-off-by: Pauli Virtanen <[email-masked]>
Signed-off-by: Luiz Augusto von Dentz <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/bluetooth/iso.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index df21c79800fb6..e38f52638627d 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -111,6 +111,8 @@ static void iso_conn_free(struct kref *ref)
 	/* Ensure no more work items will run since hci_conn has been dropped */
 	disable_delayed_work_sync(&conn->timeout_work);
 
+	kfree_skb(conn->rx_skb);
+
 	kfree(conn);
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:44:21 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368561; cv=none; b=o8yelVzBYrOlUArFaqBGqDChtrYpHM9BEmeOn+RcTobHVdSP4j+w3KaY0CLdd8b9NFnpB7wDDi9sjLHDO/MjOuIwFgUdziQKCFmUXfnJHLIa4VtVnMnl62Dh5KznYUdvx6UEtnzGU9wTLPtge21EWdeWQwPS5vB23UYoZJPODZA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368561; c=relaxed/simple;
	bh=o6VVlnhp9tykTFQOo0STWI1Ujmk7A9/7TCPF/R2pILU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=u6nAolgpg82hbN0X5Hihbuf7f2IPUuk29nQmiRLeD4G2DKd0QYMqvG4vWzsZJGdc7fB7x3c0is9Z1HIpN3N22Cgp3u7WPrVQx5ELtcX5g985hMJ0FujOTxqyL7aIDwIplPkYQ0ZQTsioq46DcDTF9UbVJdzsWKxUVL7r1LJ150A=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Z4KSkbMj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Luiz Augusto von Dentz <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 203/262] Bluetooth: ISO: Fix possible UAF on iso_conn_free
Date: Mon, 13 Oct 2025 16:45:45 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Luiz Augusto von Dentz <[email-masked]>

[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ]

This attempt to fix similar issue to sco_conn_free where if the
conn->sk is not set to NULL may lead to UAF on iso_conn_free.

Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Luiz Augusto von Dentz <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/bluetooth/iso.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index a08a0f3d5003c..df21c79800fb6 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -743,6 +743,13 @@ static void iso_sock_kill(struct sock *sk)
 
 	BT_DBG("sk %p state %d", sk, sk->sk_state);
 
+	/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
+	if (iso_pi(sk)->conn) {
+		iso_conn_lock(iso_pi(sk)->conn);
+		iso_pi(sk)->conn->sk = NULL;
+		iso_conn_unlock(iso_pi(sk)->conn);
+	}
+
 	/* Kill poor orphan */
 	bt_sock_unlink(&iso_sk_list, sk);
 	sock_set_flag(sk, SOCK_DEAD);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:39:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368558; cv=none; b=s2N7Y8bgvLYNi0KuXvdkDWxQTTtgEQSJGYKg0wvffJX1O4CSjbKJ1pzCfTxKdyj5vBKke73Eat29uQFtPkvzC1WXwwAGcFllD0Gbn5kGQxihUbIXmtWJSQwCZ0Aq9Dz2rtJQa632IGRdwaQqEz2sW2v+2226HOwBtueQFw4Pc1k=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368558; c=relaxed/simple;
	bh=iEd57OnTfu/dS7LAXP7b2UMBHhV1M5FwipEl3n/JfwI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=X8MV8pFJCOxIGy+EzAT0H2nNOPHXREzXIj9VodF/M+TOBzGWk2hQL5q7m+vigs+EeLf9Zyz1G3gCGcStCW2RTKalexFIQ4YLBwqBvwMo/P4QfXEx/xOgQ+M+KQn+VHNI2WpQ2a2Bk6ecRz0SpjCoyzDwJPwX9Z2APyYJgC5uJOQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=qXEtZUcf; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Luiz Augusto von Dentz <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 202/262] Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
Date: Mon, 13 Oct 2025 16:45:44 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Luiz Augusto von Dentz <[email-masked]>

[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ]

The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO
was not called with a specific index which breaks the likes of
bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an
adapter is plugged, so instead of depending hdev not to be set just
enable the UUID on any index like it was done with iso_sock_uuid.

Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled")
Signed-off-by: Luiz Augusto von Dentz <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/bluetooth/mgmt.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 8b75647076bae..563cae4f76b0d 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -4412,13 +4412,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
 		return -ENOMEM;
 
 #ifdef CONFIG_BT_FEATURE_DEBUG
-	if (!hdev) {
-		flags = bt_dbg_get() ? BIT(0) : 0;
+	flags = bt_dbg_get() ? BIT(0) : 0;
 
-		memcpy(rp->features[idx].uuid, debug_uuid, 16);
-		rp->features[idx].flags = cpu_to_le32(flags);
-		idx++;
-	}
+	memcpy(rp->features[idx].uuid, debug_uuid, 16);
+	rp->features[idx].flags = cpu_to_le32(flags);
+	idx++;
 #endif
 
 	if (hdev && hci_dev_le_state_simultaneous(hdev)) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:49:11 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368555; cv=none; b=q4opnpOrKJ0ulLW9obuPo0WO0ta7GazRolvPyORmEA1Z5fRwJ5+ixZ4/P4p5UOT8ROk3CaAtsSqwjjXIKmd3YwZ8TBYDGESyHf+avF7mXYrsf9MIGXK55wtgMwDNg5AYNg57KXJ0OMH2ZDBHgw2efWJpLj/xUe7CF+ogYBl45qg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368555; c=relaxed/simple;
	bh=t24NbpDYNtiKj3itJGMFYXgGHnw7KtrjGVxDkWmYtGw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=JFC94N8K7mZbgiFioKpUsjeysIDf5HGfHL8n+bQjYdzG8J8eqTkldT8EUDvJBRK/qapOpscCRIDhCZogKvgTUra6xRUvMk1phm3fdNhxyF/HRfOJXozzk3qOEiYAmdMuzYgW1y+0I0IPQybM8Z3UHLcMILatu38x4wd3XQqQVVY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=LaBXhJ5k; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	zhang jiao <[email-masked]>,
	"Michael S. Tsirkin" <[email-masked]>,
	Simon Horman <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 201/262] vhost: vringh: Fix copy_to_iter return value check
Date: Mon, 13 Oct 2025 16:45:43 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael S. Tsirkin <[email-masked]>

[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ]

The return value of copy_to_iter can't be negative, check whether the
copied length is equal to the requested length instead of checking for
negative values.

Cc: zhang jiao <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]
Signed-off-by: Michael S. Tsirkin <[email-masked]>
Reviewed-by: Simon Horman <[email-masked]>
Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/vhost/vringh.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 73e153f9b4495..0db4f3babe961 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -1237,6 +1237,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
 		struct iov_iter iter;
 		u64 translated;
 		int ret;
+		size_t size;
 
 		ret = iotlb_translate(vrh, (u64)(uintptr_t)dst,
 				      len - total_translated, &translated,
@@ -1254,9 +1255,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
 				      translated);
 		}
 
-		ret = copy_to_iter(src, translated, &iter);
-		if (ret < 0)
-			return ret;
+		size = copy_to_iter(src, translated, &iter);
+		if (size != translated)
+			return -EFAULT;
 
 		src += translated;
 		dst += translated;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:29 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368552; cv=none; b=PU4Seyura4z7Eec5LeEmtsL0x+OCYClrdpzX1nQaYN7SuS0IrC11n3lI/5IvDTTYRIKD1nZR9aZAOG0nRFkFK/GEFdUKTZRX8EsYYtf0AfgtcEzdMYoQWeEn8rklZ8W1p4MmMPg2IicP9itwmLlgjnD7BF7gQeNc0rcgspWDhHY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368552; c=relaxed/simple;
	bh=K9alUFH6YHvYyacjxI9qQi8N4mG0uvagCmsEhF1jEgU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=UACUWS2XFxuoSF6QVa09UUqSwDcPZv/2auE4kAN6PgW88nw7/P1K/nAJj/dVkepLQ0qNbvVqTHEyKD+fyjpvN5//B6Yvf4wr29RZqH6RiPwI0f34FsnXkFVZhq6bO02mZdtZjRyQfSQsELMq/meCygr+uJMKfHCfNiOQqoV3hws=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=W5RmEtg5; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	I Viswanath <[email-masked]>,
	Richard Cochran <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 200/262] ptp: Add a upper bound on max_vclocks
Date: Mon, 13 Oct 2025 16:45:42 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: I Viswanath <[email-masked]>

[ Upstream commit e9f35294e18da82162004a2f35976e7031aaf7f9 ]

syzbot reported WARNING in max_vclocks_store.

This occurs when the argument max is too large for kcalloc to handle.

Extend the guard to guard against values that are too large for
kcalloc

Reported-by: [email-masked]
Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df
Tested-by: [email-masked]
Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion")
Signed-off-by: I Viswanath <[email-masked]>
Acked-by: Richard Cochran <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/ptp/ptp_private.h | 1 +
 drivers/ptp/ptp_sysfs.c   | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h
index b352df4cd3f97..f329263f33aa1 100644
--- a/drivers/ptp/ptp_private.h
+++ b/drivers/ptp/ptp_private.h
@@ -22,6 +22,7 @@
 #define PTP_MAX_TIMESTAMPS 128
 #define PTP_BUF_TIMESTAMPS 30
 #define PTP_DEFAULT_MAX_VCLOCKS 20
+#define PTP_MAX_VCLOCKS_LIMIT (KMALLOC_MAX_SIZE/(sizeof(int)))
 #define PTP_MAX_CHANNELS 2048
 
 enum {
diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c
index 6b1b8f57cd951..200eaf5006968 100644
--- a/drivers/ptp/ptp_sysfs.c
+++ b/drivers/ptp/ptp_sysfs.c
@@ -284,7 +284,7 @@ static ssize_t max_vclocks_store(struct device *dev,
 	size_t size;
 	u32 max;
 
-	if (kstrtou32(buf, 0, &max) || max == 0)
+	if (kstrtou32(buf, 0, &max) || max == 0 || max > PTP_MAX_VCLOCKS_LIMIT)
 		return -EINVAL;
 
 	if (max == ptp->max_vclocks)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:46:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368541; cv=none; b=Ksok+xcJGN+SkRJq60ZxmGnq74uUoYJD98twmHX3tY5lHPKTXnrfPd/RgU27vkru6folshMx2+UzeyCGOb2Vim1ynhN/hrbA5YaaDpHeZqO8sBDt9IFJV7sFKHGVeI+GrgZhdDkV+CpJ29bpH2yvYVK6h+Jqpux1mt94sKmsJfA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368541; c=relaxed/simple;
	bh=+IHfBzj6VhJC+1DhuekWkK2h/N1U2t2c3WWaLTAnq7Y=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=sa+ylHsqPQLO6C0RetqSBNNhC2LRjyLeC54UfaEgMRnb8YlZKmrloETyATSPqXufgkK+51IAtRnfmW4zjPhXyc9jwR+SJIvYQyfRIVxxcZ3pgZ4tdG5V8iMb2lmZ5JleMJooCYtKBI+fs4VBOavDFiakKrlRPeloS7wErskoHwU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=iZy+o2bB; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Marek Vasut <[email-masked]>,
	Manivannan Sadhasivam <[email-masked]>,
	Bjorn Helgaas <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 196/262] PCI: rcar-gen4: Fix inverted break condition in PHY initialization
Date: Mon, 13 Oct 2025 16:45:38 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marek Vasut <[email-masked]>

[ Upstream commit 2bdf1d428f48e1077791bb7f88fd00262118256d ]

R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 4581
Figure 104.3b Initial Setting of PCIEC(example), third quarter of the
figure indicates that register 0xf8 should be polled until bit 18 becomes
set to 1.

Register 0xf8, bit 18 is 0 immediately after write to PCIERSTCTRL1 and is
set to 1 in less than 1 ms afterward. The current readl_poll_timeout()
break condition is inverted and returns when register 0xf8, bit 18 is set
to 0, which in most cases means immediately. In case
CONFIG_DEBUG_LOCK_ALLOC=y, the timing changes just enough for the first
readl_poll_timeout() poll to already read register 0xf8, bit 18 as 1 and
afterward never read register 0xf8, bit 18 as 0, which leads to timeout
and failure to start the PCIe controller.

Fix this by inverting the poll condition to match the reference manual
initialization sequence.

Fixes: faf5a975ee3b ("PCI: rcar-gen4: Add support for R-Car V4H")
Signed-off-by: Marek Vasut <[email-masked]>
Signed-off-by: Manivannan Sadhasivam <[email-masked]>
Signed-off-by: Bjorn Helgaas <[email-masked]>
Tested-by: Geert Uytterhoeven <[email-masked]>
Reviewed-by: Geert Uytterhoeven <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pci/controller/dwc/pcie-rcar-gen4.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
index 30d16f85f6465..14f69efa243c3 100644
--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
@@ -733,7 +733,7 @@ static int rcar_gen4_pcie_ltssm_control(struct rcar_gen4_pcie *rcar, bool enable
 	val &= ~APP_HOLD_PHY_RST;
 	writel(val, rcar->base + PCIERSTCTRL1);
 
-	ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, !(val & BIT(18)), 100, 10000);
+	ret = readl_poll_timeout(rcar->phy_base + 0x0f8, val, val & BIT(18), 100, 10000);
 	if (ret < 0)
 		return ret;
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:30:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368537; cv=none; b=PiNpgRju+dT0GAMndcOQm4WiK1o4sXXtY4FSoWs4zVyfG/OOjFDjmRO1xlmOxvR303IY7XOL4Z85sJlXhbOXRjV8rZwd6F1sMP5nrGsRwZKZqxrYGmb94eOSTljEUBWOjUXjcClGjzvDxuvzYt48KrW5GLFs/rXhZFA8Ec6XQ9Q=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368537; c=relaxed/simple;
	bh=QrmdgupOwnAcELOuuXGTiV0vi308PSAkxHGd/pyR15k=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=kAfmv+uv35GNE/91o31Ik534bBLkghg3X0mOKJYrSSxLESo7t+R8t5iaouKolmepSaYs9I3R27VP0ub+xOb7fj6M8BhbEi08p84vnmBUhARAzsJY8muM58NttrFUtDWZlh/nr0ebyE080BfE5tpLD7S1AqUajlnqc+aNv++M+RY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=VtMdN3fC; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Marek Vasut <[email-masked]>,
	Manivannan Sadhasivam <[email-masked]>,
	Bjorn Helgaas <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 195/262] PCI: rcar-gen4: Assure reset occurs before DBI access
Date: Mon, 13 Oct 2025 16:45:37 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marek Vasut <[email-masked]>

[ Upstream commit 0056d29f8c1b13d7e60d60cdb159767ac8f6a883 ]

Assure the reset is latched and the core is ready for DBI access. On R-Car
V4H, the PCIe reset is asynchronous and does not take effect immediately,
but needs a short time to complete. In case DBI access happens in that
short time, that access generates an SError. Make sure that condition can
never happen, read back the state of the reset, which should turn the
asynchronous reset into a synchronous one, and wait a little over 1ms to
add additional safety margin.

Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode")
Signed-off-by: Marek Vasut <[email-masked]>
Signed-off-by: Manivannan Sadhasivam <[email-masked]>
Signed-off-by: Bjorn Helgaas <[email-masked]>
Tested-by: Geert Uytterhoeven <[email-masked]>
Reviewed-by: Geert Uytterhoeven <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pci/controller/dwc/pcie-rcar-gen4.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
index 5382008e366ec..30d16f85f6465 100644
--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
@@ -213,6 +213,19 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar)
 	if (ret)
 		goto err_unprepare;
 
+	/*
+	 * Assure the reset is latched and the core is ready for DBI access.
+	 * On R-Car V4H, the PCIe reset is asynchronous and does not take
+	 * effect immediately, but needs a short time to complete. In case
+	 * DBI access happens in that short time, that access generates an
+	 * SError. To make sure that condition can never happen, read back the
+	 * state of the reset, which should turn the asynchronous reset into
+	 * synchronous one, and wait a little over 1ms to add additional
+	 * safety margin.
+	 */
+	reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc);
+	fsleep(1000);
+
 	if (rcar->drvdata->additional_common_init)
 		rcar->drvdata->additional_common_init(rcar);
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:35:14 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368532; cv=none; b=EtkgD/K6p254KJmgKhmn4jskB1CfJQ/HwW4sBErZVjL/6Xl/W94TuunW6y5JcPswmMOyha8VyW2MMfSzjzL+poKgIyuOQX9mC8X/GZOqXkoJTqgSYP+6Scg3I0CzwfTZNOKK4S+t4RA8SEXuVReEreAhEBcCenBaVIcZ8b8tbSk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368532; c=relaxed/simple;
	bh=3+NTBIOuvwdH/mvT3CJ4EzgaLM0SnYvw/bdMmhdqNos=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=hH2uW+XkBLROGCMmRgGAtz5BafqB9WWINgEVDOGx0bNrf+z9W7yjzwomOYIJ14cCnIJqx+j32tAinD1id525kINuJzxAmPtIHhzwk6rMjbNxCY/MJFS5JJLjEVYxWHqTAD/cAgr8kjKI65A7hE3g/ei4cz1PY/nBvIzbwrZ1YZo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=r77Mb5Xz; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Geert Uytterhoeven <[email-masked]>,
	Marek Vasut <[email-masked]>,
	Manivannan Sadhasivam <[email-masked]>,
	Bjorn Helgaas <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>,
	=?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 194/262] PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion
Date: Mon, 13 Oct 2025 16:45:36 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marek Vasut <[email-masked]>

[ Upstream commit 8795b70581770657cd5ead3c965348f05242580f ]

R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr. 21, 2025 page 585
Figure 9.3.2 Software Reset flow (B) indicates that for peripherals in HSC
domain, after reset has been asserted by writing a matching reset bit into
register SRCR, it is mandatory to wait 1ms.

Because it is the controller driver which can determine whether or not the
controller is in HSC domain based on its compatible string, add the missing
delay in the controller driver.

This 1ms delay is documented on R-Car V4H and V4M; it is currently unclear
whether S4 is affected as well. This patch does apply the extra delay on
R-Car S4 as well.

Fixes: 0d0c551011df ("PCI: rcar-gen4: Add R-Car Gen4 PCIe controller support for host mode")
Suggested-by: Geert Uytterhoeven <[email-masked]>
Signed-off-by: Marek Vasut <[email-masked]>
[mani: added the missing r-b tag from Krzysztof]
Signed-off-by: Manivannan Sadhasivam <[email-masked]>
Signed-off-by: Bjorn Helgaas <[email-masked]>
Reviewed-by: Geert Uytterhoeven <[email-masked]>
Reviewed-by: Krzysztof Wilczyński <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pci/controller/dwc/pcie-rcar-gen4.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
index 5d77a01648606..5382008e366ec 100644
--- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
+++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
@@ -182,8 +182,17 @@ static int rcar_gen4_pcie_common_init(struct rcar_gen4_pcie *rcar)
 		return ret;
 	}
 
-	if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc))
+	if (!reset_control_status(dw->core_rsts[DW_PCIE_PWR_RST].rstc)) {
 		reset_control_assert(dw->core_rsts[DW_PCIE_PWR_RST].rstc);
+		/*
+		 * R-Car V4H Reference Manual R19UH0186EJ0130 Rev.1.30 Apr.
+		 * 21, 2025 page 585 Figure 9.3.2 Software Reset flow (B)
+		 * indicates that for peripherals in HSC domain, after
+		 * reset has been asserted by writing a matching reset bit
+		 * into register SRCR, it is mandatory to wait 1ms.
+		 */
+		fsleep(1000);
+	}
 
 	val = readl(rcar->base + PCIEMSR0);
 	if (rcar->drvdata->mode == DW_PCIE_RC_TYPE) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:27:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368528; cv=none; b=AFSasGQAKZ2iyjP0vgvRy88isdk8on4n9r5JB0HsMhyzYH7/FAxCqG2i98IQOOftQENn8TNRo114uN9RGq7FCceO+lGqKF4Qiw84jAH27t9KvAzFW/4p19C1UmcGv0utWqEoIN/qlxIE29QdpvwhnbHNJQhLfsoyP8wQ8HfETfA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368528; c=relaxed/simple;
	bh=wAN4dR44f05Ty1Ubmnuw2fuAlCttf8VxI7t8lWnrF6c=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Exff43NOW7NUGJVf288MSbT5i7EorapGkFnforiW+S2aM+RauL1qLNKFG9+FuOVQW/PEsq8+F7JfzCG1gmzORvjFsa+6zhKt3RGGIWFNlzEKjSnj1mqhQk2g+1YcQ9IcHgeU9aASZeIJDM16oTApprnoIXjaHsv7bewQ/cz5nk0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=sWWrwoAa; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Cristian Ciocaltea <[email-masked]>,
	Shuah Khan <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 193/262] usb: vhci-hcd: Prevent suspending virtually attached devices
Date: Mon, 13 Oct 2025 16:45:35 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Cristian Ciocaltea <[email-masked]>

[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]

The VHCI platform driver aims to forbid entering system suspend when at
least one of the virtual USB ports are bound to an active USB/IP
connection.

However, in some cases, the detection logic doesn't work reliably, i.e.
when all devices attached to the virtual root hub have been already
suspended, leading to a broken suspend state, with unrecoverable resume.

Ensure the virtually attached devices do not enter suspend by setting
the syscore PM flag.  Note this is currently limited to the client side
only, since the server side doesn't implement system suspend prevention.

Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
Signed-off-by: Cristian Ciocaltea <[email-masked]>
Acked-by: Shuah Khan <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 8dac1edc74d4e..a793e30d46b78 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
 				 ctrlreq->wValue, vdev->rhport);
 
 			vdev->udev = usb_get_dev(urb->dev);
+			/*
+			 * NOTE: A similar operation has been done via
+			 * USB_REQ_GET_DESCRIPTOR handler below, which is
+			 * supposed to always precede USB_REQ_SET_ADDRESS.
+			 *
+			 * It's not entirely clear if operating on a different
+			 * usb_device instance here is a real possibility,
+			 * otherwise this call and vdev->udev assignment above
+			 * should be dropped.
+			 */
+			dev_pm_syscore_device(&vdev->udev->dev, true);
 			usb_put_dev(old);
 
 			spin_lock(&vdev->ud.lock);
@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
 					"Not yet?:Get_Descriptor to device 0 (get max pipe size)\n");
 
 			vdev->udev = usb_get_dev(urb->dev);
+			/*
+			 * Set syscore PM flag for the virtually attached
+			 * devices to ensure they will not enter suspend on
+			 * the client side.
+			 *
+			 * Note this doesn't have any impact on the physical
+			 * devices attached to the host system on the server
+			 * side, hence there is no need to undo the operation
+			 * on disconnect.
+			 */
+			dev_pm_syscore_device(&vdev->udev->dev, true);
 			usb_put_dev(old);
 			goto out;
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:30:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368526; cv=none; b=Iiqj1BJ3KBDtoID5W/ew86I5G3br/vU5F+DOa5cZg08a6i7Owuy6EO9LYNRxpnxgLu5l8EctRoqUjErFHz1NhNDkvmaiK6kUmUjz1CLu74ZSw2eZD4Y+nrA8auO1WDPE+Z1ONDjDR0kDClRqRB5+RUQQIEuAsYFt61HAXmxwp0Q=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368526; c=relaxed/simple;
	bh=AMVyQutS7QSzpKmR9DMAkB9C2h7po5CZV1VsnOdK0V8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=U/JkSr8vQ3C9Gj0Br2xRCn50pdigaBnAeAB+yPye5Ff5ly1sjFLyJ7vY8sEXYpUzoS8LQl+3M3Rt7d7msTrALHVcDoZuSifKIWoXZq595ClFtnWel7wSDV6kK7gkknY7JzeBLyL7nexpTBjHKyoyonLAikuFAM9avBQxp1DuCOU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=o+TAx2xJ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ranjan Kumar <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 192/262] scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
Date: Mon, 13 Oct 2025 16:45:34 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ranjan Kumar <[email-masked]>

[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]

During mpt3sas_transport_port_remove(), messages were logged with
dev_printk() against &mpt3sas_port->port->dev. At this point the SAS
transport device may already be partially unregistered or freed, leading
to a crash when accessing its struct device.

Using ioc_info(), which logs via the PCI device (ioc->pdev->dev),
guaranteed to remain valid until driver removal.

[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI
[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G           OE       6.16.0-rc1+ #1 PREEMPT(voluntary)
[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024
[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70
[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff
[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206
[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32
[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845
[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8
[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000
[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30
[83428.295833] FS:  00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000
[83428.295837] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0
[83428.295844] PKRU: 55555554
[83428.295846] Call Trace:
[83428.295848]  <TASK>
[83428.295850]  _dev_printk+0x5c/0x80
[83428.295857]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.295863]  mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas]
[83428.295882]  _scsih_remove_device+0x21b/0x280 [mpt3sas]
[83428.295894]  ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas]
[83428.295906]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.295910]  mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas]
[83428.295921]  _scsih_expander_node_remove+0x129/0x140 [mpt3sas]
[83428.295933]  _scsih_expander_node_remove+0x6a/0x140 [mpt3sas]
[83428.295944]  scsih_remove+0x3f0/0x4a0 [mpt3sas]
[83428.295957]  pci_device_remove+0x3b/0xb0
[83428.295962]  device_release_driver_internal+0x193/0x200
[83428.295968]  driver_detach+0x44/0x90
[83428.295971]  bus_remove_driver+0x69/0xf0
[83428.295975]  pci_unregister_driver+0x2a/0xb0
[83428.295979]  _mpt3sas_exit+0x1f/0x300 [mpt3sas]
[83428.295991]  __do_sys_delete_module.constprop.0+0x174/0x310
[83428.295997]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.296000]  ? __x64_sys_getdents64+0x9a/0x110
[83428.296005]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.296009]  ? syscall_trace_enter+0xf6/0x1b0
[83428.296014]  do_syscall_64+0x7b/0x2c0
[83428.296019]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.296023]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
Signed-off-by: Ranjan Kumar <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
index d84413b77d849..421db8996927b 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
@@ -987,11 +987,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
 	list_for_each_entry_safe(mpt3sas_phy, next_phy,
 	    &mpt3sas_port->phy_list, port_siblings) {
 		if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
-			dev_printk(KERN_INFO, &mpt3sas_port->port->dev,
-			    "remove: sas_addr(0x%016llx), phy(%d)\n",
-			    (unsigned long long)
-			    mpt3sas_port->remote_identify.sas_address,
-			    mpt3sas_phy->phy_id);
+			ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n",
+				(unsigned long long) mpt3sas_port->remote_identify.sas_address,
+					mpt3sas_phy->phy_id);
 		mpt3sas_phy->phy_belongs_to_port = 0;
 		if (!ioc->remove_host)
 			sas_port_delete_phy(mpt3sas_port->port,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:47:27 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368520; cv=none; b=rAD+JC24nGsNQ/wqXez/tOiOmNhRQ/6ub8coYwiireemsCm28kIRK+LTl1xaUEnb0FXqFaL0MyQlJ8Rv7Rk2Ccmv1aIcBGoTTwiGzB7HncqUWZzItsToxKPTsi/xuOwE+GYWJyOLVamW1pB7ivOL7ZNA7aKxg+AFoAYQSRlTQu8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368520; c=relaxed/simple;
	bh=kB8fT27hhVutbP38QLuZ1xzt7wl8S0vMcY4Kmp7SFPQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=VMbKWIY2kpC0yxWQjTbJ0y3ATbBR1qMsPovUc74dumsA4ZlWcBxAejTU64bb2AkCU4Sy/a41f0aB3AKRwiccGwAbEsPNl8JJH1oxCx41r4hevGVLcHYFYyZ8ZmT2I2nyeQyoXsCk4whv1JBwQ07OyAWCxVNA6dYjpNZY9LQfZ90=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=fh8LvIFW; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Julian Anastasov <[email-masked]>,
	Slavin Liu <[email-masked]>,
	Florian Westphal <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 190/262] ipvs: Defer ip_vs_ftp unregister during netns cleanup
Date: Mon, 13 Oct 2025 16:45:32 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Slavin Liu <[email-masked]>

[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]

On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp
before connections with valid cp->app pointers are flushed, leading to a
use-after-free.

Fix this by introducing a global `exiting_module` flag, set to true in
ip_vs_ftp_exit() before unregistering the pernet subsystem. In
__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns
cleanup (when exiting_module is false) and defer it to
__ip_vs_cleanup_batch(), which unregisters all apps after all connections
are flushed. If called during module exit, unregister ip_vs_ftp
immediately.

Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
Suggested-by: Julian Anastasov <[email-masked]>
Signed-off-by: Slavin Liu <[email-masked]>
Signed-off-by: Julian Anastasov <[email-masked]>
Signed-off-by: Florian Westphal <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/netfilter/ipvs/ip_vs_ftp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index d8a284999544b..206c6700e2006 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -53,6 +53,7 @@ enum {
 	IP_VS_FTP_EPSV,
 };
 
+static bool exiting_module;
 /*
  * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
  * First port is set to the default port.
@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net)
 {
 	struct netns_ipvs *ipvs = net_ipvs(net);
 
-	if (!ipvs)
+	if (!ipvs || !exiting_module)
 		return;
 
 	unregister_ip_vs_app(ipvs, &ip_vs_ftp);
@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void)
  */
 static void __exit ip_vs_ftp_exit(void)
 {
+	exiting_module = true;
 	unregister_pernet_subsys(&ip_vs_ftp_ops);
 	/* rcu_barrier() is called by netns */
 }
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:48:50 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368514; cv=none; b=EfMQmIhemDsbk9GqDQEdfuGjvZ2W0Gq6UKxARWM3jdMKkKk56iXt1mp66UKFCKUdy4kIk/lqX10WpyN54u3Kv29d028hwHghQoidnicr4HCWUH2iNmiplR75wkjs+cCyz/A69uu7odiwsN5+3Af5uDSpWF2kAVOY9fbkTJXO1ds=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368514; c=relaxed/simple;
	bh=SkP1MvfpMlPq/9fxIjtw6iCJ8n3JR9gslw0NchviMV8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=H3RR5lgVDu/Y73vCATYT/A2e+xbYIxWn+iHMwOMTOyCFE3Q0xy7/Q5twcUcLRohUgyRVPWxldv5crQWmZuMJuWTG2ynK8Cngg2elEUrp8kRK+FczdTWP7r8g0PAYNrU3AsRE8p1hYHfQxFs98aOcDDzv/pNPnd52lpBoIBmOpas=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JTiM6gTq; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Lin Yujun <[email-masked]>,
	James Clark <[email-masked]>,
	Suzuki K Poulose <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 188/262] coresight: Fix incorrect handling for return value of devm_kzalloc
Date: Mon, 13 Oct 2025 16:45:30 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lin Yujun <[email-masked]>

[ Upstream commit 70714eb7243eaf333d23501d4c7bdd9daf011c01 ]

The return value of devm_kzalloc could be an null pointer,
use "!desc.pdata" to fix incorrect handling return value
of devm_kzalloc.

Fixes: 4277f035d227 ("coresight: trbe: Add a representative coresight_platform_data for TRBE")
Signed-off-by: Lin Yujun <[email-masked]>
Reviewed-by: James Clark <[email-masked]>
Signed-off-by: Suzuki K Poulose <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-trbe.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
index 5755674913723..d771980a278dc 100644
--- a/drivers/hwtracing/coresight/coresight-trbe.c
+++ b/drivers/hwtracing/coresight/coresight-trbe.c
@@ -1267,7 +1267,7 @@ static void arm_trbe_register_coresight_cpu(struct trbe_drvdata *drvdata, int cp
 	 * into the device for that purpose.
 	 */
 	desc.pdata = devm_kzalloc(dev, sizeof(*desc.pdata), GFP_KERNEL);
-	if (IS_ERR(desc.pdata))
+	if (!desc.pdata)
 		goto cpu_clear;
 
 	desc.type = CORESIGHT_DEV_TYPE_SINK;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:27:22 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368511; cv=none; b=iKmowMvMFRRp+xkscDsxF+JbAnFCjjtXQ9JPks5X0Ne+aXEEsWD/Io/4rMkGwbSxSKbkhNGnUfhuKAIGf16qdvKYGyl1ef7nYePUtql5WPN7OURh15zc8GN8Lb658OWxdjCog8ptD+rawh4WFeE6S87gD+cZJFP01jYXtzdoyws=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368511; c=relaxed/simple;
	bh=ylYUE6hbgWfPyM6KXgsX7N6iPeDQe/ZHEjA8i3I9rrw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=O+ub9MBwhmQE7gGzeUJKEw9zzjjCdd4VPv9bJP0O6BAVr2Fmc/xBvJ/4PfbJad6B+etIjK64MZjEAc5ybQWbnVYCIfxl+mmFDP1k223G70R4cheBT8uXng3mgaLPvUSOhot0sZuf8pKSJbuColWkzYx4QufHjErF5n60pz3RIC4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lwF9X7CX; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	James Clark <[email-masked]>,
	Jie Gan <[email-masked]>,
	Suzuki K Poulose <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 187/262] coresight: tpda: fix the logic to setup the element size
Date: Mon, 13 Oct 2025 16:45:29 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jie Gan <[email-masked]>

[ Upstream commit 43e0a92c04de7c822f6104abc73caa4a857b4a02 ]

Some TPDM devices support both CMB and DSB datasets, requiring
the system to enable the port with both corresponding element sizes.

Currently, the logic treats tpdm_read_element_size as successful if
the CMB element size is retrieved correctly, regardless of whether
the DSB element size is obtained. This behavior causes issues
when parsing data from TPDM devices that depend on both element sizes.

To address this, the function should explicitly fail if the DSB
element size cannot be read correctly.

Fixes: e6d7f5252f73 ("coresight-tpda: Add support to configure CMB element")
Reviewed-by: James Clark <[email-masked]>
Signed-off-by: Jie Gan <[email-masked]>
Signed-off-by: Suzuki K Poulose <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-tpda.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hwtracing/coresight/coresight-tpda.c b/drivers/hwtracing/coresight/coresight-tpda.c
index bfca103f9f847..865fd6273e5e4 100644
--- a/drivers/hwtracing/coresight/coresight-tpda.c
+++ b/drivers/hwtracing/coresight/coresight-tpda.c
@@ -71,12 +71,15 @@ static int tpdm_read_element_size(struct tpda_drvdata *drvdata,
 	if (tpdm_has_dsb_dataset(tpdm_data)) {
 		rc = fwnode_property_read_u32(dev_fwnode(csdev->dev.parent),
 				"qcom,dsb-element-bits", &drvdata->dsb_esize);
+		if (rc)
+			goto out;
 	}
 	if (tpdm_has_cmb_dataset(tpdm_data)) {
 		rc = fwnode_property_read_u32(dev_fwnode(csdev->dev.parent),
 				"qcom,cmb-element-bits", &drvdata->cmb_esize);
 	}
 
+out:
 	if (rc)
 		dev_warn_once(&csdev->dev,
 			"Failed to read TPDM Element size: %d\n", rc);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:38:50 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368508; cv=none; b=JZ+Xw7gejq/48t/cbrQc1AgmsVNx7YJfz3wdVnOnmONbcSv+Sn45rtK9PNcb5CLgQ7zTLxNWAeQgsAevuSqvtAG/MS0s7ljo46MOk/BKnZsg/rUD4GyzmP4A97LBLdJ7Nc4chkAyeOmtT7jOn/SmXk82Hy0y1BDQCy6JVmLcmr0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368508; c=relaxed/simple;
	bh=bc/Z/3k3T9XvLIWZ+yN1sb5EEe/G7NvEdLNjJH7CMXo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=mycj7ktF18rr0o6Tk3CkBwvGaCItRcB41FkXXtCcHEwqBl70TDxBHYAs6T6ZCoGjNfCVv9aWqDPHzkv+OcKRcskFLJzi+V6LhAsfm8b3jbxfCQRNMXooAnVHrYK25brQ09Tx1SObzb2MQHndghfYjcSFmtEvJl7eOW/DZ+xxhvU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dZvPvGUZ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Tamas Zsoldos <[email-masked]>,
	Leo Yan <[email-masked]>,
	James Clark <[email-masked]>,
	Suzuki K Poulose <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 186/262] coresight: trbe: Return NULL pointer for allocation failures
Date: Mon, 13 Oct 2025 16:45:28 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leo Yan <[email-masked]>

[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ]

When the TRBE driver fails to allocate a buffer, it currently returns
the error code "-ENOMEM". However, the caller etm_setup_aux() only
checks for a NULL pointer, so it misses the error. As a result, the
driver continues and eventually causes a kernel panic.

Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on
allocation failures. This allows that the callers can properly handle
the failure.

Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
Reported-by: Tamas Zsoldos <[email-masked]>
Signed-off-by: Leo Yan <[email-masked]>
Reviewed-by: James Clark <[email-masked]>
Signed-off-by: Suzuki K Poulose <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-trbe.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
index 492b2612f64e0..5755674913723 100644
--- a/drivers/hwtracing/coresight/coresight-trbe.c
+++ b/drivers/hwtracing/coresight/coresight-trbe.c
@@ -745,12 +745,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
 
 	buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event));
 	if (!buf)
-		return ERR_PTR(-ENOMEM);
+		return NULL;
 
 	pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL);
 	if (!pglist) {
 		kfree(buf);
-		return ERR_PTR(-ENOMEM);
+		return NULL;
 	}
 
 	for (i = 0; i < nr_pages; i++)
@@ -760,7 +760,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
 	if (!buf->trbe_base) {
 		kfree(pglist);
 		kfree(buf);
-		return ERR_PTR(-ENOMEM);
+		return NULL;
 	}
 	buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE;
 	buf->trbe_write = buf->trbe_base;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:44:47 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368505; cv=none; b=QLu+ozb/DQn5Y1l9W9Ttz+W9lnkU/s9C/Po44QYlD+vlpbi41JbAWzt+D3aro7hfgBh06MPz6j2EGUTkQ6QroyY/JPTEaOlMr3e9XThiHPuTLKOVpGy8B8mbUh+bnO85jITkp6vxJ2RQx4evJsDuX8i1qVMQX3S+4yWo418nQAk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368505; c=relaxed/simple;
	bh=u84p/Wp8PcVxbqa2052II7GG5IN6JTT79FHPc1l2Smw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=eYM6ug6PtX4IbX97Dy2znrko+uy2T83IVmw/xp3reGDdQWB+AvMyJnNpBKE18rMyA563QfJAVxgzQ0AvDMOALDhrCd07vDTiB2s3iwnyHMLPUgDkluhAcAT1pCnzOeuRzq/fw6pr5WyUoNy4I89ekDk3gYJ43uxIHqiqTDbxG/c=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YbWeYJZT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Anshuman Khandual <[email-masked]>,
	Yeoreum Yun <[email-masked]>,
	James Clark <[email-masked]>,
	Leo Yan <[email-masked]>,
	Suzuki K Poulose <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 185/262] coresight: etm4x: Support atclk
Date: Mon, 13 Oct 2025 16:45:27 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leo Yan <[email-masked]>

[ Upstream commit 40c0cdc9cbbebae9f43bef1cab9ce152318d0cce ]

The atclk is an optional clock for the CoreSight ETMv4, but the driver
misses to initialize it.

This change enables atclk in probe of the ETMv4 driver, and dynamically
control the clock during suspend and resume.

No need to check the driver data and clock pointer in the runtime
suspend and resume, so remove checks.  And add error handling in the
resume function.

Add a minor fix to the comment format when adding the atclk field.

Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
Reviewed-by: Anshuman Khandual <[email-masked]>
Reviewed-by: Yeoreum Yun <[email-masked]>
Tested-by: James Clark <[email-masked]>
Signed-off-by: Leo Yan <[email-masked]>
Signed-off-by: Suzuki K Poulose <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../coresight/coresight-etm4x-core.c          | 20 ++++++++++++++-----
 drivers/hwtracing/coresight/coresight-etm4x.h |  4 +++-
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index cdfd35e03c1dc..7b9eaeb115d21 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -2157,6 +2157,10 @@ static int etm4_probe(struct device *dev)
 	if (WARN_ON(!drvdata))
 		return -ENOMEM;
 
+	drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
+	if (IS_ERR(drvdata->atclk))
+		return PTR_ERR(drvdata->atclk);
+
 	if (pm_save_enable == PARAM_PM_SAVE_FIRMWARE)
 		pm_save_enable = coresight_loses_context_with_cpu(dev) ?
 			       PARAM_PM_SAVE_SELF_HOSTED : PARAM_PM_SAVE_NEVER;
@@ -2405,8 +2409,8 @@ static int etm4_runtime_suspend(struct device *dev)
 {
 	struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
 
-	if (drvdata->pclk && !IS_ERR(drvdata->pclk))
-		clk_disable_unprepare(drvdata->pclk);
+	clk_disable_unprepare(drvdata->atclk);
+	clk_disable_unprepare(drvdata->pclk);
 
 	return 0;
 }
@@ -2414,11 +2418,17 @@ static int etm4_runtime_suspend(struct device *dev)
 static int etm4_runtime_resume(struct device *dev)
 {
 	struct etmv4_drvdata *drvdata = dev_get_drvdata(dev);
+	int ret;
+
+	ret = clk_prepare_enable(drvdata->pclk);
+	if (ret)
+		return ret;
 
-	if (drvdata->pclk && !IS_ERR(drvdata->pclk))
-		clk_prepare_enable(drvdata->pclk);
+	ret = clk_prepare_enable(drvdata->atclk);
+	if (ret)
+		clk_disable_unprepare(drvdata->pclk);
 
-	return 0;
+	return ret;
 }
 #endif
 
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
index 899790c8777a9..3683966bd0603 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.h
+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
@@ -920,7 +920,8 @@ struct etmv4_save_state {
 
 /**
  * struct etm4_drvdata - specifics associated to an ETM component
- * @pclk        APB clock if present, otherwise NULL
+ * @pclk:       APB clock if present, otherwise NULL
+ * @atclk:      Optional clock for the core parts of the ETMv4.
  * @base:       Memory mapped base address for this component.
  * @csdev:      Component vitals needed by the framework.
  * @spinlock:   Only one at a time pls.
@@ -988,6 +989,7 @@ struct etmv4_save_state {
  */
 struct etmv4_drvdata {
 	struct clk			*pclk;
+	struct clk			*atclk;
 	void __iomem			*base;
 	struct coresight_device		*csdev;
 	spinlock_t			spinlock;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:47 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368598; cv=none; b=qrA+cKkIJzzo+5Cpkh0sFq4yJgu/C1oMo4IMRPuqB7nlAdlW1mqBsReykoCrM/sCltDDaB08WGqmP2i70EOPeRqxziZfz/w/M6yonBPdHBxEbYPjpiiyjzdawhBYiYwJ2sKunPqZWxheuzIf4k+xof0Pho4kypMbMFqeXWLtpeM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368598; c=relaxed/simple;
	bh=lBeYqI3q0xqorbvc4Y38kLueYjUD6u9igsX/tGddTMA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Ah/W7vCfsqJSvC+qHyYZIZ+ycr7+jVowrTGwEZjR2bUS3rGwppKp0kAo0K/7wbDTTQz/beGhQAvhJ4Q2Ec5Kcg89bQsa2g+KyPSeq2x1r7/Su39NcKc16oHGprOle89Hia3AQYsB71+wAbSKPCfXjMBOC50lQJ8ngAAYI12NOAU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=axhWDVqv; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Anshuman Khandual <[email-masked]>,
	Yeoreum Yun <[email-masked]>,
	James Clark <[email-masked]>,
	Leo Yan <[email-masked]>,
	Suzuki K Poulose <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 184/262] coresight: catu: Support atclk
Date: Mon, 13 Oct 2025 16:45:26 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leo Yan <[email-masked]>

[ Upstream commit 5483624effea2e893dc0df6248253a6a2a085451 ]

The atclk is an optional clock for the CoreSight CATU, but the driver
misses to initialize it.

This change enables atclk in probe of the CATU driver, and dynamically
control the clock during suspend and resume.

The checks for driver data and clocks in suspend and resume are not
needed, remove them.  Add error handling in the resume function.

Fixes: fcacb5c154ba ("coresight: Introduce support for Coresight Address Translation Unit")
Reviewed-by: Anshuman Khandual <[email-masked]>
Reviewed-by: Yeoreum Yun <[email-masked]>
Tested-by: James Clark <[email-masked]>
Signed-off-by: Leo Yan <[email-masked]>
Signed-off-by: Suzuki K Poulose <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-catu.c | 22 +++++++++++++++-----
 drivers/hwtracing/coresight/coresight-catu.h |  1 +
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
index 25fd02955c38d..abfff42b20c93 100644
--- a/drivers/hwtracing/coresight/coresight-catu.c
+++ b/drivers/hwtracing/coresight/coresight-catu.c
@@ -521,6 +521,10 @@ static int __catu_probe(struct device *dev, struct resource *res)
 	struct coresight_platform_data *pdata = NULL;
 	void __iomem *base;
 
+	drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
+	if (IS_ERR(drvdata->atclk))
+		return PTR_ERR(drvdata->atclk);
+
 	catu_desc.name = coresight_alloc_device_name(&catu_devs, dev);
 	if (!catu_desc.name)
 		return -ENOMEM;
@@ -668,18 +672,26 @@ static int catu_runtime_suspend(struct device *dev)
 {
 	struct catu_drvdata *drvdata = dev_get_drvdata(dev);
 
-	if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
-		clk_disable_unprepare(drvdata->pclk);
+	clk_disable_unprepare(drvdata->atclk);
+	clk_disable_unprepare(drvdata->pclk);
+
 	return 0;
 }
 
 static int catu_runtime_resume(struct device *dev)
 {
 	struct catu_drvdata *drvdata = dev_get_drvdata(dev);
+	int ret;
 
-	if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
-		clk_prepare_enable(drvdata->pclk);
-	return 0;
+	ret = clk_prepare_enable(drvdata->pclk);
+	if (ret)
+		return ret;
+
+	ret = clk_prepare_enable(drvdata->atclk);
+	if (ret)
+		clk_disable_unprepare(drvdata->pclk);
+
+	return ret;
 }
 #endif
 
diff --git a/drivers/hwtracing/coresight/coresight-catu.h b/drivers/hwtracing/coresight/coresight-catu.h
index 755776cd19c5b..6e6b7aac206dc 100644
--- a/drivers/hwtracing/coresight/coresight-catu.h
+++ b/drivers/hwtracing/coresight/coresight-catu.h
@@ -62,6 +62,7 @@
 
 struct catu_drvdata {
 	struct clk *pclk;
+	struct clk *atclk;
 	void __iomem *base;
 	struct coresight_device *csdev;
 	int irq;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368595; cv=none; b=J3FIzbcdakTFxGbQ2YiAEIWSBWOl5gxxgyZ30mz6+6HkVw1pJ4XorG+yILbjuB1u73xgT7N5Nsz/dTxuSug+F4OmBJXpp51+EWza5JT370lVEGCZ4XNduz5hz0IUsHr2WVst6A8aNMcCBRPwAmHgLpKOoEz4cyh9EEEwW2/d+NA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368595; c=relaxed/simple;
	bh=fgVtJs/sAab0R9tK7JfmOcVErXJqH07VFcQmKEgUXZU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=Q+ZK6yr+pAA4I4YnwymMhXcE5cWDh28j20zf74rWSgUEu3SiCX64leS5cib4EiNLnG5e3AyomjUi4uEfaTKyZteuUDwvfVpWbRWFWcNFA/06l7oqqHQQ+axtsU1B+IR+/fu2hBcX3S3g+3+ktsHBRz/WUDW2bU+uISN3T6FTlFE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JxrHqhcJ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Anshuman Khandual <[email-masked]>,
	Yeoreum Yun <[email-masked]>,
	James Clark <[email-masked]>,
	Leo Yan <[email-masked]>,
	Suzuki K Poulose <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 183/262] coresight: tmc: Support atclk
Date: Mon, 13 Oct 2025 16:45:25 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leo Yan <[email-masked]>

[ Upstream commit 8a79026926b329d4ab0c6d0921373a80ec8aab6e ]

The atclk is an optional clock for the CoreSight TMC, but the driver
misses to initialize it.  In most cases, TMC shares the atclk clock with
other CoreSight components.  Since these components enable the clock
before the TMC device is initialized, the TMC continues properly,
which is why we don’t observe any lockup issues.

This change enables atclk in probe of the TMC driver.  Given the clock
is optional, it is possible to return NULL if the clock does not exist.
IS_ERR() is tolerant for this case.

Dynamically disable and enable atclk during suspend and resume.  The
clock pointers will never be error values if the driver has successfully
probed, and the case of a NULL pointer case will be handled by the clock
core layer.  The driver data is always valid after probe. Therefore,
remove the related checks.  Also in the resume flow adds error handling.

Fixes: bc4bf7fe98da ("coresight-tmc: add CoreSight TMC driver")
Reviewed-by: Anshuman Khandual <[email-masked]>
Reviewed-by: Yeoreum Yun <[email-masked]>
Tested-by: James Clark <[email-masked]>
Signed-off-by: Leo Yan <[email-masked]>
Signed-off-by: Suzuki K Poulose <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../hwtracing/coresight/coresight-tmc-core.c  | 22 ++++++++++++++-----
 drivers/hwtracing/coresight/coresight-tmc.h   |  2 ++
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c
index 475fa4bb6813b..96ef2517dd439 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-core.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-core.c
@@ -480,6 +480,10 @@ static int __tmc_probe(struct device *dev, struct resource *res)
 	struct coresight_desc desc = { 0 };
 	struct coresight_dev_list *dev_list = NULL;
 
+	drvdata->atclk = devm_clk_get_optional_enabled(dev, "atclk");
+	if (IS_ERR(drvdata->atclk))
+		return PTR_ERR(drvdata->atclk);
+
 	ret = -ENOMEM;
 
 	/* Validity for the resource is already checked by the AMBA core */
@@ -700,18 +704,26 @@ static int tmc_runtime_suspend(struct device *dev)
 {
 	struct tmc_drvdata *drvdata = dev_get_drvdata(dev);
 
-	if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
-		clk_disable_unprepare(drvdata->pclk);
+	clk_disable_unprepare(drvdata->atclk);
+	clk_disable_unprepare(drvdata->pclk);
+
 	return 0;
 }
 
 static int tmc_runtime_resume(struct device *dev)
 {
 	struct tmc_drvdata *drvdata = dev_get_drvdata(dev);
+	int ret;
 
-	if (drvdata && !IS_ERR_OR_NULL(drvdata->pclk))
-		clk_prepare_enable(drvdata->pclk);
-	return 0;
+	ret = clk_prepare_enable(drvdata->pclk);
+	if (ret)
+		return ret;
+
+	ret = clk_prepare_enable(drvdata->atclk);
+	if (ret)
+		clk_disable_unprepare(drvdata->pclk);
+
+	return ret;
 }
 #endif
 
diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h
index 2671926be62a3..2a53acbb5990b 100644
--- a/drivers/hwtracing/coresight/coresight-tmc.h
+++ b/drivers/hwtracing/coresight/coresight-tmc.h
@@ -166,6 +166,7 @@ struct etr_buf {
 
 /**
  * struct tmc_drvdata - specifics associated to an TMC component
+ * @atclk:	optional clock for the core parts of the TMC.
  * @pclk:	APB clock if present, otherwise NULL
  * @base:	memory mapped base address for this component.
  * @csdev:	component vitals needed by the framework.
@@ -191,6 +192,7 @@ struct etr_buf {
  * @perf_buf:	PERF buffer for ETR.
  */
 struct tmc_drvdata {
+	struct clk		*atclk;
 	struct clk		*pclk;
 	void __iomem		*base;
 	struct coresight_device	*csdev;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:53:50 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368592; cv=none; b=Vol0APTvsb07T/M/Q07X5bQJKegMvFp50Y2QzEgKcjYjuS12PQ0W3nJderkPMBlyAcnrsCrKHCFR27+l3xRFt4GIOTCo+S4ffvqvaPvF7bV/wSdKr/wVghbfHcWh/8KousqYu9mhHgCmlvc96n/Pp6FFlLAzzBX2UXiRYk3SFJQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368592; c=relaxed/simple;
	bh=8mY0m1COMRcM5rlttZcRogbjor360Cd7VEdngYFk0AM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=qwc8hvXa3Y7zDRX0J4qL9aMZ9K+yRYyAnSBIiVzT4H5vBkFRDzpDLKO67tuzCObMn9bwYs1HfUb5f4P9Eh90eq34s2EPTmn+no+f4Cte2pzE/RIc+yInH5x+EGZFNUKR7wZUoDxYtSpzAM0RV5CUt9PmCTgksysHbvEKQsHaOs8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=RUkLi5Q9; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yuanfang Zhang <[email-masked]>,
	James Clark <[email-masked]>,
	Mike Leach <[email-masked]>,
	Suzuki K Poulose <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 182/262] coresight-etm4x: Conditionally access register TRCEXTINSELR
Date: Mon, 13 Oct 2025 16:45:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yuanfang Zhang <[email-masked]>

[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ]

The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0.
To avoid invalid accesses, introduce a check on numextinsel
(derived from TRCIDR5[11:9]) before reading or writing to this register.

Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses")
Signed-off-by: Yuanfang Zhang <[email-masked]>
Reviewed-by: James Clark <[email-masked]>
Reviewed-by: Mike Leach <[email-masked]>
Signed-off-by: Suzuki K Poulose <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++---
 drivers/hwtracing/coresight/coresight-etm4x.h      |  2 ++
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index be8b46f26ddc8..cdfd35e03c1dc 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -481,7 +481,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
 		etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
 		etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR);
 	}
-	etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
+	if (drvdata->numextinsel)
+		etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
 	for (i = 0; i < drvdata->nr_cntr; i++) {
 		etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i));
 		etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i));
@@ -1362,6 +1363,7 @@ static void etm4_init_arch_data(void *info)
 	etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5);
 	/* NUMEXTIN, bits[8:0] number of external inputs implemented */
 	drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5);
+	drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5);
 	/* TRACEIDSIZE, bits[21:16] indicates the trace ID width */
 	drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5);
 	/* ATBTRIG, bit[22] implementation can support ATB triggers? */
@@ -1789,7 +1791,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
 		state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR);
 		state->trcseqstr = etm4x_read32(csa, TRCSEQSTR);
 	}
-	state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
+
+	if (drvdata->numextinsel)
+		state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
 
 	for (i = 0; i < drvdata->nr_cntr; i++) {
 		state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i));
@@ -1921,7 +1925,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
 		etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR);
 		etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR);
 	}
-	etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
+	if (drvdata->numextinsel)
+		etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
 
 	for (i = 0; i < drvdata->nr_cntr; i++) {
 		etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i));
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
index 9e9165f62e81f..899790c8777a9 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.h
+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
@@ -162,6 +162,7 @@
 #define TRCIDR4_NUMVMIDC_MASK			GENMASK(31, 28)
 
 #define TRCIDR5_NUMEXTIN_MASK			GENMASK(8, 0)
+#define TRCIDR5_NUMEXTINSEL_MASK               GENMASK(11, 9)
 #define TRCIDR5_TRACEIDSIZE_MASK		GENMASK(21, 16)
 #define TRCIDR5_ATBTRIG				BIT(22)
 #define TRCIDR5_LPOVERRIDE			BIT(23)
@@ -998,6 +999,7 @@ struct etmv4_drvdata {
 	u8				nr_cntr;
 	u8				nr_ext_inp;
 	u8				numcidc;
+	u8				numextinsel;
 	u8				numvmidc;
 	u8				nrseqstate;
 	u8				nr_event;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:50:21 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368589; cv=none; b=FdOBoiLqvgSx9xFI+iUC7J92/+N4IZrww5cz0dyVHcxrmtpHihMr4e8uVECROq9LnsYiRnssAox52dqd/GdBEQB3gQZJX+VVYCiZsi167+pZD0uaLv7U7Siu1kS2wJBIuMc1qb/Ay3rn1fKqfesuBGTFCLEMFnIq7vd//0cdckE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368589; c=relaxed/simple;
	bh=5JTLJzMQblWjxor6KX3+JnK/59mcEaseGiyU8u6E8SA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=cjAVYFKFVjEUvcLdmp5u9Ig3dSejehXpiVLAnPqS0EjjKzt6enFUPx+4dQbZAlB3VfF5XMGGIuA+AUhRrUJKBgcqV2BvQT3EB//MsgYj0zfMTE1Sjox7L9fXMo4Ip3VzM1/P1Gd2x5TOoxMa3u3P5OP5TOM+kx/1FXr69QOjBZA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=sj3G+Vu1; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ivan Abramov <[email-masked]>,
	Matthew Sakai <[email-masked]>,
	Mikulas Patocka <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 181/262] dm vdo: return error on corrupted metadata in start_restoring_volume functions
Date: Mon, 13 Oct 2025 16:45:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ivan Abramov <[email-masked]>

[ Upstream commit 9ddf6d3fcbe0b96e318da364cf7e6b59cd4cb5a2 ]

The return values of VDO_ASSERT calls that validate metadata are not acted
upon.

Return UDS_CORRUPT_DATA in case of an error.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: a4eb7e255517 ("dm vdo: implement the volume index")
Signed-off-by: Ivan Abramov <[email-masked]>
Reviewed-by: Matthew Sakai <[email-masked]>
Signed-off-by: Mikulas Patocka <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/md/dm-vdo/indexer/volume-index.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm-vdo/indexer/volume-index.c b/drivers/md/dm-vdo/indexer/volume-index.c
index 12f954a0c5325..afb062e1f1fb4 100644
--- a/drivers/md/dm-vdo/indexer/volume-index.c
+++ b/drivers/md/dm-vdo/indexer/volume-index.c
@@ -836,7 +836,7 @@ static int start_restoring_volume_sub_index(struct volume_sub_index *sub_index,
 				    "%zu bytes decoded of %zu expected", offset,
 				    sizeof(buffer));
 		if (result != VDO_SUCCESS)
-			result = UDS_CORRUPT_DATA;
+			return UDS_CORRUPT_DATA;
 
 		if (memcmp(header.magic, MAGIC_START_5, MAGIC_SIZE) != 0) {
 			return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
@@ -928,7 +928,7 @@ static int start_restoring_volume_index(struct volume_index *volume_index,
 				    "%zu bytes decoded of %zu expected", offset,
 				    sizeof(buffer));
 		if (result != VDO_SUCCESS)
-			result = UDS_CORRUPT_DATA;
+			return UDS_CORRUPT_DATA;
 
 		if (memcmp(header.magic, MAGIC_START_6, MAGIC_SIZE) != 0)
 			return vdo_log_warning_strerror(UDS_CORRUPT_DATA,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:29:04 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368584; cv=none; b=frIeQuKByUbvKxkct/+IXtfwv+cnJYTqqGNoZ2oGB60Bg53lXKMihtI17YvZDGyrz/S21rSzyAoTffRAhzsNBWg9GsSyQpjkxyIaet8eTjmyXIRawwPwTy5bcWun+03XUZFhX0L+lecW8L4znZdGBO3itC+deSOlqp0p982Uek0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368584; c=relaxed/simple;
	bh=7fm/AAKGnJdB7BvC1CqwHlD7Z370fd0INzwxJa7Fpe4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=SkH+Mbyj1JbLSzLOGhH5mVMn1uJ/UPhtGwMjPmoD/EgXUuZdv21Bkev+NRDVE5GrdC+VCx30pTubQmltbvTloqvsh9c6OLNbyAlE00zMBPCf8cmOr9WmQJtadzcNIWHSsLreZuERDLWGtnWGICj3ty73xUr++wabYUjZxPikycs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ix1dUIpx; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Nagarjuna Kristam <[email-masked]>,
	Niklas Cassel <[email-masked]>,
	Manivannan Sadhasivam <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 179/262] PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert()
Date: Mon, 13 Oct 2025 16:45:21 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nagarjuna Kristam <[email-masked]>

[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ]

During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently
called twice.

pex_ep_event_pex_rst_assert() should do the opposite of
pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate
tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate
tegra_pcie_bpmp_set_pll_state() call should instead be a call to
tegra_pcie_bpmp_set_ctrl_state().

With this, the uninitialization sequence also matches that of
tegra_pcie_unconfig_controller().

Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support")
Signed-off-by: Nagarjuna Kristam <[email-masked]>
[cassel: improve commit log]
Signed-off-by: Niklas Cassel <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
[mani: added Fixes tag]
Signed-off-by: Manivannan Sadhasivam <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
index ced3b7e7bdade..815599ef72db8 100644
--- a/drivers/pci/controller/dwc/pcie-tegra194.c
+++ b/drivers/pci/controller/dwc/pcie-tegra194.c
@@ -1721,9 +1721,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)
 				ret);
 	}
 
-	ret = tegra_pcie_bpmp_set_pll_state(pcie, false);
+	ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false);
 	if (ret)
-		dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret);
+		dev_err(pcie->dev, "Failed to disable controller: %d\n", ret);
 
 	pcie->ep_state = EP_STATE_DISABLED;
 	dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n");
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:28:57 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368567; cv=none; b=MOoChcVwFqQRFz8VHSv8xeuAYf+EgFbVOoPatS2ZTHCp3eRuHfK9apToZS/0LYxqZSQ0nbAiJx7SEahXKMCMP8XB1ngZ7i6OxW9p7Jpdb1TBg9dPb3eEl8l4BfhK2KIeKdWlr1Q3d1T1DkzMsPjf+LXuzFpsOz5QPlPSlCmsAdQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368567; c=relaxed/simple;
	bh=6XdGgWrYVU0a1SqXstK9S431gMCc6RohGnqAxa+uiVI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=nijONgKgJaTSKFURe7Qxt+Id2/iZ+LREG1omT6IXqS3ylGyr6Qy1d9iI3TlQEMZhPLLp7f7rsj2PXKeKYKBguQFpSw/rGLxsNlPQeY53qAKexSdyG6E3JdnMXek01uxe4Q61D908Frkrp8WkSG6BaHajzpr+Et6l6LJ7ozc6x+E=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=VHt/PS2O; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Fedor Pchelkin <[email-masked]>,
	Ping-Ke Shih <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 178/262] wifi: rtw89: avoid circular locking dependency in ser_state_run()
Date: Mon, 13 Oct 2025 16:45:20 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Fedor Pchelkin <[email-masked]>

[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ]

Lockdep gives a splat [1] when ser_hdl_work item is executed.  It is
scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a
wiphy lock inside.  However, this workqueue can be flushed when e.g.
closing the interface and wiphy lock is already taken in that case.

Choosing wiphy_work_queue() for SER is likely not suitable.  Back on to
the global workqueue.

[1]:

 WARNING: possible circular locking dependency detected
 6.17.0-rc2 #17 Not tainted
 ------------------------------------------------------
 kworker/u32:1/61 is trying to acquire lock:
 ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core]

 but task is already holding lock:
 ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}:
        process_one_work+0x7c6/0x1450
        worker_thread+0x49e/0xd00
        kthread+0x313/0x640
        ret_from_fork+0x221/0x300
        ret_from_fork_asm+0x1a/0x30

 -> #1 ((wq_completion)phy0){+.+.}-{0:0}:
        touch_wq_lockdep_map+0x8e/0x180
        __flush_workqueue+0x129/0x10d0
        ieee80211_stop_device+0xa8/0x110
        ieee80211_do_stop+0x14ce/0x2880
        ieee80211_stop+0x13a/0x2c0
        __dev_close_many+0x18f/0x510
        __dev_change_flags+0x25f/0x670
        netif_change_flags+0x7b/0x160
        do_setlink.isra.0+0x1640/0x35d0
        rtnl_newlink+0xd8c/0x1d30
        rtnetlink_rcv_msg+0x700/0xb80
        netlink_rcv_skb+0x11d/0x350
        netlink_unicast+0x49a/0x7a0
        netlink_sendmsg+0x759/0xc20
        ____sys_sendmsg+0x812/0xa00
        ___sys_sendmsg+0xf7/0x180
        __sys_sendmsg+0x11f/0x1b0
        do_syscall_64+0xbb/0x360
        entry_SYSCALL_64_after_hwframe+0x77/0x7f

 -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}:
        __lock_acquire+0x124c/0x1d20
        lock_acquire+0x154/0x2e0
        __mutex_lock+0x17b/0x12f0
        ser_state_run+0x5e/0x180 [rtw89_core]
        rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
        process_one_work+0x82d/0x1450
        worker_thread+0x49e/0xd00
        kthread+0x313/0x640
        ret_from_fork+0x221/0x300
        ret_from_fork_asm+0x1a/0x30

 other info that might help us debug this:

 Chain exists of:
   &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work)

  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock((work_completion)(&ser->ser_hdl_work));
                                lock((wq_completion)phy0);
                                lock((work_completion)(&ser->ser_hdl_work));
   lock(&rdev->wiphy.mtx);

  *** DEADLOCK ***

 2 locks held by kworker/u32:1/61:
  #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450
  #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450

 stack backtrace:
 CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary)
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025
 Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core]
 Call Trace:
  <TASK>
  dump_stack_lvl+0x5d/0x80
  print_circular_bug.cold+0x178/0x1be
  check_noncircular+0x14c/0x170
  __lock_acquire+0x124c/0x1d20
  lock_acquire+0x154/0x2e0
  __mutex_lock+0x17b/0x12f0
  ser_state_run+0x5e/0x180 [rtw89_core]
  rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
  process_one_work+0x82d/0x1450
  worker_thread+0x49e/0xd00
  kthread+0x313/0x640
  ret_from_fork+0x221/0x300
  ret_from_fork_asm+0x1a/0x30
  </TASK>

Found by Linux Verification Center (linuxtesting.org).

Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet")
Signed-off-by: Fedor Pchelkin <[email-masked]>
Acked-by: Ping-Ke Shih <[email-masked]>
Signed-off-by: Ping-Ke Shih <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/realtek/rtw89/ser.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c
index c0f0e3d71f5f5..2a303a758e276 100644
--- a/drivers/net/wireless/realtek/rtw89/ser.c
+++ b/drivers/net/wireless/realtek/rtw89/ser.c
@@ -207,7 +207,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work)
 
 static int ser_send_msg(struct rtw89_ser *ser, u8 event)
 {
-	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
 	struct ser_msg *msg = NULL;
 
 	if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags))
@@ -223,7 +222,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
 	list_add(&msg->list, &ser->msg_q);
 	spin_unlock_irq(&ser->msg_q_lock);
 
-	ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work);
+	schedule_work(&ser->ser_hdl_work);
 	return 0;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:48:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368535; cv=none; b=MVwO3scWYTZs+iGOGL1SbMnW+DPfc6rDUJNPRFlJJlXCOV2hhUlX6VbsxRbPYtD/Ae2j+40QSHqC2fQgoiZx7KtGfG9mSSk5LuEQ43QOnV/FRzFydL8f4ZWKsU9fY7utQ200fW5/bpF5SW5UpT8fslG6+cAKuTtOwlWekFwxIbs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368535; c=relaxed/simple;
	bh=dpzqSZFdY6XIsVzkEmzhi2EFkn5boy3RYp5nikdoTao=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=CaCHBh3rQISvhGZLhCn2p4lV66KjBIh4WJiD/r2qubcSHNa1v5TKOWnmHEVjpkOQdEhDzBLYmcvzyytqdic0LUd1rqvlhj484gmkPdfABd3hZm0ndPlUW80EyRAR+OXotIFcGkZGIyhjbuAq47q6H9rnsptFZImOfibcj89OpxQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=GP3o3n1d; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhu Yanjun <[email-masked]>,
	Gui-Dong Han <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 177/262] RDMA/rxe: Fix race in do_task() when draining
Date: Mon, 13 Oct 2025 16:45:19 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gui-Dong Han <[email-masked]>

[ Upstream commit 8ca7eada62fcfabf6ec1dc7468941e791c1d8729 ]

When do_task() exhausts its iteration budget (!ret), it sets the state
to TASK_STATE_IDLE to reschedule, without a secondary check on the
current task->state. This can overwrite the TASK_STATE_DRAINING state
set by a concurrent call to rxe_cleanup_task() or rxe_disable_task().

While state changes are protected by a spinlock, both rxe_cleanup_task()
and rxe_disable_task() release the lock while waiting for the task to
finish draining in the while(!is_done(task)) loop. The race occurs if
do_task() hits its iteration limit and acquires the lock in this window.
The cleanup logic may then proceed while the task incorrectly
reschedules itself, leading to a potential use-after-free.

This bug was introduced during the migration from tasklets to workqueues,
where the special handling for the draining case was lost.

Fix this by restoring the original pre-migration behavior. If the state is
TASK_STATE_DRAINING when iterations are exhausted, set cont to 1 to
force a new loop iteration. This allows the task to finish its work, so
that a subsequent iteration can reach the switch statement and correctly
transition the state to TASK_STATE_DRAINED, stopping the task as intended.

Fixes: 9b4b7c1f9f54 ("RDMA/rxe: Add workqueue support for rxe tasks")
Reviewed-by: Zhu Yanjun <[email-masked]>
Signed-off-by: Gui-Dong Han <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Leon Romanovsky <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/sw/rxe/rxe_task.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c
index 80332638d9e3a..be6cd8ce4d97e 100644
--- a/drivers/infiniband/sw/rxe/rxe_task.c
+++ b/drivers/infiniband/sw/rxe/rxe_task.c
@@ -132,8 +132,12 @@ static void do_task(struct rxe_task *task)
 		 * yield the cpu and reschedule the task
 		 */
 		if (!ret) {
-			task->state = TASK_STATE_IDLE;
-			resched = 1;
+			if (task->state != TASK_STATE_DRAINING) {
+				task->state = TASK_STATE_IDLE;
+				resched = 1;
+			} else {
+				cont = 1;
+			}
 			goto exit;
 		}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:27:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368502; cv=none; b=EPwXzYsY6C8aKv3t6PQNiPuPvAQlVdv+XiMLB8Watv6NDtUUM4poMiMjaj57HhiC/lIV57ask1g2WzImtT+oIeHDsmBdddIVin9LJFkHRIbq0gdGMGKs+Tl7lhmZYU8jqQjQCYO6KlVkh3hhDrRhjTG78l25a4jQEDSx9vkPgFQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368502; c=relaxed/simple;
	bh=fkNjWNc7KuQnSD8BmK71MA3KSfMmz/Jx8meR13Ac9bg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=aTcDcTjXSp88Kn8qhPNuGMyZw7hCSRO1oDi6RfiHP+v/izXfbcYwhzH7jgUe+X3llNAlv/PFZK8egtuImgapHDoyWbIsmYBaffHdWjdCrzyn2GDvAECL0RcnTimvs6iJYlI4YO6jCx347h5TCi7Qaykkg/1fHBW0jFIzOnclKgs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=O3LHt/pz; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chenghai Huang <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 176/262] crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs
Date: Mon, 13 Oct 2025 16:45:18 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chenghai Huang <[email-masked]>

[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ]

When the initialization of qm->debug.acc_diff_reg fails,
the probe process does not exit. However, after qm->debug.qm_diff_regs is
freed, it is not set to NULL. This can lead to a double free when the
remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs
should be set to NULL after it is freed.

Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue")
Signed-off-by: Chenghai Huang <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/crypto/hisilicon/debugfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c
index 45e130b901eb5..17eb236e9ee4d 100644
--- a/drivers/crypto/hisilicon/debugfs.c
+++ b/drivers/crypto/hisilicon/debugfs.c
@@ -888,6 +888,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm,
 		dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
 		ret = PTR_ERR(qm->debug.acc_diff_regs);
 		qm->debug.acc_diff_regs = NULL;
+		qm->debug.qm_diff_regs = NULL;
 		return ret;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:29:13 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368601; cv=none; b=r0BSAvDxrYvDbVVWgDbmqdjPEv5NPnW3rJ0Ic/37QEnUoumius+Gf5ttVBDMTQUqS2cWfZhO5A9CqWWP7TJc131B4PTn0+sBi0JfNin0M82WKMBi1DUou0x1o8F2Y7FCcHeoPweB8zoNhmzY8N7W81OZncpL00c7UVJTaeo32WM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368601; c=relaxed/simple;
	bh=dN2MRB3lHnC/lv8O4z3R50J0HSBOlkhFAQBADuxH8V4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=GwfDHnIcPnvHaqGDaFRwRVYG/NCwfu1fPoYE5t1jNoZgGqjlOUxyMwb9D1eWMu/OBcqwhWBKgHTxcVUBc2iWruKX9HKVN7keHAP/Y8TK8hx14d6LYrHeL5Q5lwNeX5GXUuEsCKpvOwWHL+Ask3t5oTphYzfiaRCFIvxnhfJ3jpc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=H7vslPsi; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zilin Guan <[email-masked]>,
	Brett Creeley <[email-masked]>,
	Alex Williamson <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 175/262] vfio/pds: replace bitmap_free with vfree
Date: Mon, 13 Oct 2025 16:45:17 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zilin Guan <[email-masked]>

[ Upstream commit acb59a4bb8ed34e738a4c3463127bf3f6b5e11a9 ]

host_seq_bmp is allocated with vzalloc but is currently freed with
bitmap_free, which uses kfree internally. This mismach prevents the
resource from being released properly and may result in memory leaks
or other issues.

Fix this by freeing host_seq_bmp with vfree to match the vzalloc
allocation.

Fixes: f232836a9152 ("vfio/pds: Add support for dirty page tracking")
Signed-off-by: Zilin Guan <[email-masked]>
Reviewed-by: Brett Creeley <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alex Williamson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/vfio/pci/pds/dirty.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vfio/pci/pds/dirty.c b/drivers/vfio/pci/pds/dirty.c
index c51f5e4c3dd6d..481992142f790 100644
--- a/drivers/vfio/pci/pds/dirty.c
+++ b/drivers/vfio/pci/pds/dirty.c
@@ -82,7 +82,7 @@ static int pds_vfio_dirty_alloc_bitmaps(struct pds_vfio_region *region,
 
 	host_ack_bmp = vzalloc(bytes);
 	if (!host_ack_bmp) {
-		bitmap_free(host_seq_bmp);
+		vfree(host_seq_bmp);
 		return -ENOMEM;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:30:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368479; cv=none; b=uCU8rhSEvBFJNDx0XpU5atFJ16lzaBrsPcE8+Fn2ylXhdJcEIGM0MBlb8ZQxy6x0wyyJQU4AoYxUt6Zfznc+dTHomgLHs2JXkp6QdCqITDhQIKvgPDd95aXW0bb0+eKJtIF1SmfQ10koGFjCFF/LgOL5NwDfAqGQH3Tv7nPIGuA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368479; c=relaxed/simple;
	bh=gmqM+tT7SafqVkNnISlkBsMDrYyMIH7awv3hMTIaiuI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=LVl+/+ssGWNvTJbZ9LYCMxwx239YDd/Bu/b1fJ75yIYGxdhKUjnvcPB6cWJ+XWAxY+1ElowIknXzwlPIP90Secd4G56la4Y0R/qBjYlw9WBElXtcbf3Z5VNximA+Q7KyRCfDKaB1bFW3EAxAWnjO5hc9vL8OB6PsblAc74mJUZc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rjB8yDPk; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michael Karcher <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Sasha Levin <[email-masked]>,
	John Paul Adrian Glaubitz <[email-masked]>,
	Tony Rodriguez <[email-masked]>
Subject: [PATCH 6.12 174/262] sparc: fix accurate exception reporting in copy_{from,to}_user for M7
Date: Mon, 13 Oct 2025 16:45:16 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Karcher <[email-masked]>

[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a couple of bad
calculations. This will fix the return value of copy_from_user and
copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.

Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy")
Tested-by: John Paul Adrian Glaubitz <[email-masked]> # on Oracle SPARC S7
Tested-by: Tony Rodriguez <[email-masked]> # S7, see https://lore.kernel.org/r/[email-masked]
Signed-off-by: Michael Karcher <[email-masked]>
Reviewed-by: Andreas Larsson <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Andreas Larsson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/sparc/lib/M7memcpy.S     | 20 ++++++++++----------
 arch/sparc/lib/Memcpy_utils.S |  9 +++++++++
 2 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S
index cbd42ea7c3f7c..99357bfa8e82a 100644
--- a/arch/sparc/lib/M7memcpy.S
+++ b/arch/sparc/lib/M7memcpy.S
@@ -696,16 +696,16 @@ FUNC_NAME:
 	EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40)
 	faligndata %f24, %f26, %f10
 	EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40)
-	EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40)
+	EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32)
 	faligndata %f26, %f28, %f12
-	EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40)
+	EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32)
 	add	%o4, 64, %o4
-	EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40)
+	EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24)
 	faligndata %f28, %f30, %f14
-	EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40)
-	EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40)
+	EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24)
+	EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16)
 	add	%o0, 64, %o0
-	EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40)
+	EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8)
 	fsrc2	%f30, %f14
 	bgu,pt	%xcc, .Lunalign_sloop
 	 prefetch [%o4 + (8 * BLOCK_SIZE)], 20
@@ -728,7 +728,7 @@ FUNC_NAME:
 	add	%o4, 8, %o4
 	faligndata %f0, %f2, %f16
 	subcc	%o5, 8, %o5
-	EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5)
+	EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8)
 	fsrc2	%f2, %f0
 	bgu,pt	%xcc, .Lunalign_by8
 	 add	%o0, 8, %o0
@@ -772,7 +772,7 @@ FUNC_NAME:
 	subcc	%o5, 0x20, %o5
 	EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
 	EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
-	EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
+	EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
 	EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
 	bne,pt	%xcc, 1b
 	 add	%o0, 0x20, %o0
@@ -804,12 +804,12 @@ FUNC_NAME:
 	brz,pt	%o3, 2f
 	 sub	%o2, %o3, %o2
 
-1:	EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1)
+1:	EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3)
 	add	%o1, 1, %o1
 	subcc	%o3, 1, %o3
 	add	%o0, 1, %o0
 	bne,pt	%xcc, 1b
-	 EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1)
+	 EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1)
 2:
 	and	%o1, 0x7, %o3
 	brz,pn	%o3, .Lmedium_noprefetch_cp
diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S
index 64fbac28b3db1..207343367bb2d 100644
--- a/arch/sparc/lib/Memcpy_utils.S
+++ b/arch/sparc/lib/Memcpy_utils.S
@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8)
 	ba,pt	%xcc, __restore_asi
 	 add	%o2, 8, %o0
 ENDPROC(memcpy_retl_o2_plus_63_8)
+ENTRY(memcpy_retl_o2_plus_o3)
+	ba,pt	%xcc, __restore_asi
+	 add	%o2, %o3, %o0
+ENDPROC(memcpy_retl_o2_plus_o3)
+ENTRY(memcpy_retl_o2_plus_o3_plus_1)
+	add	%o3, 1, %o3
+	ba,pt	%xcc, __restore_asi
+	 add	%o2, %o3, %o0
+ENDPROC(memcpy_retl_o2_plus_o3_plus_1)
 ENTRY(memcpy_retl_o2_plus_o5)
 	ba,pt	%xcc, __restore_asi
 	 add	%o2, %o5, %o0
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:42:20 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368476; cv=none; b=k2bvvjAJZO+N9Mq9b1jWeOjUNl+r5XY0HLDLh3STPEiRGTPpTDrSI8fTwFRW5i/LZI9M2yuXwKYNUdEn6W0C1atyjDqiGR2NQYe4tnias3IPzAIvrrzqE70SGvlujZCkT67Far7rsRdycjiZ9gnL9NORLxlq9rP3Z1migtCjJ2U=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368476; c=relaxed/simple;
	bh=7OhCsowzkoqkRm31uaABjxVl60CDsp0Qz7XUL0hMObQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=iVoQf/8ULDN83J9CR8VisDHQv+lv3+nQUNAB2zkfv5Van3ktB9hAiDp6hNs/eEBayqdcF+wLiciXBipMdr0u3DvhqeD+9fneZWWDzYzKZLWH58b1WH7y3vfl8qqV4yt4yATia8aJbC0rDw1bS8//fT5dnaDLexz39KPkg+VI69w=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DZDDH5J7; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michael Karcher <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Sasha Levin <[email-masked]>,
	John Paul Adrian Glaubitz <[email-masked]>
Subject: [PATCH 6.12 173/262] sparc: fix accurate exception reporting in copy_to_user for Niagara 4
Date: Mon, 13 Oct 2025 16:45:15 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Karcher <[email-masked]>

[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a bad calculation.
This will fix the return value of copy_to_user in a specific faulting case.
The behaviour of memcpy stays unchanged.

Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <[email-masked]> # on Oracle SPARC T4-1
Signed-off-by: Michael Karcher <[email-masked]>
Reviewed-by: Andreas Larsson <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Andreas Larsson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/sparc/lib/NG4memcpy.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
index 7ad58ebe0d009..df0ec1bd19489 100644
--- a/arch/sparc/lib/NG4memcpy.S
+++ b/arch/sparc/lib/NG4memcpy.S
@@ -281,7 +281,7 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 	subcc		%o5, 0x20, %o5
 	EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
 	EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
-	EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
+	EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
 	EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
 	bne,pt		%icc, 1b
 	 add		%o0, 0x20, %o0
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:30:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368473; cv=none; b=kFnMCQrfFGsBLUKQ9EBaxunr4Fu6odDznzcwrGSp++nLU1TTWK3wdB2ny0AayiSr0PjcJ22X45h8/7G+uFH+ze79MOQJFhfbmp5Srl1YKU1F58iH5qqpaWxurB2Pvh1avKWQZWL/8wehVHTWxZPR1rU91XejCQbTwMO1oBmqWEA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368473; c=relaxed/simple;
	bh=wWMm634zhoF0BnCHtKpxWsO2fBiOzE1vcKFEuYrWDkU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=QUM4LqwvWfUMP0sTS44ITxZGay0QeV/7gi8QrLPPRezrN2hdKGGGHcFNiTwR6JBQu4ED0sX4jThgjxSJQRPVueYIoMQs3MAXO5I8bFshY0wlqiI6rlxEeNEnl5KB6aHTQizycYTHIQkO/T+RI7rMKyTxhgT9O4Ag9eYeg6xF1l8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zLIuu2r/; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michael Karcher <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Sasha Levin <[email-masked]>,
	John Paul Adrian Glaubitz <[email-masked]>,
	Magnus Lindholm <[email-masked]>,
	Ethan Hawke <[email-masked]>,
	Ken Link <[email-masked]>
Subject: [PATCH 6.12 172/262] sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
Date: Mon, 13 Oct 2025 16:45:14 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Karcher <[email-masked]>

[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a couple of bad
calculations and a broken epilogue in the exception handlers. This will
prevent crashes and ensure correct return values of copy_from_user and
copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.

Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <[email-masked]> # on SPARC T4 with modified kernel to use Niagara 1 code
Tested-by: Magnus Lindholm <[email-masked]> # on Sun Fire T2000
Signed-off-by: Michael Karcher <[email-masked]>
Tested-by: Ethan Hawke <[email-masked]> # on Sun Fire T2000
Tested-by: Ken Link <[email-masked]> # on Sun Fire T1000
Reviewed-by: Andreas Larsson <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Andreas Larsson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
index ee51c12306894..bbd3ea0a64822 100644
--- a/arch/sparc/lib/NGmemcpy.S
+++ b/arch/sparc/lib/NGmemcpy.S
@@ -79,8 +79,8 @@
 #ifndef EX_RETVAL
 #define EX_RETVAL(x)	x
 __restore_asi:
-	ret
 	wr	%g0, ASI_AIUS, %asi
+	ret
 	 restore
 ENTRY(NG_ret_i2_plus_i4_plus_1)
 	ba,pt	%xcc, __restore_asi
@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56)
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, %g1, %i0
 ENDPROC(NG_ret_i2_plus_g1_minus_56)
-ENTRY(NG_ret_i2_plus_i4)
+ENTRY(NG_ret_i2_plus_i4_plus_16)
+        add     %i4, 16, %i4
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, %i4, %i0
-ENDPROC(NG_ret_i2_plus_i4)
-ENTRY(NG_ret_i2_plus_i4_minus_8)
-	sub	%i4, 8, %i4
+ENDPROC(NG_ret_i2_plus_i4_plus_16)
+ENTRY(NG_ret_i2_plus_i4_plus_8)
+	add	%i4, 8, %i4
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, %i4, %i0
-ENDPROC(NG_ret_i2_plus_i4_minus_8)
+ENDPROC(NG_ret_i2_plus_i4_plus_8)
 ENTRY(NG_ret_i2_plus_8)
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, 8, %i0
@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4)
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, %i4, %i0
 ENDPROC(NG_ret_i2_and_7_plus_i4)
+ENTRY(NG_ret_i2_and_7_plus_i4_plus_8)
+	and	%i2, 7, %i2
+	add	%i4, 8, %i4
+	ba,pt	%xcc, __restore_asi
+	 add	%i2, %i4, %i0
+ENDPROC(NG_ret_i2_and_7_plus_i4)
 #endif
 
 	.align		64
@@ -405,13 +412,13 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
 	andn		%i2, 0xf, %i4
 	and		%i2, 0xf, %i2
 1:	subcc		%i4, 0x10, %i4
-	EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4)
+	EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16)
 	add		%i1, 0x08, %i1
-	EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4)
+	EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16)
 	sub		%i1, 0x08, %i1
-	EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4)
+	EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16)
 	add		%i1, 0x8, %i1
-	EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8)
+	EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8)
 	bgu,pt		%XCC, 1b
 	 add		%i1, 0x8, %i1
 73:	andcc		%i2, 0x8, %g0
@@ -468,7 +475,7 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
 	subcc		%i4, 0x8, %i4
 	srlx		%g3, %i3, %i5
 	or		%i5, %g2, %i5
-	EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4)
+	EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8)
 	add		%o0, 0x8, %o0
 	bgu,pt		%icc, 1b
 	 sllx		%g3, %g1, %g2
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:52:57 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368470; cv=none; b=Pc0D2MTk6khgCp1ZH6dwuSh5AhXn1ss1CltHNjHUlU4gSdEBzrna24eR1u2iEMnR6fBZ9Jo4QjJJzXRrK3FLF5kn0OAdQFDVu6U9lIeP2Wof20gjwjYGcZ9wuX7w9WKDkj50P8Esru1FyGefyBXTZ98FOb3JZbMDgh1mJTguy+A=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368470; c=relaxed/simple;
	bh=L5LGzjbOosYDEQqtKqy7ti+zvFFq3GQqTDFrNgG8ic4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=V+M+7KziM30obFyNWI2iZQsNH026/T1wkbcxtp3Kw5eNRzGFZXb251CKd6gTn3i5ngmPONSCFWzBC0OVxY3m4TwcG2g/cxbFhHxgO4ZWVeXPLYkO6G5OToy3SU9FbMjhvTQT3QyAzDHbiplAR8gpNEFTg4N/ITtzCmjC0AfuouI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Z0jSNwEL; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Anthony Yznaga <[email-masked]>,
	Michael Karcher <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Sasha Levin <[email-masked]>,
	John Paul Adrian Glaubitz <[email-masked]>,
	=?UTF-8?q?Ren=C3=A9=20Rebe?= <[email-masked]>
Subject: [PATCH 6.12 171/262] sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
Date: Mon, 13 Oct 2025 16:45:13 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Karcher <[email-masked]>

[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]

Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios
enabled resulted from copy_from_user() returning impossibly large values
greater than the size to be copied. This lead to __copy_from_iter()
returning impossible values instead of the actual number of bytes it was
able to copy.

The BUG_ON has been reported in
https://lore.kernel.org/r/[email-masked]

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. The exception handlers expect that
%o2 has already been masked during the bulk copy loop, but the masking was
performed after that loop. This will fix the return value of copy_from_user
and copy_to_user in the faulting case. The behaviour of memcpy stays
unchanged.

Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <[email-masked]> # on Sun Netra 240
Reviewed-by: Anthony Yznaga <[email-masked]>
Tested-by: René Rebe <[email-masked]> # on UltraSparc III+ and UltraSparc IIIi
Signed-off-by: Michael Karcher <[email-masked]>
Reviewed-by: Andreas Larsson <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Andreas Larsson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/sparc/lib/U3memcpy.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
index 9248d59c734ce..bace3a18f836f 100644
--- a/arch/sparc/lib/U3memcpy.S
+++ b/arch/sparc/lib/U3memcpy.S
@@ -267,6 +267,7 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 	faligndata	%f10, %f12, %f26
 	EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2)
 
+	and		%o2, 0x3f, %o2
 	subcc		GLOBAL_SPARE, 0x80, GLOBAL_SPARE
 	add		%o1, 0x40, %o1
 	bgu,pt		%XCC, 1f
@@ -336,7 +337,6 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 	 * Also notice how this code is careful not to perform a
 	 * load past the end of the src buffer.
 	 */
-	and		%o2, 0x3f, %o2
 	andcc		%o2, 0x38, %g2
 	be,pn		%XCC, 2f
 	 subcc		%g2, 0x8, %g2
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:50:29 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368461; cv=none; b=eXvIfGJbn5hBw6uhh5+aUIT5aJeiPAA/8stv8vrCQn6tyE25KaA7DfseguXXfRd3QgNI73FvN9AhKQABjUu5e50+ieUP0GwaysatqHzXxmtX9zJMdcIiXONiTX8YwbWBqZtn/YxIgq7sF640aq5PNNErmsWEu/zaWdrj+IItT9E=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368461; c=relaxed/simple;
	bh=bUNzVXWC4XuwTFFJO7uihZbbjPBzkI0cz15/zwlCP1Y=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=SLA3P5aRauS5OZlQ+hHTJTdpcEge75tqEEcpEw3wO7/ar+75WoOCEgKYjHHJAa93OZFscSh9OMkaP0BqcXEj7GTuKRj1xfpPFSxZSkxsI55FtLcTGI8JJHWS+WB2m7pEQvkEUtIl3vf8npsNM41kh8ExJiCagqqNoTgxTRCuv3w=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zfFpqlYs; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Richard Fitzgerald <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 169/262] ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback
Date: Mon, 13 Oct 2025 16:45:11 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Richard Fitzgerald <[email-masked]>

[ Upstream commit 87cab86925b7fa4c1c977bc191ac549a3b23f0ea ]

In create_sdw_dailink() check that sof_end->codec_info->add_sidecar
is not NULL before calling it.

The original code assumed that if include_sidecar is true, the codec
on that link has an add_sidecar callback. But there could be other
codecs on the same link that do not have an add_sidecar callback.

Fixes: da5244180281 ("ASoC: Intel: sof_sdw: Add callbacks to register sidecar devices")
Signed-off-by: Richard Fitzgerald <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 sound/soc/intel/boards/sof_sdw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
index 5911a05586516..00d840d5e585c 100644
--- a/sound/soc/intel/boards/sof_sdw.c
+++ b/sound/soc/intel/boards/sof_sdw.c
@@ -741,7 +741,7 @@ static int create_sdw_dailink(struct snd_soc_card *card,
 			(*codec_conf)++;
 		}
 
-		if (sof_end->include_sidecar) {
+		if (sof_end->include_sidecar && sof_end->codec_info->add_sidecar) {
 			ret = sof_end->codec_info->add_sidecar(card, dai_links, codec_conf);
 			if (ret)
 				return ret;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:52:14 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368452; cv=none; b=m5hrI2+9HS5Fc48lZlOXrl5nEnUDyaFQckmlgBf22jVka0JCakj+44XYXUBccClAugl84pgBRg4bGCO9G6aoaH2bKJ/sMFFToChl4ZUnHXp74A6KGpt2YYcw2XV0HS4f7v7oO3r/4w7ddSAjHOUr5N1WukFpqFEabKURFvd6Xyk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368452; c=relaxed/simple;
	bh=4qmZPRBYmK5+GONLJtVkyQDDeW1gUqohvHsNigLUfuM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=iMtmTlorhsTbeEBc5D9z+E2ARMKxW0YBWtLdr5YCXptj1/mbncCNeAHzc06xjnEKt9gE4EisaHp0usRRaeuDkgJxZ55o9GUY5b/cGtJHYQ2Y9aLzci+YuDr4m8FqOlA8Oz+f51ZknWRFjwct+1oirSRrJ0Nx3ZJNPV1x/cEALVg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OIXsHsiS; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Paul Menzel <[email-masked]>,
	Baochen Qiang <[email-masked]>,
	Vasanthakumar Thiagarajan <[email-masked]>,
	Jeff Johnson <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 166/262] wifi: ath10k: avoid unnecessary wait for service ready message
Date: Mon, 13 Oct 2025 16:45:08 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Baochen Qiang <[email-masked]>

[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]

Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before
failing") works around the failure in waiting for the service ready
message by active polling. Note the polling is triggered after initial
wait timeout, which means that the wait-till-timeout can not be avoided
even the message is ready.

A possible fix is to do polling once before wait as well, however this
can not handle the race that the message arrives right after polling.
So the solution is to do periodic polling until timeout.

Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1

Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing")
Reported-by: Paul Menzel <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]
Signed-off-by: Baochen Qiang <[email-masked]>
Reviewed-by: Vasanthakumar Thiagarajan <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jeff Johnson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++--------------
 1 file changed, 19 insertions(+), 20 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 09066e6aca402..fdab67a56e438 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -1764,33 +1764,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,
 
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
 {
+	unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ;
 	unsigned long time_left, i;
 
-	time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
-						WMI_SERVICE_READY_TIMEOUT_HZ);
-	if (!time_left) {
-		/* Sometimes the PCI HIF doesn't receive interrupt
-		 * for the service ready message even if the buffer
-		 * was completed. PCIe sniffer shows that it's
-		 * because the corresponding CE ring doesn't fires
-		 * it. Workaround here by polling CE rings once.
-		 */
-		ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
-
+	/* Sometimes the PCI HIF doesn't receive interrupt
+	 * for the service ready message even if the buffer
+	 * was completed. PCIe sniffer shows that it's
+	 * because the corresponding CE ring doesn't fires
+	 * it. Workaround here by polling CE rings. Since
+	 * the message could arrive at any time, continue
+	 * polling until timeout.
+	 */
+	do {
 		for (i = 0; i < CE_COUNT; i++)
 			ath10k_hif_send_complete_check(ar, i, 1);
 
+		/* The 100 ms granularity is a tradeoff considering scheduler
+		 * overhead and response latency
+		 */
 		time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
-							WMI_SERVICE_READY_TIMEOUT_HZ);
-		if (!time_left) {
-			ath10k_warn(ar, "polling timed out\n");
-			return -ETIMEDOUT;
-		}
-
-		ath10k_warn(ar, "service ready completion received, continuing normally\n");
-	}
+							msecs_to_jiffies(100));
+		if (time_left)
+			return 0;
+	} while (time_before(jiffies, timeout));
 
-	return 0;
+	ath10k_warn(ar, "failed to receive service ready completion\n");
+	return -ETIMEDOUT;
 }
 
 int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:48:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368446; cv=none; b=cT8Fc/nIE3xmr6o7+q7uCB6NtnzunlT+Ng2RDyQH/DiJE3SD1QnCuwU6HjMN/jgouWVjny4ZxysTlZJKinwKKKQNH1FMFAh+hDZWxPUPbAEtZ71hQMoNst3ddmbMrfy9vwsGzNBNsJsb9w50YOcEV0GFUQh1x0hDBrsYjee4VFM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368446; c=relaxed/simple;
	bh=pggi2wGubKR+iHMkCTnofBszBFtTA+68/+TjKuVXvgE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=AdZE8Rno58XIu/Fz3TiVonT9dPyBEjZ+vqlW7axK96O1aYnfXckc8t3GCkGd/JO+9PpvGqLWhsUwArA5wrcaQ8CuKN891srEU6+nOnz80Jg/F3RVEDpnUBlMxRkfKjYYygbjhJ78k2seUTq0o8lmdiPAjg4lJbTOzsXikCcHyI8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Da8IdU1J; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Tom Zanussi <[email-masked]>,
	"Masami Hiramatsu (Google)" <[email-masked]>,
	Bagas Sanjaya <[email-masked]>,
	"Steven Rostedt (Google)" <[email-masked]>,
	Jonathan Corbet <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 164/262] Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
Date: Mon, 13 Oct 2025 16:45:06 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bagas Sanjaya <[email-masked]>

[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ]

Section heading for sched_waking histogram is shown as normal paragraph
instead due to codeblock marker for the following diagram being in the
same line as the section underline. Separate them.

Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst")
Reviewed-by: Tom Zanussi <[email-masked]>
Reviewed-by: Masami Hiramatsu (Google) <[email-masked]>
Signed-off-by: Bagas Sanjaya <[email-masked]>
Acked-by: Steven Rostedt (Google) <[email-masked]>
Signed-off-by: Jonathan Corbet <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 Documentation/trace/histogram-design.rst | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst
index 5765eb3e9efa7..a30f4bed11b4e 100644
--- a/Documentation/trace/histogram-design.rst
+++ b/Documentation/trace/histogram-design.rst
@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking
 trigger above.
 
 sched_waking histogram
-----------------------::
+----------------------
+
+.. code-block::
 
   +------------------+
   | hist_data        |<-------------------------------------------------------+
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:38:49 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368443; cv=none; b=eJjA87dkiKG9BzMdr7UcnflnpgLYKAGJ7twQUxWnGyPlYkwCRBHRcK4idYI/glBzyNdk73DiZ2rGSyJbE02mH0ocCXGdeAVO5e36kgQ8mbWxV99f2wY3DcAAlVeZiBXbXNNu5miYF/M2YHSMPLBozF0AmpP4QT8OztUeTjDl8Vs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368443; c=relaxed/simple;
	bh=Jf1BS8nHnjoo5U+q15tNDlW7uFXJ7ZDf/lzRQrTg/QE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=lJNmSp2DQTzL6iN3cbV45DekU9a20fbmFy/6BuTccQ1KH9Ieezne9owYlQnSopLKou3Aoq+2YJH9DepOAW3Lsy7JVtRbU0OPSg3EfaUJxB8bTil+Z2Zst+VdGLRXzF94HWSBSfKpI8f5BGxFcC9hgs8gQF71GazsVqAsaaKVVqs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=pfxNgQVr; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Vlad Dumitrescu <[email-masked]>,
	Mark Zhang <[email-masked]>,
	Edward Srouji <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 163/262] IB/sa: Fix sa_local_svc_timeout_ms read race
Date: Mon, 13 Oct 2025 16:45:05 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vlad Dumitrescu <[email-masked]>

[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]

When computing the delta, the sa_local_svc_timeout_ms is read without
ib_nl_request_lock held. Though unlikely in practice, this can cause
a race condition if multiple local service threads are managing the
timeout.

Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
Signed-off-by: Vlad Dumitrescu <[email-masked]>
Reviewed-by: Mark Zhang <[email-masked]>
Signed-off-by: Edward Srouji <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Leon Romanovsky <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/core/sa_query.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 53571e6b3162c..66df5bed6a562 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1013,6 +1013,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
 	if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
 		timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
 
+	spin_lock_irqsave(&ib_nl_request_lock, flags);
+
 	delta = timeout - sa_local_svc_timeout_ms;
 	if (delta < 0)
 		abs_delta = -delta;
@@ -1020,7 +1022,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
 		abs_delta = delta;
 
 	if (delta != 0) {
-		spin_lock_irqsave(&ib_nl_request_lock, flags);
 		sa_local_svc_timeout_ms = timeout;
 		list_for_each_entry(query, &ib_nl_request_list, list) {
 			if (delta < 0 && abs_delta > query->timeout)
@@ -1038,9 +1039,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
 		if (delay)
 			mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
 					 (unsigned long)delay);
-		spin_unlock_irqrestore(&ib_nl_request_lock, flags);
 	}
 
+	spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+
 settimeout_out:
 	return 0;
 }
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:41:26 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368440; cv=none; b=aXROD8lzlkJZDCr+UUYTPQ6IzLW3jfVtCp+PcT8lzFdLHy9nQXXGPmxjm8zlPPDwA7tviOIs4Cm4dECkRqTwqTSkgPxQlR5Hu11B3CTnwyidpt7T1uN3O6b86miHiLuxsyO88ZnFT02c8D3P57WrApm3GJqsTzx4sc7ZjKaRJVI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368440; c=relaxed/simple;
	bh=LXRMzzuMkA4HwMK5h32oFYseboCnxYDVMUIHSble2oQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=te4iy4w6nRosNoaYbfgMdHQaspdw4LaShgu1j5sNFUhe738LwtqPdeYngefBJQg2W3uMrx+WwLqUyaLRcGvftt5AnVvukDfG7FjvgM1zbwEVXNfHdq6gV4uRe8fOLcQ8BO8fTopsNaQ3nqkGGinUAv8wLnDh1pJRZJY4uPJMA2Q=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=k4/MlRrN; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Parav Pandit <[email-masked]>,
	Vlad Dumitrescu <[email-masked]>,
	Edward Srouji <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 162/262] RDMA/core: Resolve MAC of next-hop device without ARP support
Date: Mon, 13 Oct 2025 16:45:04 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Parav Pandit <[email-masked]>

[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]

Currently, if the next-hop netdevice does not support ARP resolution,
the destination MAC address is silently set to zero without reporting
an error. This leads to incorrect behavior and may result in packet
transmission failures.

Fix this by deferring MAC resolution to the IP stack via neighbour
lookup, allowing proper resolution or error reporting as appropriate.

Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)")
Signed-off-by: Parav Pandit <[email-masked]>
Reviewed-by: Vlad Dumitrescu <[email-masked]>
Signed-off-by: Edward Srouji <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Leon Romanovsky <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/core/addr.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index be0743dac3fff..929e89841c12a 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -454,14 +454,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst,
 {
 	int ret = 0;
 
-	if (ndev_flags & IFF_LOOPBACK) {
+	if (ndev_flags & IFF_LOOPBACK)
 		memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
-	} else {
-		if (!(ndev_flags & IFF_NOARP)) {
-			/* If the device doesn't do ARP internally */
-			ret = fetch_ha(dst, addr, dst_in, seq);
-		}
-	}
+	else
+		ret = fetch_ha(dst, addr, dst_in, seq);
 	return ret;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:55:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368437; cv=none; b=n4sCTE0oW80l2Igv1+MTHlB+u7SkDliH5cWCFgm5PZ6y3tGe1lrIHzsPSe+zspTallzV+pnCmnp2DIXC8Rzahyu1j9L8ASj3dAmDwYMECSd1wAusW9T7TBlSvPI958pWQVuU9zTiUkwuHcAyZLX+eroxa2/GgCBQ0fj/X6OiN2o=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368437; c=relaxed/simple;
	bh=JmVtGQIv17bBPIax8MbqrtBGxCQfHvdmNy6jKuyTExI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=L0Kk998aGp/Ay997ftQYiyDTHm7YfXKOYKG5TbQwSFiJzn37gputTnn7MRFyYeVMMdvhYn3ZvlUHssQ1Es2KMR8OdOr6erfQCK63ISSJwTRv4GIIVufTYNN4+/aysfdXT1L99iMK7XMpU9JNL2xsXnj4zFjjXVcI0+PAXTPqSFg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bXECS2pj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michal Pecio <[email-masked]>,
	Mathias Nyman <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 161/262] Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"
Date: Mon, 13 Oct 2025 16:45:03 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michal Pecio <[email-masked]>

[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ]

This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3.

No actual HW bugs are known where Endpoint Context shows Running state
but Stop Endpoint fails repeatedly with Context State Error and leaves
the endpoint state unchanged. Stop Endpoint retries on Running EPs have
been performed since early 2021 with no such issues reported so far.

Trying to handle this hypothetical case brings a more realistic danger:
if Stop Endpoint fails on an endpoint which hasn't yet started after a
doorbell ring and enough latency occurs before this completion event is
handled, the driver may time out and begin removing cancelled TDs from
a running endpoint, even though one more retry would stop it reliably.

Such high latency is rare but not impossible, and removing TDs from a
running endpoint can cause more damage than not giving back a cancelled
URB (which wasn't happening anyway). So err on the side of caution and
revert to the old policy of always retrying if the EP appears running.

[Remove stable tag as we are dealing with theoretical cases -Mathias]

Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running")
Signed-off-by: Michal Pecio <[email-masked]>
Signed-off-by: Mathias Nyman <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/usb/host/xhci-ring.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 1002fa51a25aa..f377725a12128 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1199,19 +1199,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
 			 * Stopped state, but it will soon change to Running.
 			 *
 			 * Assume this bug on unexpected Stop Endpoint failures.
-			 * Keep retrying until the EP starts and stops again.
+			 * Keep retrying until the EP starts and stops again, on
+			 * chips where this is known to help. Wait for 100ms.
 			 */
+			if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
+				break;
 			fallthrough;
 		case EP_STATE_RUNNING:
 			/* Race, HW handled stop ep cmd before ep was running */
 			xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n",
 					GET_EP_CTX_STATE(ep_ctx));
-			/*
-			 * Don't retry forever if we guessed wrong or a defective HC never starts
-			 * the EP or says 'Running' but fails the command. We must give back TDs.
-			 */
-			if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
-				break;
 
 			command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
 			if (!command) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:25:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368434; cv=none; b=JOBQiWg34eFfj+xG2VyQMQwBXq40byFJAHqkNJbriBKH/6ZcjWlubaAWmsAOuK8Gkcav1iuOQXvBedSY5IDffDfqZQsCLLUqAegKThqqAI4KxN5TnCXzsQfemQYZfG3vKVmGpMoCyzl0qb5YKLY5kyyT6ecivuc7WEkfgZIF76Q=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368434; c=relaxed/simple;
	bh=0oxSeif3SZGcH7MQi9Sr9y8BX7DuNVpvnRaasDSdLSs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=SSG+PLZ8WJKYtZ/7WgqGEcmmB8Wln2vboijqANVldCGjMzapb0TKl1BbqUN7InulTgJ/pMw1PuVKU2dZLR+F/JZ0ukXLEtnsCXylfhzqSrmiMdYMsUEXstZPuQhbqGfwcPVEsnDAC08fDikhgszq3P5ZoqYtJa+zTaPfzafjnlA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Hedq7JMQ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	wangzijie <[email-masked]>,
	Chao Yu <[email-masked]>,
	Jaegeuk Kim <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 160/262] f2fs: fix zero-sized extent for precache extents
Date: Mon, 13 Oct 2025 16:45:02 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: wangzijie <[email-masked]>

[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ]

Script to reproduce:
f2fs_io write 1 0 1881 rand dsync testfile
f2fs_io fallocate 0 7708672 4096 testfile
f2fs_io write 1 1881 1 rand buffered testfile
fsync testfile
umount
mount
f2fs_io precache_extents testfile

When the data layout is something like this:
dnode1:                     dnode2:
[0]      A                  [0]    NEW_ADDR
[1]      A+1                [1]    0x0
...
[1016]   A+1016
[1017]   B (B!=A+1017)      [1017] 0x0

During precache_extents, we map the last block(valid blkaddr) in dnode1:
map->m_flags |= F2FS_MAP_MAPPED;
map->m_pblk = blkaddr(valid blkaddr);
map->m_len = 1;
then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out:
map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent:

map->m_len = 1
ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1
ei.fofs = start_pgofs = 1882
ei.len = map->m_len - ofs = 1 - 1 = 0

Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent:
A,B,C is valid blkaddr
case1:
dnode1:                     dnode2:
[0]      A                  [0]    NEW_ADDR
[1]      A+1                [1]    0x0
...                         ....
[1016]   A+1016
[1017]   B (B!=A+1017)      [1017] 0x0

case2:
dnode1:                     dnode2:
[0]      A                  [0]    C (C!=B+1)
[1]      A+1                [1]    C+1
...                         ....
[1016]   A+1016
[1017]   B (B!=A+1017)      [1017] 0x0

case3:
dnode1:                     dnode2:
[0]      A                  [0]    C (C!=B+2)
[1]      A+1                [1]    C+1
...                         ....
[1015]   A+1015
[1016]   B (B!=A+1016)
[1017]   B+1                [1017] 0x0

[1] https://lore.kernel.org/linux-f2fs-devel/[email-masked]/

Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
Signed-off-by: wangzijie <[email-masked]>
Reviewed-by: Chao Yu <[email-masked]>
Signed-off-by: Jaegeuk Kim <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/f2fs/data.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index a008d70b9f5ec..040c06dfb8c03 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1781,9 +1781,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
 		if (map->m_flags & F2FS_MAP_MAPPED) {
 			unsigned int ofs = start_pgofs - map->m_lblk;
 
-			f2fs_update_read_extent_cache_range(&dn,
-				start_pgofs, map->m_pblk + ofs,
-				map->m_len - ofs);
+			if (map->m_len > ofs)
+				f2fs_update_read_extent_cache_range(&dn,
+					start_pgofs, map->m_pblk + ofs,
+					map->m_len - ofs);
 		}
 		if (map->m_next_extent)
 			*map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:29:04 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368429; cv=none; b=uYZE4SyfxbGr8vgC99pwcqafxPJ8XC35g7O8ZoG+XZxwalRIG0iP2l1iSpYAolu+tyZnfDvEGbiWdVMIWy4l99DadgFNr2NtYAk+U7l++1P+aGmo9W32eCgDTlVnFjxlMCEq9+DCTqpT6Vwy5F5MwC07uttGKuigtF0APrffRhE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368429; c=relaxed/simple;
	bh=2M+1eKBu0cvXq+H4LqnvI3qs317JXRBB/Zk/8xHJZdk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=HBAGinAIgic1H8ITAbPYs5P1TPKfezQP2FZ7NhkgelF+8lz0AQQx82q0Q27V9bJ1G+tZ87La6UEopvWMopjWv+OaDxtMLY/vyfHFEoyFqst+0Tmhw6JsfgxhKZrq+fWoKl7x2Px4kDJCRL/+E0KixINOqsqPa7XdJo4oWP8+z1E=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2j7Tc8VK; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Arnd Bergmann <[email-masked]>,
	Benjamin Tissoires <[email-masked]>,
	Jiri Kosina <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 159/262] HID: hidraw: tighten ioctl command parsing
Date: Mon, 13 Oct 2025 16:45:01 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Benjamin Tissoires <[email-masked]>

[ Upstream commit 75d5546f60b36900051d75ee623fceccbeb6750c ]

The handling for variable-length ioctl commands in hidraw_ioctl() is
rather complex and the check for the data direction is incomplete.

Simplify this code by factoring out the various ioctls grouped by dir
and size, and using a switch() statement with the size masked out, to
ensure the rest of the command is correctly matched.

Fixes: 9188e79ec3fd ("HID: add phys and name ioctls to hidraw")
Reported-by: Arnd Bergmann <[email-masked]>
Signed-off-by: Benjamin Tissoires <[email-masked]>
Signed-off-by: Jiri Kosina <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hid/hidraw.c        | 224 ++++++++++++++++++++----------------
 include/uapi/linux/hidraw.h |   2 +
 2 files changed, 124 insertions(+), 102 deletions(-)

diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index c887f48756f4b..bbd6f23bce789 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -394,27 +394,15 @@ static int hidraw_revoke(struct hidraw_list *list)
 	return 0;
 }
 
-static long hidraw_ioctl(struct file *file, unsigned int cmd,
-							unsigned long arg)
+static long hidraw_fixed_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
+				    void __user *arg)
 {
-	struct inode *inode = file_inode(file);
-	unsigned int minor = iminor(inode);
-	long ret = 0;
-	struct hidraw *dev;
-	struct hidraw_list *list = file->private_data;
-	void __user *user_arg = (void __user*) arg;
-
-	down_read(&minors_rwsem);
-	dev = hidraw_table[minor];
-	if (!dev || !dev->exist || hidraw_is_revoked(list)) {
-		ret = -ENODEV;
-		goto out;
-	}
+	struct hid_device *hid = dev->hid;
 
 	switch (cmd) {
 		case HIDIOCGRDESCSIZE:
-			if (put_user(dev->hid->rsize, (int __user *)arg))
-				ret = -EFAULT;
+			if (put_user(hid->rsize, (int __user *)arg))
+				return -EFAULT;
 			break;
 
 		case HIDIOCGRDESC:
@@ -422,113 +410,145 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
 				__u32 len;
 
 				if (get_user(len, (int __user *)arg))
-					ret = -EFAULT;
-				else if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
-					ret = -EINVAL;
-				else if (copy_to_user(user_arg + offsetof(
-					struct hidraw_report_descriptor,
-					value[0]),
-					dev->hid->rdesc,
-					min(dev->hid->rsize, len)))
-					ret = -EFAULT;
+					return -EFAULT;
+
+				if (len > HID_MAX_DESCRIPTOR_SIZE - 1)
+					return -EINVAL;
+
+				if (copy_to_user(arg + offsetof(
+				    struct hidraw_report_descriptor,
+				    value[0]),
+				    hid->rdesc,
+				    min(hid->rsize, len)))
+					return -EFAULT;
+
 				break;
 			}
 		case HIDIOCGRAWINFO:
 			{
 				struct hidraw_devinfo dinfo;
 
-				dinfo.bustype = dev->hid->bus;
-				dinfo.vendor = dev->hid->vendor;
-				dinfo.product = dev->hid->product;
-				if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))
-					ret = -EFAULT;
+				dinfo.bustype = hid->bus;
+				dinfo.vendor = hid->vendor;
+				dinfo.product = hid->product;
+				if (copy_to_user(arg, &dinfo, sizeof(dinfo)))
+					return -EFAULT;
 				break;
 			}
 		case HIDIOCREVOKE:
 			{
-				if (user_arg)
-					ret = -EINVAL;
-				else
-					ret = hidraw_revoke(list);
-				break;
+				struct hidraw_list *list = file->private_data;
+
+				if (arg)
+					return -EINVAL;
+
+				return hidraw_revoke(list);
 			}
 		default:
-			{
-				struct hid_device *hid = dev->hid;
-				if (_IOC_TYPE(cmd) != 'H') {
-					ret = -EINVAL;
-					break;
-				}
+			/*
+			 * None of the above ioctls can return -EAGAIN, so
+			 * use it as a marker that we need to check variable
+			 * length ioctls.
+			 */
+			return -EAGAIN;
+	}
 
-				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSFEATURE(0))) {
-					int len = _IOC_SIZE(cmd);
-					ret = hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
-					break;
-				}
-				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGFEATURE(0))) {
-					int len = _IOC_SIZE(cmd);
-					ret = hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
-					break;
-				}
+	return 0;
+}
 
-				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSINPUT(0))) {
-					int len = _IOC_SIZE(cmd);
-					ret = hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
-					break;
-				}
-				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGINPUT(0))) {
-					int len = _IOC_SIZE(cmd);
-					ret = hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
-					break;
-				}
+static long hidraw_rw_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
+					  void __user *user_arg)
+{
+	int len = _IOC_SIZE(cmd);
+
+	switch (cmd & ~IOCSIZE_MASK) {
+	case HIDIOCSFEATURE(0):
+		return hidraw_send_report(file, user_arg, len, HID_FEATURE_REPORT);
+	case HIDIOCGFEATURE(0):
+		return hidraw_get_report(file, user_arg, len, HID_FEATURE_REPORT);
+	case HIDIOCSINPUT(0):
+		return hidraw_send_report(file, user_arg, len, HID_INPUT_REPORT);
+	case HIDIOCGINPUT(0):
+		return hidraw_get_report(file, user_arg, len, HID_INPUT_REPORT);
+	case HIDIOCSOUTPUT(0):
+		return hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
+	case HIDIOCGOUTPUT(0):
+		return hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
+	}
 
-				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCSOUTPUT(0))) {
-					int len = _IOC_SIZE(cmd);
-					ret = hidraw_send_report(file, user_arg, len, HID_OUTPUT_REPORT);
-					break;
-				}
-				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGOUTPUT(0))) {
-					int len = _IOC_SIZE(cmd);
-					ret = hidraw_get_report(file, user_arg, len, HID_OUTPUT_REPORT);
-					break;
-				}
+	return -EINVAL;
+}
 
-				/* Begin Read-only ioctls. */
-				if (_IOC_DIR(cmd) != _IOC_READ) {
-					ret = -EINVAL;
-					break;
-				}
+static long hidraw_ro_variable_size_ioctl(struct file *file, struct hidraw *dev, unsigned int cmd,
+					  void __user *user_arg)
+{
+	struct hid_device *hid = dev->hid;
+	int len = _IOC_SIZE(cmd);
+	int field_len;
+
+	switch (cmd & ~IOCSIZE_MASK) {
+	case HIDIOCGRAWNAME(0):
+		field_len = strlen(hid->name) + 1;
+		if (len > field_len)
+			len = field_len;
+		return copy_to_user(user_arg, hid->name, len) ?  -EFAULT : len;
+	case HIDIOCGRAWPHYS(0):
+		field_len = strlen(hid->phys) + 1;
+		if (len > field_len)
+			len = field_len;
+		return copy_to_user(user_arg, hid->phys, len) ?  -EFAULT : len;
+	case HIDIOCGRAWUNIQ(0):
+		field_len = strlen(hid->uniq) + 1;
+		if (len > field_len)
+			len = field_len;
+		return copy_to_user(user_arg, hid->uniq, len) ?  -EFAULT : len;
+	}
 
-				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWNAME(0))) {
-					int len = strlen(hid->name) + 1;
-					if (len > _IOC_SIZE(cmd))
-						len = _IOC_SIZE(cmd);
-					ret = copy_to_user(user_arg, hid->name, len) ?
-						-EFAULT : len;
-					break;
-				}
+	return -EINVAL;
+}
 
-				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWPHYS(0))) {
-					int len = strlen(hid->phys) + 1;
-					if (len > _IOC_SIZE(cmd))
-						len = _IOC_SIZE(cmd);
-					ret = copy_to_user(user_arg, hid->phys, len) ?
-						-EFAULT : len;
-					break;
-				}
+static long hidraw_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	struct inode *inode = file_inode(file);
+	unsigned int minor = iminor(inode);
+	struct hidraw *dev;
+	struct hidraw_list *list = file->private_data;
+	void __user *user_arg = (void __user *)arg;
+	int ret;
 
-				if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGRAWUNIQ(0))) {
-					int len = strlen(hid->uniq) + 1;
-					if (len > _IOC_SIZE(cmd))
-						len = _IOC_SIZE(cmd);
-					ret = copy_to_user(user_arg, hid->uniq, len) ?
-						-EFAULT : len;
-					break;
-				}
-			}
+	down_read(&minors_rwsem);
+	dev = hidraw_table[minor];
+	if (!dev || !dev->exist || hidraw_is_revoked(list)) {
+		ret = -ENODEV;
+		goto out;
+	}
+
+	if (_IOC_TYPE(cmd) != 'H') {
+		ret = -EINVAL;
+		goto out;
+	}
 
+	if (_IOC_NR(cmd) > HIDIOCTL_LAST || _IOC_NR(cmd) == 0) {
 		ret = -ENOTTY;
+		goto out;
 	}
+
+	ret = hidraw_fixed_size_ioctl(file, dev, cmd, user_arg);
+	if (ret != -EAGAIN)
+		goto out;
+
+	switch (_IOC_DIR(cmd)) {
+	case (_IOC_READ | _IOC_WRITE):
+		ret = hidraw_rw_variable_size_ioctl(file, dev, cmd, user_arg);
+		break;
+	case _IOC_READ:
+		ret = hidraw_ro_variable_size_ioctl(file, dev, cmd, user_arg);
+		break;
+	default:
+		/* Any other IOC_DIR is wrong */
+		ret = -EINVAL;
+	}
+
 out:
 	up_read(&minors_rwsem);
 	return ret;
diff --git a/include/uapi/linux/hidraw.h b/include/uapi/linux/hidraw.h
index d5ee269864e07..ebd701b3c18d9 100644
--- a/include/uapi/linux/hidraw.h
+++ b/include/uapi/linux/hidraw.h
@@ -48,6 +48,8 @@ struct hidraw_devinfo {
 #define HIDIOCGOUTPUT(len)    _IOC(_IOC_WRITE|_IOC_READ, 'H', 0x0C, len)
 #define HIDIOCREVOKE	      _IOW('H', 0x0D, int) /* Revoke device access */
 
+#define HIDIOCTL_LAST		_IOC_NR(HIDIOCREVOKE)
+
 #define HIDRAW_FIRST_MINOR 0
 #define HIDRAW_MAX_DEVICES 64
 /* number of reports to buffer */
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:45:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368426; cv=none; b=RaV8oPa4cfb9ED4p4KPezAQzHfUWUUKOXjaXvoTTMGsbSrWNT+1Eh1iTku45IO4HPInkja1VFgX0/gl3RCbqyc29kZPuhi09X9R+JCCFLxTb5G6DrE9jSmW30WIznhqU8yOOFvytmQ6vam+7QAwmOPOpddFRNNpmQR9FJVI9NSU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368426; c=relaxed/simple;
	bh=rp0kz7ZEXL7J6KCX6td5Dwihm5Ak6zUmHttKT7jeAY0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ez+7RRkJTNDLd2QZhuJ1csNXHBNrgn4gL4eJODM2MVz8hgTGHrtKSGS/QbjL6U4TqkSfKlQoKf0PqPemifHoL4RUAkRBPw2TqReuTdpfrpOe/ow9hs8VaTIbnyAKWjSbBg4ci/h36UmihPpBk4KLmQLCqVjuzr87+x/zUPqWLoY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bdL8ddzf; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 158/262] scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()
Date: Mon, 13 Oct 2025 16:45:00 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 9877c004e9f4d10e7786ac80a50321705d76e036 ]

Change the error code EAGAIN to -EAGAIN in qla_nvme_xmt_ls_rsp() to
align with qla2x00_start_sp() returning negative error codes or
QLA_SUCCESS, preventing logical errors.

Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe")
Signed-off-by: Qianfeng Rong <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/qla2xxx/qla_nvme.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index 8ee2e337c9e1b..316594aa40cc5 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -419,7 +419,7 @@ static int qla_nvme_xmt_ls_rsp(struct nvme_fc_local_port *lport,
 	switch (rval) {
 	case QLA_SUCCESS:
 		break;
-	case EAGAIN:
+	case -EAGAIN:
 		msleep(PURLS_MSLEEP_INTERVAL);
 		cnt++;
 		if (cnt < PURLS_RETRY_COUNT)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:46:54 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368423; cv=none; b=FEjlo80wAAJdBzGpmRsd/CdR9S+foJ5jgws8AVOVfUlD7AsEswD8D/O3NNvK8kb/913nWiOGi8/11YgVz5a0criC830khjhgrmKwKql46ekDLGPYWawdCNwvFlfyG9XSdaDbc2RIs9eVSyfaqpeJyUdNAFjHyGNlJrD9PBTCCGo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368423; c=relaxed/simple;
	bh=5KzS5zCpHMIcFMPyRydXAIPA77f8vYjwD+emJJ/xTMc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=W8/0SRv0afyYFyAs3/PkMGJzdRiLvokDUX+gKtGS3w4hvJ3OjnctUgCR84LZmKARhVWRMcPIbSfXtm/PBKuwgzlCzNn2R6B8brDpfUudaIb/q9zO7rBHy3yBE+mHm2gOMg4EEFKSj1/YtamUDIt/jDM2vHzcd/mC1WyuyX1odCo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=V3WvXfvx; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 157/262] scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
Date: Mon, 13 Oct 2025 16:44:59 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ]

Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align
with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS,
preventing logical errors.  Additionally, the '_rval' variable should
store negative error codes to conform to Linux kernel error code
conventions.

Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure")
Signed-off-by: Qianfeng Rong <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/qla2xxx/qla_init.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 79cdfec2bca35..8bd4aa935e22b 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -2059,11 +2059,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)
 	int cnt = 5; \
 	do { \
 		if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\
-			_rval = EINVAL; \
+			_rval = -EINVAL; \
 			break; \
 		} \
 		_rval = qla2x00_start_sp(_sp); \
-		if (_rval == EAGAIN) \
+		if (_rval == -EAGAIN) \
 			msleep(1); \
 		else \
 			break; \
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:29:00 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368420; cv=none; b=SbtQlgDlexGYq+bW6gKuN/FNqZBpNxR0ScHSXmYCu8DlzzKm9ucr/0S1cku/9XODpj9HNmLCJ8FTF2VY4ngnpniinIsgwGi2oiE5919VGUe63lMavRINZ3v8+nmRNgbQGUoXgVNTTHCsPwHHuJyga3fRU0i9E0vQJ7wbAUV5LUM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368420; c=relaxed/simple;
	bh=XKiya8boNgNUpgl3JiOzuUAoZA79lofCMbWTUQAtOaU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=kQz9dtzIKI78/fz4ORP3oMO/fyZ2tTc+dBDOa42f1eOv2Cz/suRNFB3pXMr4quCCludygtAKoZi+3jMCV9Y9SK7GAVhRolbRfGVMh20LYpwAZtvzFItRQu9c6VFCJey4NkM7eYU/FuOtbB1A26/fuMlKA1/Of4nNesakbV/Yx3U=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0HD4oXAL; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 156/262] scsi: qla2xxx: edif: Fix incorrect sign of error code
Date: Mon, 13 Oct 2025 16:44:58 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ]

Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and
qla_edif_process_els() to align with qla2x00_start_sp() returning
negative error codes or QLA_SUCCESS, preventing logical errors.

Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough")
Signed-off-by: Qianfeng Rong <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/qla2xxx/qla_edif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
index dcde55c8ee5de..be20e2c457b8e 100644
--- a/drivers/scsi/qla2xxx/qla_edif.c
+++ b/drivers/scsi/qla2xxx/qla_edif.c
@@ -1797,7 +1797,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job)
 	switch (rval) {
 	case QLA_SUCCESS:
 		break;
-	case EAGAIN:
+	case -EAGAIN:
 		msleep(EDIF_MSLEEP_INTERVAL);
 		cnt++;
 		if (cnt < EDIF_RETRY_COUNT)
@@ -3648,7 +3648,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job)
 		       p->e.extra_rx_xchg_address, p->e.extra_control_flags,
 		       sp->handle, sp->remap.req.len, bsg_job);
 		break;
-	case EAGAIN:
+	case -EAGAIN:
 		msleep(EDIF_MSLEEP_INTERVAL);
 		cnt++;
 		if (cnt < EDIF_RETRY_COUNT)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:49:14 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368417; cv=none; b=ib6nlMQ/pc1LETzu/pqyjBVpNBPGL/hRYL0iVfjVgfs+I84LYgj6WorAXiOjw/qIZAsA8wOGeO2iEsx+6LW+XTfRruDz90eMVNvjAnq1VTaiyhqsOD5KkvF/Gw3h5zgUDuoq5i52fF3nDks0LjhQmS9VhEKHbTdiNs598wqM6qc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368417; c=relaxed/simple;
	bh=K36APKBQv/nxXd5G2UvUEFKbPL3CKptXHLVEqJci4Jk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=svyAU0H0Lay2PrCLwknmIwxU5e+pmTYRcDjnULViqLaNAv/iTBpUStUkgaC9h1fboQxJIetJ66rcdgpBGJ8vH5PcM7TgxWiJ9e+S52HyjI0ClUXULi9t5t4azE3/1n2Wbd2uBTqrwGIIlO5w1gLUZTtMuWg1/g8iFQMfrUUOjNk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PW9lPMR9; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Colin Ian King <[email-masked]>,
	Ira Weiny <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 155/262] ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
Date: Mon, 13 Oct 2025 16:44:57 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Colin Ian King <[email-masked]>

[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ]

There appears to be a cut-n-paste error with the incorrect field
ndr_desc->numa_node being reported for the target node. Fix this by
using ndr_desc->target_node instead.

Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect")
Signed-off-by: Colin Ian King <[email-masked]>
Reviewed-by: Ira Weiny <[email-masked]>
Signed-off-by: Ira Weiny <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/acpi/nfit/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index ae035b93da087..3eb56b77cb6d9 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -2637,7 +2637,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
 	if (ndr_desc->target_node == NUMA_NO_NODE) {
 		ndr_desc->target_node = phys_to_target_node(spa->address);
 		dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
-			NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
+			NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end);
 	}
 
 	/*
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:41:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368414; cv=none; b=ih3irrCjCLmlyZHE1MhTaoqFB0YIzlqSe1PYkj7SMLTWmcDiw/b+6ZjC3VwavGvShB7+lh0no63alE8aaST18Ywb86t1ADwIVKuaVJJo/otIQW9Pe8srGqtedr9az1/HnbCj/Sdo6K2735no1vSjZuXy+mej5tU8W2emkoCx1GY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368414; c=relaxed/simple;
	bh=IMFFuu+ZGUjm9c+Pjsy5mUsLr05PUnYeQwxb1duNttE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=oVe3rItmyzgZufWxAQn46wKLX9YQin/8xzNClepy5a2SK8jyOzCu/OLp0xEziKwAzxjatoyTR5sAODfXsRhu1I/qiswHPkjN86RFROwIXUg7f+PqwRvNaP66kbYLEKRdCvQuxyR9GwPsmV8NZbnMVi0cKEVEtl3PyUqUBz7rq7E=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JcfbJp8X; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Sebastian Andrzej Siewior <[email-masked]>,
	Takashi Iwai <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 154/262] ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT
Date: Mon, 13 Oct 2025 16:44:56 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <[email-masked]>

[ Upstream commit 9fc4a3da9a0259a0500848b5d8657918efde176b ]

snd_pcm_group_lock_irq() acquires a spinlock_t and disables interrupts
via spin_lock_irq(). This also implicitly disables the handling of
softirqs such as TIMER_SOFTIRQ.
On PREEMPT_RT softirqs are preemptible and spin_lock_irq() does not
disable them. That means a timer can be invoked during spin_lock_irq()
on the same CPU. Due to synchronisations reasons local_bh_disable() has
a per-CPU lock named softirq_ctrl.lock which synchronizes individual
softirq against each other.
syz-bot managed to trigger a lockdep report where softirq_ctrl.lock is
acquired in hrtimer_cancel() in addition to hrtimer_run_softirq(). This
is a possible deadlock.

The softirq_ctrl.lock can not be made part of spin_lock_irq() as this
would lead to too much synchronisation against individual threads on the
system. To avoid the possible deadlock, softirqs must be manually
disabled before the lock is acquired.

Disable softirqs before the lock is acquired on PREEMPT_RT.

Reported-by: [email-masked]
Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.")
Signed-off-by: Sebastian Andrzej Siewior <[email-masked]>
Signed-off-by: Takashi Iwai <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 sound/core/pcm_native.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 9b91f68b3fff0..d15de21f6ebf0 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -84,19 +84,24 @@ void snd_pcm_group_init(struct snd_pcm_group *group)
 }
 
 /* define group lock helpers */
-#define DEFINE_PCM_GROUP_LOCK(action, mutex_action) \
+#define DEFINE_PCM_GROUP_LOCK(action, bh_lock, bh_unlock, mutex_action) \
 static void snd_pcm_group_ ## action(struct snd_pcm_group *group, bool nonatomic) \
 { \
-	if (nonatomic) \
+	if (nonatomic) { \
 		mutex_ ## mutex_action(&group->mutex); \
-	else \
-		spin_ ## action(&group->lock); \
-}
-
-DEFINE_PCM_GROUP_LOCK(lock, lock);
-DEFINE_PCM_GROUP_LOCK(unlock, unlock);
-DEFINE_PCM_GROUP_LOCK(lock_irq, lock);
-DEFINE_PCM_GROUP_LOCK(unlock_irq, unlock);
+	} else { \
+		if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_lock)   \
+			local_bh_disable();			\
+		spin_ ## action(&group->lock);			\
+		if (IS_ENABLED(CONFIG_PREEMPT_RT) && bh_unlock) \
+			local_bh_enable();                      \
+	}							\
+}
+
+DEFINE_PCM_GROUP_LOCK(lock, false, false, lock);
+DEFINE_PCM_GROUP_LOCK(unlock, false, false, unlock);
+DEFINE_PCM_GROUP_LOCK(lock_irq, true, false, lock);
+DEFINE_PCM_GROUP_LOCK(unlock_irq, false, true, unlock);
 
 /**
  * snd_pcm_stream_lock - Lock the PCM stream
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:28:56 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368409; cv=none; b=qOzlh9VMIo5OVENVK8bdZ+qEmm8exu/4UfYWRmg+V7AbFSjr3NcYq00GGKu+INOwivu3A9b166nulyC5Mwr1lXuzJ0ZBbsMluYiNU7AUaan1D/6eVXwa4hEOxHZifF9QborT25a7e3qTNiNW9ZiXfZk+REcpelVnqK+CC9vr91c=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368409; c=relaxed/simple;
	bh=tz2l/Nz+5iCG4A2lNcJWezQ2BNNIfTJ3k83c/X8XT4k=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Thj1CywLKlXYSdBl4R4gyT6XmzUSn84W4N/RkKwUCZpMLlGqc50MLUXOhR8juxVSwwuP7+JSermCb2Mnrc9tOKUaiBvsLSPCNIrro0TtBR8PLYo9E3+TBrv8IHIGSqc+FwKu50V3ASVPpjiHFjZxTm4sHCJ6toVZjQitPt4X+2k=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=jaAuGSJ/; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Chao Yu <[email-masked]>,
	Jaegeuk Kim <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 152/262] f2fs: fix to truncate first page in error path of f2fs_truncate()
Date: Mon, 13 Oct 2025 16:44:54 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chao Yu <[email-masked]>

[ Upstream commit 9251a9e6e871cb03c4714a18efa8f5d4a8818450 ]

syzbot reports a bug as below:

loop0: detected capacity change from 0 to 40427
F2FS-fs (loop0): Wrong SSA boundary, start(3584) end(4096) blocks(3072)
F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
F2FS-fs (loop0): invalid crc value
F2FS-fs (loop0): f2fs_convert_inline_folio: corrupted inline inode ino=3, i_addr[0]:0x1601, run fsck to fix.
------------[ cut here ]------------
kernel BUG at fs/inode.c:753!
RIP: 0010:clear_inode+0x169/0x190 fs/inode.c:753
Call Trace:
 <TASK>
 evict+0x504/0x9c0 fs/inode.c:810
 f2fs_fill_super+0x5612/0x6fa0 fs/f2fs/super.c:5047
 get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1692
 vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
 do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808
 do_mount fs/namespace.c:4136 [inline]
 __do_sys_mount fs/namespace.c:4347 [inline]
 __se_sys_mount+0x317/0x410 fs/namespace.c:4324
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

During f2fs_evict_inode(), clear_inode() detects that we missed to truncate
all page cache before destorying inode, that is because in below path, we
will create page #0 in cache, but missed to drop it in error path, let's fix
it.

- evict
 - f2fs_evict_inode
  - f2fs_truncate
   - f2fs_convert_inline_inode
    - f2fs_grab_cache_folio
    : create page #0 in cache
    - f2fs_convert_inline_folio
    : sanity check failed, return -EFSCORRUPTED
  - clear_inode detects that inode->i_data.nrpages is not zero

Fixes: 92dffd01790a ("f2fs: convert inline_data when i_size becomes large")
Reported-by: [email-masked]
Closes: https://lore.kernel.org/linux-f2fs-devel/[email-masked]
Signed-off-by: Chao Yu <[email-masked]>
Signed-off-by: Jaegeuk Kim <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/f2fs/file.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index fa77841f3e2cc..eb58d05284173 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -856,8 +856,16 @@ int f2fs_truncate(struct inode *inode)
 	/* we should check inline_data size */
 	if (!f2fs_may_inline_data(inode)) {
 		err = f2fs_convert_inline_inode(inode);
-		if (err)
+		if (err) {
+			/*
+			 * Always truncate page #0 to avoid page cache
+			 * leak in evict() path.
+			 */
+			truncate_inode_pages_range(inode->i_mapping,
+					F2FS_BLK_TO_BYTES(0),
+					F2FS_BLK_END_BYTES(0));
 			return err;
+		}
 	}
 
 	err = f2fs_truncate_blocks(inode, i_size_read(inode), true);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:50:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368406; cv=none; b=jDhdJ+C4z62/CtS2b47GliupmECNRmICrf1TRkVz0E8qtr6jPAPWlb1sae2Wke31a+aRKJT2IIddqXvzPnqVE3U1xg57E6VKWuAchffUmOkHytvhpypZylJ/Qd4O6GMAe4cEa1MiUyua9JT2hg+ycuO3eDqGF3VNQhwymviK/Y8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368406; c=relaxed/simple;
	bh=cGada7c+6Rwi3TE2O4COZVEZdQlIO96zUCfZlbd6XBw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DHoyE8wuDHN+hyxWTWdxp05ZMIazBw6ab3wmI0H5P2KDENNg4p8ZhXzSpDsSRv5NjT9xpYB6ly8VjEaLIgz4J+jJ9K1v4ewm4zpfuzWoj5JVe00dpgVexr4loa9JqQ5hpeIScIrVoGYzgXQaSYJa0Zm0R185Kt/in+c0kaAA71o=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OAez9C1l; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chao Yu <[email-masked]>,
	Jaegeuk Kim <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 151/262] f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()
Date: Mon, 13 Oct 2025 16:44:53 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chao Yu <[email-masked]>

[ Upstream commit 869833f54e8306326b85ca3ed08979b7ad412a4a ]

Script to reproduce:
mkfs.f2fs -O extra_attr,compression /dev/vdb -f
mount /dev/vdb /mnt/f2fs -o mode=lfs,noextent_cache
cd /mnt/f2fs
f2fs_io write 1 0 1024 rand dsync testfile
xfs_io testfile -c "fsync"
f2fs_io write 1 0 512 rand dsync testfile
xfs_io testfile -c "fsync"
cd /
umount /mnt/f2fs
mount /dev/vdb /mnt/f2fs
f2fs_io precache_extents /mnt/f2fs/testfile
umount /mnt/f2fs

Tracepoint output:
f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 0, len = 512, blkaddr = 1055744, c_len = 0
f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 513, len = 351, blkaddr = 17921, c_len = 0
f2fs_update_read_extent_tree_range: dev = (253,16), ino = 4, pgofs = 864, len = 160, blkaddr = 18272, c_len = 0

During precache_extents, there is off-by-one issue, we should update
map->m_next_extent to pgofs rather than pgofs + 1, if last blkaddr is
valid and not contiguous to previous extent.

Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
Signed-off-by: Chao Yu <[email-masked]>
Signed-off-by: Jaegeuk Kim <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/f2fs/data.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index efc30626760a6..a008d70b9f5ec 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1786,7 +1786,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map, int flag)
 				map->m_len - ofs);
 		}
 		if (map->m_next_extent)
-			*map->m_next_extent = pgofs + 1;
+			*map->m_next_extent = is_hole ? pgofs + 1 : pgofs;
 	}
 	f2fs_put_dnode(&dn);
 unlock_out:
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:25:38 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368403; cv=none; b=Ah/kavKq/OQgxpLX0ZaszfPDYYKMluQpkTQX8xlEfwcD9RwU3WDToYgWqtYcgH1Jx8Tzzq6WuMFgHnYvENW4s30qD58crro8ff9+TLstC1hYEMsqfd5mERP3vk+y5LJnN25mUrXTmUrsQ9GPiRqz1EOr58d7a+dOsSOe8YslFpU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368403; c=relaxed/simple;
	bh=KmtLCaZpDEofzXuaHglK+nW3BdRvcwPpu0rqnEJ7E8E=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=HPdXNImuL1dodeBdxIcwx2d+87JXEY7lTe0hud7OjAuvTvJ6KPQzGuVAChaTfA+rx2/xM+w+5wqxI5jp9ih2cWVJg5UDRXZ7lWik8eSzA8SLjW5wMp7fmEqS9CAuL017cJZTTp3oydZsO1iXOGGn9d2FmktFk8H6ofGa+ic0P4Q=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vbNUgARl; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhi-Jun You <[email-masked]>,
	Felix Fietkau <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 150/262] wifi: mt76: mt7915: fix mt7981 pre-calibration
Date: Mon, 13 Oct 2025 16:44:52 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhi-Jun You <[email-masked]>

[ Upstream commit 2b660ee10a0c25b209d7fda3c41b821b75dd85d9 ]

In vendor driver, size of group cal and dpd cal for mt7981 includes 6G
although the chip doesn't support it.

mt76 doesn't take this into account which results in reading from the
incorrect offset.

For devices with precal, this would lead to lower bitrate.

Fix this by aligning groupcal size with vendor driver and switch to
freq_list_v2 in mt7915_dpd_freq_idx in order to get the correct offset.

Below are iwinfo of the test device with two clients connected
(iPhone 16, Intel AX210).
Before :
	Mode: Master  Channel: 36 (5.180 GHz)  HT Mode: HE80
	Center Channel 1: 42 2: unknown
	Tx-Power: 23 dBm  Link Quality: 43/70
	Signal: -67 dBm  Noise: -92 dBm
	Bit Rate: 612.4 MBit/s
	Encryption: WPA3 SAE (CCMP)
	Type: nl80211  HW Mode(s): 802.11ac/ax/n
	Hardware: embedded [MediaTek MT7981]

After:
	Mode: Master  Channel: 36 (5.180 GHz)  HT Mode: HE80
	Center Channel 1: 42 2: unknown
	Tx-Power: 23 dBm  Link Quality: 43/70
	Signal: -67 dBm  Noise: -92 dBm
	Bit Rate: 900.6 MBit/s
	Encryption: WPA3 SAE (CCMP)
	Type: nl80211  HW Mode(s): 802.11ac/ax/n
	Hardware: embedded [MediaTek MT7981]

Tested-on: mt7981 20240823

Fixes: 19a954edec63 ("wifi: mt76: mt7915: add mt7986, mt7916 and mt7981 pre-calibration")
Signed-off-by: Zhi-Jun You <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Felix Fietkau <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../wireless/mediatek/mt76/mt7915/eeprom.h    |  6 ++--
 .../net/wireless/mediatek/mt76/mt7915/mcu.c   | 29 +++++--------------
 2 files changed, 10 insertions(+), 25 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
index 509fb43d8a688..2908e8113e48a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
@@ -50,9 +50,9 @@ enum mt7915_eeprom_field {
 #define MT_EE_CAL_GROUP_SIZE_7975		(54 * MT_EE_CAL_UNIT + 16)
 #define MT_EE_CAL_GROUP_SIZE_7976		(94 * MT_EE_CAL_UNIT + 16)
 #define MT_EE_CAL_GROUP_SIZE_7916_6G		(94 * MT_EE_CAL_UNIT + 16)
+#define MT_EE_CAL_GROUP_SIZE_7981		(144 * MT_EE_CAL_UNIT + 16)
 #define MT_EE_CAL_DPD_SIZE_V1			(54 * MT_EE_CAL_UNIT)
 #define MT_EE_CAL_DPD_SIZE_V2			(300 * MT_EE_CAL_UNIT)
-#define MT_EE_CAL_DPD_SIZE_V2_7981		(102 * MT_EE_CAL_UNIT)	/* no 6g dpd data */
 
 #define MT_EE_WIFI_CONF0_TX_PATH		GENMASK(2, 0)
 #define MT_EE_WIFI_CONF0_BAND_SEL		GENMASK(7, 6)
@@ -179,6 +179,8 @@ mt7915_get_cal_group_size(struct mt7915_dev *dev)
 		val = FIELD_GET(MT_EE_WIFI_CONF0_BAND_SEL, val);
 		return (val == MT_EE_V2_BAND_SEL_6GHZ) ? MT_EE_CAL_GROUP_SIZE_7916_6G :
 							 MT_EE_CAL_GROUP_SIZE_7916;
+	} else if (is_mt7981(&dev->mt76)) {
+		return MT_EE_CAL_GROUP_SIZE_7981;
 	} else if (mt7915_check_adie(dev, false)) {
 		return MT_EE_CAL_GROUP_SIZE_7976;
 	} else {
@@ -191,8 +193,6 @@ mt7915_get_cal_dpd_size(struct mt7915_dev *dev)
 {
 	if (is_mt7915(&dev->mt76))
 		return MT_EE_CAL_DPD_SIZE_V1;
-	else if (is_mt7981(&dev->mt76))
-		return MT_EE_CAL_DPD_SIZE_V2_7981;
 	else
 		return MT_EE_CAL_DPD_SIZE_V2;
 }
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 3398c25cb03c0..7b481aea76b6c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -3004,30 +3004,15 @@ static int mt7915_dpd_freq_idx(struct mt7915_dev *dev, u16 freq, u8 bw)
 		/* 5G BW160 */
 		5250, 5570, 5815
 	};
-	static const u16 freq_list_v2_7981[] = {
-		/* 5G BW20 */
-		5180, 5200, 5220, 5240,
-		5260, 5280, 5300, 5320,
-		5500, 5520, 5540, 5560,
-		5580, 5600, 5620, 5640,
-		5660, 5680, 5700, 5720,
-		5745, 5765, 5785, 5805,
-		5825, 5845, 5865, 5885,
-		/* 5G BW160 */
-		5250, 5570, 5815
-	};
-	const u16 *freq_list = freq_list_v1;
-	int n_freqs = ARRAY_SIZE(freq_list_v1);
-	int idx;
+	const u16 *freq_list;
+	int idx, n_freqs;
 
 	if (!is_mt7915(&dev->mt76)) {
-		if (is_mt7981(&dev->mt76)) {
-			freq_list = freq_list_v2_7981;
-			n_freqs = ARRAY_SIZE(freq_list_v2_7981);
-		} else {
-			freq_list = freq_list_v2;
-			n_freqs = ARRAY_SIZE(freq_list_v2);
-		}
+		freq_list = freq_list_v2;
+		n_freqs = ARRAY_SIZE(freq_list_v2);
+	} else {
+		freq_list = freq_list_v1;
+		n_freqs = ARRAY_SIZE(freq_list_v1);
 	}
 
 	if (freq < 4000) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:30:14 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368496; cv=none; b=eLyEhjf1n9OmIpVW6WrFafpx81fPUF25zOHpOtRxdBeM3jyHG07fe2FNupSOWH511Dm0O2+TV20RRdRFLfDnQuwtsSs2R9XdBxQJ/9XOreO1A0gHx+VXUfV2vJ+8SLwbcxmJugDswfEWyiIfrVCOy8i+R0ZaG/5+stVccuyRGRY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368496; c=relaxed/simple;
	bh=sZUCb8oTRc87XteldyDzXsITG3PmFNcp04t4xV6IGU4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=QR7e3L7iFoVbe8sDNVUsqudxEVzbR/g82wRF+v/W6TMXnXgypMcqS1pWWwCaLdiv1rb0k+kD/1u66KUFQwymwab/qgYA5rHVxtnISouHm0AyeIer8q0jEO5NCm4zza6pGmTCH7jBuK9HJY1Q+9XHgxPqeiN7ea3/YsURUSE106g=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PraTtu5a; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Lorenzo Bianconi <[email-masked]>,
	Felix Fietkau <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 149/262] wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE
Date: Mon, 13 Oct 2025 16:44:51 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lorenzo Bianconi <[email-masked]>

[ Upstream commit 809054a60d613ccca6e7f243bc68966b58044163 ]

Do not use bitmask in mt7996_wed_rro_addr DMA descriptor in order to not
break endianness

Fixes: 950d0abb5cd94 ("wifi: mt76: mt7996: add wed rx support")
Signed-off-by: Lorenzo Bianconi <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Felix Fietkau <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/mediatek/mt76/mt7996/init.c   |  8 +++++---
 drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h | 11 +++++------
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
index c550385541143..91b7d35bdb431 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
@@ -679,6 +679,7 @@ void mt7996_wfsys_reset(struct mt7996_dev *dev)
 static int mt7996_wed_rro_init(struct mt7996_dev *dev)
 {
 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
+	u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff);
 	struct mtk_wed_device *wed = &dev->mt76.mmio.wed;
 	u32 reg = MT_RRO_ADDR_ELEM_SEG_ADDR0;
 	struct mt7996_wed_rro_addr *addr;
@@ -718,7 +719,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
 
 		addr = dev->wed_rro.addr_elem[i].ptr;
 		for (j = 0; j < MT7996_RRO_WINDOW_MAX_SIZE; j++) {
-			addr->signature = 0xff;
+			addr->data = cpu_to_le32(val);
 			addr++;
 		}
 
@@ -736,7 +737,7 @@ static int mt7996_wed_rro_init(struct mt7996_dev *dev)
 	dev->wed_rro.session.ptr = ptr;
 	addr = dev->wed_rro.session.ptr;
 	for (i = 0; i < MT7996_RRO_WINDOW_MAX_LEN; i++) {
-		addr->signature = 0xff;
+		addr->data = cpu_to_le32(val);
 		addr++;
 	}
 
@@ -836,6 +837,7 @@ static void mt7996_wed_rro_free(struct mt7996_dev *dev)
 static void mt7996_wed_rro_work(struct work_struct *work)
 {
 #ifdef CONFIG_NET_MEDIATEK_SOC_WED
+	u32 val = FIELD_PREP(WED_RRO_ADDR_SIGNATURE_MASK, 0xff);
 	struct mt7996_dev *dev;
 	LIST_HEAD(list);
 
@@ -872,7 +874,7 @@ static void mt7996_wed_rro_work(struct work_struct *work)
 				MT7996_RRO_WINDOW_MAX_LEN;
 reset:
 			elem = ptr + elem_id * sizeof(*elem);
-			elem->signature = 0xff;
+			elem->data |= cpu_to_le32(val);
 		}
 		mt7996_mcu_wed_rro_reset_sessions(dev, e->id);
 out:
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index 425fd030bee00..29e7289c3a169 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -194,13 +194,12 @@ struct mt7996_hif {
 	int irq;
 };
 
+#define WED_RRO_ADDR_SIGNATURE_MASK	GENMASK(31, 24)
+#define WED_RRO_ADDR_COUNT_MASK		GENMASK(14, 4)
+#define WED_RRO_ADDR_HEAD_HIGH_MASK	GENMASK(3, 0)
 struct mt7996_wed_rro_addr {
-	u32 head_low;
-	u32 head_high : 4;
-	u32 count: 11;
-	u32 oor: 1;
-	u32 rsv : 8;
-	u32 signature : 8;
+	__le32 head_low;
+	__le32 data;
 };
 
 struct mt7996_wed_rro_session_id {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:30:13 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368494; cv=none; b=AhvBneOA51Ni51NHBk7qq7/CPDU9XVGbMjMfTzV0iyy3uphhFC1ZPXrp/x9y2ABzUCHccz02zHPMRzsKa/XSN3OAWVW6d8RBf7ZqfT+OUAgdKCq3mbXwRYHrqwJWtwFqVwQjqf6pXWFmCE/B2TcGXneaIsr6ESXaoGnHqv8g2yw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368494; c=relaxed/simple;
	bh=VpV7Lmdj4sRZlMujol5U+FtsVSTMTLHWoAhPZvaj03I=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=qI3P0wym6IrTzXDkBmbRVah/nmVQVmzH00HitBHmcqU8xeyfd9o7yDTnAn6ra9NJS/xgyQCqJrcu14jIWVODZaGsNWZcGYjzAnQR+cSQk1ykowr4f5BiKmxg3MnLQA981QZ/lzkv5W4ZtSSO6hd2wqOvQ4cRPo+mAV93bNOOiM4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=10N7ryAD; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Lorenzo Bianconi <[email-masked]>,
	Felix Fietkau <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 148/262] wifi: mt76: mt7996: Fix RX packets configuration for primary WED device
Date: Mon, 13 Oct 2025 16:44:50 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lorenzo Bianconi <[email-masked]>

[ Upstream commit cffed52dbf0ddd0db11f9df63f9976fe58ac9628 ]

In order to properly set the number of rx packets for primary WED device
if hif device is available, move hif pointer initialization before
running mt7996_mmio_wed_init routine.

Fixes: 83eafc9251d6d ("wifi: mt76: mt7996: add wed tx support")
Signed-off-by: Lorenzo Bianconi <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Felix Fietkau <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/mediatek/mt76/mt7996/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
index 04056181368a6..dbd05612f2e4a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/pci.c
@@ -132,6 +132,7 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
 	mdev = &dev->mt76;
 	mt7996_wfsys_reset(dev);
 	hif2 = mt7996_pci_init_hif2(pdev);
+	dev->hif2 = hif2;
 
 	ret = mt7996_mmio_wed_init(dev, pdev, false, &irq);
 	if (ret < 0)
@@ -156,7 +157,6 @@ static int mt7996_pci_probe(struct pci_dev *pdev,
 
 	if (hif2) {
 		hif2_dev = container_of(hif2->dev, struct pci_dev, dev);
-		dev->hif2 = hif2;
 
 		ret = mt7996_mmio_wed_init(dev, hif2_dev, true, &hif2_irq);
 		if (ret < 0)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:30:12 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368490; cv=none; b=jO7QrRdP77HtIA4McGoryP0tXGNf32ib7yZckN9aFWli7Af45eY2WiT92stvxk5wDWf6iAnyc4/zVWE9XX7p1OqlYL+pf1jqOy4DMt0VuSMnmd3PC+2+9cvJOwk7lHGRDJECo5S+sWb5rXlHq4tmL18bqsctEdhiJ9co5MxFN3s=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368490; c=relaxed/simple;
	bh=D5iwSav7aP+pvUngOMTls0I6KDJrFb1v5Gr4u6V+3Q4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=HRPYWzTWvFqHBaWDTKHncEmUtbZcsbXSsz/BAutRC+Y+vmCFLbrr9aSpgXEd1XvtMxArLW7uTrKCMVOzCgqabrc9DyDLhX5gCtnfTKXxS9cHr023pUunSPMMk3qu4IBnOmVNfaN/YpF/IRQqJ1gPrk3gd9AJhllb9fIRgGAq9Tk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IyB+StN0; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Abdun Nihaal <[email-masked]>,
	Jiri Slaby <[email-masked]>,
	Felix Fietkau <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 147/262] wifi: mt76: fix potential memory leak in mt76_wmac_probe()
Date: Mon, 13 Oct 2025 16:44:49 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Abdun Nihaal <[email-masked]>

[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]

In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory
is allocated for both struct ieee80211_hw and a workqueue. However, on
the error path, the workqueue is not freed. Fix that by calling
mt76_free_device() on the error path.

Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
Signed-off-by: Abdun Nihaal <[email-masked]>
Reviewed-by: Jiri Slaby <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Felix Fietkau <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
index ec02148a7f1f7..2ee8a6e1e310e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)
 
 	return 0;
 error:
-	ieee80211_free_hw(mt76_hw(dev));
+	mt76_free_device(mdev);
 	return ret;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:30:11 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368488; cv=none; b=tvw8y+vL2PY8gYeYqPzgheslzllaRc6Nt3RIT6FARckwP2yrM+MXKLL4WQgdjIyWyuL8t+3Uxa1GCRefsk4oHU1xDx1ny8mFaud/IS+vEZG/EVFyX9EpfCqGr2kiy2VONGIQKeqnicwEOupgUHTzZe9zKGxJO3JYj0Im0i3VbA8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368488; c=relaxed/simple;
	bh=tqjAv2vbGVo0fqv5G9G/+jDMazBkTbJKcb8IbjCBvVE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=KsmFnLZNaEOxPzz260nZEbwkqBMc1b1JnZYw3xQOSx/ekjbhTWzpizIMsAa4WkIg9vl4Dk0GyI6WE+Q0H8UIpc/t9uTHlfqGJ3ZQxVF7R1xI7nHu7qB3Dc9dpLL1KDlMc7Tw8SEmjmhsOsaWTgtIXPNCGej8ip4epGcJM2uxOcg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JBjeRkE9; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?H=C3=A5kon=20Bugge?= <[email-masked]>,
	Zhu Yanjun <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 146/262] RDMA/cm: Rate limit destroy CM ID timeout error message
Date: Mon, 13 Oct 2025 16:44:48 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Håkon Bugge <[email-masked]>

[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ]

When the destroy CM ID timeout kicks in, you typically get a storm of
them which creates a log flooding. Hence, change pr_err() to
pr_err_ratelimited() in cm_destroy_id_wait_timeout().

Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait")
Signed-off-by: Håkon Bugge <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Reviewed-by: Zhu Yanjun <[email-masked]>
Signed-off-by: Leon Romanovsky <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/core/cm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index d45e3909dafe1..50bb3c43f40bf 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -1032,8 +1032,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,
 	struct cm_id_private *cm_id_priv;
 
 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
-	pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
-	       cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
+	pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
+			   cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
 }
 
 static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:41:06 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368484; cv=none; b=UCLF1PWmF+N16xRmHDjyqNAP2e/T8jFwrIjuUmkD1RgpJ5aOuu0ooeMQKu9l1SCrgL0O3Q+MFfcHUv6OdtrRNxBdaDQYI02FEMqHIIrhEWHI3/vGUNYl9ih567Ksn0qzLqeCJTEqDwFKzHjtXehYGTqKyjOgRHyPaCPPztjOreE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368484; c=relaxed/simple;
	bh=U2a2WChg4D+bx6HAjKIoyjiJIQdUuTOs3zSMR1lTXcM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=U6NwuoJDn4Dw0CRc8M3C6VNHMCGrm0TuGMLWMJS7paJQpFuEqUPFLPyK0Lg0hqFE3CyvfYHwB/xlZRa4iQz5XR1BlqehxxINpjfQZSBxbvnm1dFlrbcNJ3vbbANIIh8I7+NWp7f8I1d5hVzI9OLF8y7yMuRCsRE+YL0+mo/k030=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=1kPcVxrl; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34289C4CEE7;
	Mon, 13 Oct 2025 15:14:44 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760368484;
	bh=U2a2WChg4D+bx6HAjKIoyjiJIQdUuTOs3zSMR1lTXcM=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=1kPcVxrlDu+1MDJNB9JqAMwIp8uumtW925SMVAX3dONTdfxwn8KWNMrrCSETuU6A1
	 vMlw9vfuXMkDsrowJmY7dYEK3Ixk0YLHFSph3gcTKw6z2z1/bL2GrFitK//7otMazu
	 P5Nct4/JPfdYM7w77B0hF4SaltjMsscoCgC29mFw=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Donet Tom <[email-masked]>,
	David Hildenbrand <[email-masked]>,
	Alison Schofield <[email-masked]>,
	Danilo Krummrich <[email-masked]>,
	Dave Jiang <[email-masked]>,
	Hiroyouki Kamezawa <[email-masked]>,
	Joanthan Cameron <[email-masked]>,
	Oscar Salvador <[email-masked]>,
	"Ritesh Harjani (IBM)" <[email-masked]>,
	"Yury Norov (NVIDIA)" <[email-masked]>,
	Zi Yan <[email-masked]>,
	Andrew Morton <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 145/262] drivers/base/node: handle error properly in register_one_node()
Date: Mon, 13 Oct 2025 16:44:47 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Donet Tom <[email-masked]>

[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]

If register_node() returns an error, it is not handled correctly.
The function will proceed further and try to register CPUs under the
node, which is not correct.

So, in this patch, if register_node() returns an error, we return
immediately from the function.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
Signed-off-by: Donet Tom <[email-masked]>
Acked-by: David Hildenbrand <[email-masked]>
Cc: Alison Schofield <[email-masked]>
Cc: Danilo Krummrich <[email-masked]>
Cc: Dave Jiang <[email-masked]>
Cc: Donet Tom <[email-masked]>
Cc: Greg Kroah-Hartman <[email-masked]>
Cc: Hiroyouki Kamezawa <[email-masked]>
Cc: Joanthan Cameron <[email-masked]>
Cc: Oscar Salvador <[email-masked]>
Cc: "Ritesh Harjani (IBM)" <[email-masked]>
Cc: Yury Norov (NVIDIA) <[email-masked]>
Cc: Zi Yan <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/base/node.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/base/node.c b/drivers/base/node.c
index eb72580288e62..6f09aa8e32237 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -879,6 +879,11 @@ int __register_one_node(int nid)
 	node_devices[nid] = node;
 
 	error = register_node(node_devices[nid], nid);
+	if (error) {
+		node_devices[nid] = NULL;
+		kfree(node);
+		return error;
+	}
 
 	/* link cpu under this node */
 	for_each_present_cpu(cpu) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:40:38 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368482; cv=none; b=Bl623Ij2ULjKnme3vbXxO9xCMhtJ9MTXvu/YqyWKwHo9Np+Aoyvwwmmiu/8X4u0W2t0XMF7mOd5qTVK1CpQxXPzdcXeo/U/mVyBbXvcEbxvYNQoYIqJGzX6xGDs6QvdUZN0djQPD3u9/dfh2ju0uRRPAbM3ow3Iy9mB6LROJkx4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368482; c=relaxed/simple;
	bh=V2c5aBg8uaoZi8MUJj5d6Vu3IzTFd9EIKJn/hYRVPsw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=EqfJZo7CQkUktkacX2hETEdcky+CarGsx9EFSp/gfp0ZE+53yicK4wccxRek90gunzaQZtsHEjxyZHNED4YYe5URIhIDl1EnkQ0XP7tF/jEoFOnmj1Ch0OWIzvdmtLbKx/36IWpR5s52eISc3djSFs3/EdT0KQcJ2CfeRlbsUiQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ahrV0cWE; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Christophe Leroy <[email-masked]>,
	Guenter Roeck <[email-masked]>,
	Wim Van Sebroeck <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 144/262] watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
Date: Mon, 13 Oct 2025 16:44:46 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christophe Leroy <[email-masked]>

[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]

When the watchdog gets enabled with this driver, it leaves enough time
for the core watchdog subsystem to start pinging it. But when the
watchdog is already started by hardware or by the boot loader, little
time remains before it fires and it happens that the core watchdog
subsystem doesn't have time to start pinging it.

Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker
function") pinging was managed by the driver itself and the watchdog
was immediately pinged by setting the timer expiry to 0.

So restore similar behaviour by pinging it when enabling it so that
if it was already enabled the watchdog timer counter is reloaded.

Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function")
Signed-off-by: Christophe Leroy <[email-masked]>
Reviewed-by: Guenter Roeck <[email-masked]>
Signed-off-by: Guenter Roeck <[email-masked]>
Signed-off-by: Wim Van Sebroeck <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/watchdog/mpc8xxx_wdt.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c
index 867f9f3113797..a4b497ecfa205 100644
--- a/drivers/watchdog/mpc8xxx_wdt.c
+++ b/drivers/watchdog/mpc8xxx_wdt.c
@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w)
 	ddata->swtc = tmp >> 16;
 	set_bit(WDOG_HW_RUNNING, &ddata->wdd.status);
 
+	mpc8xxx_wdt_keepalive(ddata);
+
 	return 0;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:48:56 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368464; cv=none; b=GOLJUB7UTwtggZaaKwt/e/PmDrmBOymvW2HZ2cZ/Jen5ma3bpLxgR9NN9hnd6dTZl8OD1Z79BweHNpZFEE3MAf5H7udLF1DSsoTtBYuGGa12oH5Y7ch4YNYZmXugDD34HGkOin7yKGiaH+GUZ1lKS3UlxsQyQE0idIXjR/x/UpQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368464; c=relaxed/simple;
	bh=Swy3Rm4Z/gVDbeUz5UWgJTW4ZanAI9UGoQPgN0XmC1o=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=opXYhtkWz6fEeodmKV12CkBqgVsP0RYAC99yrMlW4tHQebQtEHbT7DRfSbOLFqw8gDqK5vaNunVAA7XK/Nvyj/f7dhJTVlSa7qhkYUUWxebxU/KW+cExIKzlYAvTKVL2/XjiRyRBjmN1nv2ZzzCB89dOdrrWjZQr4eyIISWsVRY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=NnrSZABx; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Julian Anastasov <[email-masked]>,
	Zhang Tengfei <[email-masked]>,
	Florian Westphal <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 143/262] ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
Date: Mon, 13 Oct 2025 16:44:45 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: syzkaller.appspot.com]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhang Tengfei <[email-masked]>

[ Upstream commit 944b6b216c0387ac3050cd8b773819ae360bfb1c ]

KCSAN reported a data-race on the `ipvs->enable` flag, which is
written in the control path and read concurrently from many other
contexts.

Following a suggestion by Julian, this patch fixes the race by
converting all accesses to use `WRITE_ONCE()/READ_ONCE()`.
This lightweight approach ensures atomic access and acts as a
compiler barrier, preventing unsafe optimizations where the flag
is checked in loops (e.g., in ip_vs_est.c).

Additionally, the `enable` checks in the fast-path hooks
(`ip_vs_in_hook`, `ip_vs_out_hook`, `ip_vs_forward_icmp`) are
removed. These are unnecessary since commit 857ca89711de
("ipvs: register hooks only with services"). The `enable=0`
condition they check for can only occur in two rare and non-fatal
scenarios: 1) after hooks are registered but before the flag is set,
and 2) after hooks are unregistered on cleanup_net. In the worst
case, a single packet might be mishandled (e.g., dropped), which
does not lead to a system crash or data corruption. Adding a check
in the performance-critical fast-path to handle this harmless
condition is not a worthwhile trade-off.

Fixes: 857ca89711de ("ipvs: register hooks only with services")
Reported-by: [email-masked]
Closes: https://syzkaller.appspot.com/bug?extid=1651b5234028c294c339
Suggested-by: Julian Anastasov <[email-masked]>
Link: https://lore.kernel.org/lvs-devel/[email-masked]/
Signed-off-by: Zhang Tengfei <[email-masked]>
Acked-by: Julian Anastasov <[email-masked]>
Signed-off-by: Florian Westphal <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/netfilter/ipvs/ip_vs_conn.c |  4 ++--
 net/netfilter/ipvs/ip_vs_core.c | 11 ++++-------
 net/netfilter/ipvs/ip_vs_ctl.c  |  6 +++---
 net/netfilter/ipvs/ip_vs_est.c  | 16 ++++++++--------
 4 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index c0289f83f96df..327baa17882a8 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -885,7 +885,7 @@ static void ip_vs_conn_expire(struct timer_list *t)
 			 * conntrack cleanup for the net.
 			 */
 			smp_rmb();
-			if (ipvs->enable)
+			if (READ_ONCE(ipvs->enable))
 				ip_vs_conn_drop_conntrack(cp);
 		}
 
@@ -1433,7 +1433,7 @@ void ip_vs_expire_nodest_conn_flush(struct netns_ipvs *ipvs)
 		cond_resched_rcu();
 
 		/* netns clean up started, abort delayed work */
-		if (!ipvs->enable)
+		if (!READ_ONCE(ipvs->enable))
 			break;
 	}
 	rcu_read_unlock();
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index c7a8a08b73089..5ea7ab8bf4dcc 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1353,9 +1353,6 @@ ip_vs_out_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *stat
 	if (unlikely(!skb_dst(skb)))
 		return NF_ACCEPT;
 
-	if (!ipvs->enable)
-		return NF_ACCEPT;
-
 	ip_vs_fill_iph_skb(af, skb, false, &iph);
 #ifdef CONFIG_IP_VS_IPV6
 	if (af == AF_INET6) {
@@ -1940,7 +1937,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state
 		return NF_ACCEPT;
 	}
 	/* ipvs enabled in this netns ? */
-	if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
+	if (unlikely(sysctl_backup_only(ipvs)))
 		return NF_ACCEPT;
 
 	ip_vs_fill_iph_skb(af, skb, false, &iph);
@@ -2108,7 +2105,7 @@ ip_vs_forward_icmp(void *priv, struct sk_buff *skb,
 	int r;
 
 	/* ipvs enabled in this netns ? */
-	if (unlikely(sysctl_backup_only(ipvs) || !ipvs->enable))
+	if (unlikely(sysctl_backup_only(ipvs)))
 		return NF_ACCEPT;
 
 	if (state->pf == NFPROTO_IPV4) {
@@ -2295,7 +2292,7 @@ static int __net_init __ip_vs_init(struct net *net)
 		return -ENOMEM;
 
 	/* Hold the beast until a service is registered */
-	ipvs->enable = 0;
+	WRITE_ONCE(ipvs->enable, 0);
 	ipvs->net = net;
 	/* Counters used for creating unique names */
 	ipvs->gen = atomic_read(&ipvs_netns_cnt);
@@ -2367,7 +2364,7 @@ static void __net_exit __ip_vs_dev_cleanup_batch(struct list_head *net_list)
 		ipvs = net_ipvs(net);
 		ip_vs_unregister_hooks(ipvs, AF_INET);
 		ip_vs_unregister_hooks(ipvs, AF_INET6);
-		ipvs->enable = 0;	/* Disable packet reception */
+		WRITE_ONCE(ipvs->enable, 0);	/* Disable packet reception */
 		smp_wmb();
 		ip_vs_sync_net_cleanup(ipvs);
 	}
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 3224f6e17e736..3219338feca4d 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -256,7 +256,7 @@ static void est_reload_work_handler(struct work_struct *work)
 		struct ip_vs_est_kt_data *kd = ipvs->est_kt_arr[id];
 
 		/* netns clean up started, abort delayed work */
-		if (!ipvs->enable)
+		if (!READ_ONCE(ipvs->enable))
 			goto unlock;
 		if (!kd)
 			continue;
@@ -1482,9 +1482,9 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
 
 	*svc_p = svc;
 
-	if (!ipvs->enable) {
+	if (!READ_ONCE(ipvs->enable)) {
 		/* Now there is a service - full throttle */
-		ipvs->enable = 1;
+		WRITE_ONCE(ipvs->enable, 1);
 
 		/* Start estimation for first time */
 		ip_vs_est_reload_start(ipvs);
diff --git a/net/netfilter/ipvs/ip_vs_est.c b/net/netfilter/ipvs/ip_vs_est.c
index f821ad2e19b35..3492108bb3b97 100644
--- a/net/netfilter/ipvs/ip_vs_est.c
+++ b/net/netfilter/ipvs/ip_vs_est.c
@@ -231,7 +231,7 @@ static int ip_vs_estimation_kthread(void *data)
 void ip_vs_est_reload_start(struct netns_ipvs *ipvs)
 {
 	/* Ignore reloads before first service is added */
-	if (!ipvs->enable)
+	if (!READ_ONCE(ipvs->enable))
 		return;
 	ip_vs_est_stopped_recalc(ipvs);
 	/* Bump the kthread configuration genid */
@@ -305,7 +305,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
 	int i;
 
 	if ((unsigned long)ipvs->est_kt_count >= ipvs->est_max_threads &&
-	    ipvs->enable && ipvs->est_max_threads)
+	    READ_ONCE(ipvs->enable) && ipvs->est_max_threads)
 		return -EINVAL;
 
 	mutex_lock(&ipvs->est_mutex);
@@ -342,7 +342,7 @@ static int ip_vs_est_add_kthread(struct netns_ipvs *ipvs)
 	}
 
 	/* Start kthread tasks only when services are present */
-	if (ipvs->enable && !ip_vs_est_stopped(ipvs)) {
+	if (READ_ONCE(ipvs->enable) && !ip_vs_est_stopped(ipvs)) {
 		ret = ip_vs_est_kthread_start(ipvs, kd);
 		if (ret < 0)
 			goto out;
@@ -485,7 +485,7 @@ int ip_vs_start_estimator(struct netns_ipvs *ipvs, struct ip_vs_stats *stats)
 	struct ip_vs_estimator *est = &stats->est;
 	int ret;
 
-	if (!ipvs->est_max_threads && ipvs->enable)
+	if (!ipvs->est_max_threads && READ_ONCE(ipvs->enable))
 		ipvs->est_max_threads = ip_vs_est_max_threads(ipvs);
 
 	est->ktid = -1;
@@ -662,7 +662,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
 			/* Wait for cpufreq frequency transition */
 			wait_event_idle_timeout(wq, kthread_should_stop(),
 						HZ / 50);
-			if (!ipvs->enable || kthread_should_stop())
+			if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
 				goto stop;
 		}
 
@@ -680,7 +680,7 @@ static int ip_vs_est_calc_limits(struct netns_ipvs *ipvs, int *chain_max)
 		rcu_read_unlock();
 		local_bh_enable();
 
-		if (!ipvs->enable || kthread_should_stop())
+		if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
 			goto stop;
 		cond_resched();
 
@@ -756,7 +756,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
 	mutex_lock(&ipvs->est_mutex);
 	for (id = 1; id < ipvs->est_kt_count; id++) {
 		/* netns clean up started, abort */
-		if (!ipvs->enable)
+		if (!READ_ONCE(ipvs->enable))
 			goto unlock2;
 		kd = ipvs->est_kt_arr[id];
 		if (!kd)
@@ -786,7 +786,7 @@ static void ip_vs_est_calc_phase(struct netns_ipvs *ipvs)
 	id = ipvs->est_kt_count;
 
 next_kt:
-	if (!ipvs->enable || kthread_should_stop())
+	if (!READ_ONCE(ipvs->enable) || kthread_should_stop())
 		goto unlock;
 	id--;
 	if (id < 0)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:25:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368431; cv=none; b=pnLpSlO0QYPpy+qQyfjKQtd98O6ep/8rwazkN6nr8vgtr6dQYYM1c18HiYfOyypt2xM9Xb8Bvy6IsfLsY2xJiZPcBbttJcJoEta5fJIkWDfTCKHVvriMxDFpFui6T59hpdzUELOy5OFLnsA7X1mqt+hVM1ot7sIkCqg2Pe38abs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368431; c=relaxed/simple;
	bh=MU8/ERNspMI7iq3YBRqWOk6u0PmNlK4tUgwKHIjzOv0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=hyuCuk5hRmNekc0itKQhJ0PV5aeGq2jwfffdm8RxGPOulGutXv9Ythp3ZJ/DmTEp/a73dFZzreWJ0dB9obw1IOekAhGST2qlztx4Hyqo21PbYkpJ60Cg2+R95V2b6rfn0J2EF3Bc6WJ0iPJro1k/1tbUJnWqcqtFKe0fuiMCjFc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=C5eajRT7; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhen Ni <[email-masked]>,
	Phil Sutter <[email-masked]>,
	Florian Westphal <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 142/262] netfilter: ipset: Remove unused htable_bits in macro ahash_region
Date: Mon, 13 Oct 2025 16:44:44 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhen Ni <[email-masked]>

[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]

Since the ahash_region() macro was redefined to calculate the region
index solely from HTABLE_REGION_BITS, the htable_bits parameter became
unused.

Remove the unused htable_bits argument and its call sites, simplifying
the code without changing semantics.

Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types")
Signed-off-by: Zhen Ni <[email-masked]>
Reviewed-by: Phil Sutter <[email-masked]>
Signed-off-by: Florian Westphal <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 5251524b96afa..5e4453e9ef8e7 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -63,7 +63,7 @@ struct hbucket {
 		: jhash_size((htable_bits) - HTABLE_REGION_BITS))
 #define ahash_sizeof_regions(htable_bits)		\
 	(ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region))
-#define ahash_region(n, htable_bits)		\
+#define ahash_region(n)		\
 	((n) / jhash_size(HTABLE_REGION_BITS))
 #define ahash_bucket_start(h,  htable_bits)	\
 	((htable_bits) < HTABLE_REGION_BITS ? 0	\
@@ -702,7 +702,7 @@ mtype_resize(struct ip_set *set, bool retried)
 #endif
 				key = HKEY(data, h->initval, htable_bits);
 				m = __ipset_dereference(hbucket(t, key));
-				nr = ahash_region(key, htable_bits);
+				nr = ahash_region(key);
 				if (!m) {
 					m = kzalloc(sizeof(*m) +
 					    AHASH_INIT_SIZE * dsize,
@@ -852,7 +852,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
 	rcu_read_lock_bh();
 	t = rcu_dereference_bh(h->table);
 	key = HKEY(value, h->initval, t->htable_bits);
-	r = ahash_region(key, t->htable_bits);
+	r = ahash_region(key);
 	atomic_inc(&t->uref);
 	elements = t->hregion[r].elements;
 	maxelem = t->maxelem;
@@ -1050,7 +1050,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
 	rcu_read_lock_bh();
 	t = rcu_dereference_bh(h->table);
 	key = HKEY(value, h->initval, t->htable_bits);
-	r = ahash_region(key, t->htable_bits);
+	r = ahash_region(key);
 	atomic_inc(&t->uref);
 	rcu_read_unlock_bh();
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:25:37 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368400; cv=none; b=X0advcXpgu2LjER9mfDYyVCYUTCw47Jv4kiH96ED3QRIDEQHsrF5fyUGH+ouk+BbjxZS7I9YRfHCBd/ZhkaJBRrnM/syf8lBHhEIs6/h4f7hoXh4HjJTelCWI2SnFk4xYYW2vgBB/m8aNs1D300cYT2JPRhY4IasvKjPXgzlyDY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368400; c=relaxed/simple;
	bh=qn4FoQrJsvDaVm4GWnlT1tN2lvRuFYTXYuD8HDfg03s=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=WI8qHkZm4WMNH/RqPD5Lxad0Z7cSUb9LixmXS1wu4yViwYtQsTOXxbyl5PWPpQiu4uauh/P2mZe9ENzpwDl7tpL0vOq2yosG8d1XeGD09Of4g83tgCJdbp+KcoqU0ZaCaJ1Y2wXKS7WEZu/mOI8mVkd7IfAr3dW3GZEzor9FGig=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=w3RO43yd; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Liam Beguin <[email-masked]>,
	Andy Shevchenko <[email-masked]>,
	Hans de Goede <[email-masked]>,
	Jonathan Cameron <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 141/262] iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
Date: Mon, 13 Oct 2025 16:44:43 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hans de Goede <[email-masked]>

[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]

Fix iio_convert_raw_to_processed() offset handling for channels without
a scale attribute.

The offset has been applied to the raw64 value not to the original raw
value. Use the raw64 value so that the offset is taken into account.

Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available")
Cc: Liam Beguin <[email-masked]>
Reviewed-by: Andy Shevchenko <[email-masked]>
Signed-off-by: Hans de Goede <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jonathan Cameron <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/iio/inkern.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index 0f394266ff8c0..85ba80c57d08f 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -638,7 +638,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
 		 * If no channel scaling is available apply consumer scale to
 		 * raw value and return.
 		 */
-		*processed = raw * scale;
+		*processed = raw64 * scale;
 		return 0;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:30:15 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368500; cv=none; b=bZjendqZaMV0PELXgVJIPAsG+rnD6LDSKRuBogITStFmpxeOyA1mi5WW/+I389YsCiEFARD3nJpmUbWmv3w/t78j/R8Z7s7aB42qwcfhWmeTgsA2RKa8W8dZg10BU0YIiOOzmS9BR+Z1s4WUhcmYnvL5Co1BDq0jbPkrRssRaVM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368500; c=relaxed/simple;
	bh=QiBUuJiwG3ey1MyPML+c3TcTZDZOfdHIM0/QsRjcjEw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Z762hXBjKy6X67OgfW3RfXguHVO/VnLLpHd70ecVPmJhnBZ/Ow9emOin0MsXspvCgfC3U57Grfv7mL4pN9c9M2/D3w928Rl7S0rEXTPMCwbxTOPvxssQf2hBMynWA4sXX9i2QAWjLkBJyq63neEyHUV5N9bSGDaNKnkO6xFhaZs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gUhHvbBe; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Matteo Martelli <[email-masked]>,
	Andy Shevchenko <[email-masked]>,
	Hans de Goede <[email-masked]>,
	Jonathan Cameron <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 140/262] iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed()
Date: Mon, 13 Oct 2025 16:44:42 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hans de Goede <[email-masked]>

[ Upstream commit 0f85406bf830eb8747dd555ab53c9d97ee4af293 ]

There is an issue with the handling of negative channel scales
in iio_convert_raw_to_processed_unlocked() when the channel-scale
is of the IIO_VAL_INT_PLUS_[MICRO|NANO] type:

Things work for channel-scale values > -1.0 and < 0.0 because of
the use of signed values in:

	*processed += div_s64(raw64 * (s64)scale_val2 * scale, 1000000LL);

Things will break however for scale values < -1.0. Lets for example say
that raw = 2, (caller-provided)scale = 10 and (channel)scale_val = -1.5.

The result should then be 2 * 10 * -1.5 = -30.

channel-scale = -1.5 means scale_val = -1 and scale_val2 = 500000,
now lets see what gets stored in processed:

1. *processed = raw64 * scale_val * scale;
2. *processed += raw64 * scale_val2 * scale / 1000000LL;

1. Sets processed to 2 * -1 * 10 = -20
2. Adds 2 * 500000 * 10 / 1000000 = 10 to processed

And the end result is processed = -20 + 10 = -10, which is not correct.

Fix this by always using the abs value of both scale_val and scale_val2
and if either is negative multiply the end-result by -1.

Note there seems to be an unwritten rule about negative
IIO_VAL_INT_PLUS_[MICRO|NANO] values that:

i.   values > -1.0 and < 0.0 are written as val=0 val2=-xxx
ii.  values <= -1.0 are written as val=-xxx val2=xxx

But iio_format_value() will also correctly display a third option:

iii. values <= -1.0 written as val=-xxx val2=-xxx

Since iio_format_value() uses abs(val) when val2 < 0.

This fix also makes iio_convert_raw_to_processed() properly handle
channel-scales using this third option.

Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value")
Cc: Matteo Martelli <[email-masked]>
Reviewed-by: Andy Shevchenko <[email-masked]>
Signed-off-by: Hans de Goede <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jonathan Cameron <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/iio/inkern.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index 1155487f7aeac..0f394266ff8c0 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -10,6 +10,7 @@
 #include <linux/mutex.h>
 #include <linux/property.h>
 #include <linux/slab.h>
+#include <linux/units.h>
 
 #include <linux/iio/iio.h>
 #include <linux/iio/iio-opaque.h>
@@ -602,7 +603,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
 {
 	int scale_type, scale_val, scale_val2;
 	int offset_type, offset_val, offset_val2;
-	s64 raw64 = raw;
+	s64 denominator, raw64 = raw;
 
 	offset_type = iio_channel_read(chan, &offset_val, &offset_val2,
 				       IIO_CHAN_INFO_OFFSET);
@@ -646,20 +647,19 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
 		*processed = raw64 * scale_val * scale;
 		break;
 	case IIO_VAL_INT_PLUS_MICRO:
-		if (scale_val2 < 0)
-			*processed = -raw64 * scale_val * scale;
-		else
-			*processed = raw64 * scale_val * scale;
-		*processed += div_s64(raw64 * (s64)scale_val2 * scale,
-				      1000000LL);
-		break;
 	case IIO_VAL_INT_PLUS_NANO:
-		if (scale_val2 < 0)
-			*processed = -raw64 * scale_val * scale;
-		else
-			*processed = raw64 * scale_val * scale;
-		*processed += div_s64(raw64 * (s64)scale_val2 * scale,
-				      1000000000LL);
+		switch (scale_type) {
+		case IIO_VAL_INT_PLUS_MICRO:
+			denominator = MICRO;
+			break;
+		case IIO_VAL_INT_PLUS_NANO:
+			denominator = NANO;
+			break;
+		}
+		*processed = raw64 * scale * abs(scale_val);
+		*processed += div_s64(raw64 * scale * abs(scale_val2), denominator);
+		if (scale_val < 0 || scale_val2 < 0)
+			*processed *= -1;
 		break;
 	case IIO_VAL_FRACTIONAL:
 		*processed = div_s64(raw64 * (s64)scale_val * scale,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:25:26 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368378; cv=none; b=fwkJPd/QFgOpGWnpcpXhuapqGOZHt8Ioi+evVhqbV5YmGOo+FCkBIf617evem987sYgot89IbmmbLnDU9yJdM4Xp3q5SUOCjm1rt+jlYHNXCoNzcPAgqKK88cNAtmSPhtlX86hiz0Fn4TVMvDu8ZTZXjQUWrTW4cxrIk3+B1EXw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368378; c=relaxed/simple;
	bh=Ovji5IJAi9hxWyONm8VcjrhyWsaaFKkKr1jtSCtWCD0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=KbiIOBWr9saQrsVAVjDRWXcT3POv+yTquQHJ5rGxGxCPCoKGjlwMn2DJpPwVobL3jSzilaIppz0cd7BjXUm7GVqmth6nwYUdYYUtXVnim3pERsJ/9ULzB2T6rgZuPDYvXAJ66oO1vRLpchAyXSFjAp+mJQd4Q+XvUWpJ8wkln4U=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=T6XNGnY4; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Moon Hee Lee <[email-masked]>,
	Konstantin Komarov <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 139/262] fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
Date: Mon, 13 Oct 2025 16:44:41 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Moon Hee Lee <[email-masked]>

[ Upstream commit 0dc7117da8f92dd5fe077d712a756eccbe377d40 ]

Index allocation requires at least one bit in the $BITMAP attribute to
track usage of index entries. If the bitmap is empty while index blocks
are already present, this reflects on-disk corruption.

syzbot triggered this condition using a malformed NTFS image. During a
rename() operation involving a long filename (which spans multiple
index entries), the empty bitmap allowed the name to be added without
valid tracking. Subsequent deletion of the original entry failed with
-ENOENT, due to unexpected index state.

Reject such cases by verifying that the bitmap is not empty when index
blocks exist.

Reported-by: [email-masked]
Closes: https://syzkaller.appspot.com/bug?extid=b0373017f711c06ada64
Fixes: d99208b91933 ("fs/ntfs3: cancle set bad inode after removing name fails")
Tested-by: [email-masked]
Signed-off-by: Moon Hee Lee <[email-masked]>
Signed-off-by: Konstantin Komarov <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/ntfs3/index.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 1bf2a6593dec6..6d1bf890929d9 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1508,6 +1508,16 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni,
 			bmp_size = bmp_size_v = le32_to_cpu(bmp->res.data_size);
 		}
 
+		/*
+		 * Index blocks exist, but $BITMAP has zero valid bits.
+		 * This implies an on-disk corruption and must be rejected.
+		 */
+		if (in->name == I30_NAME &&
+		    unlikely(bmp_size_v == 0 && indx->alloc_run.count)) {
+			err = -EINVAL;
+			goto out1;
+		}
+
 		bit = bmp_size << 3;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:25:24 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368375; cv=none; b=GhbBN5e3oOwKwm0Aj80/HHh30OMei2CS8td6e8USUfWdGGTOC5cxlV0vEXOBAFw6CMRcx1HF7lnXK3rYVSXe5f3bJa0/vx0qiC3CoCEq3ndYVaMBxpZsrIb+xvInCsBhZbDin0BTX6W1U6FyHClN13XA8h/FXjOhdZBat7PUljM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368375; c=relaxed/simple;
	bh=hCWkR1NbqzeO10SZ5pgHXH2JRcv0VgyZFE5n55llmm4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ss6OIhs/xCKJtYG+KAAjDGLqyfurqD1328SsgLAs+b3PUrLepWbV/fDhNPd0mRp68esbrU8B8iuQ6igg/rPeaUTHtSQGePj4212YD0CVBuZASj+30aL4r4Gk5jUxv7t0w+iQMGYxmvH5di9HLwqZj6FSefjua4DkedmSnGDlkyo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bP6KY6BE; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Vitaly Grigoryev <[email-masked]>,
	Konstantin Komarov <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 138/262] fs: ntfs3: Fix integer overflow in run_unpack()
Date: Mon, 13 Oct 2025 16:44:40 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vitaly Grigoryev <[email-masked]>

[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ]

The MFT record relative to the file being opened contains its runlist,
an array containing information about the file's location on the physical
disk. Analysis of all Call Stack paths showed that the values of the
runlist array, from which LCNs are calculated, are not validated before
run_unpack function.

The run_unpack function decodes the compressed runlist data format
from MFT attributes (for example, $DATA), converting them into a runs_tree
structure, which describes the mapping of virtual clusters (VCN) to
logical clusters (LCN). The NTFS3 subsystem also has a shortcut for
deleting files from MFT records - in this case, the RUN_DEALLOCATE
command is sent to the run_unpack input, and the function logic
provides that all data transferred to the runlist about file or
directory is deleted without creating a runs_tree structure.

Substituting the runlist in the $DATA attribute of the MFT record for an
arbitrary file can lead either to access to arbitrary data on the disk
bypassing access checks to them (since the inode access check
occurs above) or to destruction of arbitrary data on the disk.

Add overflow check for addition operation.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
Signed-off-by: Vitaly Grigoryev <[email-masked]>
Signed-off-by: Konstantin Komarov <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/ntfs3/run.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
index 48566dff0dc92..662add939da78 100644
--- a/fs/ntfs3/run.c
+++ b/fs/ntfs3/run.c
@@ -9,6 +9,7 @@
 #include <linux/blkdev.h>
 #include <linux/fs.h>
 #include <linux/log2.h>
+#include <linux/overflow.h>
 
 #include "debug.h"
 #include "ntfs.h"
@@ -982,14 +983,18 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
 
 			if (!dlcn)
 				return -EINVAL;
-			lcn = prev_lcn + dlcn;
+
+			if (check_add_overflow(prev_lcn, dlcn, &lcn))
+				return -EINVAL;
 			prev_lcn = lcn;
 		} else {
 			/* The size of 'dlcn' can't be > 8. */
 			return -EINVAL;
 		}
 
-		next_vcn = vcn64 + len;
+		if (check_add_overflow(vcn64, len, &next_vcn))
+			return -EINVAL;
+
 		/* Check boundary. */
 		if (next_vcn > evcn + 1)
 			return -EINVAL;
@@ -1153,7 +1158,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn)
 			return -EINVAL;
 
 		run_buf += size_size + offset_size;
-		vcn64 += len;
+		if (check_add_overflow(vcn64, len, &vcn64))
+			return -EINVAL;
 
 #ifndef CONFIG_NTFS3_64BIT_CLUSTER
 		if (vcn64 > 0x100000000ull)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:28:42 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368369; cv=none; b=Hh9pqdtikxfCY7I6APXy9L4u5x5qE+AemC7aJ6WagePg3mKo56GJBg8dzPzJybweAIam8Yxv4glIixqpat8szqXjbVo1rJ+V/VYGIZhiQllhYlsC2vq4/z6VTHfuPCIy/tCwpAtCvKNnCna9CjZ6aB+4YO9QV6Bm1OfQ9aNRnCo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368369; c=relaxed/simple;
	bh=p8TeNejUx3QoB7hib6l1JBrU2au96INAEHjFl5VY8RM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=kQthljNihg/gfSs3WNy3Ttr7GeMNwLMrWn2Mi711z4tIK0yoVySMbUNRAk5reqwY0rEy85m0WKuDlNnfPMTzvqMZfyoxfmcTe5td8y2RpDhis9yHcTmCBwVvQPDi/9XkWnoht9HrOQ8H7HYcyab+jCC+cKeOKVIjGLsdTMEP7iM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JB8T0H8q; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Takashi Iwai <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 136/262] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
Date: Mon, 13 Oct 2025 16:44:38 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email-masked]>

[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]

When an invalid value is passed via quirk option, currently
bytcr_rt5640 driver just ignores and leaves as is, which may lead to
unepxected results like OOB access.

This patch adds the sanity check and corrects the input mapping to the
certain default value if an invalid value is passed.

Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks")
Signed-off-by: Takashi Iwai <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
index 8e4b821efe927..6860ac41e6b32 100644
--- a/sound/soc/intel/boards/bytcr_rt5651.c
+++ b/sound/soc/intel/boards/bytcr_rt5651.c
@@ -58,7 +58,8 @@ enum {
 	BYT_RT5651_OVCD_SF_1P5	= (RT5651_OVCD_SF_1P5 << 13),
 };
 
-#define BYT_RT5651_MAP(quirk)		((quirk) & GENMASK(3, 0))
+#define BYT_RT5651_MAP_MASK		GENMASK(3, 0)
+#define BYT_RT5651_MAP(quirk)		((quirk) & BYT_RT5651_MAP_MASK)
 #define BYT_RT5651_JDSRC(quirk)		(((quirk) & GENMASK(7, 4)) >> 4)
 #define BYT_RT5651_OVCD_TH(quirk)	(((quirk) & GENMASK(12, 8)) >> 8)
 #define BYT_RT5651_OVCD_SF(quirk)	(((quirk) & GENMASK(14, 13)) >> 13)
@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
 
 static void log_quirks(struct device *dev)
 {
-	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP)
+	int map;
+
+	map = BYT_RT5651_MAP(byt_rt5651_quirk);
+	switch (map) {
+	case BYT_RT5651_DMIC_MAP:
 		dev_info(dev, "quirk DMIC_MAP enabled");
-	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP)
+		break;
+	case BYT_RT5651_IN1_MAP:
 		dev_info(dev, "quirk IN1_MAP enabled");
-	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP)
+		break;
+	case BYT_RT5651_IN2_MAP:
 		dev_info(dev, "quirk IN2_MAP enabled");
-	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP)
+		break;
+	case BYT_RT5651_IN1_IN2_MAP:
 		dev_info(dev, "quirk IN1_IN2_MAP enabled");
+		break;
+	default:
+		dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map);
+		byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK;
+		byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP;
+		break;
+	}
+
 	if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) {
 		dev_info(dev, "quirk realtek,jack-detect-source %ld\n",
 			 BYT_RT5651_JDSRC(byt_rt5651_quirk));
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:45:59 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368367; cv=none; b=bHqDXpVBq/k8SjIUtxGgurSNXN25XIzNT+es8/Iq1HqNfv2mGQUcn59b/r3H2sp4bgVpk/9NCKREumZkPbZANyyAOjj8fMb+x77sGc43XZaqfy3cAaMSllcyxm5xFWeiKF0HxTHdoDDSOV9ELXvkXlbLHZNMdWjYXTSkwm/EiO8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368367; c=relaxed/simple;
	bh=ukiSuYPl8EocKfPRyM4339Os2NlnEEfpDfHK9Upd2YA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=s4OWo+rfOpixb3B2jLpPa8P+CzFxCLw45mU6OjWz630hiLROkEhiWKEJFuvF9bKPMbPzJUapwXml6NYKJgpmWKGhadGcWYvjE34bSp1fibitA3QGMUTdgl3pQc4SAW6gcQZamJ+bS1gWBM2MFH1Tkk41ryXTRSw1dlycSafU+Zg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=eUJrNGFm; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Takashi Iwai <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 135/262] ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
Date: Mon, 13 Oct 2025 16:44:37 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email-masked]>

[ Upstream commit fba404e4b4af4f4f747bb0e41e9fff7d03c7bcc0 ]

When an invalid value is passed via quirk option, currently
bytcr_rt5640 driver only shows an error message but leaves as is.
This may lead to unepxected results like OOB access.

This patch corrects the input mapping to the certain default value if
an invalid value is passed.

Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks")
Signed-off-by: Takashi Iwai <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 sound/soc/intel/boards/bytcr_rt5640.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
index b6434b4731261..d6991864c5a49 100644
--- a/sound/soc/intel/boards/bytcr_rt5640.c
+++ b/sound/soc/intel/boards/bytcr_rt5640.c
@@ -68,7 +68,8 @@ enum {
 	BYT_RT5640_OVCD_SF_1P5		= (RT5640_OVCD_SF_1P5 << 13),
 };
 
-#define BYT_RT5640_MAP(quirk)		((quirk) &  GENMASK(3, 0))
+#define BYT_RT5640_MAP_MASK		GENMASK(3, 0)
+#define BYT_RT5640_MAP(quirk)		((quirk) & BYT_RT5640_MAP_MASK)
 #define BYT_RT5640_JDSRC(quirk)		(((quirk) & GENMASK(7, 4)) >> 4)
 #define BYT_RT5640_OVCD_TH(quirk)	(((quirk) & GENMASK(12, 8)) >> 8)
 #define BYT_RT5640_OVCD_SF(quirk)	(((quirk) & GENMASK(14, 13)) >> 13)
@@ -140,7 +141,9 @@ static void log_quirks(struct device *dev)
 		dev_info(dev, "quirk NO_INTERNAL_MIC_MAP enabled\n");
 		break;
 	default:
-		dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map);
+		dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC1_MAP\n", map);
+		byt_rt5640_quirk &= ~BYT_RT5640_MAP_MASK;
+		byt_rt5640_quirk |= BYT_RT5640_DMIC1_MAP;
 		break;
 	}
 	if (byt_rt5640_quirk & BYT_RT5640_HSMIC2_ON_IN1)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:36:40 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368364; cv=none; b=IVmnCxXZxKiJJAtNQCK/tv0I4A5tmXNx9eADDE1DmY0hm3n+CA1THdgb6lk6U97I5ggM/kf8CVt/1zLrhMc5NJBpHJnx8SQlPFwVqwfij1DjldRNcWve9b8B979tQt2FKTwNtABraYHRllJTPHm0Cun526w0UckRmDyB7GimeQ8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368364; c=relaxed/simple;
	bh=Ge0D4dR/Gq5t+KYcBv4rhU9uq0FWPWUcybLV0x+yxeY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=fvAF95+lfIl3AJHg7CqBNvTdh7KuU2xzn8ywVz/mkbzex8HuvvI0yXFsjI73lblbg+Kk52PR/viTTQ5Zu+wOfvewBnCMly8/w3cOBJ7YwPlyG+lrJDFAXSe3zPxwVqh8tOUz7gWtWo+E707oA+bHgy02jWE0UgdBJpfjTCGQ6vk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=G69q7Q+p; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Takashi Iwai <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 134/262] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
Date: Mon, 13 Oct 2025 16:44:36 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email-masked]>

[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]

When an invalid value is passed via quirk option, currently
bytcht_es8316 driver just ignores and leaves as is, which may lead to
unepxected results like OOB access.

This patch adds the sanity check and corrects the input mapping to the
certain default value if an invalid value is passed.

Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks")
Signed-off-by: Takashi Iwai <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
index d3327bc237b5f..7975dc0ceb351 100644
--- a/sound/soc/intel/boards/bytcht_es8316.c
+++ b/sound/soc/intel/boards/bytcht_es8316.c
@@ -47,7 +47,8 @@ enum {
 	BYT_CHT_ES8316_INTMIC_IN2_MAP,
 };
 
-#define BYT_CHT_ES8316_MAP(quirk)		((quirk) & GENMASK(3, 0))
+#define BYT_CHT_ES8316_MAP_MASK			GENMASK(3, 0)
+#define BYT_CHT_ES8316_MAP(quirk)		((quirk) & BYT_CHT_ES8316_MAP_MASK)
 #define BYT_CHT_ES8316_SSP0			BIT(16)
 #define BYT_CHT_ES8316_MONO_SPEAKER		BIT(17)
 #define BYT_CHT_ES8316_JD_INVERTED		BIT(18)
@@ -60,10 +61,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
 
 static void log_quirks(struct device *dev)
 {
-	if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP)
+	int map;
+
+	map = BYT_CHT_ES8316_MAP(quirk);
+	switch (map) {
+	case BYT_CHT_ES8316_INTMIC_IN1_MAP:
 		dev_info(dev, "quirk IN1_MAP enabled");
-	if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP)
+		break;
+	case BYT_CHT_ES8316_INTMIC_IN2_MAP:
 		dev_info(dev, "quirk IN2_MAP enabled");
+		break;
+	default:
+		dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map);
+		quirk &= ~BYT_CHT_ES8316_MAP_MASK;
+		quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP;
+		break;
+	}
+
 	if (quirk & BYT_CHT_ES8316_SSP0)
 		dev_info(dev, "quirk SSP0 enabled");
 	if (quirk & BYT_CHT_ES8316_MONO_SPEAKER)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:34:44 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368361; cv=none; b=WAtGw7bGO0eJX+nCCp2yLdBHxx6opu/FG/k1wpfMNf6gW0y2OQrpLKh+NMKZUao0hnlpxFHm6eEHHnYzCwldvBDeQWczGZ8NjtjndozAHD05tiqWB7z6BkSYOUkS9bPEM2RQw83bg6I7FpkoMOdYtM2sFfv6h8GhlqkIKHf3wrM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368361; c=relaxed/simple;
	bh=VgnHW2zdx6y7ygI8Ugbu0zChJJ60hUpA+9khrlzYy98=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=hdLFhSqjyGQAYCZfJAJghOZZteRXvQpz4iAnjGiCmoctZ42EY/pC6oP9pOis27eM5DZWwI0CD1K8blj4GrUtKEAewzIPQAG036RMmUT9ViS4ZYwhC5mV1T7PrBUEfvGrqVIERPzXwTF9uwB15qRWtCiMCsI43+nwFjF2boWKKhA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=wNm++VrG; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Maciej Fijalkowski <[email-masked]>,
	Alexander Lobakin <[email-masked]>,
	Ramu R <[email-masked]>,
	Tony Nguyen <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 133/262] idpf: fix Rx descriptor ready check barrier in splitq
Date: Mon, 13 Oct 2025 16:44:35 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexander Lobakin <[email-masked]>

[ Upstream commit c20edbacc0295fd36f5f634b3421647ce3e08fd7 ]

No idea what the current barrier position was meant for. At that point,
nothing is read from the descriptor, only the pointer to the actual one
is fetched.
The correct barrier usage here is after the generation check, so that
only the first qword is read if the descriptor is not yet ready and we
need to stop polling. Debatable on coherent DMA as the Rx descriptor
size is <= cacheline size, but anyway, the current barrier position
only makes the codegen worse.

Fixes: 3a8845af66ed ("idpf: add RX splitq napi poll support")
Reviewed-by: Maciej Fijalkowski <[email-masked]>
Signed-off-by: Alexander Lobakin <[email-masked]>
Tested-by: Ramu R <[email-masked]>
Signed-off-by: Tony Nguyen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/intel/idpf/idpf_txrx.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
index 4086a6ef352e5..087a3077d5481 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
@@ -3216,18 +3216,14 @@ static int idpf_rx_splitq_clean(struct idpf_rx_queue *rxq, int budget)
 		/* get the Rx desc from Rx queue based on 'next_to_clean' */
 		rx_desc = &rxq->rx[ntc].flex_adv_nic_3_wb;
 
-		/* This memory barrier is needed to keep us from reading
-		 * any other fields out of the rx_desc
-		 */
-		dma_rmb();
-
 		/* if the descriptor isn't done, no work yet to do */
 		gen_id = le16_get_bits(rx_desc->pktlen_gen_bufq_id,
 				       VIRTCHNL2_RX_FLEX_DESC_ADV_GEN_M);
-
 		if (idpf_queue_has(GEN_CHK, rxq) != gen_id)
 			break;
 
+		dma_rmb();
+
 		rxdid = FIELD_GET(VIRTCHNL2_RX_FLEX_DESC_ADV_RXDID_M,
 				  rx_desc->rxdid_ucast);
 		if (rxdid != VIRTCHNL2_RXDID_2_FLEX_SPLITQ) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:25:15 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368355; cv=none; b=J/l+6PkBP1CoO8OxT3N8HiRwUiTmOnxAPyt1hlDc9alUZW4bNdvwA8bXqrrXb0vZPAdfXna9ov7dLlC3SX+gs+ZCiapYCgXX4gCsB0fAlomvTNFNw7aUPVevVet05nZPfPiYUrXIzOCbvvra2MT7t7+BZ6yZIpBV3JdBcCL0MbY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368355; c=relaxed/simple;
	bh=1HGtm1Nim5g+htlCLbH8ZbvM6cD29SolrDMQGqQBczc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=NDcbbXytmYjgnefHOD4p4yhBgpRGIIvrSJYOEnqrJtLhgxbD6zwed9viVNFbaFjht1WI97CzdFxyeJO6XiJrj67w1H8NsO+CtXpmMSEoRjGPTkedFB0xJPT+7No+UqL3t3WEZiYTvrVDyP+jYiEVoLb6yi68JHq7lRwwUDLcrCY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FtqKxENj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Liao Yuanhong <[email-masked]>,
	Miri Korenblit <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 132/262] wifi: iwlwifi: Remove redundant header files
Date: Mon, 13 Oct 2025 16:44:34 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Liao Yuanhong <[email-masked]>

[ Upstream commit b4b34ba66443696cc5f3e95493f9d7597259b728 ]

The header file "fw/img.h" is already included on line 9. Remove the
redundant include.

Fixes: 2594e4d9e1a2d ("wifi: iwlwifi: prepare for reading SAR tables from UEFI")
Signed-off-by: Liao Yuanhong <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Miri Korenblit <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/intel/iwlwifi/fw/regulatory.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
index 81787501d4a4f..11704163876b8 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.h
@@ -12,7 +12,6 @@
 #include "fw/api/phy.h"
 #include "fw/api/config.h"
 #include "fw/api/nvm-reg.h"
-#include "fw/img.h"
 #include "iwl-trans.h"
 
 #define BIOS_SAR_MAX_PROFILE_NUM	4
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:28:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368352; cv=none; b=SW4PB676Ml0McrwEbsswRVFsArmO7Ya3AJcuiukdlWStvLMwEktJGo7UVjLNysl/ufaYRRAi3qQEH0lTAv+EPHQCfGfiWTABlT8s48TQKRztbujrwUftqiSSTthnoDLrIhszMFkRD+1gkpHFZNIfba0gGwl4zLcnhCfovul9Eoc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368352; c=relaxed/simple;
	bh=ymFmd0GvUoFnpNYNYrs/7rostoS/SuCESRW2a7/2pTM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ledNgKkTzZkjVGGkK8Yvy1TVnFBGiUv47IzeORMTydvxvzMHbmQe1J1ROGAohKskSkAZtMCOMFNccSbCKS7ZN3RjflniJpkFXd70bWF0HJ4QrZ0usFnfk1PzBYYKDD1agO0brqW2PdRX1Z+DT/pKpCMi2aJW0vqgC6XcVeCirNo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FQjBvKrh; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Wang Liang <[email-masked]>,
	Calvin Owens <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 131/262] pps: fix warning in pps_register_cdev when register device fail
Date: Mon, 13 Oct 2025 16:44:33 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wang Liang <[email-masked]>

[ Upstream commit b0531cdba5029f897da5156815e3bdafe1e9b88d ]

Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error
handling in __video_register_device()"), the release hook should be set
before device_register(). Otherwise, when device_register() return error
and put_device() try to callback the release function, the below warning
may happen.

  ------------[ cut here ]------------
  WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567
  Modules linked in:
  CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE
  RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567
  Call Trace:
   <TASK>
   kobject_cleanup+0x136/0x410 lib/kobject.c:689
   kobject_release lib/kobject.c:720 [inline]
   kref_put include/linux/kref.h:65 [inline]
   kobject_put+0xe9/0x130 lib/kobject.c:737
   put_device+0x24/0x30 drivers/base/core.c:3797
   pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402
   pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108
   pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57
   tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432
   tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563
   tiocsetd drivers/tty/tty_io.c:2429 [inline]
   tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:598 [inline]
   __se_sys_ioctl fs/ioctl.c:584 [inline]
   __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
   </TASK>

Before commit c79a39dc8d06 ("pps: Fix a use-after-free"),
pps_register_cdev() call device_create() to create pps->dev, which will
init dev->release to device_create_release(). Now the comment is outdated,
just remove it.

Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed
in pps_register_source() to avoid a double free in the failure case.

Link: https://lore.kernel.org/all/[email-masked]/
Fixes: c79a39dc8d06 ("pps: Fix a use-after-free")
Signed-off-by: Wang Liang <[email-masked]>
Reviewed-By: Calvin Owens <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pps/kapi.c | 5 +----
 drivers/pps/pps.c  | 5 ++---
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
index 92d1b62ea239d..e9389876229ea 100644
--- a/drivers/pps/kapi.c
+++ b/drivers/pps/kapi.c
@@ -109,16 +109,13 @@ struct pps_device *pps_register_source(struct pps_source_info *info,
 	if (err < 0) {
 		pr_err("%s: unable to create char device\n",
 					info->name);
-		goto kfree_pps;
+		goto pps_register_source_exit;
 	}
 
 	dev_dbg(&pps->dev, "new PPS source %s\n", info->name);
 
 	return pps;
 
-kfree_pps:
-	kfree(pps);
-
 pps_register_source_exit:
 	pr_err("%s: unable to register source\n", info->name);
 
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index 9463232af8d2e..c6b8b64782761 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -374,6 +374,7 @@ int pps_register_cdev(struct pps_device *pps)
 			       pps->info.name);
 			err = -EBUSY;
 		}
+		kfree(pps);
 		goto out_unlock;
 	}
 	pps->id = err;
@@ -383,13 +384,11 @@ int pps_register_cdev(struct pps_device *pps)
 	pps->dev.devt = MKDEV(pps_major, pps->id);
 	dev_set_drvdata(&pps->dev, pps);
 	dev_set_name(&pps->dev, "pps%d", pps->id);
+	pps->dev.release = pps_device_destruct;
 	err = device_register(&pps->dev);
 	if (err)
 		goto free_idr;
 
-	/* Override the release function with our own */
-	pps->dev.release = pps_device_destruct;
-
 	pr_debug("source %s got cdev (%d:%d)\n", pps->info.name, pps_major,
 		 pps->id);
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:39:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368346; cv=none; b=KovCCdjuiJeV1x83dcDJqYPcRVB15a6Oj3t3A8LNC7iPNCwy+ZTVt6gcMXN6Fgwm/zEumaEDJyCd9y4k+651mD5dRhIjgtPNJ3M6m/afbJRW7/HYwEIVVykJXFPm9kvxRy8/kSGavpfkpO0K3OwdpBplYQLjSwXA5OZaKNycc/4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368346; c=relaxed/simple;
	bh=kLtunDa2/IC23nuD1jgQZnWoOCywTOu8VFnsDI2DlJ4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=s8sbICugbgsSBuBUaYf9jL5dveYJGbBfW+SGbq8wEM/gA1FaWilLboNsKAqQfuk7Fuja6U3cLR7Wz1iW3C3nEApG1swPUbkuzDulFa9WIbKu9ENVFtUcJLOXYb0HsTXOqJwgHU5Q+MGO1i5fV9vTP7QrXKxACGTB2WMiw/GnDuI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WkrIU/1I; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Seppo Takalo <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 129/262] tty: n_gsm: Dont block input queue by waiting MSC
Date: Mon, 13 Oct 2025 16:44:31 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Seppo Takalo <[email-masked]>

[ Upstream commit 3cf0b3c243e56bc43be560617416c1d9f301f44c ]

Currently gsm_queue() processes incoming frames and when opening
a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update().
If basic mode is used it calls gsm_modem_upd_via_msc() and it
cannot block the input queue by waiting the response to come
into the same input queue.

Instead allow sending Modem Status Command without waiting for remote
end to respond. Define a new function gsm_modem_send_initial_msc()
for this purpose. As MSC is only valid for basic encoding, it does
not do anything for advanced or when convergence layer type 2 is used.

Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open")
Signed-off-by: Seppo Takalo <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/tty/n_gsm.c | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 252849910588f..c917fc20b469a 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -461,6 +461,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg);
 static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr);
 static void gsmld_write_trigger(struct gsm_mux *gsm);
 static void gsmld_write_task(struct work_struct *work);
+static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci);
 
 /**
  *	gsm_fcs_add	-	update FCS
@@ -2174,7 +2175,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci)
 		pr_debug("DLCI %d goes open.\n", dlci->addr);
 	/* Send current modem state */
 	if (dlci->addr) {
-		gsm_modem_update(dlci, 0);
+		gsm_modem_send_initial_msc(dlci);
 	} else {
 		/* Start keep-alive control */
 		gsm->ka_num = 0;
@@ -4156,6 +4157,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk)
 	return gsm_control_wait(dlci->gsm, ctrl);
 }
 
+/**
+ * gsm_modem_send_initial_msc - Send initial modem status message
+ *
+ * @dlci channel
+ *
+ * Send an initial MSC message after DLCI open to set the initial
+ * modem status lines. This is only done for basic mode.
+ * Does not wait for a response as we cannot block the input queue
+ * processing.
+ */
+static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci)
+{
+	u8 modembits[2];
+
+	if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT)
+		return 0;
+
+	modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */
+	modembits[1] = (gsm_encode_modem(dlci) << 1) | EA;
+	return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2);
+}
+
 /**
  *	gsm_modem_update	-	send modem status line state
  *	@dlci: channel
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:53:58 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368343; cv=none; b=S54Hz/XsGwTVA4hYfW4SjkQHe88FjfEC3rqPh6m8OXmgrW+BGObyUyXgHC3mRLqn8dx7kJd+2bNknPTauaUG4It4yzpNOUPl6H2kXQBsWeDB2R8VOKqMCUXD1o9iOBwLZpyiHiZFLjjKd/Z+1zGj4bpZvRgaO5pVzHS4xe9U8h4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368343; c=relaxed/simple;
	bh=fLBBz84uujbfyVvtNnWK+B9/hrOFXKqoij1jLdkcgTk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=nbUKhcU0xc3jxeiGpEScaJ6e9EL/zDPriV2/1xnOq7SyE2B8Y2GuQHW7B2rIIaaayYxax1UK0QQt/AZW2HXO1ob8QtXDz9YYuqmeU6KW3tl5+EUhjeONi4ZXd4sKyhNmbEueE5fDmJrtZPlkvs41aYeAGEnZ7mrWW85lSurduQw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0IgEDx4x; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	William Wu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 128/262] usb: gadget: configfs: Correctly set use_os_string at bind
Date: Mon, 13 Oct 2025 16:44:30 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: William Wu <[email-masked]>

[ Upstream commit e271cc0d25015f4be6c88bd7731444644eb352c2 ]

Once the use_os_string flag is set to true for some functions
(e.g. adb/mtp) which need to response the OS string, and then
if we re-bind the ConfigFS gadget to use the other functions
(e.g. hid) which should not to response the OS string, however,
because the use_os_string flag is still true, so the usb gadget
response the OS string descriptor incorrectly, this can cause
the USB device to be unrecognizable on the Windows system.

An example of this as follows:

echo 1 > os_desc/use
ln -s functions/ffs.adb configs/b.1/function0
start adbd
echo "<udc device>" > UDC   #succeed

stop adbd
rm configs/b.1/function0
echo 0 > os_desc/use
ln -s functions/hid.gs0 configs/b.1/function0
echo "<udc device>" > UDC  #fail to connect on Windows

This patch sets the use_os_string flag to false at bind if
the functions not support OS Descriptors.

Signed-off-by: William Wu <[email-masked]>
Fixes: 87213d388e92 ("usb: gadget: configfs: OS String support")
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/usb/gadget/configfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 1b4d0056f1d08..82282373c786b 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1750,6 +1750,8 @@ static int configfs_composite_bind(struct usb_gadget *gadget,
 		cdev->use_os_string = true;
 		cdev->b_vendor_code = gi->b_vendor_code;
 		memcpy(cdev->qw_sign, gi->qw_sign, OS_STRING_QW_SIGN_LEN);
+	} else {
+		cdev->use_os_string = false;
 	}
 
 	if (gadget_is_otg(gadget) && !otg_desc[0]) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:46:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368337; cv=none; b=KFNs/UNbRc7f3BVVF/Z29qIeAbU/83auCuxv8dPUyySDgJUYTSod2VG1EWgriXhqnaXQeC0ZW/e12LKvjP84rVFOaP4nAb51jKeJ7uUCz5kXfT+eLPpkj0Pd3MqLl8H2znHuHIxiHSqHD3m9NT7FeNh1wi9Kk2Jq+Bxpihl3sRA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368337; c=relaxed/simple;
	bh=5lvpuJ+m8O5sEqdDb/BSGz9w440QHySnFZhFQUzkSe8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=hr8ETarPQoarjmjwYFfJbzFjOrNXS+G2AHRLf/a/7soxCHKTAv6jAZt0PzeBe0ZpQLAmLcxi4AnM/3rpJ2Hixj2FfP8SZ0dOHnrLwxC6KPGqkeyDsroaW9Lvi5D95gjic+nCRBY6DTIw6viAErtp3nZqfmMcMKF1fjNQqYKcNEg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QrJjk5+l; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	Alex Deucher <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 126/262] drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
Date: Mon, 13 Oct 2025 16:44:28 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit cbda64f3f58027f68211dda8ea94d52d7e493995 ]

Use negative error code -EINVAL instead of positive EINVAL in the default
case of svm_ioctl() to conform to Linux kernel error code conventions.

Fixes: 42de677f7999 ("drm/amdkfd: register svm range")
Signed-off-by: Qianfeng Rong <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
index 3e9e0f36cd3f4..a8d4b3a3e77af 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -4231,7 +4231,7 @@ svm_ioctl(struct kfd_process *p, enum kfd_ioctl_svm_op op, uint64_t start,
 		r = svm_range_get_attr(p, mm, start, size, nattrs, attrs);
 		break;
 	default:
-		r = EINVAL;
+		r = -EINVAL;
 		break;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:28:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368334; cv=none; b=gvmP/7b/c8utBQ/JOPB8ApK024lUeDT+3LwA0r9Bx9B9Hv07jjVNkzPJ7OhRW84K/IMsBFPCHYPR3m9LxHjw29r/r510l1DDAs8/LLuCp1zcdnzgrHjgofWVMLhEtB+YsPrkUwdX6XU9TQqFLgmcl8qis2joRLa4aGm63eXk/L8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368334; c=relaxed/simple;
	bh=ebop7vL4RDNGc9OaM3jNZeMfNDxQ47GdSQKgEXULDII=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Wwpwk85J49V7cm7Cb83kv9WRxLeCKnm6DasZREakrprZxcAiSC5GhSRLQx3pTF/HFRlmhxJFA3eUmZsVh/OZvniWcgyU6xEl8/k7ygPToTIals0AtvfyDjIwzNCOgTnZujIJTwl8zyrOZjdxaOUog+qsJ9bASi9rl5gbHS+U3ts=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ZZTl3OPq; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Eric Dumazet <[email-masked]>,
	Neal Cardwell <[email-masked]>,
	Kuniyuki Iwashima <[email-masked]>,
	Jason Xing <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 125/262] tcp: fix __tcp_close() to only send RST when required
Date: Mon, 13 Oct 2025 16:44:27 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email-masked]>

[ Upstream commit 5f9238530970f2993b23dd67fdaffc552a2d2e98 ]

If the receive queue contains payload that was already
received, __tcp_close() can send an unexpected RST.

Refine the code to take tp->copied_seq into account,
as we already do in tcp recvmsg().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <[email-masked]>
Reviewed-by: Neal Cardwell <[email-masked]>
Reviewed-by: Kuniyuki Iwashima <[email-masked]>
Reviewed-by: Jason Xing <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/ipv4/tcp.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 988992ff898b3..739931aabb4e3 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3058,8 +3058,8 @@ bool tcp_check_oom(const struct sock *sk, int shift)
 
 void __tcp_close(struct sock *sk, long timeout)
 {
+	bool data_was_unread = false;
 	struct sk_buff *skb;
-	int data_was_unread = 0;
 	int state;
 
 	WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
@@ -3078,11 +3078,12 @@ void __tcp_close(struct sock *sk, long timeout)
 	 *  reader process may not have drained the data yet!
 	 */
 	while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-		u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;
+		u32 end_seq = TCP_SKB_CB(skb)->end_seq;
 
 		if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
-			len--;
-		data_was_unread += len;
+			end_seq--;
+		if (after(end_seq, tcp_sk(sk)->copied_seq))
+			data_was_unread = true;
 		__kfree_skb(skb);
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:25:04 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368332; cv=none; b=KYBpaGWf2YepKcG679wsiwQVT8430tMP47Dj32ACq8WqVKPHS/VjV1j2X5z+QD9GZ2lA4qUu2eGDSwLu/vyVEm2MkZ9ThphDTETn2+KfyTEq6iXegBoU4NrH3mE5u7uIaTQXRiTwTmvArGUwxOkpCRxdwxrqNqMncABwANN4Ros=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368332; c=relaxed/simple;
	bh=oJRzvEuCI2MmDviYOgxmMyxXTYrlmGwbB4MTOYj5YBE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=BvFhWp0auY07CoE+CzVeWAYibWx8EvD/4XiKUBkLVx+9NWu8q2UqzRNRTegh5jp9kViZzlOKg4XqZo0g3xxUFw0LwhRWRF9UFYqE/7ssRwv7CN9jyA5tHpZGsAj08lJG4YlSkjKuvgr5+jrtMxT2X+5FVU/BzPwWk1uuSxgt6M0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=UevdTvEj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alok Tiwari <[email-masked]>,
	Manivannan Sadhasivam <[email-masked]>,
	Bjorn Helgaas <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 124/262] PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
Date: Mon, 13 Oct 2025 16:44:26 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alok Tiwari <[email-masked]>

[ Upstream commit e1a8805e5d263453ad76a4f50ab3b1c18ea07560 ]

Fix incorrect argument order in devm_kcalloc() when allocating port->phys.
The original call used sizeof(phy) as the number of elements and
port->lanes as the element size, which is reversed.  While this happens to
produce the correct total allocation size with current pointer size and
lane counts, the argument order is wrong.

Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs")
Signed-off-by: Alok Tiwari <[email-masked]>
[mani: added Fixes tag]
Signed-off-by: Manivannan Sadhasivam <[email-masked]>
Signed-off-by: Bjorn Helgaas <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pci/controller/pci-tegra.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
index d7517c3976e7f..4f70b7f2ded9c 100644
--- a/drivers/pci/controller/pci-tegra.c
+++ b/drivers/pci/controller/pci-tegra.c
@@ -1343,7 +1343,7 @@ static int tegra_pcie_port_get_phys(struct tegra_pcie_port *port)
 	unsigned int i;
 	int err;
 
-	port->phys = devm_kcalloc(dev, sizeof(phy), port->lanes, GFP_KERNEL);
+	port->phys = devm_kcalloc(dev, port->lanes, sizeof(phy), GFP_KERNEL);
 	if (!port->phys)
 		return -ENOMEM;
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:28:29 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368329; cv=none; b=OR2avgt5peVRxGCeE/xc11Qinj3GcWDDf8CZqwqSFxG5aMruilaii9oP9VRRH2lRzIapWN1TuLEsWtpsFy2Skkg+M8v1Bl+OnQ2L61KcJRff56ro06bD+wcEFFTnTp6wnTctSTMEmz+CDGKJkkWD56JriaSaNwQGlYkDQwPxE0U=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368329; c=relaxed/simple;
	bh=Tl53nBm+npSWF/yKe/tkfIvjW7MdvFhRZS79rCb2260=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=RF9AgK4WOMvwKSPcg0X0iqA4oshP4f/8GbF7AdCwDU24MotUVq9H9SOc8MFwYlpP2GWxNzpzHuM/G7/LCsTwCViCAPid2bQyFOYajs2yiL/3LwNpQeRrEEPpo19n5uZwt/neBVa3xof0eSbi5FU8a1TqNLsdqeF2ychg+31giRA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=eev3VRcd; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Stefan Kerkmann <[email-masked]>,
	Jeff Chen <[email-masked]>,
	Johannes Berg <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 123/262] wifi: mwifiex: send world regulatory domain to driver
Date: Mon, 13 Oct 2025 16:44:25 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Kerkmann <[email-masked]>

[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]

The world regulatory domain is a restrictive subset of channel
configurations which allows legal operation of the adapter all over the
world. Changing to this domain should not be prevented.

Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed
Signed-off-by: Stefan Kerkmann <[email-masked]>
Reviewed-by: Jeff Chen <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Johannes Berg <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 59bea82eab294..8801b93eacd42 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -684,10 +684,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
 		return;
 	}
 
-	/* Don't send world or same regdom info to firmware */
-	if (strncmp(request->alpha2, "00", 2) &&
-	    strncmp(request->alpha2, adapter->country_code,
-		    sizeof(request->alpha2))) {
+	/* Don't send same regdom info to firmware */
+	if (strncmp(request->alpha2, adapter->country_code,
+		    sizeof(request->alpha2)) != 0) {
 		memcpy(adapter->country_code, request->alpha2,
 		       sizeof(request->alpha2));
 		mwifiex_send_domain_info_cmd_fw(wiphy);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:37:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368324; cv=none; b=as4PuE/KpLriBIaITANRQPQMca4u1cz/uDacCMOabhN/8cBIH/gixRuObiBqESISeoGPppFq8ZrT4xqaLLBpNzFuCZjik5HXamottpTvWOiwCVXCRXyZUMgmPQLE+fFPVVHvvnfh9+yNcbn1EvJJzWykXk2Z+qw/Ql0SLQ6UdzM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368324; c=relaxed/simple;
	bh=IGt0n38gy2snRZfM8eAUD4VnpOts/gJPxjYyNHSieoQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=peVC8pVQiRlvwfST8W9N7iQo6YFz5BGYO9Se++OYxYuxCbyI/5tBJpuIwFKOIzU0XT/vSy04H6RhmYFJTYSVCyhm0X/0IgAs4EU5R0gs5SMluTnk1CIlw0fP+I2d4j7it2IVC80y30nfNKtEeF78bk59HD26+e6ErDBawpEtmwo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vo/zKhVG; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 122/262] drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
Date: Mon, 13 Oct 2025 16:44:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ]

Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk
switching on Oland when two 4K 60Hz monitors are connected")

This is an ad-hoc DPM fix, necessary because we don't have
proper bandwidth calculation for DCE 6.

We define "high pixelclock" for SI as higher than necessary
for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into
this category.

When two high pixel clock displays are connected to Oland,
additionally disable shader clock switching, which results in
a higher voltage, thereby addressing some visible flickering.

v2:
Add more comments.
v3:
Split into two commits for easier review.

Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index 76fc08cda7480..82167eca26683 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -3430,12 +3430,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
 {
 	struct  si_ps *ps = si_get_ps(rps);
 	struct amdgpu_clock_and_voltage_limits *max_limits;
+	struct amdgpu_connector *conn;
 	bool disable_mclk_switching = false;
 	bool disable_sclk_switching = false;
 	u32 mclk, sclk;
 	u16 vddc, vddci, min_vce_voltage = 0;
 	u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
 	u32 max_sclk = 0, max_mclk = 0;
+	u32 high_pixelclock_count = 0;
 	int i;
 
 	if (adev->asic_type == CHIP_HAINAN) {
@@ -3463,6 +3465,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
 		}
 	}
 
+	/* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz.
+	 * For example, 4K 60Hz and 1080p 144Hz fall into this category.
+	 * Find number of such displays connected.
+	 */
+	for (i = 0; i < adev->mode_info.num_crtc; i++) {
+		if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) ||
+			!adev->mode_info.crtcs[i]->enabled)
+			continue;
+
+		conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector);
+
+		if (conn->pixelclock_for_modeset > 297000)
+			high_pixelclock_count++;
+	}
+
+	/* These are some ad-hoc fixes to some issues observed with SI GPUs.
+	 * They are necessary because we don't have something like dce_calcs
+	 * for these GPUs to calculate bandwidth requirements.
+	 */
+	if (high_pixelclock_count) {
+		/* On Oland, we observe some flickering when two 4K 60Hz
+		 * displays are connected, possibly because voltage is too low.
+		 * Raise the voltage by requiring a higher SCLK.
+		 * (Voltage cannot be adjusted independently without also SCLK.)
+		 */
+		if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND)
+			disable_sclk_switching = true;
+	}
+
 	if (rps->vce_active) {
 		rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk;
 		rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:53:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368320; cv=none; b=JUdejLCiMNdVEiqVJLJFKSL2FoAyoO/Ff19EFGsAcJuglU7FkyAXN9h8BdJewYZ+239n8skdcOnYQ2MX5z1keP7MRP8O1iUJUNTKP5az4DYfBfXS+aeG0DEV36lY6AtwazAJAG8qwM9jF4tndYWC9DrqFjlzHlIDqYUrL2Jwf1k=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368320; c=relaxed/simple;
	bh=MEoJA228dxQU7hernWcMiEBX/8nIC+n0GQC21M4n6PE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=DyKErdjSOld2uCj+/CWAxvAz9DqRVTP8GgQFUQ+xJjUxkLsacH01ASq/8it6DXFrvhi/gQIoz/FaW2qHBfG2PfwINXwOyLU8iOsU/OoSEggIieD/i+rCEWbaC9PagI+Ns9KvGZ9moDKLAiyrDKe0cxq+huOkvPfbsgBATSX00cw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=h0AEsRj1; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 121/262] drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)
Date: Mon, 13 Oct 2025 16:44:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit ed3803533c7bf7df88bc3fc9f70bd317e1228ea8 ]

According to pp_pm_compute_clocks the non-DC display code
has "issues with mclk switching with refresh rates over 120 hz".
The workaround is to disable MCLK switching in this case.

Do the same for legacy DPM.

Fixes: 6ddbd37f1074 ("drm/amd/pm: optimize the amdgpu_pm_compute_clocks() implementations")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
index 42efe838fa85c..2d2d2d5e67634 100644
--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c
@@ -66,6 +66,13 @@ u32 amdgpu_dpm_get_vblank_time(struct amdgpu_device *adev)
 					(amdgpu_crtc->v_border * 2));
 
 				vblank_time_us = vblank_in_pixels * 1000 / amdgpu_crtc->hw_mode.clock;
+
+				/* we have issues with mclk switching with
+				 * refresh rates over 120 hz on the non-DC code.
+				 */
+				if (drm_mode_vrefresh(&amdgpu_crtc->hw_mode) > 120)
+					vblank_time_us = 0;
+
 				break;
 			}
 		}
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:28:26 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368318; cv=none; b=n8Op+It/E0d7Glftk5Tuy2lwDrZyM4RyngYitHcQRf0FDGJB4lnZk8WCLETOyDsj13ql8sEp5P97K8TBgH5zIcrWGVq47OjTPO0OTHvRONyIOfQqiSuD8NgcM5aDG3BH8cfmOS60y7dLQTuNBbPysBZe6CK1bwgmaGGAI3gCNr4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368318; c=relaxed/simple;
	bh=6oSO/sy2EdHRTMuSqU69ai3TvlQTs9Ce+Z7UFzMXIDQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=GS0ldWpsi+6+RsuHMA6b+r/+WsSiJ0ycPq2sDyAhE3RdJSFGo9O2kW/uNb3bdi18JH7X/bvJvU7mRRBaPqvVJEnnagxRWSs7gnMXKUg56DsVHvXcOGMG97z6AsI9vGiigm6A8Ho5u0Qyqul8sYvzHO8paf1/g7UptDyAbfELwG8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XCwVUV7O; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 120/262] drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
Date: Mon, 13 Oct 2025 16:44:22 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ]

Some parts of the code base expect that MCLK switching is turned
off when the vblank time is set to zero.

According to pp_pm_compute_clocks the non-DC code has issues
with MCLK switching with refresh rates over 120 Hz.

v3:
Add code comment to explain this better.
Add an if statement instead of changing the switch_limit.

Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index a8fe6aa6845eb..76fc08cda7480 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -3066,7 +3066,13 @@ static bool si_dpm_vblank_too_short(void *handle)
 	/* we never hit the non-gddr5 limit so disable it */
 	u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0;
 
-	if (vblank_time < switch_limit)
+	/* Consider zero vblank time too short and disable MCLK switching.
+	 * Note that the vblank time is set to maximum when no displays are attached,
+	 * so we'll still enable MCLK switching in that case.
+	 */
+	if (vblank_time == 0)
+		return true;
+	else if (vblank_time < switch_limit)
 		return true;
 	else
 		return false;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:54:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368315; cv=none; b=Xb2M39t5LKVMKiTqZJDFOl8zaZBkozB+upQ83kJTpLITY+anhjoGNXMbmGALOCxQO0ig9CbkO/9LXI7/pnRMmcH0hKf7i/DckWQ2ArGRTldQMZrCLhp+4g01KJjqT9wgOsHcxp6bKlODn7FK/vunVWjeKTGGGRzAyPUynHPtvxw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368315; c=relaxed/simple;
	bh=UCm4saks1B3I7gt0SDBtZVYv2GpICc24XbkXddXzdDA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=pOUzE9fDwNbpGv/HTfOCOXz8Cub2remnm1+Lf0PiXSm1LrDF+jCMWJukV7QZhGv/gZ3HlmG0v8bhCLDCLSJS/7PAivlWX966uDNmSLJ938OndCpa3HZGW79JM/+iNJJBdG8Eq7P6sUU7N9s6mMNgyO9+dRU+DU35cRT2JY9xY3k=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=e6yiUldn; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 119/262] drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
Date: Mon, 13 Oct 2025 16:44:21 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ]

Based on some comments in dm_pp_display_configuration
above the crtc_index and line_time fields, these values
are programmed to the SMC to work around an SMC hang
when it switches MCLK.

According to Alex, the Windows driver programs them to:
mclk_change_block_cp_min = 200 / line_time
mclk_change_block_cp_max = 100 / line_time
Let's use the same for the sake of consistency.

Previously we used the watermark values, but it seemed buggy
as the code was mixing up low/high and A/B watermarks, and
was not saving a low watermark value on DCE 6, so
mclk_change_block_cp_max would be always zero previously.

Split this change off from the previous si_upload_smc_data
to make it easier to bisect, in case it causes any issues.

Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index 341f2d796aeeb..a8fe6aa6845eb 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -5809,8 +5809,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
 		crtc_index = amdgpu_crtc->crtc_id;
 
 		if (amdgpu_crtc->line_time) {
-			mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
-			mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
+			mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time;
+			mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time;
 		}
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:48:08 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368312; cv=none; b=GIk0P+8LYqlfwIYgeDwXvY7v2X5Cz9Gx/xwJ6gJsKQiL0p/4ZYv86o3nTJNYAHERNTc0dE8scHQ60Rf//yNenagCOTaLjoncIZzYUelKcwtJQbIcyw5DOhIzI06LiiXhzk9sJwtwYdEG4jM5MKCZEJtqj51iItyxcpw3T720oIw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368312; c=relaxed/simple;
	bh=x7IYyjszqtxUwFdD8OtIoTtCgYy4I2IZcNrTeaOWNS4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=guMC6suXtlpBPDmJnu/Ai2WsYXJSYvCpSXmHhQXIQzhBnZHy76gdQ49PCuZ3++P/CN8JsSO7VYp3nBJPDmALcA374m1cEcf2Yk1IIu9DrxOJady1fN/iRAArMrDqB2oL/isGHGJ+67HOElDMPD93ezDrlPqGMnMrL3Z0JGWHqr8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=MX9WPWOt; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 118/262] drm/amd/pm: Fix si_upload_smc_data (v3)
Date: Mon, 13 Oct 2025 16:44:20 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit a43b2cec04b02743338aa78f837ee0bdf066a6d5 ]

The si_upload_smc_data function uses si_write_smc_soft_register
to set some register values in the SMC, and expects the result
to be PPSMC_Result_OK which is 1.

The PPSMC_Result_OK / PPSMC_Result_Failed values are used for
checking the result of a command sent to the SMC.
However, the si_write_smc_soft_register actually doesn't send
any commands to the SMC and returns zero on success,
so this check was incorrect.

Fix that by not checking the return value, just like other
calls to si_write_smc_soft_register.

v3:
Additionally, when no display is plugged in, there is no need
to restrict MCLK switching, so program the registers to zero.

Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 43 ++++++++++++----------
 1 file changed, 24 insertions(+), 19 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index 6a97ddcd695b5..341f2d796aeeb 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -5789,9 +5789,9 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
 {
 	struct amdgpu_crtc *amdgpu_crtc = NULL;
 	int i;
-
-	if (adev->pm.dpm.new_active_crtc_count == 0)
-		return 0;
+	u32 crtc_index = 0;
+	u32 mclk_change_block_cp_min = 0;
+	u32 mclk_change_block_cp_max = 0;
 
 	for (i = 0; i < adev->mode_info.num_crtc; i++) {
 		if (adev->pm.dpm.new_active_crtcs & (1 << i)) {
@@ -5800,26 +5800,31 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
 		}
 	}
 
-	if (amdgpu_crtc == NULL)
-		return 0;
+	/* When a display is plugged in, program these so that the SMC
+	 * performs MCLK switching when it doesn't cause flickering.
+	 * When no display is plugged in, there is no need to restrict
+	 * MCLK switching, so program them to zero.
+	 */
+	if (adev->pm.dpm.new_active_crtc_count && amdgpu_crtc) {
+		crtc_index = amdgpu_crtc->crtc_id;
 
-	if (amdgpu_crtc->line_time <= 0)
-		return 0;
+		if (amdgpu_crtc->line_time) {
+			mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
+			mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
+		}
+	}
 
-	if (si_write_smc_soft_register(adev,
-				       SI_SMC_SOFT_REGISTER_crtc_index,
-				       amdgpu_crtc->crtc_id) != PPSMC_Result_OK)
-		return 0;
+	si_write_smc_soft_register(adev,
+		SI_SMC_SOFT_REGISTER_crtc_index,
+		crtc_index);
 
-	if (si_write_smc_soft_register(adev,
-				       SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
-				       amdgpu_crtc->wm_high / amdgpu_crtc->line_time) != PPSMC_Result_OK)
-		return 0;
+	si_write_smc_soft_register(adev,
+		SI_SMC_SOFT_REGISTER_mclk_change_block_cp_min,
+		mclk_change_block_cp_min);
 
-	if (si_write_smc_soft_register(adev,
-				       SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
-				       amdgpu_crtc->wm_low / amdgpu_crtc->line_time) != PPSMC_Result_OK)
-		return 0;
+	si_write_smc_soft_register(adev,
+		SI_SMC_SOFT_REGISTER_mclk_change_block_cp_max,
+		mclk_change_block_cp_max);
 
 	return 0;
 }
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:24:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368306; cv=none; b=C6MDUbNmMxQbva76eld9THm2vxo5f019jtg0xYEnKO/xQkkCtsZH/9S8YuZU9GK1pv1rZKm3lru1K87SSi8pyC/t3Ja1Xg62XhAcMR3r0nabkDoI41crFmUVX0SV0Ln0oF3QiJ4ESxl3OfD3b3GnS7Rtbl+zvUmleuklWs1qREY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368306; c=relaxed/simple;
	bh=kxbvuVfZszMH1IfaEHlUQjPE9RWtfJ8aMwAVvKrlNOM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=u1dJvqdRcRACdgE6ZM1xLDTew1z8xpvWBGP1lq87YpNl6vl/T2XaTO+6dZx1c0XgMW3Har3kb6eJOW3hY5Grb1Q4H9ZTK6MiZP6gt//LXcQOHX5vdv+knuMFNYRbo94mJwVcXvE4gZ4NfMnzNzHlJpCnaATOEkfSjUG5FHZWNYs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bv0EQThv; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 116/262] drm/amdgpu: Power up UVD 3 for FW validation (v2)
Date: Mon, 13 Oct 2025 16:44:18 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ]

Unlike later versions, UVD 3 has firmware validation.
For this to work, the UVD should be powered up correctly.

When DPM is enabled and the display clock is off,
the SMU may choose a power state which doesn't power
the UVD, which can result in failure to initialize UVD.

v2:
Add code comments to explain about the UVD power state
and how UVD clock is turned on/off.

Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
index 805d6662c88b6..21376d98ee498 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
@@ -623,7 +623,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev,
  *
  * @handle: handle used to pass amdgpu_device pointer
  *
- * Initialize the hardware, boot up the VCPU and do some testing
+ * Initialize the hardware, boot up the VCPU and do some testing.
+ *
+ * On SI, the UVD is meant to be used in a specific power state,
+ * or alternatively the driver can manually enable its clock.
+ * In amdgpu we use the dedicated UVD power state when DPM is enabled.
+ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state
+ * for the SMU and afterwards enables the UVD clock.
+ * This is automatically done by amdgpu_uvd_ring_begin_use when work
+ * is submitted to the UVD ring. Here, we have to call it manually
+ * in order to power up UVD before firmware validation.
+ *
+ * Note that we must not disable the UVD clock here, as that would
+ * cause the ring test to fail. However, UVD is powered off
+ * automatically after the ring test: amdgpu_uvd_ring_end_use calls
+ * the UVD idle work handler which will disable the UVD clock when
+ * all fences are signalled.
  */
 static int uvd_v3_1_hw_init(void *handle)
 {
@@ -633,6 +648,15 @@ static int uvd_v3_1_hw_init(void *handle)
 	int r;
 
 	uvd_v3_1_mc_resume(adev);
+	uvd_v3_1_enable_mgcg(adev, true);
+
+	/* Make sure UVD is powered during FW validation.
+	 * It's going to be automatically powered off after the ring test.
+	 */
+	if (adev->pm.dpm_enabled)
+		amdgpu_dpm_enable_uvd(adev, true);
+	else
+		amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
 
 	r = uvd_v3_1_fw_validate(adev);
 	if (r) {
@@ -640,9 +664,6 @@ static int uvd_v3_1_hw_init(void *handle)
 		return r;
 	}
 
-	uvd_v3_1_enable_mgcg(adev, true);
-	amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
-
 	uvd_v3_1_start(adev);
 
 	r = amdgpu_ring_test_helper(ring);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:34:59 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368303; cv=none; b=sbpWYyETocVGvGea22zY9R1Z19Tkvyg7ngtFecIXIe9dUa9reT3seUUtgszXukmiRgNgBiAHxL0ZWTVaV4C9f3KfgBuQd3vt+7TdSYNr2yRq4jEHNo5S8IDun4IqTChwz69qWKVfYD+MLHVizjkqMKpCVzHNk8j8rOsGX6Xhun4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368303; c=relaxed/simple;
	bh=iCOAajrBgIwcJ0oEzyPXZQhOSuEU5xrzYGy65zbJY1w=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=uVJ51S2wzujw+lvxK127GWWM+yMzMOHMoptWrUhAGmLpBOdO9+zOs+1/slJFIHbpWGWMW5KfeZ4d4XRRM83qrErPLJqxHjsPK+sg1rhuSkIKhJJE1g4JlgbcQl38inhi++qoT9P4foJs2Ie7IVaSBdV4TOlpZncKMNr08lDoEis=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rRHdfyUt; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yuanfang Zhang <[email-masked]>,
	Suzuki K Poulose <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 115/262] coresight: Only register perf symlink for sinks with alloc_buffer
Date: Mon, 13 Oct 2025 16:44:17 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yuanfang Zhang <[email-masked]>

[ Upstream commit 12d9a9dd9d8a4f1968073e7f34515896d1e22b78 ]

Ensure that etm_perf_add_symlink_sink() is only called for devices
that implement the alloc_buffer operation. This prevents invalid
symlink creation for dummy sinks that do not implement alloc_buffer.

Without this check, perf may attempt to use a dummy sink that lacks
alloc_buffer operationsu to initialise perf's ring buffer, leading
to runtime failures.

Fixes: 9d3ba0b6c0569 ("Coresight: Add coresight dummy driver")
Signed-off-by: Yuanfang Zhang <[email-masked]>
Signed-off-by: Suzuki K Poulose <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-core.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
index b7941d8abbfe7..f20d4cab8f1df 100644
--- a/drivers/hwtracing/coresight/coresight-core.c
+++ b/drivers/hwtracing/coresight/coresight-core.c
@@ -1200,8 +1200,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc)
 		goto out_unlock;
 	}
 
-	if (csdev->type == CORESIGHT_DEV_TYPE_SINK ||
-	    csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) {
+	if ((csdev->type == CORESIGHT_DEV_TYPE_SINK ||
+	     csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) &&
+	    sink_ops(csdev)->alloc_buffer) {
 		ret = etm_perf_add_symlink_sink(csdev);
 
 		if (ret) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:53:58 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368300; cv=none; b=JlH9GJnsaQ59D4UsqphjxaxjUewxwbqULGwVMZ9x62bk5Eesqr/vHBgEzoUjUZFd4E+4aIzWOJuIfcJMPwkSZFanB2t8/acZizBiXmTWIbvYo8BAiDb0AJ/l8ge1WBXSLfjjSrhReYStQ0llg0iZ7SOMNKJ403ggLs2ttc/YyeY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368300; c=relaxed/simple;
	bh=yYU1aA2NoN+YpkOqK4vn/f+j1PSWfAyOb7de26ReN7w=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=R8wd/5JcRpfIlY+0vGl2QJXq7xpyG1NSbrp5Ug6mzOc8u9V5ap6kvAZne9bppuygtH88If5xh4dUdR1Jq1R27gktyVhvbDxLCPuh92HrTzL5WBr2crwBmELoLyh1yD7G3cSrDnVUjweNFZbrMCAzsGLxvbi/sSQENY//WfSAwIc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lm8JQuqE; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Eric Dumazet <[email-masked]>,
	David Ahern <[email-masked]>,
	Yue Haibing <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 114/262] inet: ping: check sock_net() in ping_get_port() and ping_lookup()
Date: Mon, 13 Oct 2025 16:44:16 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email-masked]>

[ Upstream commit 59f26d86b2a16f1406f3b42025062b6d1fba5dd5 ]

We need to check socket netns before considering them in ping_get_port().
Otherwise, one malicious netns could 'consume' all ports.

Add corresponding check in ping_lookup().

Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
Signed-off-by: Eric Dumazet <[email-masked]>
Reviewed-by: David Ahern <[email-masked]>
Reviewed-by: Yue Haibing <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/ipv4/ping.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 619ddc087957f..37a3fa98d904f 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -77,6 +77,7 @@ static inline struct hlist_head *ping_hashslot(struct ping_table *table,
 
 int ping_get_port(struct sock *sk, unsigned short ident)
 {
+	struct net *net = sock_net(sk);
 	struct inet_sock *isk, *isk2;
 	struct hlist_head *hlist;
 	struct sock *sk2 = NULL;
@@ -90,9 +91,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
 		for (i = 0; i < (1L << 16); i++, result++) {
 			if (!result)
 				result++; /* avoid zero */
-			hlist = ping_hashslot(&ping_table, sock_net(sk),
-					    result);
+			hlist = ping_hashslot(&ping_table, net, result);
 			sk_for_each(sk2, hlist) {
+				if (!net_eq(sock_net(sk2), net))
+					continue;
 				isk2 = inet_sk(sk2);
 
 				if (isk2->inet_num == result)
@@ -108,8 +110,10 @@ int ping_get_port(struct sock *sk, unsigned short ident)
 		if (i >= (1L << 16))
 			goto fail;
 	} else {
-		hlist = ping_hashslot(&ping_table, sock_net(sk), ident);
+		hlist = ping_hashslot(&ping_table, net, ident);
 		sk_for_each(sk2, hlist) {
+			if (!net_eq(sock_net(sk2), net))
+				continue;
 			isk2 = inet_sk(sk2);
 
 			/* BUG? Why is this reuse and not reuseaddr? ping.c
@@ -129,7 +133,7 @@ int ping_get_port(struct sock *sk, unsigned short ident)
 		pr_debug("was not hashed\n");
 		sk_add_node_rcu(sk, hlist);
 		sock_set_flag(sk, SOCK_RCU_FREE);
-		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+		sock_prot_inuse_add(net, sk->sk_prot, 1);
 	}
 	spin_unlock(&ping_table.lock);
 	return 0;
@@ -188,6 +192,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
 	}
 
 	sk_for_each_rcu(sk, hslot) {
+		if (!net_eq(sock_net(sk), net))
+			continue;
 		isk = inet_sk(sk);
 
 		pr_debug("iterate\n");
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:34:09 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368298; cv=none; b=XsphwBeQmskhqtRdDY2n+L7iPfbhZBNvEVVs1lyUDuPEfBdJbENJ2WMDq0Cfyu6mCcy55i2gP1PydfwuPZugcXi+ZeYqt+tRSs8zcfFhaKLPLCzWhsOSXxL172LIy6ozUfn1jMxgjdpbu9U/PjNZRhb1jb7g03DdEqxqI7Li3AA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368298; c=relaxed/simple;
	bh=csxZDkJkBq7OCqlnRiqthjgHCyDPNTmub2/nf74bSkE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=NI6UxbbYxB9MnaXA6Mkh8QMIYeXoQtgJYF+dO7i+zS7K9EvMnLhbZBMLDdeuA4aalA4KeCW6/RwPR9QP50200+eCKIPrF7K/QGTOpek5EgobaoVTQHRJMZO4YwY61yw2pnwNoAu26J+4vsyo2fTmrVSHFCGsk96b42RQ3T1cooM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2tQkEee1; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhushuai Yin <[email-masked]>,
	Chenghai Huang <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 113/262] crypto: hisilicon/qm - check whether the input function and PF are on the same device
Date: Mon, 13 Oct 2025 16:44:15 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhushuai Yin <[email-masked]>

[ Upstream commit 6a2c9164b52e6bc134127fd543461fdef95cc8ec ]

Function rate limiting is set through physical function driver.
Users configure by providing function information and rate limit values.
Before configuration, it is necessary to check whether the
provided function and PF belong to the same device.

Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check")
Signed-off-by: Zhushuai Yin <[email-masked]>
Signed-off-by: Chenghai Huang <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/crypto/hisilicon/qm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
index 5bbb2759a6691..a9550a05dfbd3 100644
--- a/drivers/crypto/hisilicon/qm.c
+++ b/drivers/crypto/hisilicon/qm.c
@@ -3657,6 +3657,10 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf,
 	}
 
 	pdev = container_of(dev, struct pci_dev, dev);
+	if (pci_physfn(pdev) != qm->pdev) {
+		pci_err(qm->pdev, "the pdev input does not match the pf!\n");
+		return -EINVAL;
+	}
 
 	*fun_index = pdev->devfn;
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:50:06 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368395; cv=none; b=lj1DV1nECPUINWz6QG61Ba3feb9bYVPg5SvZDR7LWklAf8m/XjINaSaOHJMzfvjZ7Imw+M/QGLB9VQ2OI28E/QUDjlYipGm7TYkQJwobAYPVrc/b2Zchw6IP6VkR59+DFP7y7RZAFQ7fVXBYbwJut8xalHyYNt11G4ZVfSG2Re4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368395; c=relaxed/simple;
	bh=go8FWlrZk6OPQaU4F1+ABBOjvl5EEzFh9sGaYwkXBsw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pJo6RoRPzQerndqExyeN53wO8Kmb3PtC4bxL2ibbLR77HaMf6I2E9dyjALqUUl/z8RRPxYldVk0Y1rpZSRFayt3cw+EntAfNErMQhXLvBPj2apkewyoKiDyI86sPNvP+s15/espx/myy2bKhCEvGzbYLuE6IPapOvkcJvgZV9AU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=CzivOMhf; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chenghai Huang <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 112/262] crypto: hisilicon - re-enable address prefetch after device resuming
Date: Mon, 13 Oct 2025 16:44:14 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chenghai Huang <[email-masked]>

[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ]

When the device resumes from a suspended state, it will revert to its
initial state and requires re-enabling. Currently, the address prefetch
function is not re-enabled after device resuming. Move the address prefetch
enable to the initialization process. In this way, the address prefetch
can be enabled when the device resumes by calling the initialization
process.

Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device")
Signed-off-by: Chenghai Huang <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/crypto/hisilicon/hpre/hpre_main.c |  3 +-
 drivers/crypto/hisilicon/qm.c             |  3 -
 drivers/crypto/hisilicon/sec2/sec_main.c  | 80 +++++++++++------------
 drivers/crypto/hisilicon/zip/zip_main.c   |  5 +-
 4 files changed, 43 insertions(+), 48 deletions(-)

diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
index 34d30b7838134..a11fe5e276773 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
@@ -690,6 +690,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)
 
 	/* Config data buffer pasid needed by Kunpeng 920 */
 	hpre_config_pasid(qm);
+	hpre_open_sva_prefetch(qm);
 
 	hpre_enable_clock_gate(qm);
 
@@ -1366,8 +1367,6 @@ static int hpre_pf_probe_init(struct hpre *hpre)
 	if (ret)
 		return ret;
 
-	hpre_open_sva_prefetch(qm);
-
 	hisi_qm_dev_err_init(qm);
 	ret = hpre_show_last_regs_init(qm);
 	if (ret)
diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
index b18692ee7fd56..5bbb2759a6691 100644
--- a/drivers/crypto/hisilicon/qm.c
+++ b/drivers/crypto/hisilicon/qm.c
@@ -4272,9 +4272,6 @@ static void qm_restart_prepare(struct hisi_qm *qm)
 {
 	u32 value;
 
-	if (qm->err_ini->open_sva_prefetch)
-		qm->err_ini->open_sva_prefetch(qm);
-
 	if (qm->ver >= QM_HW_V3)
 		return;
 
diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
index 75c25f0d5f2b8..9014cc36705ff 100644
--- a/drivers/crypto/hisilicon/sec2/sec_main.c
+++ b/drivers/crypto/hisilicon/sec2/sec_main.c
@@ -441,6 +441,45 @@ static void sec_set_endian(struct hisi_qm *qm)
 	writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
 }
 
+static void sec_close_sva_prefetch(struct hisi_qm *qm)
+{
+	u32 val;
+	int ret;
+
+	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+		return;
+
+	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+	val |= SEC_PREFETCH_DISABLE;
+	writel(val, qm->io_base + SEC_PREFETCH_CFG);
+
+	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
+					 val, !(val & SEC_SVA_DISABLE_READY),
+					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+	if (ret)
+		pci_err(qm->pdev, "failed to close sva prefetch\n");
+}
+
+static void sec_open_sva_prefetch(struct hisi_qm *qm)
+{
+	u32 val;
+	int ret;
+
+	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+		return;
+
+	/* Enable prefetch */
+	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+	val &= SEC_PREFETCH_ENABLE;
+	writel(val, qm->io_base + SEC_PREFETCH_CFG);
+
+	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
+					 val, !(val & SEC_PREFETCH_DISABLE),
+					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+	if (ret)
+		pci_err(qm->pdev, "failed to open sva prefetch\n");
+}
+
 static void sec_engine_sva_config(struct hisi_qm *qm)
 {
 	u32 reg;
@@ -474,45 +513,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm)
 		writel_relaxed(reg, qm->io_base +
 				SEC_INTERFACE_USER_CTRL1_REG);
 	}
-}
-
-static void sec_open_sva_prefetch(struct hisi_qm *qm)
-{
-	u32 val;
-	int ret;
-
-	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
-		return;
-
-	/* Enable prefetch */
-	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
-	val &= SEC_PREFETCH_ENABLE;
-	writel(val, qm->io_base + SEC_PREFETCH_CFG);
-
-	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
-					 val, !(val & SEC_PREFETCH_DISABLE),
-					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
-	if (ret)
-		pci_err(qm->pdev, "failed to open sva prefetch\n");
-}
-
-static void sec_close_sva_prefetch(struct hisi_qm *qm)
-{
-	u32 val;
-	int ret;
-
-	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
-		return;
-
-	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
-	val |= SEC_PREFETCH_DISABLE;
-	writel(val, qm->io_base + SEC_PREFETCH_CFG);
-
-	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
-					 val, !(val & SEC_SVA_DISABLE_READY),
-					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
-	if (ret)
-		pci_err(qm->pdev, "failed to close sva prefetch\n");
+	sec_open_sva_prefetch(qm);
 }
 
 static void sec_enable_clock_gate(struct hisi_qm *qm)
@@ -1094,7 +1095,6 @@ static int sec_pf_probe_init(struct sec_dev *sec)
 	if (ret)
 		return ret;
 
-	sec_open_sva_prefetch(qm);
 	hisi_qm_dev_err_init(qm);
 	sec_debug_regs_clear(qm);
 	ret = sec_show_last_regs_init(qm);
diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
index 18177aba3d3a6..323f53217f0c0 100644
--- a/drivers/crypto/hisilicon/zip/zip_main.c
+++ b/drivers/crypto/hisilicon/zip/zip_main.c
@@ -557,6 +557,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
 		writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63);
 		writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63);
 	}
+	hisi_zip_open_sva_prefetch(qm);
 
 	/* let's open all compression/decompression cores */
 	dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val;
@@ -568,6 +569,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
 	       CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) |
 	       FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL);
 
+	hisi_zip_set_high_perf(qm);
 	hisi_zip_enable_clock_gate(qm);
 
 	return 0;
@@ -1163,9 +1165,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
 	if (ret)
 		return ret;
 
-	hisi_zip_set_high_perf(qm);
-
-	hisi_zip_open_sva_prefetch(qm);
 	hisi_qm_dev_err_init(qm);
 	hisi_zip_debug_regs_clear(qm);
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:28:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368392; cv=none; b=HRZYEI8E0z8UWnCPk885PTV31sAC2GG27emDLknqeV8IKml7acZCjVYdnrbpu8OEfyBhmQoBgueoHFfLoYVnDiapEwWn0J4/Gz3/iUYfk7KVpKufw4aIJ/ITKDAxdOhlJM6Nbn67Pp8l/VIMaJlmHBWQtw1BRyyhVBQpaDvXDlY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368392; c=relaxed/simple;
	bh=UAxdxW0RSYChfWc1IbUIkfdcSInpiIxy0Gbji7II7CE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=k41iC8C1sRFW/FmNRDjwl/e/Cpbt0Gr5o6aGLGGf0ktR8Bv/K5XXOWuPjchnknrxB6guzluNGe8q1rMc3QDa5JBdlurYTNciLShh0AnrUenBq98SElAgYeR3e6Rx0dbNHsitF5/SC3qj8L6zIn0GRHikPBmD/Lc34kEMNYuzcHk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ojLwY4r0; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chenghai Huang <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 111/262] crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations
Date: Mon, 13 Oct 2025 16:44:13 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chenghai Huang <[email-masked]>

[ Upstream commit d4e081510471e79171c4e0a11f6cb608e49bc082 ]

When configuring the high-performance mode register, there is no
need to verify whether the register has been successfully
enabled, as there is no possibility of a write failure for this
register.

Fixes: a9864bae1806 ("crypto: hisilicon/zip - add zip comp high perf mode configuration")
Signed-off-by: Chenghai Huang <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/crypto/hisilicon/zip/zip_main.c | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
index 80c2fcb1d26dc..18177aba3d3a6 100644
--- a/drivers/crypto/hisilicon/zip/zip_main.c
+++ b/drivers/crypto/hisilicon/zip/zip_main.c
@@ -449,10 +449,9 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg)
 	return false;
 }
 
-static int hisi_zip_set_high_perf(struct hisi_qm *qm)
+static void hisi_zip_set_high_perf(struct hisi_qm *qm)
 {
 	u32 val;
-	int ret;
 
 	val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET);
 	if (perf_mode == HZIP_HIGH_COMP_PERF)
@@ -462,13 +461,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm)
 
 	/* Set perf mode */
 	writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
-	ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET,
-					 val, val == perf_mode, HZIP_DELAY_1_US,
-					 HZIP_POLL_TIMEOUT_US);
-	if (ret)
-		pci_err(qm->pdev, "failed to set perf mode\n");
-
-	return ret;
 }
 
 static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
@@ -1171,9 +1163,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
 	if (ret)
 		return ret;
 
-	ret = hisi_zip_set_high_perf(qm);
-	if (ret)
-		return ret;
+	hisi_zip_set_high_perf(qm);
 
 	hisi_zip_open_sva_prefetch(qm);
 	hisi_qm_dev_err_init(qm);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:39:22 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368389; cv=none; b=aC9kwBNdlb3AjY7LRLRovKOtxKvw7evRca0VF/NgNZcGQaqDzPnWWh+YvEj6cKQxtcUX3TGn/1goelNOSd6x6Vr9YK75kpGF8AvL7rXm7JG1mm5sPWCPRSC1XS9Y4fAqjtKmmXQlDtcaw1oA5R/g9By9PIXD9jhlpev0HfgxMbU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368389; c=relaxed/simple;
	bh=6m19/FwVIxPZjvLBgF4fE+k7+cIGB1xtO171JAWoV90=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=t08fERrkCTYo0NKqXSXYaImjOQYivM0eqKGjHenlM4Zl6v1j+DQM/HLAE4XZWWRWwezJER9cF0O7e+CTawtJHupQljx3cR1jFBZOQ1d5tfFjBqB0dditX7VtXjaV6W1zx7ZnZMKxPYBREGP/i2vlguZoR15M7wsSsbPHUJsIiI0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IhOxTI39; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Arnd Bergmann <[email-masked]>,
	Hans Verkuil <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 110/262] media: st-delta: avoid excessive stack usage
Date: Mon, 13 Oct 2025 16:44:12 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email-masked]>

[ Upstream commit 5954ad7d1af92cb6244c5f31216e43af55febbb7 ]

Building with a reduced stack warning limit shows that delta_mjpeg_decode()
copies a giant structure to the stack each time but only uses three of
its members:

drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c: In function 'delta_mjpeg_decode':
drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c:427:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]

Open-code the passing of the structure members that are actually used here.

Fixes: 433ff5b4a29b ("[media] st-delta: add mjpeg support")
Signed-off-by: Arnd Bergmann <[email-masked]>
Signed-off-by: Hans Verkuil <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../platform/st/sti/delta/delta-mjpeg-dec.c   | 20 ++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
index 0533d4a083d24..a078f1107300e 100644
--- a/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
+++ b/drivers/media/platform/st/sti/delta/delta-mjpeg-dec.c
@@ -239,7 +239,7 @@ static int delta_mjpeg_ipc_open(struct delta_ctx *pctx)
 	return 0;
 }
 
-static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
+static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, dma_addr_t pstart, dma_addr_t pend)
 {
 	struct delta_dev *delta = pctx->dev;
 	struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
@@ -256,8 +256,8 @@ static int delta_mjpeg_ipc_decode(struct delta_ctx *pctx, struct delta_au *au)
 
 	memset(params, 0, sizeof(*params));
 
-	params->picture_start_addr_p = (u32)(au->paddr);
-	params->picture_end_addr_p = (u32)(au->paddr + au->size - 1);
+	params->picture_start_addr_p = pstart;
+	params->picture_end_addr_p = pend;
 
 	/*
 	 * !WARNING!
@@ -374,12 +374,14 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
 	struct delta_dev *delta = pctx->dev;
 	struct delta_mjpeg_ctx *ctx = to_ctx(pctx);
 	int ret;
-	struct delta_au au = *pau;
+	void *au_vaddr = pau->vaddr;
+	dma_addr_t au_dma = pau->paddr;
+	size_t au_size = pau->size;
 	unsigned int data_offset = 0;
 	struct mjpeg_header *header = &ctx->header_struct;
 
 	if (!ctx->header) {
-		ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
+		ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
 					      header, &data_offset);
 		if (ret) {
 			pctx->stream_errors++;
@@ -405,17 +407,17 @@ static int delta_mjpeg_decode(struct delta_ctx *pctx, struct delta_au *pau)
 			goto err;
 	}
 
-	ret = delta_mjpeg_read_header(pctx, au.vaddr, au.size,
+	ret = delta_mjpeg_read_header(pctx, au_vaddr, au_size,
 				      ctx->header, &data_offset);
 	if (ret) {
 		pctx->stream_errors++;
 		goto err;
 	}
 
-	au.paddr += data_offset;
-	au.vaddr += data_offset;
+	au_dma += data_offset;
+	au_vaddr += data_offset;
 
-	ret = delta_mjpeg_ipc_decode(pctx, &au);
+	ret = delta_mjpeg_ipc_decode(pctx, au_dma, au_dma + au_size - 1);
 	if (ret)
 		goto err;
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:47:13 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368386; cv=none; b=mTznsebG3VOar5x2PQiAR6KYe837WnH+lw+kOf6kLopOBUb955ghPa1K5kQxA43SIo418DvAbZP5IqkR5K8MxsChXee7piUvHha+ci2ysUzUWz1+IRkGzVqj6kHa2ZA5WCp3KZzJk3+K82ql8Wr2r96eC2L4Mw6k8EmskFn1qp8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368386; c=relaxed/simple;
	bh=jgzTXB0061lvqeLUR6wO5A3SQjwnr1Unp4nJV59jv48=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bXmRXq85W6MDjLS+AIEESABKe9LfAMnwod9lNQG0aajMblJp/OJrTpKM1TLVtJoRjfVA//bi3sfzeNkS3rNof5D09ecDRpri0EAjeATMwH/UG6+AuJtnS9qKZ3NfAiZ1ZoKdkKyGFiTL/h+QkAc0Md4mjLg4LGwT2LPcWTyNCZc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yD1xMimh; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	Takashi Iwai <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 109/262] ALSA: lx_core: use int type to store negative error codes
Date: Mon, 13 Oct 2025 16:44:11 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 4ef353d546cda466fc39b7daca558d7bcec21c09 ]

Change the 'ret' variable from u16 to int to store negative error codes or
zero returned by lx_message_send_atomic().

Storing the negative error codes in unsigned type, doesn't cause an issue
at runtime but it's ugly as pants. Additionally, assigning negative error
codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
flag is enabled.

No effect on runtime.

Fixes: 02bec4904508 ("ALSA: lx6464es - driver for the digigram lx6464es interface")
Signed-off-by: Qianfeng Rong <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Takashi Iwai <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 sound/pci/lx6464es/lx_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
index 9d95ecb299aed..a99acd1125e74 100644
--- a/sound/pci/lx6464es/lx_core.c
+++ b/sound/pci/lx6464es/lx_core.c
@@ -316,7 +316,7 @@ static int lx_message_send_atomic(struct lx6464es *chip, struct lx_rmh *rmh)
 /* low-level dsp access */
 int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
 {
-	u16 ret;
+	int ret;
 
 	mutex_lock(&chip->msg_lock);
 
@@ -330,10 +330,10 @@ int lx_dsp_get_version(struct lx6464es *chip, u32 *rdsp_version)
 
 int lx_dsp_get_clock_frequency(struct lx6464es *chip, u32 *rfreq)
 {
-	u16 ret = 0;
 	u32 freq_raw = 0;
 	u32 freq = 0;
 	u32 frequency = 0;
+	int ret;
 
 	mutex_lock(&chip->msg_lock);
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:52:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368383; cv=none; b=Nzl+K/A/UUoPSl2augM/u9kG0duQwm1dfnADiod3YeSkr5PQn4RV0zwuGnJJyxG6+QscCW81x7j1WzpcSA1YUaa6P4zwb7U2xO3tzCWmVuYiRYvWQwOkCrZJVP9UZXvnb8pPwg/w5NIoH07iBW9J9JW3bBNmYlZA+eti7T4L5do=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368383; c=relaxed/simple;
	bh=a2MpA/MNafW3j1LBqrd0ygkoBHZ/L1qjMiBU30B/jFw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=CENlQqnF6Xmfz/3lr7Buqh7yGj+M9qwdM/EWTqmQvHgO1i4UvAkABX17UfjOdx2vO8wHla4UihIZyBOW2gcS0CTqKRNVe0s+t0GGtifgeOr38KYzExe8Q4eujZIS6hjlkZY4sIBlC19qQsbNQ4WkBop9BqYpgizaUcxf++f/qvM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=tk4a36u9; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Nirmoy Das <[email-masked]>,
	Bjorn Helgaas <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 108/262] PCI/ACPI: Fix pci_acpi_preserve_config() memory leak
Date: Mon, 13 Oct 2025 16:44:10 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nirmoy Das <[email-masked]>

[ Upstream commit fac679df7580979174c90303f004b09cdc6f086f ]

pci_acpi_preserve_config() leaks memory by returning early without freeing
the ACPI object on success. Fix that by always freeing the obj, which is
not needed by the caller.

Fixes: 9d7d5db8e78e ("PCI: Move PRESERVE_BOOT_CONFIG _DSM evaluation to pci_register_host_bridge()")
Signed-off-by: Nirmoy Das <[email-masked]>
Signed-off-by: Bjorn Helgaas <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pci/pci-acpi.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 99c58ee09fbb0..0cd8a75e22580 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -122,6 +122,8 @@ phys_addr_t acpi_pci_root_get_mcfg_addr(acpi_handle handle)
 
 bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge)
 {
+	bool ret = false;
+
 	if (ACPI_HANDLE(&host_bridge->dev)) {
 		union acpi_object *obj;
 
@@ -135,11 +137,11 @@ bool pci_acpi_preserve_config(struct pci_host_bridge *host_bridge)
 					      1, DSM_PCI_PRESERVE_BOOT_CONFIG,
 					      NULL, ACPI_TYPE_INTEGER);
 		if (obj && obj->integer.value == 0)
-			return true;
+			ret = true;
 		ACPI_FREE(obj);
 	}
 
-	return false;
+	return ret;
 }
 
 /* _HPX PCI Setting Record (Type 0); same as _HPP */
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:28:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368380; cv=none; b=hKBUUbb2Qxza8KHYNSEDA7REZ0is2L2ZOFk7QXL8uoXyiEp0eCQh5KDitz+2HznDLnTDAYy7wx4BgIKVn2l7gWVjGydoMwOSNCOQ5MByQXtzyrVbY0jvXc+A8fy3ORhfthXY/jn3ERfKDuLzeK0L5WW5X58Q/sJL7vOwmslilag=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368380; c=relaxed/simple;
	bh=Y9b2BjPwrDel7+3z1hDmTtKuVMElHeNC3SLI0/t6bQk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DIuewGO4E1+yR3d9X03PhIw9QGAgbNmfUv4hjXcbgTGww9oLSSYLPZQxs77e1Wl54DjoIWIHM+4Wc5GJuGa6CkjmqgZtd7GK4dzsae/g9cDujJEUf7eDn5YRe3SuesNs2tU2tS3/KSg/kk/iD3n6duvFxijdiCSNkCGHLxbXpDA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uHTPT/Yv; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Patrisious Haddad <[email-masked]>,
	Mark Bloch <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	Jason Gunthorpe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 107/262] RDMA/mlx5: Fix vport loopback forcing for MPV device
Date: Mon, 13 Oct 2025 16:44:09 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Patrisious Haddad <[email-masked]>

[ Upstream commit 08aae7860450c89eebbc6fd4d38416e53c7a33d2 ]

Previously loopback for MPV was supposed to be permanently enabled,
however other driver flows were able to over-ride that configuration and
disable it.

Add force_lb parameter that indicates that loopback should always be
enabled which prevents all other driver flows from disabling it.

Fixes: a9a9e68954f2 ("RDMA/mlx5: Fix vport loopback for MPV device")
Link: https://patch.msgid.link/r/[email-masked]
Signed-off-by: Patrisious Haddad <[email-masked]>
Reviewed-by: Mark Bloch <[email-masked]>
Signed-off-by: Leon Romanovsky <[email-masked]>
Signed-off-by: Jason Gunthorpe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/hw/mlx5/main.c    | 19 +++++++++++++++----
 drivers/infiniband/hw/mlx5/mlx5_ib.h |  1 +
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 29d0bc583169b..f3e58797705d7 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1813,7 +1813,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev,
 }
 
 static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
-				struct mlx5_core_dev *slave)
+				struct mlx5_core_dev *slave,
+				struct mlx5_ib_lb_state *lb_state)
 {
 	int err;
 
@@ -1825,6 +1826,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
 	if (err)
 		goto out;
 
+	lb_state->force_enable = true;
 	return 0;
 
 out:
@@ -1833,16 +1835,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master,
 }
 
 static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master,
-				  struct mlx5_core_dev *slave)
+				  struct mlx5_core_dev *slave,
+				  struct mlx5_ib_lb_state *lb_state)
 {
 	mlx5_nic_vport_update_local_lb(slave, false);
 	mlx5_nic_vport_update_local_lb(master, false);
+
+	lb_state->force_enable = false;
 }
 
 int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
 {
 	int err = 0;
 
+	if (dev->lb.force_enable)
+		return 0;
+
 	mutex_lock(&dev->lb.mutex);
 	if (td)
 		dev->lb.user_td++;
@@ -1864,6 +1872,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
 
 void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp)
 {
+	if (dev->lb.force_enable)
+		return;
+
 	mutex_lock(&dev->lb.mutex);
 	if (td)
 		dev->lb.user_td--;
@@ -3521,7 +3532,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev,
 
 	lockdep_assert_held(&mlx5_ib_multiport_mutex);
 
-	mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev);
+	mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
 
 	mlx5_core_mp_event_replay(ibdev->mdev,
 				  MLX5_DRIVER_EVENT_AFFILIATION_REMOVED,
@@ -3618,7 +3629,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev,
 				  MLX5_DRIVER_EVENT_AFFILIATION_DONE,
 				  &key);
 
-	err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev);
+	err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb);
 	if (err)
 		goto unbind;
 
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 29bde64ea1eac..f49cb588a856d 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -1083,6 +1083,7 @@ struct mlx5_ib_lb_state {
 	u32			user_td;
 	int			qps;
 	bool			enabled;
+	bool			force_enable;
 };
 
 struct mlx5_ib_pf_eq {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:54:59 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368358; cv=none; b=ev0rxeEGjaJBtErjghFxGlsMyWveeAjgU0g3DnLRsHHb0Z3W5+3Ss7cdPERXNU/Gb/6Wj7tFLx31bfyLrz2i6uNTP7Fj9Y55szQTCebsKx+73yMBGSEF7RlSiwDg5T1bGQ9DyxIp0QH7ZdayUpyK4yFSgRipiEUxY3r900NO31w=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368358; c=relaxed/simple;
	bh=/N/B7eQcwoprnayHjDG1E5EuaykzoftIRLy0jFc/zWE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=c9yEmS2WemauuMbeHG9vDUXQq1gZxKrex2dwyQ+uRMVI4XewEGFPpfyZolWiPTpjd8Qps7fgHcNcpYXQvvuOPw1iqDAsgg0vXaweRD3FegkJ5TOOhlnPY/ePNC7TRYI27g5aWwR8Dd90r3afYeJpgO+J96Xts+29z7K0l6HdRjg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2lxLydBN; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chuck Lever <[email-masked]>,
	Or Har-Toov <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	Jason Gunthorpe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 106/262] RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count
Date: Mon, 13 Oct 2025 16:44:08 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Or Har-Toov <[email-masked]>

[ Upstream commit 1a7c18c485bf17ef408d5ebb7f83e1f8ef329585 ]

The mlx5 driver currently derives max_qp_wr directly from the
log_max_qp_sz HCA capability:

    props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);

However, this value represents the number of WQEs in units of Basic
Blocks (see MLX5_SEND_WQE_BB), not actual number of WQEs.  Since the size
of a WQE can vary depending on transport type and features (e.g., atomic
operations, UMR, LSO), the actual number of WQEs can be significantly
smaller than the WQEBB count suggests.

This patch introduces a conservative estimation of the worst-case WQE size
— considering largest segments possible with 1 SGE and no inline data or
special features. It uses this to derive a more accurate max_qp_wr value.

Fixes: 938fe83c8dcb ("net/mlx5_core: New device capabilities handling")
Link: https://patch.msgid.link/r/[email-masked]
Reported-by: Chuck Lever <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]/
Signed-off-by: Or Har-Toov <[email-masked]>
Signed-off-by: Leon Romanovsky <[email-masked]>
Signed-off-by: Jason Gunthorpe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/hw/mlx5/main.c | 48 ++++++++++++++++++++++++++++++-
 1 file changed, 47 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 435c456a4fd5b..29d0bc583169b 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -13,6 +13,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/slab.h>
 #include <linux/bitmap.h>
+#include <linux/log2.h>
 #include <linux/sched.h>
 #include <linux/sched/mm.h>
 #include <linux/sched/task.h>
@@ -865,6 +866,51 @@ static void fill_esw_mgr_reg_c0(struct mlx5_core_dev *mdev,
 	resp->reg_c0.mask = mlx5_eswitch_get_vport_metadata_mask();
 }
 
+/*
+ * Calculate maximum SQ overhead across all QP types.
+ * Other QP types (REG_UMR, UC, RC, UD/SMI/GSI, XRC_TGT)
+ * have smaller overhead than the types calculated below,
+ * so they are implicitly included.
+ */
+static u32 mlx5_ib_calc_max_sq_overhead(void)
+{
+	u32 max_overhead_xrc, overhead_ud_lso, a, b;
+
+	/* XRC_INI */
+	max_overhead_xrc = sizeof(struct mlx5_wqe_xrc_seg);
+	max_overhead_xrc += sizeof(struct mlx5_wqe_ctrl_seg);
+	a = sizeof(struct mlx5_wqe_atomic_seg) +
+	    sizeof(struct mlx5_wqe_raddr_seg);
+	b = sizeof(struct mlx5_wqe_umr_ctrl_seg) +
+	    sizeof(struct mlx5_mkey_seg) +
+	    MLX5_IB_SQ_UMR_INLINE_THRESHOLD / MLX5_IB_UMR_OCTOWORD;
+	max_overhead_xrc += max(a, b);
+
+	/* UD with LSO */
+	overhead_ud_lso = sizeof(struct mlx5_wqe_ctrl_seg);
+	overhead_ud_lso += sizeof(struct mlx5_wqe_eth_pad);
+	overhead_ud_lso += sizeof(struct mlx5_wqe_eth_seg);
+	overhead_ud_lso += sizeof(struct mlx5_wqe_datagram_seg);
+
+	return max(max_overhead_xrc, overhead_ud_lso);
+}
+
+static u32 mlx5_ib_calc_max_qp_wr(struct mlx5_ib_dev *dev)
+{
+	struct mlx5_core_dev *mdev = dev->mdev;
+	u32 max_wqe_bb_units = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
+	u32 max_wqe_size;
+	/* max QP overhead + 1 SGE, no inline, no special features */
+	max_wqe_size = mlx5_ib_calc_max_sq_overhead() +
+		       sizeof(struct mlx5_wqe_data_seg);
+
+	max_wqe_size = roundup_pow_of_two(max_wqe_size);
+
+	max_wqe_size = ALIGN(max_wqe_size, MLX5_SEND_WQE_BB);
+
+	return (max_wqe_bb_units * MLX5_SEND_WQE_BB) / max_wqe_size;
+}
+
 static int mlx5_ib_query_device(struct ib_device *ibdev,
 				struct ib_device_attr *props,
 				struct ib_udata *uhw)
@@ -1023,7 +1069,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
 	props->max_mr_size	   = ~0ull;
 	props->page_size_cap	   = ~(min_page_size - 1);
 	props->max_qp		   = 1 << MLX5_CAP_GEN(mdev, log_max_qp);
-	props->max_qp_wr	   = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
+	props->max_qp_wr = mlx5_ib_calc_max_qp_wr(dev);
 	max_rq_sg =  MLX5_CAP_GEN(mdev, max_wqe_sz_rq) /
 		     sizeof(struct mlx5_wqe_data_seg);
 	max_sq_desc = min_t(int, MLX5_CAP_GEN(mdev, max_wqe_sz_sq), 512);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:37:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368326; cv=none; b=FyXcq7p+eojFgOuB9eIH1NELcU0dc/q3QnSby54+IMV8egX5rwKGPNutEBaleO7CpCuBO3ChX8lelv7QcOg53cElikZIgTXpFiS91cK6/6EmQHNO+RPfeVKyp2W7q0pGVPRygQr7uRC5bYYjIAAnHpsGYruqgkYP0S7TpbcxsB4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368326; c=relaxed/simple;
	bh=Ob2wnkrS94X4Q/2XrVHk2giantw+BfOMNA9d+woGGVo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=hYftP1Wc/Vr9tVhwHUIeuiPfMB83KbRpQBGwu92qKti5pBf6aSjeUtuwNcjRHktrEQDklUfM7/ZAZjjZfJ+wP29pQcUh1kieDwG6Rsb6IC4NUHD8H6LTao2l+Mrr3AYjiyVq/6Qqp3Zu/XSi8FbSIVNuRxzFJfjqKPSzFFxbD/Y=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WA2z30bX; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhang Shurong <[email-masked]>,
	Jacopo Mondi <[email-masked]>,
	Sakari Ailus <[email-masked]>,
	Hans Verkuil <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 105/262] media: rj54n1cb0c: Fix memleak in rj54n1_probe()
Date: Mon, 13 Oct 2025 16:44:07 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  2.0 PDS_OTHER_BAD_TLD      Untrustworthy TLDs
                             [URI: rect.top (top)]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 24

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhang Shurong <[email-masked]>

[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]

rj54n1_probe() won't clean all the allocated resources in fail
path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
prevent memleak.

Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver")
Signed-off-by: Zhang Shurong <[email-masked]>
Reviewed-by: Jacopo Mondi <[email-masked]>
Signed-off-by: Sakari Ailus <[email-masked]>
Signed-off-by: Hans Verkuil <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/media/i2c/rj54n1cb0c.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
index b7ca39f63dba8..6dfc912168510 100644
--- a/drivers/media/i2c/rj54n1cb0c.c
+++ b/drivers/media/i2c/rj54n1cb0c.c
@@ -1329,10 +1329,13 @@ static int rj54n1_probe(struct i2c_client *client)
 			V4L2_CID_GAIN, 0, 127, 1, 66);
 	v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops,
 			V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1);
-	rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
-	if (rj54n1->hdl.error)
-		return rj54n1->hdl.error;
 
+	if (rj54n1->hdl.error) {
+		ret = rj54n1->hdl.error;
+		goto err_free_ctrl;
+	}
+
+	rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
 	rj54n1->clk_div		= clk_div;
 	rj54n1->rect.left	= RJ54N1_COLUMN_SKIP;
 	rj54n1->rect.top	= RJ54N1_ROW_SKIP;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:49:03 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368294; cv=none; b=TlyezGJjQXcPHhe7KsNY0q52jtD4UhdOWRc1CZqKLFRoMiFmDqTR+EaDg10Zrwnbe1wo9m7nGZ3oQUggYD2GwJlUbvGUWzq/9e33Uzpz3bu4gUSnkmCILpEDK1DBhHZUaLr23Mi3Q4/DVSsgSfMDH/uYSiW4gaAbTawgaMaFwYQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368294; c=relaxed/simple;
	bh=KELxqXfJY8BSCv7XCetA6CQGdZXkJf67Zb7Kz3ZDMoo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Lcn+ZgwapUnV1I4sVo2JKpumLLmWprlxqc+uNZpP87HYCzshMbtocmQuxa0locSp2A3ZOb5LmoqwAIrOsZ1pSONGNn+TXNIzNh6Q0zHZz29rxO9561j02XEoxXrjcW7jYBnoVpOBsC7Fo2eGlqY57QTfwofdVIiJbVdf/gMdgbM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=S4ARp/Ye; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Thorsten Blum <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 104/262] crypto: octeontx2 - Call strscpy() with correct size argument
Date: Mon, 13 Oct 2025 16:44:06 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thorsten Blum <[email-masked]>

[ Upstream commit 361fa7f813e7056cecdb24f3582ab0ad4a088e4e ]

In otx2_cpt_dl_custom_egrp_create(), strscpy() is called with the length
of the source string rather than the size of the destination buffer.

This is fine as long as the destination buffer is larger than the source
string, but we should still use the destination buffer size instead to
call strscpy() as intended. And since 'tmp_buf' is a fixed-size buffer,
we can safely omit the size argument and let strscpy() infer it using
sizeof().

Fixes: d9d7749773e8 ("crypto: octeontx2 - add apis for custom engine groups")
Signed-off-by: Thorsten Blum <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
index 1493a373baf71..cf68b213c3e62 100644
--- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
+++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_ucode.c
@@ -1614,7 +1614,7 @@ int otx2_cpt_dl_custom_egrp_create(struct otx2_cptpf_dev *cptpf,
 		return -EINVAL;
 	}
 	err_msg = "Invalid engine group format";
-	strscpy(tmp_buf, ctx->val.vstr, strlen(ctx->val.vstr) + 1);
+	strscpy(tmp_buf, ctx->val.vstr);
 	start = tmp_buf;
 
 	has_se = has_ie = has_ae = false;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:25:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368397; cv=none; b=rlbF8dwrYVHlOyU3Z0h8hZYSLTcMiALpPN3K1bpanUYQyu6Xko0FIMGXc8s9+wsF8jmMsomaUPeFCi1GPVlHtlTvdNPjUncBMMjbvI9m1n6grqRtQj0PjF2s+AbaknggZ1bLTlZOMk/NQmUZnpFdI8OWi/7HjWb/gm5qeWzx8Fg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368397; c=relaxed/simple;
	bh=tRiKZAXsQHUqGWAv9mcmNglu93wqpa24Z4GcvrR3XHU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bo5iL2HuozIr9KjKmIXIgDP6Z0+OcmKrzpvHh/hMi0D4j/74MP7631FFmkvLRhFlBA8DzN2reujl2xh/44stya3aHTADRHTBMqd9tGE4U+Vfcw0sbFSccDqnrntmMbRuRXB4gZGDWwmpgKfiXFtmPt4nzJK4nnGQiwf3qsiUGI4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YfPhLnUM; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Thomas Fourier <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 103/262] scsi: myrs: Fix dma_alloc_coherent() error check
Date: Mon, 13 Oct 2025 16:44:05 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Fourier <[email-masked]>

[ Upstream commit edb35b1ffc686fd9b5a91902f034eb9f4d2c9f6b ]

Check for NULL return value with dma_alloc_coherent(), because DMA
address is not always set by dma_alloc_coherent() on failure.

Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)")
Signed-off-by: Thomas Fourier <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/myrs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c
index 1469d0c54e455..5a02fd3bc6c9e 100644
--- a/drivers/scsi/myrs.c
+++ b/drivers/scsi/myrs.c
@@ -498,14 +498,14 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
 	/* Temporary dma mapping, used only in the scope of this function */
 	mbox = dma_alloc_coherent(&pdev->dev, sizeof(union myrs_cmd_mbox),
 				  &mbox_addr, GFP_KERNEL);
-	if (dma_mapping_error(&pdev->dev, mbox_addr))
+	if (!mbox)
 		return false;
 
 	/* These are the base addresses for the command memory mailbox array */
 	cs->cmd_mbox_size = MYRS_MAX_CMD_MBOX * sizeof(union myrs_cmd_mbox);
 	cmd_mbox = dma_alloc_coherent(&pdev->dev, cs->cmd_mbox_size,
 				      &cs->cmd_mbox_addr, GFP_KERNEL);
-	if (dma_mapping_error(&pdev->dev, cs->cmd_mbox_addr)) {
+	if (!cmd_mbox) {
 		dev_err(&pdev->dev, "Failed to map command mailbox\n");
 		goto out_free;
 	}
@@ -520,7 +520,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
 	cs->stat_mbox_size = MYRS_MAX_STAT_MBOX * sizeof(struct myrs_stat_mbox);
 	stat_mbox = dma_alloc_coherent(&pdev->dev, cs->stat_mbox_size,
 				       &cs->stat_mbox_addr, GFP_KERNEL);
-	if (dma_mapping_error(&pdev->dev, cs->stat_mbox_addr)) {
+	if (!stat_mbox) {
 		dev_err(&pdev->dev, "Failed to map status mailbox\n");
 		goto out_free;
 	}
@@ -533,7 +533,7 @@ static bool myrs_enable_mmio_mbox(struct myrs_hba *cs,
 	cs->fwstat_buf = dma_alloc_coherent(&pdev->dev,
 					    sizeof(struct myrs_fwstat),
 					    &cs->fwstat_addr, GFP_KERNEL);
-	if (dma_mapping_error(&pdev->dev, cs->fwstat_addr)) {
+	if (!cs->fwstat_buf) {
 		dev_err(&pdev->dev, "Failed to map firmware health buffer\n");
 		cs->fwstat_buf = NULL;
 		goto out_free;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:55:12 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368271; cv=none; b=Iav8DKarC837dhZqNiup5Rex18Q9IMv5G0k6PgOFDpa52a3vSW2kBzTGea1tVwgdiwXZYzEyXpmKFKF/dFefzfOWgN0jjrECRcUvNaeurz3X+YTYHwJkfqSN8gJoyh407mHgBiH+sIJ0TCmvNsbgE76SQ6ykHJzEiSxhoXxxPxA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368271; c=relaxed/simple;
	bh=t7c4M5iq+5KcTOWEQu0uoqiqbcEi3zaDjeomPBSIz2U=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pJov2vOg5jVafFqPuGE9le9PrQHL5MsY1LKYY+iV/TsKoVCm/jaPzp1+aO3fA2rHoAJ1M5D4N+okA3gJ3qoi+K/BMF32s3abY7dD8GX5o6JfVmBwV+8slDHqt/4D1M2Rvw3X60POY7RydVW66xWWy5jcpnL0/tnLNDnWKPDLDHM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aplzYzRw; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Igor Pylypiv <[email-masked]>,
	Niklas Cassel <[email-masked]>,
	Damien Le Moal <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 102/262] scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
Date: Mon, 13 Oct 2025 16:44:04 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Niklas Cassel <[email-masked]>

[ Upstream commit 251be2f6037fb7ab399f68cd7428ff274133d693 ]

Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when
device is gone") UBSAN reports:

  UBSAN: array-index-out-of-bounds in drivers/scsi/pm8001/pm8001_sas.c:786:17
  index 28 is out of range for type 'pm8001_phy [16]'

on rmmod when using an expander.

For a direct attached device, attached_phy contains the local phy id.
For a device behind an expander, attached_phy contains the remote phy
id, not the local phy id.

I.e. while pm8001_ha will have pm8001_ha->chip->n_phy local phys, for a
device behind an expander, attached_phy can be much larger than
pm8001_ha->chip->n_phy (depending on the amount of phys of the
expander).

E.g. on my system pm8001_ha has 8 phys with phy ids 0-7.  One of the
ports has an expander connected.  The expander has 31 phys with phy ids
0-30.

The pm8001_ha->phy array only contains the phys of the HBA.  It does not
contain the phys of the expander.  Thus, it is wrong to use attached_phy
to index the pm8001_ha->phy array for a device behind an expander.

Thus, we can only clear phy_attached for devices that are directly
attached.

Fixes: f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone")
Reviewed-by: Igor Pylypiv <[email-masked]>
Signed-off-by: Niklas Cassel <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Reviewed-by: Damien Le Moal <[email-masked]>
Tested-by: Damien Le Moal <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/pm8001/pm8001_sas.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index a9d6dac413346..4daab8b6d6752 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -703,6 +703,7 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
 	unsigned long flags = 0;
 	struct pm8001_hba_info *pm8001_ha;
 	struct pm8001_device *pm8001_dev = dev->lldd_dev;
+	struct domain_device *parent_dev = dev->parent;
 
 	pm8001_ha = pm8001_find_ha_by_dev(dev);
 	spin_lock_irqsave(&pm8001_ha->lock, flags);
@@ -719,7 +720,13 @@ static void pm8001_dev_gone_notify(struct domain_device *dev)
 			spin_lock_irqsave(&pm8001_ha->lock, flags);
 		}
 		PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
-		pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
+
+		/*
+		 * The phy array only contains local phys. Thus, we cannot clear
+		 * phy_attached for a device behind an expander.
+		 */
+		if (!(parent_dev && dev_is_expander(parent_dev->dev_type)))
+			pm8001_ha->phy[pm8001_dev->attached_phy].phy_attached = 0;
 		pm8001_free_dev(pm8001_dev);
 	} else {
 		pm8001_dbg(pm8001_ha, DISC, "Found dev has gone.\n");
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:50:21 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368269; cv=none; b=u31Ihv944iDB/kDHaNN94XI4+tQ4HzllfJeDqaha5EUwRI5CKGJnCHDRwfZ5n0vpxCT89wy8k6mwNDtrUc8egT0GdKlQAcIPB82HtTteimsMB9qw3bY9eFv9STVqnb4MeHwAN8XKPvDur5dZWVeS0VaEilOw9+dtvG2/x//qv1g=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368269; c=relaxed/simple;
	bh=B9vZz4EGRXpWvoZSBhaWWynSD/w3yOBx4PymB4UT8rw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=llk24mSNLXAy1Uwdw2NISnQOiVhDV8UHxZLfeAw5UJD31TZgRdCa6LK09kvhszEbZ6WBrG2AMoQ7mY6d7GfcZeCSiqkEFPXnQGr7efERUzxyBxH/BXKSZftElNrlCIGZTYN26VyWqAYoYeoJy6j7xTUrAktZyfjO1eJvZo9JEx4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=NP/nZ0CB; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Arnd Bergmann <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 101/262] hwrng: nomadik - add ARM_AMBA dependency
Date: Mon, 13 Oct 2025 16:44:03 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <[email-masked]>

[ Upstream commit efaa2d815a0e4d1c06750e587100f6f7f4ee5497 ]

Compile-testing this driver is only possible when the AMBA bus driver is
available in the kernel:

x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_remove':
nomadik-rng.c:(.text+0x67): undefined reference to `amba_release_regions'
x86_64-linux-ld: drivers/char/hw_random/nomadik-rng.o: in function `nmk_rng_probe':
nomadik-rng.c:(.text+0xee): undefined reference to `amba_request_regions'
x86_64-linux-ld: nomadik-rng.c:(.text+0x18d): undefined reference to `amba_release_regions'

The was previously implied by the 'depends on ARCH_NOMADIK', but needs to be
specified for the COMPILE_TEST case.

Fixes: d5e93b3374e4 ("hwrng: Kconfig - Add helper dependency on COMPILE_TEST")
Signed-off-by: Arnd Bergmann <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/char/hw_random/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index b51d9e243f351..f0dde77f50b42 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -286,6 +286,7 @@ config HW_RANDOM_INGENIC_TRNG
 config HW_RANDOM_NOMADIK
 	tristate "ST-Ericsson Nomadik Random Number Generator support"
 	depends on ARCH_NOMADIK || COMPILE_TEST
+	depends on ARM_AMBA
 	default HW_RANDOM
 	help
 	  This driver provides kernel-side support for the Random Number
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:28:09 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368266; cv=none; b=eWzVTs+IRlozVAUTUpVwLI9SX10kTjiJcECqtG/H9FWrtcdPOHYqidaAedrMUSFzb9PKZmOQGVomooFI5n5AisZ8UjEWyfroxX+u1WwZ4Uh7Op1W70zge0bILEsdDMdB0Tt6/xUR7IZ48ZBTtxHXy9NufJthT4s9ypsa6ot9g7s=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368266; c=relaxed/simple;
	bh=uXMTvqsI2n/tBXURiBCa5WEMX/rk0DbmwtBSWCgPc5A=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=VYecrsPyEHC1Ei0bLfXY82Q1vFjXbx1ULqzGQGtMgfyj/ssq/1z0QvqfDH7pU37+1fEoIR9zuqVUuTAevsYHUEIzqL5TGsbqKE8fegupSwyd+enUHbPGFJVSTqyxpRUun1IYq21d9ny3dvsPLBb8Xg4qBaz+KW3iuCosIVruFpg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=VsUu80ii; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Thomas Fourier <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 100/262] crypto: keembay - Add missing check after sg_nents_for_len()
Date: Mon, 13 Oct 2025 16:44:02 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Fourier <[email-masked]>

[ Upstream commit 4e53be21dd0315c00eaf40cc8f8c0facd4d9a6b2 ]

sg_nents_for_len() returns an int which is negative in case of error.

Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver")
Signed-off-by: Thomas Fourier <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
index fdeca861933cb..903f31dc663e9 100644
--- a/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
+++ b/drivers/crypto/intel/keembay/keembay-ocs-hcu-core.c
@@ -232,7 +232,7 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
 	struct device *dev = rctx->hcu_dev->dev;
 	unsigned int remainder = 0;
 	unsigned int total;
-	size_t nents;
+	int nents;
 	size_t count;
 	int rc;
 	int i;
@@ -253,6 +253,9 @@ static int kmb_ocs_dma_prepare(struct ahash_request *req)
 	/* Determine the number of scatter gather list entries to process. */
 	nents = sg_nents_for_len(req->src, rctx->sg_data_total - remainder);
 
+	if (nents < 0)
+		return nents;
+
 	/* If there are entries to process, map them. */
 	if (nents) {
 		rctx->sg_dma_nents = dma_map_sg(dev, req->src, nents,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:38:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368263; cv=none; b=k+CsdOL3AhRZjMBOfbMXXcmRgkGhqFXJwaxSC3hUxgJos9zgpcX2nwUhSf05y3lh2O55VHg7YiQr5I7j2yL5zp9TPqedhnrEFFJkWbNU4g9k1IM7zwZ3NHo/6p306bGVdafVPGxkB2z9GzS/eqm0bHWFz087IP4njjMhRlruy9Q=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368263; c=relaxed/simple;
	bh=sCKT9uHxbbqYTVPZr2on4IgKwapgcfQhn003v96NR4Y=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=RTbRHZM8MQoP4vZISpAlLgarLy9fs7ovwLZvVNNiS88xKO3UMcnQns78GJILywxh9YDAUqimNQ+oi+15EBQhHRG0+t4uMFfgbQML4txkzXfDudRVSHapFm6hK7jrdMEZZIE8dEg8rTNXJ2C10paXA8cnbsWzO8qA/VuuSvuo+2k=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=v+UZVupF; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Liao Yuanhong <[email-masked]>,
	Alex Deucher <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 099/262] drm/amd/display: Remove redundant semicolons
Date: Mon, 13 Oct 2025 16:44:01 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Liao Yuanhong <[email-masked]>

[ Upstream commit 90b810dd859c0df9db2290da1ac5842e5f031267 ]

Remove unnecessary semicolons.

Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321")
Signed-off-by: Liao Yuanhong <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c    | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
index 9ba6cb67655f4..6c75aa82327ac 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_rq_dlg_calc_32.c
@@ -139,7 +139,6 @@ void dml32_rq_dlg_get_rq_reg(display_rq_regs_st *rq_regs,
 	if (dual_plane) {
 		unsigned int p1_pte_row_height_linear = get_dpte_row_height_linear_c(mode_lib, e2e_pipe_param,
 				num_pipes, pipe_idx);
-		;
 		if (src->sw_mode == dm_sw_linear)
 			ASSERT(p1_pte_row_height_linear >= 8);
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:56 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368260; cv=none; b=ekr+lqJnFGPzdBXI6BPXV30/eIgNgsf/E8DgSKLpTuiynnq52rtupkc6REPkzYhMcB5l0Lz0cZkvnuVcpQuEBeS1tPVjUWdtC+lUcpM2+RmdaHAAU3YvpoPD/EUbGD3lXS+k+JJVzzKOSTYgyp9tcnoblINkikvZ0RkE+Xta8nM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368260; c=relaxed/simple;
	bh=ojwbqnOxXX7T/kqGh1o0+iRLjfumX5kZmM5e3C07a28=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=T0AwOX+5XyNveDCYrvmZUW7q9KXsnP8XBpYdAjMZgS3PQKjYTIpB9+SytILCnDMgU0iK1kmbNSrDNRvPyr4KUvgkPp0kNDZ9tuTComMZLkhy3t0/xnfERmU94RTe8yuTcA3Lh5koYqZyZHxpsH2NuBNPM+D+wKLxKEMnWUTMXxE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Wmd44jqi; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 098/262] serial: max310x: Add error checking in probe()
Date: Mon, 13 Oct 2025 16:44:00 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email-masked]>

[ Upstream commit 672a37ba8af1f2ebcedeb94aea2cdd047f805f30 ]

Check if devm_i2c_new_dummy_device() fails.

Fixes: 2e1f2d9a9bdb ("serial: max310x: implement I2C support")
Signed-off-by: Dan Carpenter <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/tty/serial/max310x.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
index 35369a2f77b29..2f8e3ea4fe128 100644
--- a/drivers/tty/serial/max310x.c
+++ b/drivers/tty/serial/max310x.c
@@ -1641,6 +1641,8 @@ static int max310x_i2c_probe(struct i2c_client *client)
 		port_client = devm_i2c_new_dummy_device(&client->dev,
 							client->adapter,
 							port_addr);
+		if (IS_ERR(port_client))
+			return PTR_ERR(port_client);
 
 		regcfg_i2c.name = max310x_regmap_name(i);
 		regmaps[i] = devm_regmap_init_i2c(port_client, &regcfg_i2c);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:52:40 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368251; cv=none; b=sqj7zfbI4rXuCA8lpB6yG/4gnfu0TJQr7L4lrJNI2yK2KBWZkCFVNlVbFCsNRjdBYos1X9rZ5X4ovNenX5hC1sq/LW153iGoLJSEtiQaGWQkYrTdL4PVcFC+7py7XKeuCGw8zi/nfW500PPmgT9A2UnGZMTge6xQzAFlfbZHd64=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368251; c=relaxed/simple;
	bh=WA4DTqZnawzJ8LdiHabiwiMKrg3OOZOWUCfiN9lXsiQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Pi1K8rDz2JOg0t79LWqqdPeYadFMZNV6A5jREbnDW8NMgB2Da6WeeMTyXfjsWc+EKNXKDg1N0z4R+YlFWrUkolNBXEKMmY6cyXVoIjIZ2VC08qWkTsxurAUeWGtwmpH9CyeLZ2nwMrj0oeXQnhYf2ANGUbqSZZY+L+VUmxuZHVc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vCpSVq2P; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 096/262] usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
Date: Mon, 13 Oct 2025 16:43:58 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email-masked]>

[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]

The kthread_run() function returns error pointers so the
max3421_hcd->spi_thread pointer can be either error pointers or NULL.
Check for both before dereferencing it.

Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning")
Signed-off-by: Dan Carpenter <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/usb/host/max3421-hcd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index dcf31a592f5d1..4b5f03f683f77 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1916,7 +1916,7 @@ max3421_probe(struct spi_device *spi)
 	if (hcd) {
 		kfree(max3421_hcd->tx);
 		kfree(max3421_hcd->rx);
-		if (max3421_hcd->spi_thread)
+		if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread))
 			kthread_stop(max3421_hcd->spi_thread);
 		usb_put_hcd(hcd);
 	}
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:47:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368249; cv=none; b=q8Qo5sPs08RfKoSIEoURkxRBuiwvprPTM/NlSR5e63MdqCYPZHqZw2mu+vowPfwCpFFUfx12zBCSY7JXHv91gMTyb1Glikt9k8JQvb0FXvT8RBdsb9m7sEdnDRCsvd6LldwY7lVrNXSSL+nwCGM1u3AKecP/JxMXH4GwxhvMwpk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368249; c=relaxed/simple;
	bh=k59j627iKSztaJscYyaxLV32oIAb5QOUVXtrI5wfV1E=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=inw2pbrGRdZnXaxQNnHi86t/DCNC/wMwtUBb8v9CCMTcDFiHWfTm7IuVX+udeLKrhz5cl1haE56pJrpxfTUXZf4CXt9Uv5agaVU9rL84t3o7uclxcdhBftnU4O8His8vceLRNAuQLFOkzJuOVSW09/TRM2wVWXWAoMaS118NiVk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=U8HSjRgB; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jonas Karlman <[email-masked]>,
	Vinod Koul <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 095/262] phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568
Date: Mon, 13 Oct 2025 16:43:57 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jonas Karlman <[email-masked]>

[ Upstream commit 7bb14b61b7d03db770b7e8871493f5b9b2be2b79 ]

The boot firmware may disable the U3 port early during boot and leave it
up to the controller or PHY driver to re-enable U3 when needed.

The Rockchip USBDP PHY driver currently does this for RK3576 and RK3588,
something the Rockchip Naneng Combo PHY driver never does for RK3568.
This may result in USB 3.0 ports being limited to only using USB 2.0 or
in special cases not working at all on RK3568.

Write to PIPE_GRF USB3OTGx_CON1 reg to ensure the U3 port is enabled
when a PHY with PHY_TYPE_USB3 mode is used.

Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568")
Signed-off-by: Jonas Karlman <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Vinod Koul <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
index 1ef6d9630f7e0..fbaeb7ca600d1 100644
--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
+++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c
@@ -122,6 +122,8 @@ struct rockchip_combphy_grfcfg {
 	struct combphy_reg pipe_xpcs_phy_ready;
 	struct combphy_reg pipe_pcie1l0_sel;
 	struct combphy_reg pipe_pcie1l1_sel;
+	struct combphy_reg u3otg0_port_en;
+	struct combphy_reg u3otg1_port_en;
 };
 
 struct rockchip_combphy_cfg {
@@ -431,6 +433,14 @@ static int rk3568_combphy_cfg(struct rockchip_combphy_priv *priv)
 		rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txcomp_sel, false);
 		rockchip_combphy_param_write(priv->phy_grf, &cfg->pipe_txelec_sel, false);
 		rockchip_combphy_param_write(priv->phy_grf, &cfg->usb_mode_set, true);
+		switch (priv->id) {
+		case 0:
+			rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg0_port_en, true);
+			break;
+		case 1:
+			rockchip_combphy_param_write(priv->pipe_grf, &cfg->u3otg1_port_en, true);
+			break;
+		}
 		break;
 
 	case PHY_TYPE_SATA:
@@ -574,6 +584,8 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = {
 	/* pipe-grf */
 	.pipe_con0_for_sata	= { 0x0000, 15, 0, 0x00, 0x2220 },
 	.pipe_xpcs_phy_ready	= { 0x0040, 2, 2, 0x00, 0x01 },
+	.u3otg0_port_en		= { 0x0104, 15, 0, 0x0181, 0x1100 },
+	.u3otg1_port_en		= { 0x0144, 15, 0, 0x0181, 0x1100 },
 };
 
 static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:28:03 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368246; cv=none; b=SHGg/tMxA2yCwhAAKremzmcUCKYJm5YEwfHUqgfpBp4QuwqqpCat34VvtN/+DnQN1m5sBXCMValgsddJHZHWl6glW9+rYljBfYWAu7H2N5vb0CHCGYmvRtgc9bjqJyt6FXPCp/4HwrAlEnrZDJk7G3xArQshjKHgraOeB0xgg80=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368246; c=relaxed/simple;
	bh=6ZoFtuEH6Des+p283L0HjsEVQeylKDjqJSJFYmhPyGI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=HvgN5rzRAgpL2zFOEThenAYc2AYfx3o3C2DFBRhW3g4alzMWdfwVqy5DMM9ZAof2JyA0SG4gvYLzc4sGtDfR+SVs45zbponE+Tgj0ecWcSC2B2xvbNbejLB75LGB3yUFTGAwE4O//u4KvXyb3jDWNY1XupFvEwQF4cB9eLOoKN0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=la/XP9VN; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jacopo Mondi <[email-masked]>,
	Laurent Pinchart <[email-masked]>,
	Hans Verkuil <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 094/262] media: zoran: Remove zoran_fh structure
Date: Mon, 13 Oct 2025 16:43:56 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jacopo Mondi <[email-masked]>

[ Upstream commit dc322d13cf417552b59e313e809a6da40b8b36ef ]

The zoran_fh structure is a wrapper around v4l2_fh. Its usage has been
mostly removed by commit 83f89a8bcbc3 ("media: zoran: convert to vb2"),
but the structure stayed by mistake. It is now used in a single
location, assigned from a void pointer and then recast to a void
pointer, without being every accessed. Drop it.

Fixes: 83f89a8bcbc3 ("media: zoran: convert to vb2")
Signed-off-by: Jacopo Mondi <[email-masked]>
Signed-off-by: Laurent Pinchart <[email-masked]>
Signed-off-by: Hans Verkuil <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/media/pci/zoran/zoran.h        | 6 ------
 drivers/media/pci/zoran/zoran_driver.c | 3 +--
 2 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h
index 1cd990468d3de..d05e222b39215 100644
--- a/drivers/media/pci/zoran/zoran.h
+++ b/drivers/media/pci/zoran/zoran.h
@@ -154,12 +154,6 @@ struct zoran_jpg_settings {
 
 struct zoran;
 
-/* zoran_fh contains per-open() settings */
-struct zoran_fh {
-	struct v4l2_fh fh;
-	struct zoran *zr;
-};
-
 struct card_info {
 	enum card_type type;
 	char name[32];
diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c
index 5c05e64c71a90..80377992a6073 100644
--- a/drivers/media/pci/zoran/zoran_driver.c
+++ b/drivers/media/pci/zoran/zoran_driver.c
@@ -511,12 +511,11 @@ static int zoran_s_fmt_vid_cap(struct file *file, void *__fh,
 			       struct v4l2_format *fmt)
 {
 	struct zoran *zr = video_drvdata(file);
-	struct zoran_fh *fh = __fh;
 	int i;
 	int res = 0;
 
 	if (fmt->fmt.pix.pixelformat == V4L2_PIX_FMT_MJPEG)
-		return zoran_s_fmt_vid_out(file, fh, fmt);
+		return zoran_s_fmt_vid_out(file, __fh, fmt);
 
 	for (i = 0; i < NUM_FORMATS; i++)
 		if (fmt->fmt.pix.pixelformat == zoran_formats[i].fourcc)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:36:47 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368243; cv=none; b=ate4R04N77JgHgd7KMwkJ4mbZ8LVwG+fqjeDzEZ60TextdlSNmoAmVzw7giy6dsBpFKKlXhfiDlUY2zXrgQRfBaT5FE3Uoko6KjDNJvDpA9VdtSWTuVlu9u3ZNC3yybdLbkti+RVueSrc9m9ZirlbGpZhH3u2fuRAgpKdZIkPw4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368243; c=relaxed/simple;
	bh=X0Fh2sh9svPZIHXq1Pwc66uiF7XOBKajSg39d7xLA2Q=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=fSnZSyzchApt7qwTe1sceKcH/bODf3cP2mb+h1KuQ6ISmrqh2Ype4Hr3srH9k1gu1gtxoV8STRtpoKBsefHh3AI/VT+PJU4yxlz6xiQ17BjSlHDGlAil6NBT35vvYP857iuJx619ExxB2IA9Yzs3TEM+Yoqdg8sIbWgVXTOsUUs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mp/Otj68; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chia-I Wu <[email-masked]>,
	Chen-Yu Tsai <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 093/262] drm/bridge: it6505: select REGMAP_I2C
Date: Mon, 13 Oct 2025 16:43:55 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chia-I Wu <[email-masked]>

[ Upstream commit 21b137f651cf9d981e22d2c60a2a8105f50a6361 ]

Fix

  aarch64-linux-gnu-ld: drivers/gpu/drm/bridge/ite-it6505.o: in function `it6505_i2c_probe':
  ite-it6505.c:(.text+0x754): undefined reference to `__devm_regmap_init_i2c'

Signed-off-by: Chia-I Wu <[email-masked]>
Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver")
Reviewed-by: Chen-Yu Tsai <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Chen-Yu Tsai <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/bridge/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig
index 3eb955333c809..66369b6a023f0 100644
--- a/drivers/gpu/drm/bridge/Kconfig
+++ b/drivers/gpu/drm/bridge/Kconfig
@@ -101,6 +101,7 @@ config DRM_ITE_IT6505
 	select EXTCON
 	select CRYPTO
 	select CRYPTO_HASH
+	select REGMAP_I2C
 	help
 	  ITE IT6505 DisplayPort bridge chip driver.
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:27:54 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368240; cv=none; b=rdYtBoFce2YQkyaojtohJ8FfB++wCw0lQdoH81VRZwn4+qUP00h+q6EcdoSPkChqk1bDVta+9fu1aAJpI1c/tcSJbyPr+IhdT2kQLLLH6ammWg1NJVJDqaVSX/GKOBpEI9O7VdMdZJg01G4/ShmFPR/ZA8ls8cCrN2K+DHWzvf0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368240; c=relaxed/simple;
	bh=1epM/zyXAKlkXBB2VaSlwjmm2W99oypffgxQglBji2s=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pnA88JdWvfnEDSOVDhUWSvfcBGnJoUVikawZxtuxhN6ufh8s4iGHSbX+4Bgn4c+WvaAnpPFHVSv92m/Bv7CG0DrpQXMEv+34fyM6EnCAITO/CHUvaP+yMO9Qq2uXDHwPnubdW4VLm/uvPB48h2fl//f5FG/ESDlGjZLlcWO6vxA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=euTE0LCT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chao Yu <[email-masked]>,
	Jaegeuk Kim <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 092/262] f2fs: fix condition in __allow_reserved_blocks()
Date: Mon, 13 Oct 2025 16:43:54 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chao Yu <[email-masked]>

[ Upstream commit e75ce117905d2830976a289e718470f3230fa30a ]

If reserve_root mount option is not assigned, __allow_reserved_blocks()
will return false, it's not correct, fix it.

Fixes: 7e65be49ed94 ("f2fs: add reserved blocks for root user")
Signed-off-by: Chao Yu <[email-masked]>
Signed-off-by: Jaegeuk Kim <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/f2fs/f2fs.h | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 2dec22f2ea639..0d3ef487f72ac 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -2331,8 +2331,6 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
 {
 	if (!inode)
 		return true;
-	if (!test_opt(sbi, RESERVE_ROOT))
-		return false;
 	if (IS_NOQUOTA(inode))
 		return true;
 	if (uid_eq(F2FS_OPTION(sbi).s_resuid, current_fsuid()))
@@ -2353,7 +2351,7 @@ static inline unsigned int get_available_block_count(struct f2fs_sb_info *sbi,
 	avail_user_block_count = sbi->user_block_count -
 					sbi->current_reserved_blocks;
 
-	if (!__allow_reserved_blocks(sbi, inode, cap))
+	if (test_opt(sbi, RESERVE_ROOT) && !__allow_reserved_blocks(sbi, inode, cap))
 		avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks;
 
 	if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:27:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368237; cv=none; b=Yf8tMNpwa92QGrsZWxQd5Ckdu0AZmQzDcHiuRoQQURNtvI/SQFbAHD7tU8/+OACKLD2EREiQCA0olEKq59YYrWEwKk3a5YF5raZs2tQj7MWexYgEeDvUIci9sbEsBAOXCuLNxr+6BY4mLeqvYdKpe4RwwCXhTGQJ9iihggq+lKQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368237; c=relaxed/simple;
	bh=HWOvGk1DdFAV3O+hkYRjoq8WSdNZJ3WntlCPHx4BEF4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=cyrJKESF9UBThLbnJdXIs1AFks+Wgu43Dl5Mz4fNNDoe7ULf8da3X0Ub/O1ENjephRvBrBWaP15rrlZw5+gClTdwXRyDtADKiB62YBiYVNpYcLuxl7tGs6rbOIlSRlvPdaL92K6XKCkf3cXuUuqGT/UU5bMfBU5iPCynenXC+Ng=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EQ86XmvN; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Christian=20K=C3=B6nig?= <[email-masked]>,
	Brahmajit Das <[email-masked]>,
	Alex Deucher <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 091/262] drm/radeon/r600_cs: clean up of dead code in r600_cs
Date: Mon, 13 Oct 2025 16:43:53 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brahmajit Das <[email-masked]>

[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]

GCC 16 enables -Werror=unused-but-set-variable= which results in build
error with the following message.

drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:
drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
 1411 |         unsigned offset, i, level;
      |                             ^~~~~
cc1: all warnings being treated as errors
make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1

level although is set, but in never used in the function
r600_texture_size. Thus resulting in dead code and this error getting
triggered.

Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)")
Acked-by: Christian König <[email-masked]>
Signed-off-by: Brahmajit Das <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index ac77d1246b945..811265648a582 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
 			      unsigned block_align, unsigned height_align, unsigned base_align,
 			      unsigned *l0_size, unsigned *mipmap_size)
 {
-	unsigned offset, i, level;
+	unsigned offset, i;
 	unsigned width, height, depth, size;
 	unsigned blocksize;
 	unsigned nbx, nby;
@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
 	w0 = r600_mip_minify(w0, 0);
 	h0 = r600_mip_minify(h0, 0);
 	d0 = r600_mip_minify(d0, 0);
-	for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) {
+	for (i = 0, offset = 0; i < nlevels; i++) {
 		width = r600_mip_minify(w0, i);
 		nbx = r600_fmt_get_nblocksx(format, width);
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:30:50 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368234; cv=none; b=RIFtxz6iROUItDRApNdzRyULDabYhJFnm1PA3D9UroSZq1VGoxlki8C67A2S5URwjSILIotkQSbjuEzHPjdjfW8id6KHhaJVCXcei71DsPz5kjpS0+yF1qcR43YPePbLQv/6OPCjZYuvD0akDwRs3lVjIGYYAbcsx+BCtfDkr1g=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368234; c=relaxed/simple;
	bh=in/3Luai7Cw9+zlj25Es7gqJBcuEmx+0NLl1oEBNOTc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=T/VmipOUIYKAsLfWdVwAUIZufclTP8HhX18kS1krH0BepZXWINTEhFPKYzr9giZC7/r7qUXx3mCHkNau09z81aaOMLHVq8AxY26Zfmqiivb1zQmgEHqfIvrGiTl8PEnpeoxSs9ZTEfa0asvek1ol9EFvz9z1q+mbXt6u+AFTB28=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=za2byTeo; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Douglas Anderson <[email-masked]>,
	Neil Armstrong <[email-masked]>,
	Brigham Campbell <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 090/262] drm/panel: novatek-nt35560: Fix invalid return value
Date: Mon, 13 Oct 2025 16:43:52 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brigham Campbell <[email-masked]>

[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ]

Fix bug in nt35560_set_brightness() which causes the function to
erroneously report an error. mipi_dsi_dcs_write() returns either a
negative value when an error occurred or a positive number of bytes
written when no error occurred. The buggy code reports an error under
either condition.

Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel")
Reviewed-by: Douglas Anderson <[email-masked]>
Reviewed-by: Neil Armstrong <[email-masked]>
Signed-off-by: Brigham Campbell <[email-masked]>
Signed-off-by: Neil Armstrong <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
index 5bbea734123bc..ee04c55175bb8 100644
--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
@@ -161,7 +161,7 @@ static int nt35560_set_brightness(struct backlight_device *bl)
 		par = 0x00;
 		ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY,
 					 &par, 1);
-		if (ret) {
+		if (ret < 0) {
 			dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret);
 			return ret;
 		}
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:27:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368231; cv=none; b=YcXa/yj5kKcGd5ZAGXM+h1JhGN900on7fj/RKDt6sYx7UhPOiSRKs+f/prAYk3jDB5uuoUjh3gcF214aJHRuhfSc89br1OnQVgCWBT0W/RF0VEdUtuFcaj+RyMRam19QzI+fpnjrQQGG9DALODFmdXu6JG9OCkqaohtTMd8M1jc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368231; c=relaxed/simple;
	bh=byISUw4NLz7nqbPaDvfU2AnKml+cbSqTVCPNUd18KNY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=jiXkPiED9H+K/qiK+aY8ZmPJY6MGZgA3l3uB6hMMXIVxst1yJ+9vxSIvkKIQEGTuflBS6TU/PGoTS1xR68WrQautJ7GSWdROQprEIkI+x7ZPlsiSjy0INGpiaVygppvbVEFWBNLkreZouBTLwGWOskM7e6XFi5bhyRSLkIvzRb4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=TFb2xTeD; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yinhao Hu <[email-masked]>,
	Kaiyan Mei <[email-masked]>,
	Dongliang Mu <[email-masked]>,
	Daniel Borkmann <[email-masked]>,
	Alexei Starovoitov <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 089/262] bpf: Enforce expected_attach_type for tailcall compatibility
Date: Mon, 13 Oct 2025 16:43:51 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <[email-masked]>

[ Upstream commit 4540aed51b12bc13364149bf95f6ecef013197c0 ]

Yinhao et al. recently reported:

  Our fuzzer tool discovered an uninitialized pointer issue in the
  bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.
  This leads to a NULL pointer dereference when a BPF program attempts to
  deference the txq member of struct xdp_buff object.

The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the
entry point for bpf_prog_test_run_xdp() and its expected_attach_type can
neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot
of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP
to pass xdp_is_valid_access() validation. The program returns struct xdp_md's
egress_ifindex, and the latter is only allowed to be accessed under mentioned
expected_attach_type. progB is then inserted into the tailcall which progA
calls.

The underlying issue goes beyond XDP though. Another example are programs
of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well
as sock_addr_func_proto() have different logic depending on the programs'
expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME
should not be allowed doing a tailcall into a program which calls bpf_bind()
out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.

In short, specifying expected_attach_type allows to open up additional
functionality or restrictions beyond what the basic bpf_prog_type enables.
The use of tailcalls must not violate these constraints. Fix it by enforcing
expected_attach_type in __bpf_prog_map_compatible().

Note that we only enforce this for tailcall maps, but not for BPF devmaps or
cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and
cpu_map_bpf_prog_run*() which set up a new environment / context and therefore
these situations are not prone to this issue.

Fixes: 5e43f899b03a ("bpf: Check attach type at prog load time")
Reported-by: Yinhao Hu <[email-masked]>
Reported-by: Kaiyan Mei <[email-masked]>
Reviewed-by: Dongliang Mu <[email-masked]>
Signed-off-by: Daniel Borkmann <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexei Starovoitov <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 include/linux/bpf.h | 1 +
 kernel/bpf/core.c   | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 6db72c66de91d..e8d9803cc6756 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -281,6 +281,7 @@ struct bpf_map_owner {
 	bool xdp_has_frags;
 	u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE];
 	const struct btf_type *attach_func_proto;
+	enum bpf_attach_type expected_attach_type;
 };
 
 struct bpf_map {
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 1f51c8f20722e..08bdb623f4f91 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2326,6 +2326,7 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
 		map->owner->type  = prog_type;
 		map->owner->jited = fp->jited;
 		map->owner->xdp_has_frags = aux->xdp_has_frags;
+		map->owner->expected_attach_type = fp->expected_attach_type;
 		map->owner->attach_func_proto = aux->attach_func_proto;
 		for_each_cgroup_storage_type(i) {
 			map->owner->storage_cookie[i] =
@@ -2337,6 +2338,10 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map,
 		ret = map->owner->type  == prog_type &&
 		      map->owner->jited == fp->jited &&
 		      map->owner->xdp_has_frags == aux->xdp_has_frags;
+		if (ret &&
+		    map->map_type == BPF_MAP_TYPE_PROG_ARRAY &&
+		    map->owner->expected_attach_type != fp->expected_attach_type)
+			ret = false;
 		for_each_cgroup_storage_type(i) {
 			if (!ret)
 				break;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:32:48 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368228; cv=none; b=geaLMO3XJi4meSRQ8Daq4GQJ7hh6Fguo3eqDBeMDnOCzzA+BiPVdwUZViFOTxAVdctEqW/ACJhi5x2FjONxRn2onjmWcknIav37CmWegFCC9s+ZynhlR/QaKjWwlY/vYKvIMwqxBtrg/4Q1R9LCVMCOkmo0vcbKfuQ1bIZY7aAs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368228; c=relaxed/simple;
	bh=Z0Wlgi+2bBCnHIdcDjGDJITmLxC6M3EzO0Z6HHhKGmc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=uZ43W+x40tQkB4wbBHKL3rtOl7k5iXI9U+e+DVoiNnszIARO6mg+Sp7VDHFXGVzAn8CPS/KBLdP/KzJlcxW3XOxobycE1vfZd+FlcjirefO5c7oihP7Qna4VsLPG+Qzq9OEXWs+kj2XtOOT96Q9Ba31IcxEsqYa8JjGAbY75hZE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QrNDkbPL; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	"D. Wythe" <[email-masked]>,
	Andrii Nakryiko <[email-masked]>,
	Martin KaFai Lau <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 088/262] libbpf: Fix error when st-prefix_ops and ops from differ btf
Date: Mon, 13 Oct 2025 16:43:50 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: D. Wythe <[email-masked]>

[ Upstream commit 0cc114dc358cf8da2ca23a366e761e89a46ca277 ]

When a module registers a struct_ops, the struct_ops type and its
corresponding map_value type ("bpf_struct_ops_") may reside in different
btf objects, here are four possible case:

+--------+---------------+-------------+---------------------------------+
|        |bpf_struct_ops_| xxx_ops     |                                 |
+--------+---------------+-------------+---------------------------------+
| case 0 | btf_vmlinux   | btf_vmlinux | be used and reg only in vmlinux |
+--------+---------------+-------------+---------------------------------+
| case 1 | btf_vmlinux   | mod_btf     | INVALID                         |
+--------+---------------+-------------+---------------------------------+
| case 2 | mod_btf       | btf_vmlinux | reg in mod but be used both in  |
|        |               |             | vmlinux and mod.                |
+--------+---------------+-------------+---------------------------------+
| case 3 | mod_btf       | mod_btf     | be used and reg only in mod     |
+--------+---------------+-------------+---------------------------------+

Currently we figure out the mod_btf by searching with the struct_ops type,
which makes it impossible to figure out the mod_btf when the struct_ops
type is in btf_vmlinux while it's corresponding map_value type is in
mod_btf (case 2).

The fix is to use the corresponding map_value type ("bpf_struct_ops_")
as the lookup anchor instead of the struct_ops type to figure out the
`btf` and `mod_btf` via find_ksym_btf_id(), and then we can locate
the kern_type_id via btf__find_by_name_kind() with the `btf` we just
obtained from find_ksym_btf_id().

With this change the lookup obtains the correct btf and mod_btf for case 2,
preserves correct behavior for other valid cases, and still fails as
expected for the invalid scenario (case 1).

Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support")
Signed-off-by: D. Wythe <[email-masked]>
Signed-off-by: Andrii Nakryiko <[email-masked]>
Acked-by: Andrii Nakryiko <[email-masked]>
Acked-by: Martin KaFai Lau <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/lib/bpf/libbpf.c | 36 +++++++++++++++++-------------------
 1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index ac5ad30266a5e..060aecf60b76b 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -990,35 +990,33 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw,
 	const struct btf_member *kern_data_member;
 	struct btf *btf = NULL;
 	__s32 kern_vtype_id, kern_type_id;
-	char tname[256];
+	char tname[192], stname[256];
 	__u32 i;
 
 	snprintf(tname, sizeof(tname), "%.*s",
 		 (int)bpf_core_essential_name_len(tname_raw), tname_raw);
 
-	kern_type_id = find_ksym_btf_id(obj, tname, BTF_KIND_STRUCT,
-					&btf, mod_btf);
-	if (kern_type_id < 0) {
-		pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n",
-			tname);
-		return kern_type_id;
-	}
-	kern_type = btf__type_by_id(btf, kern_type_id);
+	snprintf(stname, sizeof(stname), "%s%s", STRUCT_OPS_VALUE_PREFIX, tname);
 
-	/* Find the corresponding "map_value" type that will be used
-	 * in map_update(BPF_MAP_TYPE_STRUCT_OPS).  For example,
-	 * find "struct bpf_struct_ops_tcp_congestion_ops" from the
-	 * btf_vmlinux.
+	/* Look for the corresponding "map_value" type that will be used
+	 * in map_update(BPF_MAP_TYPE_STRUCT_OPS) first, figure out the btf
+	 * and the mod_btf.
+	 * For example, find "struct bpf_struct_ops_tcp_congestion_ops".
 	 */
-	kern_vtype_id = find_btf_by_prefix_kind(btf, STRUCT_OPS_VALUE_PREFIX,
-						tname, BTF_KIND_STRUCT);
+	kern_vtype_id = find_ksym_btf_id(obj, stname, BTF_KIND_STRUCT, &btf, mod_btf);
 	if (kern_vtype_id < 0) {
-		pr_warn("struct_ops init_kern: struct %s%s is not found in kernel BTF\n",
-			STRUCT_OPS_VALUE_PREFIX, tname);
+		pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", stname);
 		return kern_vtype_id;
 	}
 	kern_vtype = btf__type_by_id(btf, kern_vtype_id);
 
+	kern_type_id = btf__find_by_name_kind(btf, tname, BTF_KIND_STRUCT);
+	if (kern_type_id < 0) {
+		pr_warn("struct_ops init_kern: struct %s is not found in kernel BTF\n", tname);
+		return kern_type_id;
+	}
+	kern_type = btf__type_by_id(btf, kern_type_id);
+
 	/* Find "struct tcp_congestion_ops" from
 	 * struct bpf_struct_ops_tcp_congestion_ops {
 	 *	[ ... ]
@@ -1031,8 +1029,8 @@ find_struct_ops_kern_types(struct bpf_object *obj, const char *tname_raw,
 			break;
 	}
 	if (i == btf_vlen(kern_vtype)) {
-		pr_warn("struct_ops init_kern: struct %s data is not found in struct %s%s\n",
-			tname, STRUCT_OPS_VALUE_PREFIX, tname);
+		pr_warn("struct_ops init_kern: struct %s data is not found in struct %s\n",
+			tname, stname);
 		return -EINVAL;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:24:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368225; cv=none; b=mZhECHwMdqXRxmgRRBsmMyP1cXWRJI+vcVsc/HgDIYHj6TIXAK3N4oeTEwLcKM5k5hJa+vReClHNBzjFA4GebqGP3zpMPz572VGe8DMMFoEqDafItG25jyaH/87g98AI/T+3TD/MbLhUDCM/HbxkeVc5IAK0A8P+mq/8PVGaxSk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368225; c=relaxed/simple;
	bh=YXIjgWMRI0e3d0Vg1xuISR2AbXTdb5vYWpwDB8ftbW0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=JZeXERWvDiawmAMdVN6PEtMGxVBCP48+sU1MggM8jiJXj0qWveCok+RhRfysmfimHurf1aKM8bClYZdJ6BPQZ8Gsfj44cEwIMUrqI96UCa2jpkE2Nor9qQnK+A92ylV091zK2oRbxLMhpHmSTGTbC23gTngLKFadpfbjTjD++QU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FM7f4VJH; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Kohei Ito <[email-masked]>,
	Kunihiko Hayashi <[email-masked]>,
	Jarkko Nikula <[email-masked]>,
	Wolfram Sang <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 087/262] i2c: designware: Add disabling clocks when probe fails
Date: Mon, 13 Oct 2025 16:43:49 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kunihiko Hayashi <[email-masked]>

[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]

After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is
called. However, this function doesn't disable clocks and the clock-enable
count keeps increasing. Should disable these clocks explicitly.

Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
Co-developed-by: Kohei Ito <[email-masked]>
Signed-off-by: Kohei Ito <[email-masked]>
Signed-off-by: Kunihiko Hayashi <[email-masked]>
Acked-by: Jarkko Nikula <[email-masked]>
Signed-off-by: Wolfram Sang <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i2c/busses/i2c-designware-platdrv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 1615facff29c6..24c0ada72f6a5 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -311,6 +311,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
 
 exit_probe:
 	dw_i2c_plat_pm_cleanup(dev);
+	i2c_dw_prepare_clk(dev, false);
 exit_reset:
 	reset_control_assert(dev->rst);
 	return ret;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:41:30 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368220; cv=none; b=ZVqLHbvuM2sJupZ/DrixbhG/BLytqQ4eV5Lc/N8grmbDlsxropVgAmYXUKTGXZcjKJz06dIgkNi4lPO1+d4/MZDji3E/LESs5055gO6ZMOtPN0uFwA6Csc0wjM4EudCsHZHtXjE1FKj4VdR59xV6ZZM/uBFByPHsQOMrKtIcUL0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368220; c=relaxed/simple;
	bh=HVO6rMWpcIK0Ba7CCUG6171n1bLaz3SGThzxY+gmNMA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=lyiV5aWz+7e7g/GAIQ85O0MX3PXSr9uhQeS5e5i0hdupuMpGctTjlJCU07MdTlVB/0ElGbJaemQTCjWYJ1Z8YZz82DxncFiInf6EVJyw8EQjPw0ocLi0PInGzRDhGONym90keyHWQhO+dUm13W7vUsFK1j2XQgzlIesFNmJOX54=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Kv47ijl/; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Kohei Ito <[email-masked]>,
	Kunihiko Hayashi <[email-masked]>,
	Jarkko Nikula <[email-masked]>,
	Wolfram Sang <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 086/262] i2c: designware: Fix clock issue when PM is disabled
Date: Mon, 13 Oct 2025 16:43:48 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kunihiko Hayashi <[email-masked]>

[ Upstream commit 70e633bedeeb4a7290d3b1dd9d49cc2bae25a46f ]

When the driver is removed, the clocks are first enabled by
calling pm_runtime_get_sync(), and then disabled with
pm_runtime_put_sync().

If CONFIG_PM=y, clocks for this controller are disabled when it's in
the idle state. So the clocks are properly disabled when the driver
exits.

Othewise, the clocks are always enabled and the PM functions have
no effect. Therefore, the driver exits without disabling the clocks.

    # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
    18
    # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/bind
    # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
    20
    # echo 1214a000.i2c > /sys/bus/platform/drivers/i2c_designware/unbind
    # cat /sys/kernel/debug/clk/clk-pclk/clk_enable_count
    20

To ensure that the clocks can be disabled correctly even without
CONFIG_PM=y, should add the following fixes:

- Replace with pm_runtime_put_noidle(), which only decrements the runtime
  PM usage count.
- Call i2c_dw_prepare_clk(false) to explicitly disable the clocks.

Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
Co-developed-by: Kohei Ito <[email-masked]>
Signed-off-by: Kohei Ito <[email-masked]>
Signed-off-by: Kunihiko Hayashi <[email-masked]>
Tested-by: Jarkko Nikula <[email-masked]>
Acked-by: Jarkko Nikula <[email-masked]>
Signed-off-by: Wolfram Sang <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i2c/busses/i2c-designware-platdrv.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index ef9bed2f2dccb..1615facff29c6 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -328,9 +328,11 @@ static void dw_i2c_plat_remove(struct platform_device *pdev)
 	i2c_dw_disable(dev);
 
 	pm_runtime_dont_use_autosuspend(device);
-	pm_runtime_put_sync(device);
+	pm_runtime_put_noidle(device);
 	dw_i2c_plat_pm_cleanup(dev);
 
+	i2c_dw_prepare_clk(dev, false);
+
 	i2c_dw_remove_lock_support(dev);
 
 	reset_control_assert(dev->rst);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:33:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368217; cv=none; b=dfAU86wezMl+JaOMZzJvdzK1mSGZ/1vfnyyVRYKeBgCdugZxYDw+pirzRKv8FtY7/q7e0FbjTcR+zO5AZZZZFENKViMgR1uo7JYrDKrb94dLoDLwyxdIdZeP+/FjaeUFs8nVVxG+2jTEPpyRCimPwiZD6EB0wkeGqGlV5dBCSLE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368217; c=relaxed/simple;
	bh=gIxdF2xdZFhXXz9Kfygt+8GVDtUS/d/nBs3muQMsJJs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=tG3r/+NAExU1P+kAdw9o+UHXdJGzMsGrJF1nJY0molEK++uvO+sMheTUizPGhhx/kkhSvBt+rwTAezYFPj+2RVglACRWh4YSdi/IOdBXope7G/znU1DZu6HhiZ6qO3Jh5cR6m/xQUXFzHBdfKofJ+WVOMDszP8CTFDFboaUYz2I=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2EpDGRnK; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	"Leilk.Liu" <[email-masked]>,
	Chen-Yu Tsai <[email-masked]>,
	Wolfram Sang <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 085/262] i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
Date: Mon, 13 Oct 2025 16:43:47 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leilk.Liu <[email-masked]>

[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]

The old IC does not support the I2C_MASTER_WRRD (write-then-read)
function, but the current code’s handling of i2c->auto_restart may
potentially lead to entering the I2C_MASTER_WRRD software flow,
resulting in unexpected bugs.

Instead of repurposing the auto_restart flag, add a separate flag
to signal I2C_MASTER_WRRD operations.

Also fix handling of msgs. If the operation (i2c->op) is
I2C_MASTER_WRRD, then the msgs pointer is incremented by 2.
For all other operations, msgs is simply incremented by 1.

Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller")
Signed-off-by: Leilk.Liu <[email-masked]>
Suggested-by: Chen-Yu Tsai <[email-masked]>
Reviewed-by: Chen-Yu Tsai <[email-masked]>
Signed-off-by: Wolfram Sang <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
index e0ba653dec2d6..8beef73960c74 100644
--- a/drivers/i2c/busses/i2c-mt65xx.c
+++ b/drivers/i2c/busses/i2c-mt65xx.c
@@ -1243,6 +1243,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
 {
 	int ret;
 	int left_num = num;
+	bool write_then_read_en = false;
 	struct mtk_i2c *i2c = i2c_get_adapdata(adap);
 
 	ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
@@ -1256,6 +1257,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
 		if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
 		    msgs[0].addr == msgs[1].addr) {
 			i2c->auto_restart = 0;
+			write_then_read_en = true;
 		}
 	}
 
@@ -1280,12 +1282,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
 		else
 			i2c->op = I2C_MASTER_WR;
 
-		if (!i2c->auto_restart) {
-			if (num > 1) {
-				/* combined two messages into one transaction */
-				i2c->op = I2C_MASTER_WRRD;
-				left_num--;
-			}
+		if (write_then_read_en) {
+			/* combined two messages into one transaction */
+			i2c->op = I2C_MASTER_WRRD;
+			left_num--;
 		}
 
 		/* always use DMA mode. */
@@ -1293,7 +1293,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
 		if (ret < 0)
 			goto err_exit;
 
-		msgs++;
+		if (i2c->op == I2C_MASTER_WRRD)
+			msgs += 2;
+		else
+			msgs++;
 	}
 	/* the return value is number of executed messages */
 	ret = num;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:36:25 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368214; cv=none; b=EB7qz0OQBqH4qFLQgOZ2Z/8B4alugFTws1qVWFEbeQY09yde4Tk/RvE2CvuemT3vJpJHU9N39fAZAcA2zswod1wYkB2wgkxWpSUXrQCzHGKnBdfwIfJ9bXzBg3F0iReDTx9S4gE2LmaBk5SyNs5Zn+v/hwgsrGiMjzQpS+FHPLU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368214; c=relaxed/simple;
	bh=uA0MyUQ0PGsYOftqnEtIBveFZOVvJxqEhZft1U7p258=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=tgwxK5FkzCH3T/YGFmPA0W2n1oYvxTzuU2Vxh8kdRBc0vyWymlaKt7hPV9shuBpfFn+OOqtxvj3TVc/EHXI7oHxXF1ReCRCjwU4sQkguMtk73UU714PzKGGkTOedSY3tF3V8xRYkDoIVOT+bi4bZQA7xZrNXkNZ6jCFtqQG6Vx4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=RbFFo6LM; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	kernel test robot <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Daniel Lezcano <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 084/262] thermal/drivers/qcom/lmh: Add missing IRQ includes
Date: Mon, 13 Oct 2025 16:43:46 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Baryshkov <[email-masked]>

[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ]

As reported by LKP, the Qualcomm LMH driver needs to include several
IRQ-related headers, which decrlare necessary IRQ functionality.
Currently driver builds on ARM64 platforms, where the headers are pulled
in implicitly by other headers, but fails to build on other platforms.

Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver")
Reported-by: kernel test robot <[email-masked]>
Closes: https://lore.kernel.org/oe-kbuild-all/[email-masked]/
Signed-off-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Daniel Lezcano <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/thermal/qcom/lmh.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c
index d2d49264cf83a..7c299184c59b1 100644
--- a/drivers/thermal/qcom/lmh.c
+++ b/drivers/thermal/qcom/lmh.c
@@ -5,6 +5,8 @@
  */
 #include <linux/module.h>
 #include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/irqdesc.h>
 #include <linux/irqdomain.h>
 #include <linux/err.h>
 #include <linux/platform_device.h>
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:46:26 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368211; cv=none; b=UBBVoeR6eR92kq6lJw2t+aPDuEBbDkfpnkhKFSzHpNRvfckvmQ1HlOb/QaHqemwSG+iCg/1e2rI+6F9+rCXKsDT+S+TSIc8LlpwI32RL74oZRDWB7IbKbwEoILrxfKoz3OJ2n+S6sJZy+WPG6H9DjszB54ull3btUYTMeJpJijo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368211; c=relaxed/simple;
	bh=eC4JGsw2uyLirOx093vRHvLhbFcFn7C4JLDHz40Yj7I=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=u1JuMCVLx0jwNd/eul2eO6D1AmMy0llu+c0QfB1tQyaoQWJUMc8UtuMvVXFpNkgAZ1HanPM8Z/NHaq5dOoPrJDHt7eoV7sjO4n/3+y50jyomJun0DCvu9Iy8xNc5OkqMCivzFD3xHAOtLjOLERwsSRz8A33AzsRUNENV6BfE80A=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OTsHDwJA; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dmitry Baryshkov <[email-masked]>,
	Daniel Lezcano <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 083/262] thermal/drivers/qcom: Make LMH select QCOM_SCM
Date: Mon, 13 Oct 2025 16:43:45 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Baryshkov <[email-masked]>

[ Upstream commit 57eda47bd14b0c2876f2db42e757c57b7a671965 ]

The QCOM_SCM symbol is not user-visible, so it makes little sense to
depend on it. Make LMH driver select QCOM_SCM as all other drivers do
and, as the dependecy is now correctly handled, enable || COMPILE_TEST
in order to include the driver into broader set of build tests.

Fixes: 9e5a4fb84230 ("thermal/drivers/qcom/lmh: make QCOM_LMH depends on QCOM_SCM")
Signed-off-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Daniel Lezcano <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/thermal/qcom/Kconfig | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/thermal/qcom/Kconfig b/drivers/thermal/qcom/Kconfig
index 2c7f3f9a26ebb..a6bb01082ec69 100644
--- a/drivers/thermal/qcom/Kconfig
+++ b/drivers/thermal/qcom/Kconfig
@@ -34,7 +34,8 @@ config QCOM_SPMI_TEMP_ALARM
 
 config QCOM_LMH
 	tristate "Qualcomm Limits Management Hardware"
-	depends on ARCH_QCOM && QCOM_SCM
+	depends on ARCH_QCOM || COMPILE_TEST
+	select QCOM_SCM
 	help
 	  This enables initialization of Qualcomm limits management
 	  hardware(LMh). LMh allows for hardware-enforced mitigation for cpus based on
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:38:08 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368208; cv=none; b=lz07d3MtdxLnjyXeYmUxVPysMAbVW7cQXzdnXS2qiETYt/ksH9QQSH3hFL3zNmB5qRKdYWy/eEM02Jrm0XGUJCCJy2t0qq9N4LOG7zcUUX3+FTf72JHcrcd7R2gjM2rQ2nDw0IHqlxQm27Oy5Pw3dwqPXb2O1bcGU5jDul2Hqog=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368208; c=relaxed/simple;
	bh=5gGelTspZKYoEbrC8QtDlVQcjbcBeSM9ZdaOwN1r/eo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=BWtE+1Qo3mpQs0XeSOiMOcpco/9pIYGSrmpMaCFEWlYD3JdIVjm2DNNtT6Xljj9vDMRT8rEgvOff577rKEUraOqv3AldcpYVj1Wbxc2hfIqI1FUXyamyk2hKrJAAA+81MiQDxr1tGEIrJv57o4ForyL0Ma8XLUvmi0cgCPATkjU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=LMY9NK5i; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Vadim Pasternak <[email-masked]>,
	Guenter Roeck <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 082/262] hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems
Date: Mon, 13 Oct 2025 16:43:44 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vadim Pasternak <[email-masked]>

[ Upstream commit c02e4644f8ac9c501077ef5ac53ae7fc51472d49 ]

Distinct between fan speed setting request coming for hwmon and
thermal subsystems.

There are fields 'last_hwmon_state' and 'last_thermal_state' in the
structure 'mlxreg_fan_pwm', which respectively store the cooling state
set by the 'hwmon' and 'thermal' subsystem.
The purpose is to make arbitration of fan speed setting. For example, if
fan speed required to be not lower than some limit, such setting is to
be performed through 'hwmon' subsystem, thus 'thermal' subsystem will
not set fan below this limit.

Currently, the 'last_thermal_state' is also be updated by 'hwmon' causing
cooling state to never be set to a lower value.

Eliminate update of 'last_thermal_state', when request is coming from
'hwmon' subsystem.

Fixes: da74944d3a46 ("hwmon: (mlxreg-fan) Use pwm attribute for setting fan speed low limit")
Signed-off-by: Vadim Pasternak <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Guenter Roeck <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwmon/mlxreg-fan.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
index c25a54d5b39ad..0ba9195c9d713 100644
--- a/drivers/hwmon/mlxreg-fan.c
+++ b/drivers/hwmon/mlxreg-fan.c
@@ -113,8 +113,8 @@ struct mlxreg_fan {
 	int divider;
 };
 
-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
-				    unsigned long state);
+static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+				     unsigned long state, bool thermal);
 
 static int
 mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr,
@@ -224,8 +224,9 @@ mlxreg_fan_write(struct device *dev, enum hwmon_sensor_types type, u32 attr,
 				 * last thermal state.
 				 */
 				if (pwm->last_hwmon_state >= pwm->last_thermal_state)
-					return mlxreg_fan_set_cur_state(pwm->cdev,
-									pwm->last_hwmon_state);
+					return _mlxreg_fan_set_cur_state(pwm->cdev,
+									 pwm->last_hwmon_state,
+									 false);
 				return 0;
 			}
 			return regmap_write(fan->regmap, pwm->reg, val);
@@ -357,9 +358,8 @@ static int mlxreg_fan_get_cur_state(struct thermal_cooling_device *cdev,
 	return 0;
 }
 
-static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
-				    unsigned long state)
-
+static int _mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+				     unsigned long state, bool thermal)
 {
 	struct mlxreg_fan_pwm *pwm = cdev->devdata;
 	struct mlxreg_fan *fan = pwm->fan;
@@ -369,7 +369,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
 		return -EINVAL;
 
 	/* Save thermal state. */
-	pwm->last_thermal_state = state;
+	if (thermal)
+		pwm->last_thermal_state = state;
 
 	state = max_t(unsigned long, state, pwm->last_hwmon_state);
 	err = regmap_write(fan->regmap, pwm->reg,
@@ -381,6 +382,13 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
 	return 0;
 }
 
+static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
+				    unsigned long state)
+
+{
+	return _mlxreg_fan_set_cur_state(cdev, state, true);
+}
+
 static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {
 	.get_max_state	= mlxreg_fan_get_max_state,
 	.get_cur_state	= mlxreg_fan_get_cur_state,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:56:15 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368206; cv=none; b=K37URAm1pDr2DpSKahiIbez0kD90G9IqgFQG23Zby2WaM5VCh9w5JwDVoNLQ4oF8QEA8z4AAQa8F1/XCJZSZOTf83Z27QJMUgHGRGADcAdrkqcKUBu5eaAAjARrvAnS/bz+tM6kugQYBDHiP7hC44fRZMTTIdXnYKny4e+NRthI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368206; c=relaxed/simple;
	bh=1hm/JH/yvhmEzFWl1ErMCJxlQWQxrmKPZsAI1jK+l84=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=iMDNpAuFfWevwuSoyUw+zd9Y1rv6y/ahVL5rPcE+BNwZGxQPmZx/N44QG/mzfmeUOrPZfUVCmSDpqkZFInWpt+K1fohIv1okS5N5i5lkDgwhZqW4yTHxqF0YL/1jb5DlggWNua1FdyY8lJzoMsfcmwcxIU6cyDLeiXLkz0UCd2g=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=usAYPfYa; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Hulk Robot <[email-masked]>,
	Qi Xi <[email-masked]>,
	Arnd Bergmann <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 081/262] once: fix race by moving DO_ONCE to separate section
Date: Mon, 13 Oct 2025 16:43:43 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qi Xi <[email-masked]>

[ Upstream commit edcc8a38b5ac1a3dbd05e113a38a25b937ebefe5 ]

The commit c2c60ea37e5b ("once: use __section(".data.once")") moved
DO_ONCE's ___done variable to .data.once section, which conflicts with
DO_ONCE_LITE() that also uses the same section.

This creates a race condition when clear_warn_once is used:

Thread 1 (DO_ONCE)             Thread 2 (DO_ONCE)
__do_once_start
    read ___done (false)
    acquire once_lock
execute func
__do_once_done
    write ___done (true)      __do_once_start
    release once_lock             // Thread 3 clear_warn_once reset ___done
                                  read ___done (false)
                                  acquire once_lock
                              execute func
schedule once_work            __do_once_done
once_deferred: OK             write ___done (true)
static_branch_disable         release once_lock
                              schedule once_work
                              once_deferred:
                                  BUG_ON(!static_key_enabled)

DO_ONCE_LITE() in once_lite.h is used by WARN_ON_ONCE() and other warning
macros. Keep its ___done flag in the .data..once section and allow resetting
by clear_warn_once, as originally intended.

In contrast, DO_ONCE() is used for functions like get_random_once() and
relies on its ___done flag for internal synchronization. We should not reset
DO_ONCE() by clear_warn_once.

Fix it by isolating DO_ONCE's ___done into a separate .data..do_once section,
shielding it from clear_warn_once.

Fixes: c2c60ea37e5b ("once: use __section(".data.once")")
Reported-by: Hulk Robot <[email-masked]>
Signed-off-by: Qi Xi <[email-masked]>
Signed-off-by: Arnd Bergmann <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 include/asm-generic/vmlinux.lds.h | 1 +
 include/linux/once.h              | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 23b358a1271cd..3c75199947f09 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -354,6 +354,7 @@
 	__start_once = .;						\
 	*(.data..once)							\
 	__end_once = .;							\
+	*(.data..do_once)						\
 	STRUCT_ALIGN();							\
 	*(__tracepoints)						\
 	/* implement dynamic printk debug */				\
diff --git a/include/linux/once.h b/include/linux/once.h
index 30346fcdc7995..449a0e34ad5ad 100644
--- a/include/linux/once.h
+++ b/include/linux/once.h
@@ -46,7 +46,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
 #define DO_ONCE(func, ...)						     \
 	({								     \
 		bool ___ret = false;					     \
-		static bool __section(".data..once") ___done = false;	     \
+		static bool __section(".data..do_once") ___done = false;     \
 		static DEFINE_STATIC_KEY_TRUE(___once_key);		     \
 		if (static_branch_unlikely(&___once_key)) {		     \
 			unsigned long ___flags;				     \
@@ -64,7 +64,7 @@ void __do_once_sleepable_done(bool *done, struct static_key_true *once_key,
 #define DO_ONCE_SLEEPABLE(func, ...)						\
 	({									\
 		bool ___ret = false;						\
-		static bool __section(".data..once") ___done = false;		\
+		static bool __section(".data..do_once") ___done = false;	\
 		static DEFINE_STATIC_KEY_TRUE(___once_key);			\
 		if (static_branch_unlikely(&___once_key)) {			\
 			___ret = __do_once_sleepable_start(&___done);		\
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:54:24 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368202; cv=none; b=MdYW4Mzy/SCM+jbsWEJTs9byzhlS0yj5f5UJUx9ndBXtH0VFftejzI8Dk6+2bG5UFKuxP+YJOLYR4cAPCopj1Bi1qRiNA+Xgd1lsOlG3syQH+0jTw3RLvgirTiyOs/7z6o0QN1ZAk+Ky0Ou8Qqh5bu4OYHZ7SOsVuxRSM/p7MgY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368202; c=relaxed/simple;
	bh=LCB3Jnjtzu/j2U+0Aofnveqtskv/L7xl0Qq91BOSmds=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pXwoC08qi7O6ZrR/9YdKpaK0rsXoDMoNBWhKIypyxBGz9n5wDuhGBcbVxHtZrFfdQjEHF6UzqnCdfKJy+C1k0K9PAZuuJ3o7hfqeiU4wpwfiCZv1VkIIwNK+GTP3ekcxMJnXmQhMNezX5GyzAcKWq0WLsrM4GkmxPY1VpgWqjqU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gFYwlF+V; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	David Vernet <[email-masked]>,
	Yonghong Song <[email-masked]>,
	Andrea Righi <[email-masked]>,
	Alexei Starovoitov <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 080/262] bpf: Mark kfuncs as __noclone
Date: Mon, 13 Oct 2025 16:43:42 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrea Righi <[email-masked]>

[ Upstream commit d4680a11e14c7baf683cb8453d91d71d2e0b9d3e ]

Some distributions (e.g., CachyOS) support building the kernel with -O3,
but doing so may break kfuncs, resulting in their symbols not being
properly exported.

In fact, with gcc -O3, some kfuncs may be optimized away despite being
annotated as noinline. This happens because gcc can still clone the
function during IPA optimizations, e.g., by duplicating or inlining it
into callers, and then dropping the standalone symbol. This breaks BTF
ID resolution since resolve_btfids relies on the presence of a global
symbol for each kfunc.

Currently, this is not an issue for upstream, because we don't allow
building the kernel with -O3, but it may be safer to address it anyway,
to prevent potential issues in the future if compilers become more
aggressive with optimizations.

Therefore, add __noclone to __bpf_kfunc to ensure kfuncs are never
cloned and remain distinct, globally visible symbols, regardless of
the optimization level.

Fixes: 57e7c169cd6af ("bpf: Add __bpf_kfunc tag for marking kernel functions as kfuncs")
Acked-by: David Vernet <[email-masked]>
Acked-by: Yonghong Song <[email-masked]>
Signed-off-by: Andrea Righi <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexei Starovoitov <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 include/linux/btf.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/btf.h b/include/linux/btf.h
index d99178ce01d21..e473bbfe41286 100644
--- a/include/linux/btf.h
+++ b/include/linux/btf.h
@@ -82,7 +82,7 @@
  * as to avoid issues such as the compiler inlining or eliding either a static
  * kfunc, or a global kfunc in an LTO build.
  */
-#define __bpf_kfunc __used __retain noinline
+#define __bpf_kfunc __used __retain __noclone noinline
 
 #define __bpf_kfunc_start_defs()					       \
 	__diag_push();							       \
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:36:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368200; cv=none; b=nfZ+5Wr9h25WCqKpy2Iu+kXgBVCkD46WLwU9JOR7akDHrvMZnyLcHMlJKp4teMw12hWCNy5DFO2Abf6JY7XlGbv5QbF7NAOoU+rs1lvMJqcq8OMIATD0e1ZIjM3Aeg8TlwSdAt9gDswCHkp+Yj+20ZloTph/mGTRkWdH7lP0bVA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368200; c=relaxed/simple;
	bh=mlHIBPMJT8ZepJmzCOq2P41SPcetpnMo5NisEjqBf/s=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=K/MvKeeE5Ul2z67gTVwoHSmNyMj1A3mkPkUhy0vhPZ6J9Dy+Ag6lMXXNYSIBpo7e1o2D8BsCZ/aJs6W7V/xXXc9RHZ7NorWFqO8A/rJBrjtjW3LooExAOyETXjT/RIX25yWL0W7RHYW7aR/iyubJzwR/9l3nSvehHFLOOgjQYAM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mqRfQHWg; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jonas Gorski <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 079/262] spi: fix return code when spi device has too many chipselects
Date: Mon, 13 Oct 2025 16:43:41 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jonas Gorski <[email-masked]>

[ Upstream commit 188f63235bcdd207646773a8739387d85347ed76 ]

Don't return a positive value when there are too many chipselects.

Fixes: 4d8ff6b0991d ("spi: Add multi-cs memories support in SPI core")
Signed-off-by: Jonas Gorski <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/spi/spi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 8d6341b0d8668..5ad9f4a2148fa 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2462,7 +2462,7 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi,
 	if (rc > ctlr->num_chipselect) {
 		dev_err(&ctlr->dev, "%pOF has number of CS > ctlr->num_chipselect (%d)\n",
 			nc, rc);
-		return rc;
+		return -EINVAL;
 	}
 	if ((of_property_read_bool(nc, "parallel-memories")) &&
 	    (!(ctlr->flags & SPI_CONTROLLER_MULTI_CS))) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:40:14 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368197; cv=none; b=mUf3sBJW4LRxsIqKC74tTDxlduBg22qSqbt+BN9paKiJUuzwKzfOCa2LTKcjs4Qja9uJc/uayf8ylKqdDcwrx6oqMMvNq3CPWdJS4lIVnfXPj/vhSRxSqhWahpSeOIM/lVrvdrnWmZFeqtAKqVp1cTodVhHUppqDHnNMo+2yMQg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368197; c=relaxed/simple;
	bh=jmdu65ogfbm+B9CALmrkG+NQBARvKatvba8Ieft/Y6U=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=DAp+APwxx0blTMP3p4HYfz827BzDL7Vx3DY7g7molVFb5eRBnVdD+8EbWG61YxObgKnI9STTtKgQIjDhUNcqVi5yHAnT8GE3/2I9zGEEtb3XxCbGIW2L6HOiqJgkrSEUkl/q4rdiGv3DWnHo5yrrZOI5WYrc0N2j7gCCJvYs5wg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=qKwsWmf5; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhouyi Zhou <[email-masked]>,
	=?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 078/262] tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
Date: Mon, 13 Oct 2025 16:43:40 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhouyi Zhou <[email-masked]>

[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ]

Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of
__kernel_old_time_t") made nolibc use the kernel's time type so that
`time_t` matches `timespec::tv_sec` on all ABIs (notably x32).

But since __kernel_old_time_t is fairly new, notably from 2020 in commit
94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"),
nolibc builds that rely on host headers may fail.

Switch to __kernel_time_t, which is the same as __kernel_old_time_t and
has existed for longer.

Tested in PPC VM of Open Source Lab of Oregon State University
(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh)

Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t")
Signed-off-by: Zhouyi Zhou <[email-masked]>
[Thomas: Reformat commit and its message a bit]
Signed-off-by: Thomas Weißschuh <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/include/nolibc/std.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h
index a9d8b5b51f37f..f24953f8b949c 100644
--- a/tools/include/nolibc/std.h
+++ b/tools/include/nolibc/std.h
@@ -33,6 +33,6 @@ typedef unsigned long       nlink_t;
 typedef   signed long         off_t;
 typedef   signed long     blksize_t;
 typedef   signed long      blkcnt_t;
-typedef __kernel_old_time_t  time_t;
+typedef __kernel_time_t      time_t;
 
 #endif /* _NOLIBC_STD_H */
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:42:26 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368194; cv=none; b=ZrrQDw6aIQSrzgLcQRHoL+RZa/FqyNpB5gcvafw0w3szS0z/UPWHxMFzsW6Px8NUQsmg9oc4TNR0DHqcG0hJCph16zk0DwjMazOi/p1Nw+IWvK0X6e/HFoQXnAAiIr5pFUKQMNfooFTHhxPtgHnk63QIrfl9npU9T6Y5K1R62pk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368194; c=relaxed/simple;
	bh=3U8/CXw9z4gNo82gXYBUiQAnevdp5vlc0ZC4U1SJCXg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Bl7gOdXnBJWA7fx9C09W7C/a8DZ4YunVXejnf2VVKXf4dkb9u8FIcQpSL6IJtLqxZCOVZbuDObLTX1hxd2uySUMu5YC1S+gHcr6yIKNAtJ/hLiEh/grz2pz+z3L49ngWL6nhYiyelVZX3CEONraSlBsuTtdEyoGj0S1A5hBbb8Q=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bDiHGlc9; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	"Rafael J. Wysocki" <[email-masked]>,
	Thomas Gleixner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 077/262] smp: Fix up and expand the smp_call_function_many() kerneldoc
Date: Mon, 13 Oct 2025 16:43:39 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email-masked]>

[ Upstream commit ccf09357ffef2ab472369ab9cdf470c9bc9b821a ]

The smp_call_function_many() kerneldoc comment got out of sync with the
function definition (bool parameter "wait" is incorrectly described as a
bitmask in it), so fix it up by copying the "wait" description from the
smp_call_function() kerneldoc and add information regarding the handling
of the local CPU to it.

Fixes: 49b3bd213a9f ("smp: Fix all kernel-doc warnings")
Signed-off-by: Rafael J. Wysocki <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/smp.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/kernel/smp.c b/kernel/smp.c
index f25e20617b7eb..fa6faf50fb43b 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -891,16 +891,15 @@ static void smp_call_function_many_cond(const struct cpumask *mask,
  * @mask: The set of cpus to run on (only runs on online subset).
  * @func: The function to run. This must be fast and non-blocking.
  * @info: An arbitrary pointer to pass to the function.
- * @wait: Bitmask that controls the operation. If %SCF_WAIT is set, wait
- *        (atomically) until function has completed on other CPUs. If
- *        %SCF_RUN_LOCAL is set, the function will also be run locally
- *        if the local CPU is set in the @cpumask.
- *
- * If @wait is true, then returns once @func has returned.
+ * @wait: If true, wait (atomically) until function has completed
+ *        on other CPUs.
  *
  * You must not call this function with disabled interrupts or from a
  * hardware interrupt handler or from a bottom half handler. Preemption
  * must be disabled when calling this function.
+ *
+ * @func is not called on the local CPU even if @mask contains it.  Consider
+ * using on_each_cpu_cond_mask() instead if this is not desirable.
  */
 void smp_call_function_many(const struct cpumask *mask,
 			    smp_call_func_t func, void *info, bool wait)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:28:17 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368289; cv=none; b=psFgD4LTIihQHZznO1JivOA68C4TQ6fBpZ7I30ez1LDT6+BcS3rIVplHPYINIGwj/8q3YnFqbOuc8wNNkZ0OYhNqQxqAu9ZNHVQHcpEvNP9uNCfWQb3RYlDdZ9QRNF35FLZKS75voDWzelOIxSMMR0/SHMdzztyfdZ6oBTHSGrY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368289; c=relaxed/simple;
	bh=K/RZHVwOdx8RRXqxpOV9wxPo3e5mNGLQlrZk78j2fJY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Z6b6qWloROIMyHSBFXz0EfB5fCp/h0NZsf5pszn/a26Ulk0F09cK8MfxFQLTrsWu9zUn2nDbVNNM15ti4Tt8yhaRXvEMmvsanggIYtt08CmzbuZCc5Rr9ttqQ8Nq4RPtRizOU4NfSKht3BuxtzrB2p55YsyGvhUxT7HuXz/jA1s=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ydjcLvcd; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Puranjay Mohan <[email-masked]>,
	Hengqi Chen <[email-masked]>,
	Song Liu <[email-masked]>,
	Alexei Starovoitov <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 076/262] bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()
Date: Mon, 13 Oct 2025 16:43:38 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hengqi Chen <[email-masked]>

[ Upstream commit 6ff4a0fa3e1b2b9756254b477fb2f0fbe04ff378 ]

The current implementation seems incorrect and does NOT match the
comment above, use bpf_jit_binary_pack_finalize() instead.

Fixes: 1dad391daef1 ("bpf, arm64: use bpf_prog_pack for memory management")
Acked-by: Puranjay Mohan <[email-masked]>
Signed-off-by: Hengqi Chen <[email-masked]>
Acked-by: Song Liu <[email-masked]>
Acked-by: Puranjay Mohan <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexei Starovoitov <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/net/bpf_jit_comp.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 5553508c36440..ca6d002a6f137 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -2754,8 +2754,7 @@ void bpf_jit_free(struct bpf_prog *prog)
 		 * before freeing it.
 		 */
 		if (jit_data) {
-			bpf_arch_text_copy(&jit_data->ro_header->size, &jit_data->header->size,
-					   sizeof(jit_data->header->size));
+			bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header);
 			kfree(jit_data);
 		}
 		hdr = bpf_jit_binary_pack_hdr(prog);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:40:33 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368286; cv=none; b=lxKmu8kkCpF3Bm8R/TPFtg7q6bm8jrn0FRm4q4ZxOW7vq9XMC9yPyEjYkEvfaTiOSMqGFhH3fO8ZjN0ilkzZQTHuZ7FER6ljPB+xDKFQookHqdmifgu0+TKebGwVEUawNxAlPdKiCDnnD3MPTHQ9F5ts4CdmBVfXnhO1Qa+iZts=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368286; c=relaxed/simple;
	bh=E1FOUgV0zOlv/LiiaT3B0XVBIbVL/2DTrzs+D1xZ4vQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=AjnTb2qBouYu/kBQZ4gZ4rrLkwYfFeqL1bXPM/mtb1SaV3o7VFtPsw4CwRfC9SrihdMLCHsY+jigC6dVsAUxQu/uh3PQZs48OvV6TAq7yFQgK/p3UObvo0FH0TqcFaC7a2wSjJCqVrg0YfbibN7UYkohTYCxkMVGpP+Gl4MUYuM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=wHJ/Nf4K; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Paul Chaignon <[email-masked]>,
	Daniel Borkmann <[email-masked]>,
	Eduard Zingerman <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 075/262] bpf: Explicitly check accesses to bpf_sock_addr
Date: Mon, 13 Oct 2025 16:43:37 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: syzkaller.appspot.com]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paul Chaignon <[email-masked]>

[ Upstream commit 6fabca2fc94d33cdf7ec102058983b086293395f ]

Syzkaller found a kernel warning on the following sock_addr program:

    0: r0 = 0
    1: r2 = *(u32 *)(r1 +60)
    2: exit

which triggers:

    verifier bug: error during ctx access conversion (0)

This is happening because offset 60 in bpf_sock_addr corresponds to an
implicit padding of 4 bytes, right after msg_src_ip4. Access to this
padding isn't rejected in sock_addr_is_valid_access and it thus later
fails to convert the access.

This patch fixes it by explicitly checking the various fields of
bpf_sock_addr in sock_addr_is_valid_access.

I checked the other ctx structures and is_valid_access functions and
didn't find any other similar cases. Other cases of (properly handled)
padding are covered in new tests in a subsequent patch.

Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
Reported-by: [email-masked]
Signed-off-by: Paul Chaignon <[email-masked]>
Signed-off-by: Daniel Borkmann <[email-masked]>
Acked-by: Eduard Zingerman <[email-masked]>
Acked-by: Daniel Borkmann <[email-masked]>
Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
Link: https://lore.kernel.org/bpf/b5860[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/core/filter.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index 02fedc404d7f7..c850e5d6cbd87 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -9233,13 +9233,17 @@ static bool sock_addr_is_valid_access(int off, int size,
 			return false;
 		info->reg_type = PTR_TO_SOCKET;
 		break;
-	default:
-		if (type == BPF_READ) {
-			if (size != size_default)
-				return false;
-		} else {
+	case bpf_ctx_range(struct bpf_sock_addr, user_family):
+	case bpf_ctx_range(struct bpf_sock_addr, family):
+	case bpf_ctx_range(struct bpf_sock_addr, type):
+	case bpf_ctx_range(struct bpf_sock_addr, protocol):
+		if (type != BPF_READ)
 			return false;
-		}
+		if (size != size_default)
+			return false;
+		break;
+	default:
+		return false;
 	}
 
 	return true;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:39:44 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368283; cv=none; b=thYsGdtNG301/UPuXAz7DPgkQUo0Jhk3p6NNlat6aQhPvz5/+Qv9MqR49CjY/qmqy6Oq76IXkudsbDjERmOPTlYDgMd+86IRPbsuSCIXxfUIvJSBtZ0BXw75Tkw3N00ldJ9l4gPJ2hD0TSeMFRFPy/5ZmVqI4R+zNIQQzziLBys=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368283; c=relaxed/simple;
	bh=ihTj8WGjg8MDAXw1fCR5ThdAFlmxE59iBS3s4t0P7qE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=a8h53s1Zx7LiLs8kjjR8HxoeH5O2WobaFoVfkuj+YS1eVFZDASRYIo2N9oBmlk7dZBjYuJyF8FJJGuWlXvGyPS80oHe06Di3JFq7qVX6S3F7tk5DPAu+sBj5fmxQNsenq0UeqDIPsu1OPwHX+9bUF99cQdGOFHpFPjcU9Xf5OJY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0TkAtPs3; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Akhilesh Patil <[email-masked]>,
	Shuah Khan <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 074/262] selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
Date: Mon, 13 Oct 2025 16:43:36 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Akhilesh Patil <[email-masked]>

[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]

Check if watchdog device supports WDIOF_KEEPALIVEPING option before
entering keep_alive() ping test loop. Fix watchdog-test silently looping
if ioctl based ping is not supported by the device. Exit from test in
such case instead of getting stuck in loop executing failing keep_alive()

watchdog_info:
 identity:              m41t93 rtc Watchdog
 firmware_version:      0
Support/Status: Set timeout (in seconds)
Support/Status: Watchdog triggers a management or other external alarm not a reboot

Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.
WDIOC_KEEPALIVE not supported by this device

without this change
Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.
Watchdog Ticking Away!
(Where test stuck here forver silently)

Updated change log at commit time:
Shuah Khan <[email-masked]>

Link: https://lore.kernel.org/r/[email-masked]
Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path")
Signed-off-by: Akhilesh Patil <[email-masked]>
Signed-off-by: Shuah Khan <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
index a1f506ba55786..4f09c5db0c7f3 100644
--- a/tools/testing/selftests/watchdog/watchdog-test.c
+++ b/tools/testing/selftests/watchdog/watchdog-test.c
@@ -332,6 +332,12 @@ int main(int argc, char *argv[])
 	if (oneshot)
 		goto end;
 
+	/* Check if WDIOF_KEEPALIVEPING is supported */
+	if (!(info.options & WDIOF_KEEPALIVEPING)) {
+		printf("WDIOC_KEEPALIVE not supported by this device\n");
+		goto end;
+	}
+
 	printf("Watchdog Ticking Away!\n");
 
 	/*
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:38:28 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368280; cv=none; b=bt+wCNsolqhWJiVwK1tyLCG5e3D+3BpVeLAjDqu2gLimYitgIKatZhN837jbLVcXfBv935N2Ylab17tTzt42Tr8AobDt50PzSVewUzknXkwo5X3Asu+ktqC2/RbbhHxC70q5V9pEpZkVWOh0Gq5l/IaD+8ndlJXua1jbPcY9oFE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368280; c=relaxed/simple;
	bh=CJhwsUWph+1ziWMQqu8oLdgciVEWwiEmOrNHnmI++VI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=fVhvJ7XV6NleNr1gwIRvNvt2J7FETVPliBvVzo4TEXcHkdhBCOfSempVo9wa2DURBKLJ8GU5/p6ikoKI85PORRoMlsLKP4c1iU343me+uNKFYJBSTAjLL6sUJojk8glEbTxMHXHPsk5sfe/kNZiOOGCE9IteTEM8hORUWhKwBvs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Jcoj/x8Y; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Stanley Chu <[email-masked]>,
	Frank Li <[email-masked]>,
	Alexandre Belloni <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 073/262] i3c: master: svc: Recycle unused IBI slot
Date: Mon, 13 Oct 2025 16:43:35 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stanley Chu <[email-masked]>

[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ]

In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool
to store the IBI payload. However, when an error condition is encountered,
the function returns without recycling the IBI slot, resulting in an IBI
slot leak.

Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte")
Signed-off-by: Stanley Chu <[email-masked]>
Reviewed-by: Frank Li <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexandre Belloni <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i3c/master/svc-i3c-master.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index 7d8e1540f02ae..a1945bf9ef19e 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -377,6 +377,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,
 						SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000);
 	if (ret) {
 		dev_err(master->dev, "Timeout when polling for COMPLETE\n");
+		i3c_generic_ibi_recycle_slot(data->ibi_pool, slot);
 		return ret;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:24:38 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368277; cv=none; b=BCQMsEKwGJEVLIniUGJ3vaZAyBordyIHioInY8AQ4SuTgC7C7NjNohqMVh+VmpIes61lgKJ4h/GPeI98DT6IyNq3pkiCkU1mZNa7wR8cdw2VviVi2dC6kocKQii1C82QvnRUoZolY9+rICUPq1LD858qfbfF1v0wkXEQQEHL6ds=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368277; c=relaxed/simple;
	bh=JTJJ4xVkghIwdg8GNyvlbwZEBhSvHbc7Y4d/YFJMjnw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=S14gEXsbhuZ6FGmSNo7hKZRL++HheS2ng6tYaWUxvijUMuVHsrQnagpRyuKWuVZh3Pv0m8lhYlymslKgoUs8qAMMRl0y5J6zukgstgRMrXw08XeEcoynQMSSEEevZ64nEbhqG+v9/pbIJmDAKhkblOy+oLZfcSo4vu7g0e6UKv0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=HHXewjkT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Stanley Chu <[email-masked]>,
	Frank Li <[email-masked]>,
	Alexandre Belloni <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 072/262] i3c: master: svc: Use manual response for IBI events
Date: Mon, 13 Oct 2025 16:43:34 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stanley Chu <[email-masked]>

[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ]

Driver wants to nack the IBI request when the target is not in the
known address list. In below code, svc_i3c_master_nack_ibi() will
cause undefined behavior when using AUTOIBI with auto response rule,
because hw always auto ack the IBI request.

    switch (ibitype) {
    case SVC_I3C_MSTATUS_IBITYPE_IBI:
            dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
            if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
                    svc_i3c_master_nack_ibi(master);
            ...
            break;

AutoIBI has another issue that the controller doesn't quit AutoIBI state
after IBIWON polling timeout when there is a SDA glitch(high->low->high).
1. SDA high->low: raising an interrupt to execute IBI ISR
2. SDA low->high
3. Driver writes an AutoIBI request
4. AutoIBI process does not start because SDA is not low
5. IBIWON polling times out
6. Controller reamins in AutoIBI state and doesn't accept EmitStop request

Emitting broadcast address with IBIRESP_MANUAL avoids both issues.

Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
Signed-off-by: Stanley Chu <[email-masked]>
Reviewed-by: Frank Li <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexandre Belloni <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index 474a96ebda226..7d8e1540f02ae 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -438,9 +438,24 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
 	 */
 	writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS);
 
-	/* Acknowledge the incoming interrupt with the AUTOIBI mechanism */
-	writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI |
-	       SVC_I3C_MCTRL_IBIRESP_AUTO,
+	/*
+	 * Write REQUEST_START_ADDR request to emit broadcast address for arbitration,
+	 * instend of using AUTO_IBI.
+	 *
+	 * Using AutoIBI request may cause controller to remain in AutoIBI state when
+	 * there is a glitch on SDA line (high->low->high).
+	 * 1. SDA high->low, raising an interrupt to execute IBI isr.
+	 * 2. SDA low->high.
+	 * 3. IBI isr writes an AutoIBI request.
+	 * 4. The controller will not start AutoIBI process because SDA is not low.
+	 * 5. IBIWON polling times out.
+	 * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request.
+	 */
+	writel(SVC_I3C_MCTRL_REQUEST_START_ADDR |
+	       SVC_I3C_MCTRL_TYPE_I3C |
+	       SVC_I3C_MCTRL_IBIRESP_MANUAL |
+	       SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) |
+	       SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR),
 	       master->regs + SVC_I3C_MCTRL);
 
 	/* Wait for IBIWON, should take approximately 100us */
@@ -460,10 +475,15 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
 	switch (ibitype) {
 	case SVC_I3C_MSTATUS_IBITYPE_IBI:
 		dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
-		if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
+		if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) {
 			svc_i3c_master_nack_ibi(master);
-		else
+		} else {
+			if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD)
+				svc_i3c_master_ack_ibi(master, true);
+			else
+				svc_i3c_master_ack_ibi(master, false);
 			svc_i3c_master_handle_ibi(master, dev);
+		}
 		break;
 	case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN:
 		if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN))
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:51:16 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368274; cv=none; b=qw8rDZnnJxHKAEtlUA4N8w1fUG32fc8lae7IZrwYVlUyYY1w/74a5eZVo4L29oo9gutQrbATkLOVkfD8cQ/40fgNSghLF8uCKrqGQfmCkK4HPYtLn3AvpLmaWsHSX+AsKCzQdJB3DvvjUYQefR9LGA/YWwBFOu+AaPRClHFwUM0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368274; c=relaxed/simple;
	bh=J9eQOsZ8SEKCl6SvgD8gReJsk6iMEM5BYrmGLAMnyQI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=oUcBmBYZnfMBZc2I3JiRWG2BVGPKfIMvI5wTaTGZAECBmty/NbiqBsoI4ZPixVa/PP5hSMcSayMsJXXOkKCy7Dmu9fkgfpFdvi/5Xj0cx9a/u2B4wD3Mm5sduTo4jzqTbSE+6UPGEXlpj1lwnBk+8xJcaYRRjGsRR7MCEF+CD8o=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vrENIHb5; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Hannes Reinecke <[email-masked]>,
	Daniel Wagner <[email-masked]>,
	Keith Busch <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 071/262] nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
Date: Mon, 13 Oct 2025 16:43:33 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Wagner <[email-masked]>

[ Upstream commit db5a5406fb7e5337a074385c7a3e53c77f2c1bd3 ]

It’s possible for more than one async command to be in flight from
__nvmet_fc_send_ls_req. For each command, a tgtport reference is taken.

In the current code, only one put work item is queued at a time, which
results in a leaked reference.

To fix this, move the work item to the nvmet_fc_ls_req_op struct, which
already tracks all resources related to the command.

Fixes: 710c69dbaccd ("nvmet-fc: avoid deadlock on delete association path")
Reviewed-by: Hannes Reinecke <[email-masked]>
Signed-off-by: Daniel Wagner <[email-masked]>
Signed-off-by: Keith Busch <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/nvme/target/fc.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index ef8c5961e10c8..0ade23610ae64 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -54,6 +54,8 @@ struct nvmet_fc_ls_req_op {		/* for an LS RQST XMT */
 	int				ls_error;
 	struct list_head		lsreq_list; /* tgtport->ls_req_list */
 	bool				req_queued;
+
+	struct work_struct		put_work;
 };

@@ -111,8 +113,6 @@ struct nvmet_fc_tgtport {
 	struct nvmet_fc_port_entry	*pe;
 	struct kref			ref;
 	u32				max_sg_cnt;
-
-	struct work_struct		put_work;
 };
 
 struct nvmet_fc_port_entry {
@@ -235,12 +235,13 @@ static int nvmet_fc_tgt_a_get(struct nvmet_fc_tgt_assoc *assoc);
 static void nvmet_fc_tgt_q_put(struct nvmet_fc_tgt_queue *queue);
 static int nvmet_fc_tgt_q_get(struct nvmet_fc_tgt_queue *queue);
 static void nvmet_fc_tgtport_put(struct nvmet_fc_tgtport *tgtport);
-static void nvmet_fc_put_tgtport_work(struct work_struct *work)
+static void nvmet_fc_put_lsop_work(struct work_struct *work)
 {
-	struct nvmet_fc_tgtport *tgtport =
-		container_of(work, struct nvmet_fc_tgtport, put_work);
+	struct nvmet_fc_ls_req_op *lsop =
+		container_of(work, struct nvmet_fc_ls_req_op, put_work);
 
-	nvmet_fc_tgtport_put(tgtport);
+	nvmet_fc_tgtport_put(lsop->tgtport);
+	kfree(lsop);
 }
 static int nvmet_fc_tgtport_get(struct nvmet_fc_tgtport *tgtport);
 static void nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport,
@@ -367,7 +368,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
 				  DMA_BIDIRECTIONAL);
 
 out_putwork:
-	queue_work(nvmet_wq, &tgtport->put_work);
+	queue_work(nvmet_wq, &lsop->put_work);
 }
 
 static int
@@ -388,6 +389,7 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport,
 	lsreq->done = done;
 	lsop->req_queued = false;
 	INIT_LIST_HEAD(&lsop->lsreq_list);
+	INIT_WORK(&lsop->put_work, nvmet_fc_put_lsop_work);
 
 	lsreq->rqstdma = fc_dma_map_single(tgtport->dev, lsreq->rqstaddr,
 				  lsreq->rqstlen + lsreq->rsplen,
@@ -447,8 +449,6 @@ nvmet_fc_disconnect_assoc_done(struct nvmefc_ls_req *lsreq, int status)
 	__nvmet_fc_finish_ls_req(lsop);
 
 	/* fc-nvme target doesn't care about success or failure of cmd */
-
-	kfree(lsop);
 }
 
 /*
@@ -1412,7 +1412,6 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo,
 	kref_init(&newrec->ref);
 	ida_init(&newrec->assoc_cnt);
 	newrec->max_sg_cnt = template->max_sgl_segments;
-	INIT_WORK(&newrec->put_work, nvmet_fc_put_tgtport_work);
 
 	ret = nvmet_fc_alloc_ls_iodlist(newrec);
 	if (ret) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:40:16 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368254; cv=none; b=F/EY9OAeRDF1wS/rD9WahfnlnOH5yY0t7cYxH8o4R+rqVu6yAoeRp8KFP+SWAqt8j7NduwcmO1qTYMEyRG990ZBEbf3KJiY3yXlD97sFL00G75JSxzvklt53p78/vX/ZmRGnw/6tn6pQIw+HbJ3BJx3E6IYNlgg6pY+691Fcz3k=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368254; c=relaxed/simple;
	bh=pdKTKvxteNA7xF7K5zhRqv2tcuvInOQ67q0xLBCrzQI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=NiwaMuA3J+9UgGoKaGwu3/PSbT1tYUusDn+DSPY18qUYHjbpwRru2v6DibpfrAqiERW6h+f8tO/GcktrYM7eYs2Djk+S7wpJdnM3tts5LZpw2sThLdRVJfYbsGWsEaK0949VgNE76l0ZM885Zg0+NmBYfBOjk4KN/SnSZ9esP3w=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=VU17hVYX; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Hengqi Chen <[email-masked]>,
	Daniel Borkmann <[email-masked]>,
	Pu Lehui <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 070/262] riscv, bpf: Sign extend struct ops return values properly
Date: Mon, 13 Oct 2025 16:43:32 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hengqi Chen <[email-masked]>

[ Upstream commit fd2e08128944a7679e753f920e9eda72057e427c ]

The ns_bpf_qdisc selftest triggers a kernel panic:

    Unable to handle kernel paging request at virtual address ffffffffa38dbf58
    Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000
    [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000
    Oops [#1]
    Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)]
    CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G        W  OE       6.17.0-rc1-g2465bb83e0b4 #1 NONE
    Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
    Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024
    epc : __qdisc_run+0x82/0x6f0
     ra : __qdisc_run+0x6e/0x6f0
    epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550
     gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180
     t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0
     s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001
     a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000
     a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049
     s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000
     s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0
     s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000
     s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000
     t5 : 0000000000000000 t6 : ff60000093a6a8b6
    status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d
    [<ffffffff80bd5c7a>] __qdisc_run+0x82/0x6f0
    [<ffffffff80b6fe58>] __dev_queue_xmit+0x4c0/0x1128
    [<ffffffff80b80ae0>] neigh_resolve_output+0xd0/0x170
    [<ffffffff80d2daf6>] ip6_finish_output2+0x226/0x6c8
    [<ffffffff80d31254>] ip6_finish_output+0x10c/0x2a0
    [<ffffffff80d31446>] ip6_output+0x5e/0x178
    [<ffffffff80d2e232>] ip6_xmit+0x29a/0x608
    [<ffffffff80d6f4c6>] inet6_csk_xmit+0xe6/0x140
    [<ffffffff80c985e4>] __tcp_transmit_skb+0x45c/0xaa8
    [<ffffffff80c995fe>] tcp_connect+0x9ce/0xd10
    [<ffffffff80d66524>] tcp_v6_connect+0x4ac/0x5e8
    [<ffffffff80cc19b8>] __inet_stream_connect+0xd8/0x318
    [<ffffffff80cc1c36>] inet_stream_connect+0x3e/0x68
    [<ffffffff80b42b20>] __sys_connect_file+0x50/0x88
    [<ffffffff80b42bee>] __sys_connect+0x96/0xc8
    [<ffffffff80b42c40>] __riscv_sys_connect+0x20/0x30
    [<ffffffff80e5bcae>] do_trap_ecall_u+0x256/0x378
    [<ffffffff80e69af2>] handle_exception+0x14a/0x156
    Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709
    ---[ end trace 0000000000000000 ]---

The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer
is treated as a 32bit value and sign extend to 64bit in epilogue. This
behavior is right for most bpf prog types but wrong for struct ops which
requires RISC-V ABI.

So let's sign extend struct ops return values according to the function
model and RISC-V ABI([0]).

  [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf

Fixes: 25ad10658dc1 ("riscv, bpf: Adapt bpf trampoline to optimized riscv ftrace framework")
Signed-off-by: Hengqi Chen <[email-masked]>
Signed-off-by: Daniel Borkmann <[email-masked]>
Tested-by: Pu Lehui <[email-masked]>
Reviewed-by: Pu Lehui <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/riscv/net/bpf_jit_comp64.c | 42 ++++++++++++++++++++++++++++++++-
 1 file changed, 41 insertions(+), 1 deletion(-)

diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index 563425b4963c9..497945aa3e2c4 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -559,6 +559,39 @@ static void emit_atomic(u8 rd, u8 rs, s16 off, s32 imm, bool is64,
 	}
 }
 
+/*
+ * Sign-extend the register if necessary
+ */
+static int sign_extend(u8 rd, u8 rs, u8 sz, bool sign, struct rv_jit_context *ctx)
+{
+	if (!sign && (sz == 1 || sz == 2)) {
+		if (rd != rs)
+			emit_mv(rd, rs, ctx);
+		return 0;
+	}
+
+	switch (sz) {
+	case 1:
+		emit_sextb(rd, rs, ctx);
+		break;
+	case 2:
+		emit_sexth(rd, rs, ctx);
+		break;
+	case 4:
+		emit_sextw(rd, rs, ctx);
+		break;
+	case 8:
+		if (rd != rs)
+			emit_mv(rd, rs, ctx);
+		break;
+	default:
+		pr_err("bpf-jit: invalid size %d for sign_extend\n", sz);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 #define BPF_FIXUP_OFFSET_MASK   GENMASK(26, 0)
 #define BPF_FIXUP_REG_MASK      GENMASK(31, 27)
 #define REG_DONT_CLEAR_MARKER	0	/* RV_REG_ZERO unused in pt_regmap */
@@ -1020,8 +1053,15 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
 		restore_args(min_t(int, nr_arg_slots, RV_MAX_REG_ARGS), args_off, ctx);
 
 	if (save_ret) {
-		emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx);
 		emit_ld(regmap[BPF_REG_0], -(retval_off - 8), RV_REG_FP, ctx);
+		if (is_struct_ops) {
+			ret = sign_extend(RV_REG_A0, regmap[BPF_REG_0], m->ret_size,
+					  m->ret_flags & BTF_FMODEL_SIGNED_ARG, ctx);
+			if (ret)
+				goto out;
+		} else {
+			emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx);
+		}
 	}
 
 	emit_ld(RV_REG_S1, -sreg_off, RV_REG_FP, ctx);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:46:04 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368222; cv=none; b=E7zCu42eJqjLyg1E4uaYepm1MZ+UycUR2AR9XXymbylMoqC2awhqwWfJwArlYK+j0HNPb2Y715Eo+Wn9k37ds58rFDOVftann392FLegrh1yB1ZUSmvv6Mxg9vPBqJxUwVB8EUv1xUjLd6ZvBc2v9oFB9vsjjbL53Yp6zz7J05U=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368222; c=relaxed/simple;
	bh=BKtDRRAmM4y8nbjtwbyi3qYS5X7iQk93+Oc+zyZ2CgA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=WA3VUiGxpL1EiCthq1c9TzsvK8FLK12lnGgIRsh81xyTqhs6SkXOdfgDAmTRlJKBgSGPhpt7VEl/saGtoFneNYciqmEikd9VyyCbtVh/lcRJ6O6iKy6kS1vlsgd1FP2qWrIzYJeCMyxWAn6ahcEoyyc07GJxYVi7kC8kJXqypRw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=SfX/VJJd; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dmitry Antipov <[email-masked]>,
	"Rafael J. Wysocki" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 069/262] ACPICA: Fix largest possible resource descriptor index
Date: Mon, 13 Oct 2025 16:43:31 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Antipov <[email-masked]>

[ Upstream commit 8ca944fea4d6d9019e01f2d6f6e766f315a9d73f ]

ACPI_RESOURCE_NAME_LARGE_MAX should be equal to the last actually
used resource descriptor index (ACPI_RESOURCE_NAME_CLOCK_INPUT).

Otherwise 'resource_index' in 'acpi_ut_validate_resource()' may be
clamped incorrectly and resulting value may issue an out-of-bounds
access for 'acpi_gbl_resource_types' array. Compile tested only.

Fixes: 520d4a0ee5b6 ("ACPICA: add support for ClockInput resource (v6.5)")
Link: https://github.com/acpica/acpica/commit/cf00116c
Link: https://marc.info/?l=linux-acpi&m=175449676131260&w=2
Signed-off-by: Dmitry Antipov <[email-masked]>
Signed-off-by: Rafael J. Wysocki <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/acpi/acpica/aclocal.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
index 6f4fe47c955bd..35460c2072a4a 100644
--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -1141,7 +1141,7 @@ struct acpi_port_info {
 #define ACPI_RESOURCE_NAME_PIN_GROUP_FUNCTION   0x91
 #define ACPI_RESOURCE_NAME_PIN_GROUP_CONFIG     0x92
 #define ACPI_RESOURCE_NAME_CLOCK_INPUT          0x93
-#define ACPI_RESOURCE_NAME_LARGE_MAX            0x94
+#define ACPI_RESOURCE_NAME_LARGE_MAX            0x93
 
 /*****************************************************************************
  *
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:27:38 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368191; cv=none; b=Dp+GLtPI/MSrgMULVOFkLVFadvwOpZao32/pLKPQ/1Ulz6bueTwifsErLQ7Ia1FOytYvk2uzBVR7ydtsgxYH+ZsIcbDcpSUj249k3DsBhDPq4vlExp/ussbRh6bUWKd99RLYAwZR3pbay9do0Os1vQV5/xZdqRWm/NsTyP8aoW0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368191; c=relaxed/simple;
	bh=ouN30tGe5Chl15z6LNQleJKIYr8SDDHv7ynvbfIyb1g=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=nKtj+jahx2RQaGWUa34QhIZ5qiTX18OVLtV0R8N1k4Eb2lrZ1wiP/KafISWDoK87T+JucLA1t6EkTvIkEVwvC8AdxoRTWFneTFf9rIsHI0IWdkwBvUX4TSXmGaP4ntW6tobTOW1ZcKGGKuKq1L3+SFTrnoaFsFfH2AJ5xa6Dv10=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EGGeICq9; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <[email-masked]>,
	=?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 068/262] pwm: tiehrpwm: Fix corner case in clock divisor calculation
Date: Mon, 13 Oct 2025 16:43:30 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Uwe Kleine-König <[email-masked]>

[ Upstream commit 00f83f0e07e44e2f1fb94b223e77ab7b18ee2d7d ]

The function set_prescale_div() is responsible for calculating the clock
divisor settings such that the input clock rate is divided down such that
the required period length is at most 0x10000 clock ticks. If period_cycles
is an integer multiple of 0x10000, the divisor period_cycles / 0x10000 is
good enough. So round up in the calculation of the required divisor and
compare it using >= instead of >.

Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
Signed-off-by: Uwe Kleine-König <[email-masked]>
Link: https://lore.kernel.org/r/8548861[email-masked]
Signed-off-by: Uwe Kleine-König <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pwm/pwm-tiehrpwm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index a23e48b8523db..7a86cb090f76f 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -161,7 +161,7 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
 
 			*prescale_div = (1 << clkdiv) *
 					(hspclkdiv ? (hspclkdiv * 2) : 1);
-			if (*prescale_div > rqst_prescaler) {
+			if (*prescale_div >= rqst_prescaler) {
 				*tb_clk_div = (clkdiv << TBCTL_CLKDIV_SHIFT) |
 					(hspclkdiv << TBCTL_HSPCLKDIV_SHIFT);
 				return 0;
@@ -224,7 +224,7 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
 	pc->period_cycles[pwm->hwpwm] = period_cycles;
 
 	/* Configure clock prescaler to support Low frequency PWM wave */
-	if (set_prescale_div(period_cycles/PERIOD_MAX, &ps_divval,
+	if (set_prescale_div(DIV_ROUND_UP(period_cycles, PERIOD_MAX), &ps_divval,
 			     &tb_divval)) {
 		dev_err(pwmchip_parent(chip), "Unsupported values\n");
 		return -EINVAL;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:39:21 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368291; cv=none; b=qnH3ZOzd6KVabBHKUJxcx9hujnLfv1xxyUMtoXUak2qayCnpXgN2LF7AkqE1xufeav1AzTvYZXux6FDH8+zDfnhhETMofDzQEICsg4huZl+prhILnqNm4isZgPMYRkAhY0dBycNfySGDSH6Z+d0qj3NhxIUPMgt3Z8u/77m7CLY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368291; c=relaxed/simple;
	bh=IpCzIcav0XWpyHpQbHPTnWv9VtxlCemp5QrJ/Bse9+A=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=Mn7cnSpygcITh2+06dmHjMRUu+Xw3hC3yZMBgjfIx2PA1YDr1WE4fJ0Q4/eYLOwZ2+yH2GxZSiBIyVXlLSBwi6I6GZnzjwbM231iVySR2U82PawKwWckVpc2x7vtP8BI9334ZQ7ghjpNBTDmxGKd2QVEFgEOZc2Ho9GD88s+5f0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=kV7qTe7H; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <[email-masked]>,
	=?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 067/262] pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation
Date: Mon, 13 Oct 2025 16:43:29 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Uwe Kleine-König <[email-masked]>

[ Upstream commit bc7ce5bfc504eea9eac0eb0215017b9fcfc62c59 ]

In Up-Count Mode the timer is reset to zero one tick after it reaches
TBPRD, so the period length is (TBPRD + 1) * T_TBCLK. This matches both
the documentation and measurements. So the value written to the TBPRD has
to be one less than the calculated period_cycles value.

A complication here is that for a 100% relative duty-cycle the value
written to the CMPx register has to be TBPRD + 1 which might overflow if
TBPRD is 0xffff. To handle that the calculation of the AQCTLx register
has to be moved to ehrpwm_pwm_config() and the edge at CTR = CMPx has to
be skipped.

Additionally the AQCTL_PRD register field has to be 0 because that defines
the hardware's action when the maximal counter value is reached, which is
(as above) one clock tick before the period's end. The period start edge
has to happen when the counter is reset and so is defined in the AQCTL_ZRO
field.

Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
Signed-off-by: Uwe Kleine-König <[email-masked]>
Link: https://lore.kernel.org/r/dc818c6[email-masked]
Signed-off-by: Uwe Kleine-König <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pwm/pwm-tiehrpwm.c | 143 +++++++++++++++----------------------
 1 file changed, 58 insertions(+), 85 deletions(-)

diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index a94b1e387b924..a23e48b8523db 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -36,7 +36,7 @@
 
 #define CLKDIV_MAX		7
 #define HSPCLKDIV_MAX		7
-#define PERIOD_MAX		0xFFFF
+#define PERIOD_MAX		0x10000
 
 /* compare module registers */
 #define CMPA			0x12
@@ -65,14 +65,10 @@
 #define AQCTL_ZRO_FRCHIGH	BIT(1)
 #define AQCTL_ZRO_FRCTOGGLE	(BIT(1) | BIT(0))
 
-#define AQCTL_CHANA_POLNORMAL	(AQCTL_CAU_FRCLOW | AQCTL_PRD_FRCHIGH | \
-				AQCTL_ZRO_FRCHIGH)
-#define AQCTL_CHANA_POLINVERSED	(AQCTL_CAU_FRCHIGH | AQCTL_PRD_FRCLOW | \
-				AQCTL_ZRO_FRCLOW)
-#define AQCTL_CHANB_POLNORMAL	(AQCTL_CBU_FRCLOW | AQCTL_PRD_FRCHIGH | \
-				AQCTL_ZRO_FRCHIGH)
-#define AQCTL_CHANB_POLINVERSED	(AQCTL_CBU_FRCHIGH | AQCTL_PRD_FRCLOW | \
-				AQCTL_ZRO_FRCLOW)
+#define AQCTL_CHANA_POLNORMAL	(AQCTL_CAU_FRCLOW | AQCTL_ZRO_FRCHIGH)
+#define AQCTL_CHANA_POLINVERSED	(AQCTL_CAU_FRCHIGH | AQCTL_ZRO_FRCLOW)
+#define AQCTL_CHANB_POLNORMAL	(AQCTL_CBU_FRCLOW | AQCTL_ZRO_FRCHIGH)
+#define AQCTL_CHANB_POLINVERSED	(AQCTL_CBU_FRCHIGH | AQCTL_ZRO_FRCLOW)
 
 #define AQSFRC_RLDCSF_MASK	(BIT(7) | BIT(6))
 #define AQSFRC_RLDCSF_ZRO	0
@@ -108,7 +104,6 @@ struct ehrpwm_pwm_chip {
 	unsigned long clk_rate;
 	void __iomem *mmio_base;
 	unsigned long period_cycles[NUM_PWM_CHANNEL];
-	enum pwm_polarity polarity[NUM_PWM_CHANNEL];
 	struct clk *tbclk;
 	struct ehrpwm_context ctx;
 };
@@ -177,51 +172,20 @@ static int set_prescale_div(unsigned long rqst_prescaler, u16 *prescale_div,
 	return 1;
 }
 
-static void configure_polarity(struct ehrpwm_pwm_chip *pc, int chan)
-{
-	u16 aqctl_val, aqctl_mask;
-	unsigned int aqctl_reg;
-
-	/*
-	 * Configure PWM output to HIGH/LOW level on counter
-	 * reaches compare register value and LOW/HIGH level
-	 * on counter value reaches period register value and
-	 * zero value on counter
-	 */
-	if (chan == 1) {
-		aqctl_reg = AQCTLB;
-		aqctl_mask = AQCTL_CBU_MASK;
-
-		if (pc->polarity[chan] == PWM_POLARITY_INVERSED)
-			aqctl_val = AQCTL_CHANB_POLINVERSED;
-		else
-			aqctl_val = AQCTL_CHANB_POLNORMAL;
-	} else {
-		aqctl_reg = AQCTLA;
-		aqctl_mask = AQCTL_CAU_MASK;
-
-		if (pc->polarity[chan] == PWM_POLARITY_INVERSED)
-			aqctl_val = AQCTL_CHANA_POLINVERSED;
-		else
-			aqctl_val = AQCTL_CHANA_POLNORMAL;
-	}
-
-	aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK;
-	ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val);
-}
-
 /*
  * period_ns = 10^9 * (ps_divval * period_cycles) / PWM_CLK_RATE
  * duty_ns   = 10^9 * (ps_divval * duty_cycles) / PWM_CLK_RATE
  */
 static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
-			     u64 duty_ns, u64 period_ns)
+			     u64 duty_ns, u64 period_ns, enum pwm_polarity polarity)
 {
 	struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
 	u32 period_cycles, duty_cycles;
 	u16 ps_divval, tb_divval;
 	unsigned int i, cmp_reg;
 	unsigned long long c;
+	u16 aqctl_val, aqctl_mask;
+	unsigned int aqctl_reg;
 
 	if (period_ns > NSEC_PER_SEC)
 		return -ERANGE;
@@ -231,15 +195,10 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
 	do_div(c, NSEC_PER_SEC);
 	period_cycles = (unsigned long)c;
 
-	if (period_cycles < 1) {
-		period_cycles = 1;
-		duty_cycles = 1;
-	} else {
-		c = pc->clk_rate;
-		c = c * duty_ns;
-		do_div(c, NSEC_PER_SEC);
-		duty_cycles = (unsigned long)c;
-	}
+	c = pc->clk_rate;
+	c = c * duty_ns;
+	do_div(c, NSEC_PER_SEC);
+	duty_cycles = (unsigned long)c;
 
 	/*
 	 * Period values should be same for multiple PWM channels as IP uses
@@ -271,46 +230,67 @@ static int ehrpwm_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
 		return -EINVAL;
 	}
 
-	pm_runtime_get_sync(pwmchip_parent(chip));
-
-	/* Update clock prescaler values */
-	ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval);
-
 	/* Update period & duty cycle with presacler division */
 	period_cycles = period_cycles / ps_divval;
 	duty_cycles = duty_cycles / ps_divval;
 
-	/* Configure shadow loading on Period register */
-	ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW);
+	if (period_cycles < 1)
+		period_cycles = 1;
 
-	ehrpwm_write(pc->mmio_base, TBPRD, period_cycles);
+	pm_runtime_get_sync(pwmchip_parent(chip));
 
-	/* Configure ehrpwm counter for up-count mode */
-	ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK,
-		      TBCTL_CTRMODE_UP);
+	/* Update clock prescaler values */
+	ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CLKDIV_MASK, tb_divval);
 
-	if (pwm->hwpwm == 1)
+	if (pwm->hwpwm == 1) {
 		/* Channel 1 configured with compare B register */
 		cmp_reg = CMPB;
-	else
+
+		aqctl_reg = AQCTLB;
+		aqctl_mask = AQCTL_CBU_MASK;
+
+		if (polarity == PWM_POLARITY_INVERSED)
+			aqctl_val = AQCTL_CHANB_POLINVERSED;
+		else
+			aqctl_val = AQCTL_CHANB_POLNORMAL;
+
+		/* if duty_cycle is big, don't toggle on CBU */
+		if (duty_cycles > period_cycles)
+			aqctl_val &= ~AQCTL_CBU_MASK;
+
+	} else {
 		/* Channel 0 configured with compare A register */
 		cmp_reg = CMPA;
 
-	ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles);
+		aqctl_reg = AQCTLA;
+		aqctl_mask = AQCTL_CAU_MASK;
 
-	pm_runtime_put_sync(pwmchip_parent(chip));
+		if (polarity == PWM_POLARITY_INVERSED)
+			aqctl_val = AQCTL_CHANA_POLINVERSED;
+		else
+			aqctl_val = AQCTL_CHANA_POLNORMAL;
 
-	return 0;
-}
+		/* if duty_cycle is big, don't toggle on CAU */
+		if (duty_cycles > period_cycles)
+			aqctl_val &= ~AQCTL_CAU_MASK;
+	}
 
-static int ehrpwm_pwm_set_polarity(struct pwm_chip *chip,
-				   struct pwm_device *pwm,
-				   enum pwm_polarity polarity)
-{
-	struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
+	aqctl_mask |= AQCTL_PRD_MASK | AQCTL_ZRO_MASK;
+	ehrpwm_modify(pc->mmio_base, aqctl_reg, aqctl_mask, aqctl_val);
+
+	/* Configure shadow loading on Period register */
+	ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_PRDLD_MASK, TBCTL_PRDLD_SHDW);
+
+	ehrpwm_write(pc->mmio_base, TBPRD, period_cycles - 1);
+
+	/* Configure ehrpwm counter for up-count mode */
+	ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_CTRMODE_MASK,
+		      TBCTL_CTRMODE_UP);
+
+	if (!(duty_cycles > period_cycles))
+		ehrpwm_write(pc->mmio_base, cmp_reg, duty_cycles);
 
-	/* Configuration of polarity in hardware delayed, do at enable */
-	pc->polarity[pwm->hwpwm] = polarity;
+	pm_runtime_put_sync(pwmchip_parent(chip));
 
 	return 0;
 }
@@ -339,9 +319,6 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
 
 	ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val);
 
-	/* Channels polarity can be configured from action qualifier module */
-	configure_polarity(pc, pwm->hwpwm);
-
 	/* Enable TBCLK */
 	ret = clk_enable(pc->tbclk);
 	if (ret) {
@@ -406,10 +383,6 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
 			ehrpwm_pwm_disable(chip, pwm);
 			enabled = false;
 		}
-
-		err = ehrpwm_pwm_set_polarity(chip, pwm, state->polarity);
-		if (err)
-			return err;
 	}
 
 	if (!state->enabled) {
@@ -418,7 +391,7 @@ static int ehrpwm_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
 		return 0;
 	}
 
-	err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period);
+	err = ehrpwm_pwm_config(chip, pwm, state->duty_cycle, state->period, state->polarity);
 	if (err)
 		return err;
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:37:28 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368168; cv=none; b=aq0vRfmpjwfti8Qp8rz1a4FST1Pfcknhx+U0yfoWf8bVOAfLFR1Te5zWekZmEgHek+kONlEu/RX6LADoXWHa3ITBcBCc/B9AVkivXNsdFsb5LzPKut7chfUyeLccaBYmeKwPft7PlYjLnON2kSo9mSUaAytr/88m8WbZCp8HUUk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368168; c=relaxed/simple;
	bh=cG14cJU0w5WxkUHID86YC6DJncRF23GPpDtB3WwU3oE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=i5u65cQ1BSVXMCDi058aw831ihvMwWDXu6pQ8I230gCt54mPXdmSmDvT2zt2D0N5Ua8hYb9vwaz8DyNqKgMtdfsjFh7su/eyuv5eRednatNqWKib5+VH0IQP/8xZt/JnZLhLGiIOeajzb7bQEHZhgq9Qz5ut+PdZyq5qflUA5Uo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WHlbY1Wj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <[email-masked]>,
	=?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 066/262] pwm: tiehrpwm: Make code comment in .free() more useful
Date: Mon, 13 Oct 2025 16:43:28 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Uwe Kleine-König <[email-masked]>

[ Upstream commit 878dbfc12cc52b17d79d205560c0fafcf5332b13 ]

Instead of explaining trivia to everyone who can read C describe the
higher-level effect of setting pc->period_cycles[pwm->hwpwm] to zero.

Fixes: 01b2d4536f02 ("pwm: pwm-tiehrpwm: Fix conflicting channel period setting")
Signed-off-by: Uwe Kleine-König <[email-masked]>
Link: https://lore.kernel.org/r/4c38dd1[email-masked]
Signed-off-by: Uwe Kleine-König <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pwm/pwm-tiehrpwm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index 5e674a7bbf3be..a94b1e387b924 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -391,7 +391,7 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
 {
 	struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
 
-	/* set period value to zero on free */
+	/* Don't let a pwm without consumer block requests to the other channel */
 	pc->period_cycles[pwm->hwpwm] = 0;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:23:16 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368165; cv=none; b=ZAzHCEV7TxYT05oZOhyPqhkPqujXzIAjvtjmyVbMh2pf1jyBav7M01U742MPFgTS8pt7m8dMVhLQVLtOpa8rGXVhGWzKmauUivw1DR8TUAd3Gx75zTPBabqW8SaaJqg2gQ7PLt33+ShvZuEweQvOeWGjGUnCaXwm5lWrqFQTqdk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368165; c=relaxed/simple;
	bh=gUhGGwCoCjOeDyU9iFJGGIt+1sBSrtkrNKAN0xuu4DE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=pZcROCJYxq6Cnp5attRicaZI3Norfig60SONMKYBhTIYBmIjwA7QGuqYigo/qRUxTVD7xBJS978qMmtbfjRicU4aBAWAv9Pj3eZ12GWrmtoPIpbJjFiZ2uAn2RIP+DuvmAV/gs+Mh/CLbhbroJDrOIF0nNZJ/ivPTGI+PfhmN3Y=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=UuyfiXqn; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <[email-masked]>,
	=?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 065/262] pwm: tiehrpwm: Dont drop runtime PM reference in .free()
Date: Mon, 13 Oct 2025 16:43:27 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Uwe Kleine-König <[email-masked]>

[ Upstream commit 21a5e91fda50fc662ce1a12bd0aae9d103455b43 ]

The pwm driver calls pm_runtime_get_sync() when the hardware becomes
enabled and pm_runtime_put_sync() when it becomes disabled. The PWM's
state is kept when a consumer goes away, so the call to
pm_runtime_put_sync() in the .free() callback is unbalanced resulting in
a non-functional device and a reference underlow for the second consumer.

The easiest fix for that issue is to just not drop the runtime PM
reference in .free(), so do that.

Fixes: 19891b20e7c2 ("pwm: pwm-tiehrpwm: PWM driver support for EHRPWM")
Signed-off-by: Uwe Kleine-König <[email-masked]>
Link: https://lore.kernel.org/r/bbb089c[email-masked]
Signed-off-by: Uwe Kleine-König <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pwm/pwm-tiehrpwm.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
index 0125e73b98dfb..5e674a7bbf3be 100644
--- a/drivers/pwm/pwm-tiehrpwm.c
+++ b/drivers/pwm/pwm-tiehrpwm.c
@@ -391,11 +391,6 @@ static void ehrpwm_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)
 {
 	struct ehrpwm_pwm_chip *pc = to_ehrpwm_pwm_chip(chip);
 
-	if (pwm_is_enabled(pwm)) {
-		dev_warn(pwmchip_parent(chip), "Removing PWM device without disabling\n");
-		pm_runtime_put_sync(pwmchip_parent(chip));
-	}
-
 	/* set period value to zero on free */
 	pc->period_cycles[pwm->hwpwm] = 0;
 }
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:27:16 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368162; cv=none; b=Gt+M29XZQD5pAhqPGRuxj9YuZ1j+pkY6LNexsKOQNhESX82mMnjdVKAxAI0TGUHl4t+q8Wlr5Dyi6zKjtMuMiMPgcMuK4xcrRbz9Cjvwbo50voORJ1v1LedHftkKMxGcM350X398PTTJrh4gJCBrKELotsLgU9qaSNliaFvNB2s=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368162; c=relaxed/simple;
	bh=1su5Nfhgaxt+EEE0HHj2sn2J8H2bTvnXGA2Ht/tK9j4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=qCQltS2Cny6lF06ZinDx18fCjKc6qBNiCWEzO9dKdjUrTaNwy/GjBM5gJGe33J1PHYPAeRMwB5JV3SpTM8AeFyrd77wefIW5Wyj430YbGWrcHNKYhlJs3BpJFeg8CFoq35oRcFHFMDjjHzCZS49h23EZk0KDn/WdCdiENYjjZhc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=UKYylAZr; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	AngeloGioacchino Del Regno <[email-masked]>,
	Fei Shao <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 064/262] arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
Date: Mon, 13 Oct 2025 16:43:26 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: AngeloGioacchino Del Regno <[email-masked]>

[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ]

This devicetree contained only the SoC compatible but lacked the
machine specific one: add a "mediatek,mt8516-pumpkin" compatible
to the list to fix dtbs_check warnings.

Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts")
Signed-off-by: AngeloGioacchino Del Regno <[email-masked]>
Reviewed-by: Fei Shao <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
index cce642c538128..3d3db33a64dc6 100644
--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
@@ -11,7 +11,7 @@
 
 / {
 	model = "Pumpkin MT8516";
-	compatible = "mediatek,mt8516";
+	compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516";
 
 	memory@40000000 {
 		device_type = "memory";
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:43:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368159; cv=none; b=pMjj29Hpc9T7j8yp4JoBB7rA+7l/9nol5ZWqfMAVrS/rnJyfIlWk2DrMMkYsqweDXW+VBPPCPSZJQWUJjMqdN5/0I4vi9Hkho3GqUFpEfaDJqvxg0WC8Vrjq8R2XdR/zppRdVVuHqh67wsghYZuHjWoDHpkIv8z9mgRHcxxWwjg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368159; c=relaxed/simple;
	bh=UnqK5brO30YKIhwtYxoijZ3VRb0bGciiMHlnXBV1oyY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bMHOmvWm4uV1QzUKR9NKVY1UiMuPNGs9DKKxjacb8B1PXK085U8VH/4LTjixMnAtG2visRBBTRhUVwXLPliLkR8mxMKkzPymE5MTLC3jR+e4aPnkQVfwQtW2kZh81oTj4EWAO+4Jmpr2OxeV39UNmyMPDh+on+4taCwmWGUSWds=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=NEMZ/pZf; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	AngeloGioacchino Del Regno <[email-masked]>,
	Fei Shao <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 063/262] arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes
Date: Mon, 13 Oct 2025 16:43:25 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: AngeloGioacchino Del Regno <[email-masked]>

[ Upstream commit 09a1e9c973973aff26e66a5673c19442d91b9e3d ]

All of the MT6360 regulator nodes were wrong and would not probe
because the regulator names are supposed to be lower case, but
they are upper case in this devicetree.

Change all nodes to be lower case to get working regulators.

Fixes: 94aaf79a6af5 ("arm64: dts: mediatek: add Kontron 3.5"-SBC-i1200")
Signed-off-by: AngeloGioacchino Del Regno <[email-masked]>
Reviewed-by: Fei Shao <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../mediatek/mt8395-kontron-3-5-sbc-i1200.dts    | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
index e2e75b8ff9188..9ab4fee769e40 100644
--- a/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts
@@ -351,7 +351,7 @@ regulator {
 			LDO_VIN2-supply = <&vsys>;
 			LDO_VIN3-supply = <&vsys>;
 
-			mt6360_buck1: BUCK1 {
+			mt6360_buck1: buck1 {
 				regulator-name = "emi_vdd2";
 				regulator-min-microvolt = <600000>;
 				regulator-max-microvolt = <1800000>;
@@ -361,7 +361,7 @@ MT6360_OPMODE_LP
 				regulator-always-on;
 			};
 
-			mt6360_buck2: BUCK2 {
+			mt6360_buck2: buck2 {
 				regulator-name = "emi_vddq";
 				regulator-min-microvolt = <300000>;
 				regulator-max-microvolt = <1300000>;
@@ -371,7 +371,7 @@ MT6360_OPMODE_LP
 				regulator-always-on;
 			};
 
-			mt6360_ldo1: LDO1 {
+			mt6360_ldo1: ldo1 {
 				regulator-name = "mt6360_ldo1"; /* Test point */
 				regulator-min-microvolt = <1200000>;
 				regulator-max-microvolt = <3600000>;
@@ -379,7 +379,7 @@ mt6360_ldo1: LDO1 {
 							   MT6360_OPMODE_LP>;
 			};
 
-			mt6360_ldo2: LDO2 {
+			mt6360_ldo2: ldo2 {
 				regulator-name = "panel1_p1v8";
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <1800000>;
@@ -387,7 +387,7 @@ mt6360_ldo2: LDO2 {
 							   MT6360_OPMODE_LP>;
 			};
 
-			mt6360_ldo3: LDO3 {
+			mt6360_ldo3: ldo3 {
 				regulator-name = "vmc_pmu";
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <3300000>;
@@ -395,7 +395,7 @@ mt6360_ldo3: LDO3 {
 							   MT6360_OPMODE_LP>;
 			};
 
-			mt6360_ldo5: LDO5 {
+			mt6360_ldo5: ldo5 {
 				regulator-name = "vmch_pmu";
 				regulator-min-microvolt = <3300000>;
 				regulator-max-microvolt = <3300000>;
@@ -403,7 +403,7 @@ mt6360_ldo5: LDO5 {
 							   MT6360_OPMODE_LP>;
 			};
 
-			mt6360_ldo6: LDO6 {
+			mt6360_ldo6: ldo6 {
 				regulator-name = "mt6360_ldo6"; /* Test point */
 				regulator-min-microvolt = <500000>;
 				regulator-max-microvolt = <2100000>;
@@ -411,7 +411,7 @@ mt6360_ldo6: LDO6 {
 							   MT6360_OPMODE_LP>;
 			};
 
-			mt6360_ldo7: LDO7 {
+			mt6360_ldo7: ldo7 {
 				regulator-name = "emi_vmddr_en";
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <1800000>;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:46:41 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368156; cv=none; b=QZq7zXh7Y4N0dgtoO9V93zh6xZ2XW99lWsgbzs488G/lTP8h0cAxZKj4QiZL7YFs/QAQ9GALOCXwrQe80stV3wcp+yuvtzcZodu5GeQBD/wszSWmyMGRp4V8SP3bsAGrQDphtcErcBMHXSyeb8jIG3L4u5GZyz39qMW3yuXpAps=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368156; c=relaxed/simple;
	bh=smb+RFPi/FeScm3PVew3d/HLSUxLkE/lEJ1PyfnakK8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=YcDkXblZED9pW5MWglMtuHw15KpF/G48gBIKN+F9tSMlF1BbN/BiB9Nba8LPZTeldYhqiuOIEZ1uD0RGwm2CA8fT1tT61kS1X2EihO5dmY7kYQlZzYlDXUQ0iaseYQFyXZa0fystzjzW9KyuBfqcPU9rXYQ526taLNVEVPmBU94=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aURPHdti; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	AngeloGioacchino Del Regno <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 062/262] arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value
Date: Mon, 13 Oct 2025 16:43:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: AngeloGioacchino Del Regno <[email-masked]>

[ Upstream commit 236681fb64102f25ed11df55999e6985c1bc2f7d ]

Change the latch-ck value from 0x14 to 4: as only bits [0-3] are
actually used, the final value that gets written to the register
field for DAT_LATCH_CK_SEL is just 0x4.

This also fixes dtbs_check warnings.

Fixes: 5a65dcccf483 ("arm64: dts: mediatek: mt6795-xperia-m5: Add eMMC, MicroSD slot, SDIO")
Signed-off-by: AngeloGioacchino Del Regno <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
index 91de920c22457..03cc48321a3f4 100644
--- a/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
+++ b/arch/arm64/boot/dts/mediatek/mt6795-sony-xperia-m5.dts
@@ -212,7 +212,7 @@ proximity@48 {
 
 &mmc0 {
 	/* eMMC controller */
-	mediatek,latch-ck = <0x14>; /* hs400 */
+	mediatek,latch-ck = <4>; /* hs400 */
 	mediatek,hs200-cmd-int-delay = <1>;
 	mediatek,hs400-cmd-int-delay = <1>;
 	mediatek,hs400-ds-dly3 = <0x1a>;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:23:11 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368153; cv=none; b=AYEeslYhiAvfG3iLSTIYTeMbgNHFFGLycbqWEM8Q2DXmCLofL1pPngC8jdPurO9CgfuEBelldIZQQK1YFX14zQWVl9fBPf5nx+kwk/2QH/Vh1zpR3/Y8xPwF3fyxum5HkMcsRNoVebxuRiDbs4/v1wh5Fz8v3np6dCVRXPbyQwE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368153; c=relaxed/simple;
	bh=yLHX+tCEAkzMlUx6ZnXWpRIuxACtz0XSb1zqMiYflTo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Q6iiwNq2kLhT3bFuTkUXhmkMOzCKXEJP2j3QueFH/4QfuG0A15CnbnZmV99hDwbq+Gy5pF/UapxqRLx35jKJZcA8EErCeFfCQs7y7ABvVpDRIF320etV5mg1b99CNC0uUVOQc7/uDS8IKBpC8GtifaynthtboZRSVMVCDdFMi9M=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=fv5R8t+e; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Avri Altman <[email-masked]>,
	Jens Wiklander <[email-masked]>,
	Bean Huo <[email-masked]>,
	Ulf Hansson <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 061/262] mmc: core: Fix variable shadowing in mmc_route_rpmb_frames()
Date: Mon, 13 Oct 2025 16:43:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bean Huo <[email-masked]>

[ Upstream commit 072755cca7e743c28a273fcb69b0e826109473d7 ]

Rename the inner 'frm' variable to 'resp_frm' in the write path of
mmc_route_rpmb_frames() to avoid shadowing the outer 'frm' variable.

The function declares 'frm' at function scope pointing to the request
frame, but then redeclares another 'frm' variable inside the write
block pointing to the response frame. This shadowing makes the code
confusing and error-prone.

Using 'resp_frm' for the response frame makes the distinction clear
and improves code readability.

Fixes: 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem")
Reviewed-by: Avri Altman <[email-masked]>
Reviewed-by: Jens Wiklander <[email-masked]>
Signed-off-by: Bean Huo <[email-masked]>
Signed-off-by: Ulf Hansson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/mmc/core/block.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 1d08009f2bd83..08b8276e1da93 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2876,15 +2876,15 @@ static int mmc_route_rpmb_frames(struct device *dev, u8 *req,
 		return -ENOMEM;
 
 	if (write) {
-		struct rpmb_frame *frm = (struct rpmb_frame *)resp;
+		struct rpmb_frame *resp_frm = (struct rpmb_frame *)resp;
 
 		/* Send write request frame(s) */
 		set_idata(idata[0], MMC_WRITE_MULTIPLE_BLOCK,
 			  1 | MMC_CMD23_ARG_REL_WR, req, req_len);
 
 		/* Send result request frame */
-		memset(frm, 0, sizeof(*frm));
-		frm->req_resp = cpu_to_be16(RPMB_RESULT_READ);
+		memset(resp_frm, 0, sizeof(*resp_frm));
+		resp_frm->req_resp = cpu_to_be16(RPMB_RESULT_READ);
 		set_idata(idata[1], MMC_WRITE_MULTIPLE_BLOCK, 1, resp,
 			  resp_len);
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:30:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368147; cv=none; b=N9KoPJqOtyHuqVzDGNUWwd5T426zbGMj4u4yk9tk0d3yjgz2PZ8Cc+VGSR4ZtG0bbi3MEti8MlEVIZheaY5Z9pGb94G8PzaoqAXrOEs47WL4iuLfsQz1wMc5b7nkPQIZMgTl23Z5/azMA+ZJ6ZDoE+pJDPV0U53MLSIzz9bEhSk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368147; c=relaxed/simple;
	bh=NVYmvdxbTY/acpC62Z9lQDPv0WRXWupIM6/nwmJUew4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=INlOMQKso7yqyM0BsDx8oxpMpp/mlW3jRm7awkSUcuRaeX6sg2zhiym+M0l9SmCsjGscUBJSp06ttJMoKh7NaXwkamQdj5XiloYiUZ+x0S4oRq6KxVLBemDNlV6JqGKddNJSPVg8TreRYpNV/xO8dfKING3A9liyyaQEHjb/LJY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=I9iknPrw; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	AngeloGioacchino Del Regno <[email-masked]>,
	Fei Shao <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 060/262] arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names
Date: Mon, 13 Oct 2025 16:43:22 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: AngeloGioacchino Del Regno <[email-masked]>

[ Upstream commit 98967109c9c0e2de4140827628c63f96314099ab ]

The node names for "pmic", "regulators", "rtc", and "keys" are
dictated by the PMIC MFD binding: change those to adhere to it.

Fixes: aef783f3e0ca ("arm64: dts: mediatek: Add MT6331 PMIC devicetree")
Signed-off-by: AngeloGioacchino Del Regno <[email-masked]>
Reviewed-by: Fei Shao <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/mediatek/mt6331.dtsi | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt6331.dtsi b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
index d89858c73ab1b..243afbffa21fd 100644
--- a/arch/arm64/boot/dts/mediatek/mt6331.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt6331.dtsi
@@ -6,12 +6,12 @@
 #include <dt-bindings/input/input.h>
 
 &pwrap {
-	pmic: mt6331 {
+	pmic: pmic {
 		compatible = "mediatek,mt6331";
 		interrupt-controller;
 		#interrupt-cells = <2>;
 
-		mt6331regulator: mt6331regulator {
+		mt6331regulator: regulators {
 			compatible = "mediatek,mt6331-regulator";
 
 			mt6331_vdvfs11_reg: buck-vdvfs11 {
@@ -258,7 +258,7 @@ mt6331_vrtc_reg: ldo-vrtc {
 			};
 
 			mt6331_vdig18_reg: ldo-vdig18 {
-				regulator-name = "dvdd18_dig";
+				regulator-name = "vdig18";
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <1800000>;
 				regulator-ramp-delay = <0>;
@@ -266,11 +266,11 @@ mt6331_vdig18_reg: ldo-vdig18 {
 			};
 		};
 
-		mt6331rtc: mt6331rtc {
+		mt6331rtc: rtc {
 			compatible = "mediatek,mt6331-rtc";
 		};
 
-		mt6331keys: mt6331keys {
+		mt6331keys: keys {
 			compatible = "mediatek,mt6331-keys";
 			power {
 				linux,keycodes = <KEY_POWER>;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:41:55 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368144; cv=none; b=qMBn7G+qjryKejhgR2QE/rDbwPzF0FuPZ0/MtPuSlCD7c3JeIa0uesz7MFqrZ7KJflcqolPSG/1Z/5ZpevvdAWJhPsxW2d8gwY2D8CxB0o7xaxPSFSJzDwa7UEQ5F2tf7OdzHPIHav+CCyaEFysjDEZGzZb8kr9Pm5wBbDgd5P4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368144; c=relaxed/simple;
	bh=GIJ3Y/Jr/C7Jh1+dwbxIbgLg9M0rEiIXqfkOOrFeJ/Q=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=abjer6FIm2qM94zBDGG/eA/rhuZqXW6xyexzsUW1chRjdXmxUkoAv78/dYtQcNnRS0OW4ZpMlghjFJ7OB9cGh/41gtUrIt36la63pqsRXdlSpgDQasCqnXAVpOFiuM3Ym1H2S7cz3gEDsHkGlUW2J69+zkEX8KSoXEmgdhFGbAM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=N+DuOLGv; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chen-Yu Tsai <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 059/262] arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model
Date: Mon, 13 Oct 2025 16:43:21 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chen-Yu Tsai <[email-masked]>

[ Upstream commit 0370911565869384f19b35ea9e71ee7a57b48a33 ]

The touchscreen controller used with the original Krabby design is the
Elan eKTH6918, which is in the same family as eKTH6915, but supporting
a larger screen size with more sense lines.

OTOH, the touchscreen controller that actually shipped on the Tentacruel
devices is the Elan eKTH6A12NAY. A compatible string was added for it
specifically because it has different power sequencing timings.

Fix up the touchscreen nodes for both these. This also includes adding
a previously missing reset line. Also add "no-reset-on-power-off" since
the power is always on, and putting it in reset would consume more
power.

Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool")
Signed-off-by: Chen-Yu Tsai <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi   | 8 ++++----
 .../dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts  | 4 ++++
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
index 7c971198fa956..72a2a2bff0a93 100644
--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-krabby.dtsi
@@ -71,14 +71,14 @@ &i2c1 {
 	i2c-scl-internal-delay-ns = <10000>;
 
 	touchscreen: touchscreen@10 {
-		compatible = "hid-over-i2c";
+		compatible = "elan,ekth6915";
 		reg = <0x10>;
 		interrupts-extended = <&pio 12 IRQ_TYPE_LEVEL_LOW>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&touchscreen_pins>;
-		post-power-on-delay-ms = <10>;
-		hid-descr-addr = <0x0001>;
-		vdd-supply = <&pp3300_s3>;
+		reset-gpios = <&pio 60 GPIO_ACTIVE_LOW>;
+		vcc33-supply = <&pp3300_s3>;
+		no-reset-on-power-off;
 	};
 };
 
diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
index 26d3451a5e47c..24d9ede63eaa2 100644
--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola-tentacruel-sku262144.dts
@@ -42,3 +42,7 @@ MATRIX_KEY(0x00, 0x04, KEY_VOLUMEUP)
 		CROS_STD_MAIN_KEYMAP
 	>;
 };
+
+&touchscreen {
+	compatible = "elan,ekth6a12nay";
+};
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:41:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368141; cv=none; b=fesY7kqjI+hWD61ZMtMlXJfqR3h8Dvqblop29J7QcFmmQSwVnZZy1xafbb9fjfaiZ/WY4Cs8J+Hh1DRteLJ0agxrN5vTb3/+CBM3igX9h8vmtfoNi89IB+DQSatfhr9p1qE9PzlwOb6oJW81Y1bR+f0vwSTEkje7D7uBFIVe9Jk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368141; c=relaxed/simple;
	bh=YeD5iW/bySKObCl73uQbWdtVZa/+9nyxrWBHsS8OdlQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=GxE+Iq33D8t8RXEkfHz5uFS2vW3Gza1krvKjmowRr3KsV/wcdsLw/WMfQYWBVw6bDTYVeWiARzYLuMIpGl1NCGgmIVP5R2tjqAQqFJrYJ0X/pzSYsgIdOXKysnyO5lqWpl8t6tHFaLA1jqjZUYeCGHBQw8HKcDV7zE32x7iOpG0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=VL2vNqFl; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Johan Hovold <[email-masked]>,
	Konrad Dybcio <[email-masked]>,
	"Rafael J. Wysocki" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 058/262] cpuidle: qcom-spm: fix device and OF node leaks at probe
Date: Mon, 13 Oct 2025 16:43:20 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email-masked]>

[ Upstream commit cdc06f912670c8c199d5fa9e78b64b7ed8e871d0 ]

Make sure to drop the reference to the saw device taken by
of_find_device_by_node() after retrieving its driver data during
probe().

Also drop the reference to the CPU node sooner to avoid leaking it in
case there is no saw node or device.

Fixes: 60f3692b5f0b ("cpuidle: qcom_spm: Detach state machine from main SPM handling")
Signed-off-by: Johan Hovold <[email-masked]>
Reviewed-by: Konrad Dybcio <[email-masked]>
Signed-off-by: Rafael J. Wysocki <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/cpuidle/cpuidle-qcom-spm.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/cpuidle/cpuidle-qcom-spm.c b/drivers/cpuidle/cpuidle-qcom-spm.c
index 1fc9968eae199..b6b06a510fd86 100644
--- a/drivers/cpuidle/cpuidle-qcom-spm.c
+++ b/drivers/cpuidle/cpuidle-qcom-spm.c
@@ -96,20 +96,23 @@ static int spm_cpuidle_register(struct device *cpuidle_dev, int cpu)
 		return -ENODEV;
 
 	saw_node = of_parse_phandle(cpu_node, "qcom,saw", 0);
+	of_node_put(cpu_node);
 	if (!saw_node)
 		return -ENODEV;
 
 	pdev = of_find_device_by_node(saw_node);
 	of_node_put(saw_node);
-	of_node_put(cpu_node);
 	if (!pdev)
 		return -ENODEV;
 
 	data = devm_kzalloc(cpuidle_dev, sizeof(*data), GFP_KERNEL);
-	if (!data)
+	if (!data) {
+		put_device(&pdev->dev);
 		return -ENOMEM;
+	}
 
 	data->spm = dev_get_drvdata(&pdev->dev);
+	put_device(&pdev->dev);
 	if (!data->spm)
 		return -EINVAL;
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:41:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368136; cv=none; b=M+HWb/zf6v3LZlBuKLZdJsBTSP6djAH11EH8uLPWExnOYHCR8cLJ9S3gWZXnpZFiXpsESyvfPsXRRLogAgE+II56jtTV194lPnTvSlrNP0pkV1LYzPz5rawaf6qTYo3ggeKgeTGfKCEBIhtQ575FWbY2K4tQerKVEOrCx+a4RqI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368136; c=relaxed/simple;
	bh=EsFeKI4TYwHJ39eL+IVgW4cwCflY4Vu6C3ErGuD6VVE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=P1MkQpbSH8tc8gZBGJo0OOlKdkgg6nBfO2ecA2MoQZ9G1OuTBo836hxOfkdKFzD4jYFKSJcdwZyr3OT9Zee2qPObsiZr1dfErVQsx66lwBya3DG17frw73etallGQG1jMq/GZh9RLQCSZdbZeh3UPMDD3BDTlvo6RAUknpx/wJo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XKSKSQGm; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Roger Lu <[email-masked]>,
	Johan Hovold <[email-masked]>,
	AngeloGioacchino Del Regno <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 056/262] soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure
Date: Mon, 13 Oct 2025 16:43:18 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email-masked]>

[ Upstream commit 6ab4f79ea92324f7f2eb22692054a34bbba7cf35 ]

Make sure to drop the references taken by of_find_device_by_node() when
looking up the thermal sensor and opp devices during probe on probe
failure (e.g. probe deferral) and on driver unbind.

Fixes: 681a02e95000 ("soc: mediatek: SVS: introduce MTK SVS engine")
Cc: Roger Lu <[email-masked]>
Signed-off-by: Johan Hovold <[email-masked]>
Reviewed-by: AngeloGioacchino Del Regno <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/soc/mediatek/mtk-svs.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/soc/mediatek/mtk-svs.c b/drivers/soc/mediatek/mtk-svs.c
index 9a91298c12539..cf9f5e6af6472 100644
--- a/drivers/soc/mediatek/mtk-svs.c
+++ b/drivers/soc/mediatek/mtk-svs.c
@@ -2167,6 +2167,13 @@ static struct device *svs_add_device_link(struct svs_platform *svsp,
 	return dev;
 }
 
+static void svs_put_device(void *_dev)
+{
+	struct device *dev = _dev;
+
+	put_device(dev);
+}
+
 static int svs_mt8192_platform_probe(struct svs_platform *svsp)
 {
 	struct device *dev;
@@ -2218,11 +2225,13 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
 {
 	struct device *dev;
 	u32 idx;
+	int ret;
 
 	dev = svs_add_device_link(svsp, "thermal-sensor");
 	if (IS_ERR(dev))
 		return dev_err_probe(svsp->dev, PTR_ERR(dev),
 				     "failed to get thermal device\n");
+	put_device(dev);
 
 	for (idx = 0; idx < svsp->bank_max; idx++) {
 		struct svs_bank *svsb = &svsp->banks[idx];
@@ -2232,6 +2241,7 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
 		case SVSB_SWID_CPU_LITTLE:
 		case SVSB_SWID_CPU_BIG:
 			svsb->opp_dev = get_cpu_device(bdata->cpu_id);
+			get_device(svsb->opp_dev);
 			break;
 		case SVSB_SWID_CCI:
 			svsb->opp_dev = svs_add_device_link(svsp, "cci");
@@ -2248,6 +2258,11 @@ static int svs_mt8183_platform_probe(struct svs_platform *svsp)
 			return dev_err_probe(svsp->dev, PTR_ERR(svsb->opp_dev),
 					     "failed to get OPP device for bank %d\n",
 					     idx);
+
+		ret = devm_add_action_or_reset(svsp->dev, svs_put_device,
+					       svsb->opp_dev);
+		if (ret)
+			return ret;
 	}
 
 	return 0;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:23:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368133; cv=none; b=K4kGwAQp2AVQg+8mCBVq8Y7LDsFDIzDEyQnieykttGP0IpztLJks071Zpadc7O9Dp+XEZMBp7xhJnlt84VbqEiYHT+ilKGZhXJLC3cSwAno6mtSYHixyKzT5TlsUHv8eK+o9BFkTRrYBaym/maLfhT25xuNRbXS79K6d4BqYnzw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368133; c=relaxed/simple;
	bh=XcnLqL92Z40LC1u1L4BPcZS9nc8H4jm3mpm8H3OEOJM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=VnD2UWXogsikmFre8P52n2QxdrvCwnJBWJMPQsjRxaB3KZjo8nXckyxdQ9PXkJP1NjzX2UbZgM90bqTmsE6yobtHz2GhLK+QmdyZmzXOJ7Oq98k6gzu5saVOnSgIMQeTx7KW2B6QUwymDH9YDoCT/rQujOrabv+6F8Q5GDLRjww=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ha8qGzIu; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Johan Hovold <[email-masked]>,
	Neil Armstrong <[email-masked]>,
	Martin Blumenstingl <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 055/262] firmware: firmware: meson-sm: fix compile-test default
Date: Mon, 13 Oct 2025 16:43:17 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email-masked]>

[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ]

Enabling compile testing should not enable every individual driver (we
have "allyesconfig" for that).

Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module")
Signed-off-by: Johan Hovold <[email-masked]>
Reviewed-by: Neil Armstrong <[email-masked]>
Reviewed-by: Martin Blumenstingl <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Neil Armstrong <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/firmware/meson/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig
index f2fdd37566482..179f5d46d8ddf 100644
--- a/drivers/firmware/meson/Kconfig
+++ b/drivers/firmware/meson/Kconfig
@@ -5,7 +5,7 @@
 config MESON_SM
 	tristate "Amlogic Secure Monitor driver"
 	depends on ARCH_MESON || COMPILE_TEST
-	default y
+	default ARCH_MESON
 	depends on ARM64_4K_PAGES
 	help
 	  Say y here to enable the Amlogic secure monitor driver
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:35:23 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368130; cv=none; b=JB+/ug0q6PwZjQ6tpBKUCfZ5p1xOfccrQbhcLcDKSHSicfmYfKBC2q0YhSiRqQRjrjCUrJSSDR+3K9PVQBhRjjUkkDyRBgzq+tq1nqAVEX9KLZmUgJCqA2U25vXS7+u1wsrJvpbRu0pDOn67OJaounj3WrCtkGVsI6YrHTDGVF8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368130; c=relaxed/simple;
	bh=mKk5N6+3NKiQiDQjyY/REGL+N/hch1f4VktunBszK0w=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=n0ze27yF7sfl37rJplInZy/CjWktY01ewaGwrU18wR3VXokv530cf8hW3hTTjw4FlRVKUYpoZn5nluQlR7Rf7sdR1xc6NWRUuc5bh3sfu3wcTsbPgb3wHWms172OpbFabSPnlih9HIeCbnwF+Rqbh8j0NOnfCel3tD7Yk1/3Cqw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Ux0BWdGa; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Nicolas Frattaroli <[email-masked]>,
	Chanwoo Choi <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 054/262] PM / devfreq: rockchip-dfi: double count on RK3588
Date: Mon, 13 Oct 2025 16:43:16 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolas Frattaroli <[email-masked]>

[ Upstream commit f89c7fb83ae95578e355bed1a7aeea5f3ca5a067 ]

On RK3588 with LPDDR4X memory, the cycle count as returned by

  perf stat -a -e rockchip_ddr/cycles/ sleep 1

consistently reads half as much as what the actual DDR frequency is at.
For a LPDDR4X module running at 2112MHz, I get more like 1056059916
cycles per second, which is almost bang-on half what it should be. No,
I'm not mixing up megatransfers and megahertz.

Consulting the downstream driver, this appears to be because the RK3588
hardware specifically (and RK3528 as well, for future reference) needs a
multiplier of 2 to get to the correct frequency with everything but
LPDDR5.

The RK3588's actual memory bandwidth measurements in MB/s are correct
however, as confirmed with stress-ng --stream. This makes me think the
access counters are not affected in the same way. This tracks with the
vendor kernel not multiplying the access counts either.

Solve this by adding a new member to the dfi struct, which each SoC can
set to whatever they want, but defaults to 1 if left unset by the SoC
init functions. The event_get_count op can then use this multiplier if
the cycle count is requested.

The cycle multiplier is not used in rockchip_dfi_get_event because the
vendor driver doesn't use it there either, and we don't do other actual
bandwidth unit conversion stuff in there anyway.

Fixes: 481d97ba61e1 ("PM / devfreq: rockchip-dfi: add support for RK3588")
Signed-off-by: Nicolas Frattaroli <[email-masked]>
Signed-off-by: Chanwoo Choi <[email-masked]>
Link: https://lore.kernel.org/lkml/[email-masked]/
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/devfreq/event/rockchip-dfi.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/devfreq/event/rockchip-dfi.c b/drivers/devfreq/event/rockchip-dfi.c
index e2a1e4463b6f5..712df781436ce 100644
--- a/drivers/devfreq/event/rockchip-dfi.c
+++ b/drivers/devfreq/event/rockchip-dfi.c
@@ -116,6 +116,7 @@ struct rockchip_dfi {
 	int buswidth[DMC_MAX_CHANNELS];
 	int ddrmon_stride;
 	bool ddrmon_ctrl_single;
+	unsigned int count_multiplier;	/* number of data clocks per count */
 };
 
 static int rockchip_dfi_enable(struct rockchip_dfi *dfi)
@@ -435,7 +436,7 @@ static u64 rockchip_ddr_perf_event_get_count(struct perf_event *event)
 
 	switch (event->attr.config) {
 	case PERF_EVENT_CYCLES:
-		count = total.c[0].clock_cycles;
+		count = total.c[0].clock_cycles * dfi->count_multiplier;
 		break;
 	case PERF_EVENT_READ_BYTES:
 		for (i = 0; i < dfi->max_channels; i++)
@@ -656,6 +657,9 @@ static int rockchip_ddr_perf_init(struct rockchip_dfi *dfi)
 		break;
 	}
 
+	if (!dfi->count_multiplier)
+		dfi->count_multiplier = 1;
+
 	ret = perf_pmu_register(pmu, "rockchip_ddr", -1);
 	if (ret)
 		return ret;
@@ -752,6 +756,7 @@ static int rk3588_dfi_init(struct rockchip_dfi *dfi)
 	dfi->max_channels = 4;
 
 	dfi->ddrmon_stride = 0x4000;
+	dfi->count_multiplier = 2;
 
 	return 0;
 };
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:40:12 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368127; cv=none; b=m3/xZ0hULEBw5FQneaM3480NOXfVuvaIIcjEd0a2de4RPIipvlOTsx8h4pYo8Qni8Sh85TZ+KDDHhV4OhMe0ZU3/ZaKf2k18jLQaXmf1VRYodctsAOAHX+74KCwqDcf7fl1Z7D9L4sdLMWwfTY/5UxdaQC/cYDsmHVNBEb6rWjE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368127; c=relaxed/simple;
	bh=c52cp2Mq362xHgpMzwKWS5joqtAlHPq8sZ/xvOXwK24=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=RgCEBUfcok3cpQCSYxCitzteNqQzitle8NzzdXCcYGShhpS2kA+B/JSLxT702diY4M6iV5zy/U/SJ8j7wirI+PL1+wInwX5PSkhiKh4Ie1Rd3xVYIPlmEgZ+ThTmQ52Kmgx/YwLxTMrVI0oplaFoYK0Y2k9xRWd2wXd879T4p0M=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aJxKLbA0; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id E984AC4CEE7;
	Mon, 13 Oct 2025 15:08:46 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760368127;
	bh=c52cp2Mq362xHgpMzwKWS5joqtAlHPq8sZ/xvOXwK24=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=aJxKLbA0nWhBNpVz99PKT3emcCD1IRwFkbkumzSCbivaqleU6SVLi1yxySlleW2ck
	 k80O2909vWIlR3zTwU8VBB6iVWNv3fvnldKsLyuFtKt/pNrOhtEzPrMwcHRniXvlyJ
	 a/o40+blZ1pSwEREqTzpuJB7f5A6SnmFvo8zXmLk=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Eric Dumazet <[email-masked]>,
	Mike Christie <[email-masked]>,
	"Richard W.M. Jones" <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Yu Kuai <[email-masked]>,
	[email-masked],
	[email-masked],
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 053/262] nbd: restrict sockets to TCP and UDP
Date: Mon, 13 Oct 2025 16:43:15 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email-masked]>

[ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ]

Recently, syzbot started to abuse NBD with all kinds of sockets.

Commit cf1b2326b734 ("nbd: verify socket is supported during setup")
made sure the socket supported a shutdown() method.

Explicitely accept TCP and UNIX stream sockets.

Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup")
Reported-by: [email-masked]
Closes: https://lore.kernel.org/netdev/[email-masked]/T/#m081036e8747cd7e2626c1da5d78c8b9d1e55b154
Signed-off-by: Eric Dumazet <[email-masked]>
Cc: Mike Christie <[email-masked]>
Cc: Richard W.M. Jones <[email-masked]>
Cc: Jens Axboe <[email-masked]>
Cc: Yu Kuai <[email-masked]>
Cc: [email-masked]
Cc: [email-masked]
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/block/nbd.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index c705acc4d6f4b..de692eed98740 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1156,6 +1156,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd,
 	if (!sock)
 		return NULL;
 
+	if (!sk_is_tcp(sock->sk) &&
+	    !sk_is_stream_unix(sock->sk)) {
+		dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n");
+		*err = -EINVAL;
+		sockfd_put(sock);
+		return NULL;
+	}
+
 	if (sock->ops->shutdown == sock_no_shutdown) {
 		dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n");
 		*err = -EINVAL;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:29:34 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368124; cv=none; b=P/37bZ1D7nxrnOLnTtzG5HkQBDk8FtPkdAdCVzWl7suHHWaXqVSeB34BeskfPEb7PVBuU9wDLTfOdqtHcVBswWyVJ+KyXsyls5mbQDPCN0caXp0no9eMKfbiKP6eFpNwPLICRwiH4aAYcnOLzX6rUnBJeOBim22RmKZfNaCXGS4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368124; c=relaxed/simple;
	bh=paa7JaKwW3ECcFr/xLgof+WcKk50N9oB3+yY57WsB7w=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=P0NTD/6593mS7xZRB3yDAB5zJjMXj/Q9+XjWr/WmkPo4gLy8Zm/6fOTYFpoYDwwe+XHPXsYz7wFbayb3A7ObjNpPCDH7h+X8Kyotm6Itwlnr8JfBTZOFxNgs+RiE62zxSXFlfkif8vL8rkqWx3bzJXZ3tkC2/EP7kilfDXTx1aE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gc/Krv2q; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Guoqing Jiang <[email-masked]>,
	AngeloGioacchino Del Regno <[email-masked]>,
	Macpaul Lin <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 052/262] arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0
Date: Mon, 13 Oct 2025 16:43:14 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guoqing Jiang <[email-masked]>

[ Upstream commit 3374b5fb26b300809ecd6aed9f414987dd17c313 ]

When test suspend resume with 6.8 based kernel, system can't resume
and I got below error which can be also reproduced with 6.16 rc6+
kernel.

mtk-pcie-gen3 112f0000.pcie: PCIe link down, current LTSSM state: detect.quiet (0x0)
mtk-pcie-gen3 112f0000.pcie: PM: dpm_run_callback(): genpd_resume_noirq returns -110
mtk-pcie-gen3 112f0000.pcie: PM: failed to resume noirq: error -110

After investigation, looks pcie0 has the same problem as pcie1 as
decribed in commit 3d7fdd8e38aa ("arm64: dts: mediatek: mt8195:
Remove suspend-breaking reset from pcie1").

Fixes: ecc0af6a3fe6 ("arm64: dts: mt8195: Add pcie and pcie phy nodes")
Signed-off-by: Guoqing Jiang <[email-masked]>
Reviewed-by: AngeloGioacchino Del Regno <[email-masked]>
Reviewed-by: Macpaul Lin <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
index 2e138b54f5563..451aa278bef50 100644
--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
@@ -1563,9 +1563,6 @@ pcie0: pcie@112f0000 {
 
 			power-domains = <&spm MT8195_POWER_DOMAIN_PCIE_MAC_P0>;
 
-			resets = <&infracfg_ao MT8195_INFRA_RST2_PCIE_P0_SWRST>;
-			reset-names = "mac";
-
 			#interrupt-cells = <1>;
 			interrupt-map-mask = <0 0 0 7>;
 			interrupt-map = <0 0 0 1 &pcie_intc0 0>,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:26:59 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368122; cv=none; b=OFkzyqhkU7+zEwtgCa1Hb1YFSCEI3D0chmZD1Gxh6l1yvmFYeclaGdPdQ3BaEcifUVkjcy26D0DdLcNQuXFxJyzJWEDwYCpqxCo5FgWP6F+A6aEllr/enlQkohXo3HbPzigL6zqUrKL6h66frL40Aq5ZOyiUYu0TCdl2Z0PiPI4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368122; c=relaxed/simple;
	bh=6jZvPQxLp5OKhTphoNXMqvHT6Tj87R0kVPZJlUa7WVY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=spctYSIpUs4L9K/yTpjHNlsxq0VyGW5X1pamjySHrLwfCX2qsYbSHfm/m3/hmyUVaj2/P/7HWj4aipRA4FRKQ/k/bbJ/QbnZPS5VlEapx4qCcu7UI8X4/CqmY/TR2t49ZQo0w4EZDL2hOPPlhzXoRI5l0lINzD5Gw6YKG8RP0rE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=HDBIEXa9; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <[email-masked]>,
	Thomas Gleixner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 051/262] selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO
Date: Mon, 13 Oct 2025 16:43:13 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Weißschuh <[email-masked]>

[ Upstream commit 4b59a9f7628fd82b24f2148f62cf327a84d26555 ]

If AT_SYSINFO_EHDR is missing the whole test needs to be skipped.
Currently this results in the following output:

	TAP version 13
	1..16
	# AT_SYSINFO_EHDR is not present!

This output is incorrect, as "1..16" still requires the subtest lines to
be printed, which isn't done however.

Switch to the correct skipping functions, so the output now correctly
indicates that no subtests are being run:

	TAP version 13
	1..0 # SKIP AT_SYSINFO_EHDR is not present!

Fixes: 693f5ca08ca0 ("kselftest: Extend vDSO selftest")
Signed-off-by: Thomas Weißschuh <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/vDSO/vdso_test_abi.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/tools/testing/selftests/vDSO/vdso_test_abi.c b/tools/testing/selftests/vDSO/vdso_test_abi.c
index a54424e2336f4..67cbfc56e4e1b 100644
--- a/tools/testing/selftests/vDSO/vdso_test_abi.c
+++ b/tools/testing/selftests/vDSO/vdso_test_abi.c
@@ -182,12 +182,11 @@ int main(int argc, char **argv)
 	unsigned long sysinfo_ehdr = getauxval(AT_SYSINFO_EHDR);
 
 	ksft_print_header();
-	ksft_set_plan(VDSO_TEST_PLAN);
 
-	if (!sysinfo_ehdr) {
-		ksft_print_msg("AT_SYSINFO_EHDR is not present!\n");
-		return KSFT_SKIP;
-	}
+	if (!sysinfo_ehdr)
+		ksft_exit_skip("AT_SYSINFO_EHDR is not present!\n");
+
+	ksft_set_plan(VDSO_TEST_PLAN);
 
 	version = versions[VDSO_VERSION];
 	name = (const char **)&names[VDSO_NAMES];
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:26:57 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368116; cv=none; b=iqiNbGmz8uv+viOT2HkCfsWm7FuCPZXVjxtMBIocokdhQ6HrvI016maQDzsA5Omq8uCYEjdbyoSPLRRdTlbwQn4dYo0xchDdaELDOZK2Ys5Wy9Niu93RM3oUTqLseEFv8WZPoLOsjDLTrYFI7VPORQfweR3v/MmRd8fwz9RwCxg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368116; c=relaxed/simple;
	bh=kthSEHILunhuwkzBvZYigXUFaJ/DZxJTGGW3P0Z1gUY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=HPMpr5OmQuCYLAjD8kGW2O2aovXM3EUurxvRa/ze29JZMkP/r2tDjqJXt7Bq+brrK9UKZTtrERBRxZmR2sDHePc0vlNw5okcQa8NRuEJTefoAXqbn+WhLb9PJjzHurh8OxzJm2CzkMJQTB3XylovNbi2f0ITAGzMUP6ucYA7qCM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PP4j3SLs; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	kernel test robot <[email-masked]>,
	=?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <[email-masked]>,
	Thomas Gleixner <[email-masked]>,
	Christophe Leroy <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 050/262] selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper
Date: Mon, 13 Oct 2025 16:43:12 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Weißschuh <[email-masked]>

[ Upstream commit 9f15e0f9ef514b8e1a80707931f6d07362e8ebc4 ]

The _rval register variable is meant to be an output operand of the asm
statement but is instead used as input operand.
clang 20.1 notices this and triggers -Wuninitialized warnings:

tools/testing/selftests/timers/auxclock.c:154:10: error: variable '_rval' is uninitialized when used here [-Werror,-Wuninitialized]
  154 |                 return VDSO_CALL(self->vdso_clock_gettime64, 2, clockid, ts);
      |                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/testing/selftests/timers/../vDSO/vdso_call.h:59:10: note: expanded from macro 'VDSO_CALL'
   59 |                 : "r" (_rval)                                           \
      |                        ^~~~~
tools/testing/selftests/timers/auxclock.c:154:10: note: variable '_rval' is declared here
tools/testing/selftests/timers/../vDSO/vdso_call.h:47:2: note: expanded from macro 'VDSO_CALL'
   47 |         register long _rval asm ("r3");                                 \
      |         ^

It seems the list of input and output operands have been switched around.
However as the argument registers are not always initialized they can not
be marked as pure inputs as that would trigger -Wuninitialized warnings.
Adding _rval as another input and output operand does also not work as it
would collide with the existing _r3 variable.

Instead reuse _r3 for both the argument and the return value.

Fixes: 6eda706a535c ("selftests: vDSO: fix the way vDSO functions are called for powerpc")
Reported-by: kernel test robot <[email-masked]>
Signed-off-by: Thomas Weißschuh <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
Reviewed-by: Christophe Leroy <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]
Closes: https://lore.kernel.org/oe-kbuild-all/[email-masked]/
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/vDSO/vdso_call.h | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/vDSO/vdso_call.h b/tools/testing/selftests/vDSO/vdso_call.h
index bb237d771051b..e7205584cbdca 100644
--- a/tools/testing/selftests/vDSO/vdso_call.h
+++ b/tools/testing/selftests/vDSO/vdso_call.h
@@ -44,7 +44,6 @@
 	register long _r6 asm ("r6");					\
 	register long _r7 asm ("r7");					\
 	register long _r8 asm ("r8");					\
-	register long _rval asm ("r3");					\
 									\
 	LOADARGS_##nr(fn, args);					\
 									\
@@ -54,13 +53,13 @@
 		"	bns+	1f\n"					\
 		"	neg	3, 3\n"					\
 		"1:"							\
-		: "+r" (_r0), "=r" (_r3), "+r" (_r4), "+r" (_r5),	\
+		: "+r" (_r0), "+r" (_r3), "+r" (_r4), "+r" (_r5),	\
 		  "+r" (_r6), "+r" (_r7), "+r" (_r8)			\
-		: "r" (_rval)						\
+		:							\
 		: "r9", "r10", "r11", "r12", "cr0", "cr1", "cr5",	\
 		  "cr6", "cr7", "xer", "lr", "ctr", "memory"		\
 	);								\
-	_rval;								\
+	_r3;								\
 })
 
 #else
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:22:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368113; cv=none; b=sUhD6FrOiziicfDTuvr9pGSPXwUOgAkJz8SlsGiP/xIDivrKWhd1VxSH8XbBZ8mny+H4pVRAyxJQGCsrt4Z3amMF0Q0edFORDlOdzC8PKY6ijOX5TwIqUmO0k5aMyTn4X/IbStskgN37pxRs6bYvU44FhbJ4nP9hVrrG+F0+Uv4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368113; c=relaxed/simple;
	bh=fUTURClY7P35QmmCnnZlk4dKTV984s1uZOcbLfVLYwM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=JWhlJCbuOhJIUB4YRvWwS1V6edcBsPS2EPJZsoTJJr3OTApQN7PyEXsKQGaTedJQCFw18Ny5j5jBP4Qa3mH7YYDAHtFK874Vku4+xjFJenPo0FurUHxN6Z2nu5IMn7Tt5Bphzqu3py25J0bfg2Er/I+cWyqYL364Wx74FLli4Ns=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=f32VMJKh; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Genjian Zhang <[email-masked]>,
	Damien Le Moal <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 049/262] null_blk: Fix the description of the cache_size module argument
Date: Mon, 13 Oct 2025 16:43:11 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Genjian Zhang <[email-masked]>

[ Upstream commit 7942b226e6b84df13b46b76c01d3b6e07a1b349e ]

When executing modinfo null_blk, there is an error in the description
of module parameter mbps, and the output information of cache_size is
incomplete.The output of modinfo before and after applying this patch
is as follows:

Before:
[...]
parm:           cache_size:ulong
[...]
parm:           mbps:Cache size in MiB for memory-backed device.
		Default: 0 (none) (uint)
[...]

After:
[...]
parm:           cache_size:Cache size in MiB for memory-backed device.
		Default: 0 (none) (ulong)
[...]
parm:           mbps:Limit maximum bandwidth (in MiB/s).
		Default: 0 (no limit) (uint)
[...]

Fixes: 058efe000b31 ("null_blk: add module parameters for 4 options")
Signed-off-by: Genjian Zhang <[email-masked]>
Reviewed-by: Damien Le Moal <[email-masked]>
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/block/null_blk/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index f10369ad90f76..ceb7aeca5d9bd 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -223,7 +223,7 @@ MODULE_PARM_DESC(discard, "Support discard operations (requires memory-backed nu
 
 static unsigned long g_cache_size;
 module_param_named(cache_size, g_cache_size, ulong, 0444);
-MODULE_PARM_DESC(mbps, "Cache size in MiB for memory-backed device. Default: 0 (none)");
+MODULE_PARM_DESC(cache_size, "Cache size in MiB for memory-backed device. Default: 0 (none)");
 
 static bool g_fua = true;
 module_param_named(fua, g_fua, bool, 0444);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:51:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368110; cv=none; b=WdhkQscxwb5221A3e7pWn1ZzUVIAD1MpQoUyXwFYgYvVmWxkELz/Iw40xSP1GRhs8PLhWuvFNzNp3g9aipkC4Iz2ypeDWNBYzemWEggSAIRVX9lBSR+hZuhKQDmP9TUDG9fitzg9O4aIbRU7Mj1mue+kzPmG7xiIfbFHWhhNHz0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368110; c=relaxed/simple;
	bh=J9RzZ3SiqnCd9dk7bAxESHvgj//pMLT9a/P9ThOlwlE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=fU0X0pzp8C1mYmBNgIByztnwdd99iqNxarCmnCKNDtghcuRDJVjRbZPH4fC/SIfAjWEaiF6ggh/v0BEd2KfNblE7xbvWyG/qDH4aJzpSeejXss1rKUErLMjh9tvRAYfHjJwu6K/L6EwTEA66RFwm4R3VFjrwAd6pox3zmB7ioLw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hITL/EU+; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 048/262] pinctrl: renesas: Use int type to store negative error codes
Date: Mon, 13 Oct 2025 16:43:10 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 9f062fc5b0ff44550088912ab89f9da40226a826 ]

Change the 'ret' variable in sh_pfc_pinconf_group_set() from unsigned
int to int, as it needs to store either negative error codes or zero
returned by sh_pfc_pinconf_set().

No effect on runtime.

Signed-off-by: Qianfeng Rong <[email-masked]>
Fixes: d0593c363f04ccc4 ("pinctrl: sh-pfc: Propagate errors on group config")
Reviewed-by: Geert Uytterhoeven <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pinctrl/renesas/pinctrl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/renesas/pinctrl.c b/drivers/pinctrl/renesas/pinctrl.c
index 29d16c9c1bd19..3a742f74ecd1d 100644
--- a/drivers/pinctrl/renesas/pinctrl.c
+++ b/drivers/pinctrl/renesas/pinctrl.c
@@ -726,7 +726,8 @@ static int sh_pfc_pinconf_group_set(struct pinctrl_dev *pctldev, unsigned group,
 	struct sh_pfc_pinctrl *pmx = pinctrl_dev_get_drvdata(pctldev);
 	const unsigned int *pins;
 	unsigned int num_pins;
-	unsigned int i, ret;
+	unsigned int i;
+	int ret;
 
 	pins = pmx->pfc->info->groups[group].pins;
 	num_pins = pmx->pfc->info->groups[group].nr_pins;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:41:32 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368107; cv=none; b=nbs7SL1v0m+gTCWoPudoUO55rH02cdMHEm5VrtO5ulVqj/bdTLWQq0dCEANYWELJ/7JNOIWIUHLQOJA1YQ1WwCPxTaAqvfJPZ/EPQ23U9OBIUdXnFeY+rsZpHFoI3Ibc0mqhD797p5Shjc68r9+L+ni2z6ksFxGONGEnZXU1KmQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368107; c=relaxed/simple;
	bh=ahPAIgUXjdha2I3mzIGsNCEUHcKP3w0JfHcXGbveVEY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=aXE7zKBVFlpL7VHpvltEmHPg9Ky/LzaWHgOYrXIVQdda+sIo7rAgR/netS0cfI5uFi9CPn81M0NhSBQoczLLkZzVMhqe0s79qyTigNsQfvQNZMCJNpmzsNpt1YNwCWap1QFuP+1zYMVYrolGLVGG9tKf/Nj4yFDKmpM0AhxWER8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=eE3jFD2K; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Andy Yan <[email-masked]>,
	Sebastian Reichel <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 047/262] power: supply: cw2015: Fix a alignment coding style issue
Date: Mon, 13 Oct 2025 16:43:09 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andy Yan <[email-masked]>

[ Upstream commit def5612170a8c6c4c6a3ea5bd6c3cfc8de6ba4b1 ]

Fix the checkpatch warning:
CHECK: Alignment should match open parenthesis

Fixes: 0cb172a4918e ("power: supply: cw2015: Use device managed API to simplify the code")
Signed-off-by: Andy Yan <[email-masked]>
Signed-off-by: Sebastian Reichel <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/power/supply/cw2015_battery.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c
index f63c3c4104515..382dff8805c62 100644
--- a/drivers/power/supply/cw2015_battery.c
+++ b/drivers/power/supply/cw2015_battery.c
@@ -702,8 +702,7 @@ static int cw_bat_probe(struct i2c_client *client)
 	if (!cw_bat->battery_workqueue)
 		return -ENOMEM;
 
-	devm_delayed_work_autocancel(&client->dev,
-							  &cw_bat->battery_delay_work, cw_bat_work);
+	devm_delayed_work_autocancel(&client->dev, &cw_bat->battery_delay_work, cw_bat_work);
 	queue_delayed_work(cw_bat->battery_workqueue,
 			   &cw_bat->battery_delay_work, msecs_to_jiffies(10));
 	return 0;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:33:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368105; cv=none; b=EjoRJLJwJCrdATaF6MmE1cqW61cxeR4Rz4nsgN99xvjdrjucmPjnnmUQbWWXYIMGvarYgaeuxHAHCj22zBcupNdCCbKfGNyoKch/iURS/4IxyP8YZ+VseNYC1ytlD1/zjaSYmu3XLUBjfQfNER01rAF33n7nbz8iq7pmuGhYLNU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368105; c=relaxed/simple;
	bh=BxNMKKsVKCO6dvlKcYX5VafShUCxLWHthB1ff/uf5NU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=lXpU9rRky6GmZRm20+W7SyiUZbO3BK+kfc1m6vDO7vml0jlmSOIhFVmNppGjcCYIi78zqsCHkbGo74OeyxFvFl357Eb0Ktt0dtTICKbXrnZfFIKQTDYZd/aRLwxX/e83NS7KbT8IqBBIH5PwP69PSpuGLwdSja3h5DP9ZdhnLiU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=SdnODYF2; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	Chanwoo Choi <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 046/262] PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()
Date: Mon, 13 Oct 2025 16:43:08 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email-masked]>

[ Upstream commit fc33bf0e097c6834646b98a7b3da0ae5b617f0f9 ]

The drv->sram_reg pointer could be set to ERR_PTR(-EPROBE_DEFER) which
would lead to a error pointer dereference.  Use IS_ERR_OR_NULL() to check
that the pointer is valid.

Fixes: e09bd5757b52 ("PM / devfreq: mtk-cci: Handle sram regulator probe deferral")
Signed-off-by: Dan Carpenter <[email-masked]>
Signed-off-by: Chanwoo Choi <[email-masked]>
Link: https://patchwork.kernel.org/project/linux-pm/patch/[email-masked]/
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/devfreq/mtk-cci-devfreq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/devfreq/mtk-cci-devfreq.c b/drivers/devfreq/mtk-cci-devfreq.c
index 7ad5225b0381d..6e608d92f7e66 100644
--- a/drivers/devfreq/mtk-cci-devfreq.c
+++ b/drivers/devfreq/mtk-cci-devfreq.c
@@ -386,7 +386,8 @@ static int mtk_ccifreq_probe(struct platform_device *pdev)
 out_free_resources:
 	if (regulator_is_enabled(drv->proc_reg))
 		regulator_disable(drv->proc_reg);
-	if (drv->sram_reg && regulator_is_enabled(drv->sram_reg))
+	if (!IS_ERR_OR_NULL(drv->sram_reg) &&
+	    regulator_is_enabled(drv->sram_reg))
 		regulator_disable(drv->sram_reg);
 
 	return ret;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:22:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368102; cv=none; b=NAWDygMp5ztnQWjdad5N2vbTqYoWRKxLvF1zVtZ+LpA8k4fwICj1VcRkBg8F922SPL+bFIkvJerhfgL1x085zwEwM+rjiXWXDySthl5R/Tah1Q3gGNdjAilxF+ElJmLWmoHz3eDOf2WeY3lUblcMcun1ZJoQOhu4ZRz1l26FJLg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368102; c=relaxed/simple;
	bh=NiDU+KCLuQUOomwb7ORvmTJQmUXj9DEJk/iUXlZr6r8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=iFZhaC1frZsuKJsH9Qzgf0g1AhZz+S41pGEPIQCSmcIT0BJRSJ9oXmFn7PnMOoy9YP7WmisxQkffvoPVObTGXyQZYHYsL//qpy31OAGAixTBz0RDq6AMxtm08UR2vG9en9d+WWMGYBgyN+aW5kXzYAkxZRfGEesiCKSdcefabWk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=VHXlXpMZ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jihed Chaibi <[email-masked]>,
	Kevin Hilman <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 045/262] ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property
Date: Mon, 13 Oct 2025 16:43:07 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jihed Chaibi <[email-masked]>

[ Upstream commit 27322753c8b913fba05250e7b5abb1da31e6ed23 ]

The dtbs_check validation for am335x-cm-t335.dtb flags an error
for an unevaluated 'num-serializer' property in the mcasp0 node.

This property is obsolete; it is not defined in the davinci-mcasp-audio
schema and is not used by the corresponding (or any) driver.

Remove this unused property to fix the schema validation warning.

Fixes: 48ab364478e77 ("ARM: dts: cm-t335: add audio support")
Signed-off-by: Jihed Chaibi <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Kevin Hilman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts | 2 --
 1 file changed, 2 deletions(-)

diff --git a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
index 06767ea164b59..ece7f7854f6aa 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
+++ b/arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts
@@ -483,8 +483,6 @@ &mcasp1 {
 
 		op-mode = <0>;          /* MCASP_IIS_MODE */
 		tdm-slots = <2>;
-		/* 16 serializers */
-		num-serializer = <16>;
 		serial-dir = <  /* 0: INACTIVE, 1: TX, 2: RX */
 			0 0 2 1 0 0 0 0 0 0 0 0 0 0 0 0
 		>;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:26:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368099; cv=none; b=GNqi/8KUFsosbu48OAarVMLHkW/4OyE9vMNqQpWoSEWqQFi40lyoL6pxrXxPYj3wU3FKXT+Ti3rbbRIteUd4/p2gWtOE8f6DXsibdAXytLBIIwMiV+nGlfyaFMKQPh339ml1g7xOfy6pML23Wd3QxPZ6xX4M43Yj3L0Ib5pLp30=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368099; c=relaxed/simple;
	bh=CjFzEO0U3e/ZrXzCK8QgIV5UHb29Yo98RyVsELtPl7A=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=CCyIxv8hqAxg2zRs07vb8ltogFv8l3zj+/t+VEHbvnP6YdhNiQVib3wnNpT1QVx9ZXHmZPo//VowUwCDmeB81SJzDkIoNft5RqU+i6qqU38Od0/s/Bb9a0Zo4plSMOLF2EEQZv7DrEEvprNNH85BszuDzKEhrxwkSmIs4eLX0EA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=MQulLi1H; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jihed Chaibi <[email-masked]>,
	Kevin Hilman <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 044/262] ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS
Date: Mon, 13 Oct 2025 16:43:06 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jihed Chaibi <[email-masked]>

[ Upstream commit 5af5b85505bc859adb338fe5d6e4842e72cdf932 ]

The ti,keep-vref-on property, defined as a boolean flag in the Device
Tree schema, was incorrectly assigned a value (<1>) in the DTS file,
causing a validation error: "size (4) error for type flag". Remove
the value to match the schema and ensure compatibility with the driver
using device_property_read_bool(). This fixes the dtbs_check error.

Fixes: ed05637c30e6 ("ARM: dts: omap3-devkit8000: Add ADS7846 Touchscreen support")
Signed-off-by: Jihed Chaibi <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Kevin Hilman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
index a7f99ae0c1fe9..78c657429f641 100644
--- a/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
+++ b/arch/arm/boot/dts/ti/omap/omap3-devkit8000-lcd-common.dtsi
@@ -65,7 +65,7 @@ ads7846@0 {
 		ti,debounce-max = /bits/ 16 <10>;
 		ti,debounce-tol = /bits/ 16 <5>;
 		ti,debounce-rep = /bits/ 16 <1>;
-		ti,keep-vref-on = <1>;
+		ti,keep-vref-on;
 		ti,settle-delay-usec = /bits/ 16 <150>;
 
 		wakeup-source;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:22:41 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368096; cv=none; b=CLWC2b1cTbZrXI7civ1OuWDv7RqV0vsDZBAmVHtlkiiBv+w7jpb0YafRer0kNL2mVmAT3EXHxUt6/Uwd9kMY3DVlziDxlO7az6MPN9JVrSUt0EyqK9pFEKcK5tOPy+a8PaBUG/+JDZxTlPOmAKJsDvkThzkBBK/cIqx8xN/p8Ho=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368096; c=relaxed/simple;
	bh=RM+j3yzKG6tvvMNK/eLU3F5RXuFkjNlKlpi78kMhRtI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DUg/phRf/ZKT27IBagP7AUA63lm4opUH0xsLY2GincAesRtzZ6lxNWy+lCrC6N+34G4PkNEPZkT8UMfwZZdkzeoqGDXXfiipg5lVzpbT+sVEvEQbCUwbCuhghOkqfaMR5xdps1b/1163kSaI/gCS7SUift+phLdE6RnXnoY9bWc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QOHhzqbn; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jihed Chaibi <[email-masked]>,
	Kevin Hilman <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 043/262] ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax
Date: Mon, 13 Oct 2025 16:43:05 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jihed Chaibi <[email-masked]>

[ Upstream commit 9658a92fad1889ff92fa4bd668cd61052687245a ]

The ti,en-ck32k-xtal property, defined as a boolean in the Device Tree
schema, was incorrectly assigned a value (<1>) in the DTS file, causing
a validation error: "size (4) error for type flag". The driver uses
of_property_read_bool(), expecting a boolean. Remove the value to fix
the dtbs_check error.

Fixes: 262178b6b8e5 ("ARM: dts: split am335x-baltos-ir5221 into dts and dtsi files")
Signed-off-by: Jihed Chaibi <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]/
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Kevin Hilman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
index a4beb718559c4..9ee9e7a1343c4 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
+++ b/arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi
@@ -270,7 +270,7 @@ &tps {
 	vcc7-supply = <&vbat>;
 	vccio-supply = <&vbat>;
 
-	ti,en-ck32k-xtal = <1>;
+	ti,en-ck32k-xtal;
 
 	regulators {
 		vrtc_reg: regulator@0 {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:26:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368093; cv=none; b=uaPLLLyznx+ACfqFla1ahFjIWvg2WWOBsYNkc2Jpy+QzkNHWfoNQ9hntI7vqAQB3l0K7NggU1yZN2gn6O35HxpsDV76ekGPkhIe//dMPZ01SjsZP98iwud93Fdi2+1nE207GCGdjo0O7CiNCvlWmE8n+IrqE+t8KmuNTI1F6o+o=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368093; c=relaxed/simple;
	bh=8zrh3NYIh7q0KM9Ad7J82K8f+3NTPVCXERFTTr4Sl34=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=ZBa0HBBUT8JrTI8PITcjEZWFzYK4BQNi/AyQrP2oq3/nCn9+cNXnHcDwxTSgN64x3zRMrLcmJ3ttGgpIDcK8pWRonL9AXpTjwAR7n946ndTIe1y4mRlip7knmGEzv6BbisngDwVc51Fd36FpoAnn2cWVQ8pT7RPXt4KHNx4k3TU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=UOyPp33T; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <[email-masked]>,
	Thomas Gleixner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 042/262] vdso: Add struct __kernel_old_timeval forward declaration to gettime.h
Date: Mon, 13 Oct 2025 16:43:04 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Weißschuh <[email-masked]>

[ Upstream commit 437054b1bbe11be87ab0a522b8ccbae3f785c642 ]

The prototype of __vdso_gettimeofday() uses this struct.  However
gettime.h's own includes do not provide a definition for it.

Add a forward declaration, similar to other used structs.

Fixes: 42874e4eb35b ("arch: vdso: consolidate gettime prototypes")
Signed-off-by: Thomas Weißschuh <[email-masked]>
Signed-off-by: Thomas Gleixner <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 include/vdso/gettime.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/vdso/gettime.h b/include/vdso/gettime.h
index c50d152e7b3e0..9ac161866653a 100644
--- a/include/vdso/gettime.h
+++ b/include/vdso/gettime.h
@@ -5,6 +5,7 @@
 #include <linux/types.h>
 
 struct __kernel_timespec;
+struct __kernel_old_timeval;
 struct timezone;
 
 #if !defined(CONFIG_64BIT) || defined(BUILD_VDSO32_64)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:43:54 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368090; cv=none; b=OIIVqhp5pzULMPQmKqECVHwlNep0KZJ1xLWE6moeqlFw2FM5o1v/FBhxpD7QIX18okE5AujZZ6GpweJGZovC0UQ8sYCSN6JkGjHKnn5D4a7yFGZKg7w3rFTQdUh+sW2Zr/BhMgYsEAZNs6xJy21E9gsGp8uZ4CkSSkA3ZfPWsCA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368090; c=relaxed/simple;
	bh=PL/3IJ5BNNyk4Rv4W+oJKtqIC3dW0ve6eoRGuZvKl48=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=CoCe8aja3oKyjk2gm6L/uODDoFp6esf3ScqEj3P0fhbuaHf3jw4IQ/pR7eI0GBy9LjB5EXlYLdf3zVf/KN7zafGo3co4GKvHXUgdBu2m/ROXESG3QpgALk/4+VtIxJq5DHjtGG1OLqDjeAbxNXO3Zkc9xb0aUXubzN2H6Ypeu7M=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Cx9PR6zR; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	"Rafael J. Wysocki" <[email-masked]>,
	Ulf Hansson <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 041/262] PM: sleep: core: Clear power.must_resume in noirq suspend error path
Date: Mon, 13 Oct 2025 16:43:03 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email-masked]>

[ Upstream commit be82483d1b60baf6747884bd74cb7de484deaf76 ]

If system suspend is aborted in the "noirq" phase (for instance, due to
an error returned by one of the device callbacks), power.is_noirq_suspended
will not be set for some devices and device_resume_noirq() will return
early for them.  Consequently, noirq resume callbacks will not run for
them at all because the noirq suspend callbacks have not run for them
yet.

If any of them has power.must_resume set and late suspend has been
skipped for it (due to power.smart_suspend), early resume should be
skipped for it either, or its state may become inconsistent (for
instance, if the early resume assumes that it will always follow
noirq resume).

Make that happen by clearing power.must_resume in device_resume_noirq()
for devices with power.is_noirq_suspended clear that have been left in
suspend by device_suspend_late(), which will subsequently cause
device_resume_early() to leave the device in suspend and avoid
changing its state.

Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag")
Link: https://lore.kernel.org/linux-pm/[email-masked]/
Signed-off-by: Rafael J. Wysocki <[email-masked]>
Reviewed-by: Ulf Hansson <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/base/power/main.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index faf4cdec23f04..abb16a5bb7967 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -628,8 +628,20 @@ static void device_resume_noirq(struct device *dev, pm_message_t state, bool asy
 	if (dev->power.syscore || dev->power.direct_complete)
 		goto Out;
 
-	if (!dev->power.is_noirq_suspended)
+	if (!dev->power.is_noirq_suspended) {
+		/*
+		 * This means that system suspend has been aborted in the noirq
+		 * phase before invoking the noirq suspend callback for the
+		 * device, so if device_suspend_late() has left it in suspend,
+		 * device_resume_early() should leave it in suspend either in
+		 * case the early resume of it depends on the noirq resume that
+		 * has not run.
+		 */
+		if (dev_pm_skip_suspend(dev))
+			dev->power.must_resume = false;
+
 		goto Out;
+	}
 
 	if (!dpm_wait_for_superior(dev, async))
 		goto Out;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:48:26 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368185; cv=none; b=B0fdI1WkBA32s2wVXAxaOtQzyX+QBRDI/3t4awkavOnB1hktB7kEDcgc7Zq64Llarl9c9Ub9urpTss4hL9ApD5tpEeyREPltwsZ12N6NNsLfEgED0lRoxyotOQjX6iuKqDPpOXmh2Grm9TMJzKziePVsPKbfo0oh7SDhpYJfb5k=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368185; c=relaxed/simple;
	bh=E6sVjzEyPIlsgel+yw/ZpX95aE9+GntFdeJXt54CQR8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DISlxPwjSIWIK5AHSJ9in0zYR+Jl0q3ryQBVCkbp0t+OvOPaS3t0V+ZkjpgGrtttFAAqKMJS9pOBsdmHQNC07f8K2tAp9YVaiazJHr4AWqHaEYV5ZFH+g5ObZvrzfP1206WYPdTl4soC56VYhNj2/RpHNt3ClEWQPw/p/o9mmSg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=r+fm8zDM; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	John Garry <[email-masked]>,
	Bart Van Assche <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 040/262] block: use int to store blk_stack_limits() return value
Date: Mon, 13 Oct 2025 16:43:02 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]

Change the 'ret' variable in blk_stack_limits() from unsigned int to int,
as it needs to store negative value -1.

Storing the negative error codes in unsigned type, or performing equality
comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but
can be confusing.  Additionally, assigning negative error codes to unsigned
type may trigger a GCC warning when the -Wsign-conversion flag is enabled.

No effect on runtime.

Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1
Signed-off-by: Qianfeng Rong <[email-masked]>
Reviewed-by: John Garry <[email-masked]>
Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment")
Reviewed-by: Bart Van Assche <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/blk-settings.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/block/blk-settings.c b/block/blk-settings.c
index f24fffdb6c294..d72a283401c3a 100644
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -552,7 +552,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb
 int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
 		     sector_t start)
 {
-	unsigned int top, bottom, alignment, ret = 0;
+	unsigned int top, bottom, alignment;
+	int ret = 0;
 
 	t->features |= (b->features & BLK_FEAT_INHERIT_MASK);
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:27:23 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368182; cv=none; b=PmECBqtf87864nbedLAjSnWA93VHcjravHWblCh1jvzmwvjPCK1fLLvb+W8Q302x3aWgeKPnRD3zvJGkqyK5cuCn2kJJqVfHikT0jaO0yauLIBDlqxkEpzTsce+zu1ez0Rq8vQmtPVaTxT+8gNnoVw+3W4ImB7mVzA1INfdOlhg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368182; c=relaxed/simple;
	bh=8WZzddaQ3pXgYKWv0Vw8SJ1++oReSi3+jW7W4wtLmc0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pi8Ny6a6vHso/fyRk6XmiVLa88EQyNzL9HrPw4WvCW8/ctqa8gwbUBpUfzpCzHRPBrGBgw5WPT6l4DBVzOodhLF9D5wktc6vwGb1QeMSKZDOmE+zPu30lHDVtGiyyWl/uKceeT08KaUKNoDR/a6vL6iMI/TND/Mz6/GpGXt/bBs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QYpJEhyY; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Andrei Lalaev <[email-masked]>,
	Lee Jones <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 039/262] leds: leds-lp55xx: Use correct address for memory programming
Date: Mon, 13 Oct 2025 16:43:01 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: ti.com]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrei Lalaev <[email-masked]>

[ Upstream commit d6058316d16ee0d1861c0550051b2492efb54b79 ]

Memory programming doesn't work for devices without page support.
For example, LP5562 has 3 engines but doesn't support pages,
the start address is changed depending on engine number.
According to datasheet [1], the PROG MEM register addresses for each
engine are as follows:

  Engine 1: 0x10
  Engine 2: 0x30
  Engine 3: 0x50

However, the current implementation incorrectly calculates the address
of PROG MEM register using the engine index starting from 1:

  prog_mem_base = 0x10
  LP55xx_BYTES_PER_PAGE = 0x20

  Engine 1: 0x10 + 0x20 * 1 = 0x30
  Engine 2: 0x10 + 0x20 * 2 = 0x50
  Engine 3: 0x10 + 0x20 * 3 = 0x70

This results in writing to the wrong engine memory, causing pattern
programming to fail.

To correct it, the engine index should be decreased:
  Engine 1: 0x10 + 0x20 * 0 = 0x10
  Engine 2: 0x10 + 0x20 * 1 = 0x30
  Engine 3: 0x10 + 0x20 * 2 = 0x50

1 - https://www.ti.com/lit/ds/symlink/lp5562.pdf

Fixes: 31379a57cf2f ("leds: leds-lp55xx: Generalize update_program_memory function")
Signed-off-by: Andrei Lalaev <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Lee Jones <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/leds/leds-lp55xx-common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/leds/leds-lp55xx-common.c b/drivers/leds/leds-lp55xx-common.c
index e71456a56ab8d..fd447eb7eb15e 100644
--- a/drivers/leds/leds-lp55xx-common.c
+++ b/drivers/leds/leds-lp55xx-common.c
@@ -212,7 +212,7 @@ int lp55xx_update_program_memory(struct lp55xx_chip *chip,
 	 * For LED chip that support page, PAGE is already set in load_engine.
 	 */
 	if (!cfg->pages_per_engine)
-		start_addr += LP55xx_BYTES_PER_PAGE * idx;
+		start_addr += LP55xx_BYTES_PER_PAGE * (idx - 1);
 
 	for (page = 0; page < program_length / LP55xx_BYTES_PER_PAGE; page++) {
 		/* Write to the next page each 32 bytes (if supported) */
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:23:24 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368179; cv=none; b=rZkBE4lFxtCLaCcQSRzk8AVBCDAhy/NcL8/e2lIann6Eawu61xiiZ5QEecr7aSnDSvQKttgZjImy1KHpSg5RYDzQYK/LyPA256EdrDAEpv4Y5xhkU4wrSV9IQAPa6WOxCFN52zGqU62DvMmXbQwuh9sFjctgZzptrtMwMH3r2Do=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368179; c=relaxed/simple;
	bh=+9iUi9FrzHRuxjxwpOF0NUyskK6oJmemITqJThWkiwQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=HipBxTyDoX91eWtFnUiogyudBNdaPWNI7Z7w96LJwaj1SiuDgnBmkr4euiN2vODhynV7mIyqszylpaPgSByvGT2ju6Rh/Fr1qBVFskT2drmdK7UjGOic84s8uPkm8Vf0/th3Qaj+hZz0cUwRNNoH7v+m7z3eRSsCc4Z1tC209fY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=e4iX74e0; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Benjamin Berg <[email-masked]>,
	=?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 038/262] selftests/nolibc: fix EXPECT_NZ macro
Date: Mon, 13 Oct 2025 16:43:00 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Benjamin Berg <[email-masked]>

[ Upstream commit 6d33ce3634f99e0c6c9ce9fc111261f2c411cb48 ]

The expect non-zero macro was incorrect and never used. Fix its
definition.

Fixes: 362aecb2d8cfa ("selftests/nolibc: add basic infrastructure to ease creation of nolibc tests")
Signed-off-by: Benjamin Berg <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Thomas Weißschuh <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/nolibc/nolibc-test.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/nolibc/nolibc-test.c b/tools/testing/selftests/nolibc/nolibc-test.c
index 6fba7025c5e3c..d73bff23c61e7 100644
--- a/tools/testing/selftests/nolibc/nolibc-test.c
+++ b/tools/testing/selftests/nolibc/nolibc-test.c
@@ -196,8 +196,8 @@ int expect_zr(int expr, int llen)
 }

-#define EXPECT_NZ(cond, expr, val)			\
-	do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen; } while (0)
+#define EXPECT_NZ(cond, expr)				\
+	do { if (!(cond)) result(llen, SKIPPED); else ret += expect_nz(expr, llen); } while (0)
 
 static __attribute__((unused))
 int expect_nz(int expr, int llen)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368176; cv=none; b=LLtedKjxX50BFzBFbqiW4UuvLbnbg4j9Xq5j6LFMIEt0ExjCeS9Fdd53t6GpA+tEjIMr1YuvB4RpHvmeI1HuKdaPMeYD94z42SY21IQREaoGHYLKtv9ZjUjV/o9LQ6+M6xty0EKdYirLAwSnSoJyTcbWoX9Sc+RtMPNm5tTqlao=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368176; c=relaxed/simple;
	bh=AlGXSfXk0hRNlNgMDH7ExD3E/qMqHN1mUAYEDBumZvE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=nD4kXinq1pEwdc2C/PTuciGr31+phQ9u3GF0wDHR2rLyImYa/dmCl++iIX8rEEXc/90mQFHgyzrV1VIslrGcORns+K/e9Tb+N/+BBd3STfUvjqjK0JwUIT5da531nO07yyuL8SZoS4TRVe2PGcinqzHm8oi73CjaCF3JJ3HIcqk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hD9/Fqgb; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	Sudeep Holla <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 037/262] regulator: scmi: Use int type to store negative error codes
Date: Mon, 13 Oct 2025 16:42:59 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 9d35d068fb138160709e04e3ee97fe29a6f8615b ]

Change the 'ret' variable from u32 to int to store negative error codes or
zero returned by of_property_read_u32().

Storing the negative error codes in unsigned type, doesn't cause an issue
at runtime but it's ugly as pants. Additionally, assigning negative error
codes to unsigned type may trigger a GCC warning when the -Wsign-conversion
flag is enabled.

No effect on runtime.

Signed-off-by: Qianfeng Rong <[email-masked]>
Reviewed-by: Sudeep Holla <[email-masked]>
Fixes: 0fbeae70ee7c ("regulator: add SCMI driver")
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/regulator/scmi-regulator.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/regulator/scmi-regulator.c b/drivers/regulator/scmi-regulator.c
index 9df726f10ad12..6d609c42e4793 100644
--- a/drivers/regulator/scmi-regulator.c
+++ b/drivers/regulator/scmi-regulator.c
@@ -257,7 +257,8 @@ static int process_scmi_regulator_of_node(struct scmi_device *sdev,
 					  struct device_node *np,
 					  struct scmi_regulator_info *rinfo)
 {
-	u32 dom, ret;
+	u32 dom;
+	int ret;
 
 	ret = of_property_read_u32(np, "reg", &dom);
 	if (ret)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:37:10 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368174; cv=none; b=GFBv2zuQzaaoFj2MX1JWbMx9SAt7pmDa3IB2S6oexeO6tNHRVrWGcemulXLwiZVGSKw8lNRvPakiFAeHp2BLJ3GkGFa1nQDEZ5irDFIbFrty/kk7OuuXKsbLjsPvOqlxlsB+fMgHDhoYTRzI9z/RIAFZOtuMtpRzwCEHnhvD0dM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368174; c=relaxed/simple;
	bh=yevQA/WqChuG1Zo0ClfRr6/DjXJuanv71k5hbKnsAMs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=LMepKtyFRJ9iJGrP8S33ziKMSBke2fTsQgrqhykTbl88pu/gbDROQqEEyPj3QoIyiJGlAGTAsseMpZz7xmoG0nQPCbBOU6qheGzsFI4hjyxDb1FdM9gtuAhTz8duyPK7MZCTbpdG+YNDEGbIaX/WeUDYIyQEpJAn2jUhSGH0Dl4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=TUE7Ml1l; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Neal Gompa <[email-masked]>,
	Sven Peter <[email-masked]>,
	Janne Grunau <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 036/262] arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map
Date: Mon, 13 Oct 2025 16:42:58 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Janne Grunau <[email-masked]>

[ Upstream commit 6e08cdd604edcec2c277af17c7d36caf827057ff ]

PCIe `port01` of t8103-j457 (iMac, M1, 2 USB-C ports, 2021) is unused
and disabled. Linux' PCI subsystem assigns the ethernet nic from
`port02` to bus 02. This results into assigning `pcie0_dart_1` from the
disabled port as iommu. The `pcie0_dart_1` instance is disabled and
probably fused off (it is on the M2 Pro Mac mini which has a disabled
PCIe port as well).
Without iommu the ethernet nic is not expected work.
Adjusts the "bus-range" and the PCIe devices "reg" property to PCI
subsystem's bus number.

Fixes: 7c77ab91b33d ("arm64: dts: apple: Add missing M1 (t8103) devices")
Reviewed-by: Neal Gompa <[email-masked]>
Reviewed-by: Sven Peter <[email-masked]>
Signed-off-by: Janne Grunau <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sven Peter <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/apple/t8103-j457.dts | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/apple/t8103-j457.dts b/arch/arm64/boot/dts/apple/t8103-j457.dts
index 152f95fd49a21..7089ccf3ce556 100644
--- a/arch/arm64/boot/dts/apple/t8103-j457.dts
+++ b/arch/arm64/boot/dts/apple/t8103-j457.dts
@@ -21,6 +21,14 @@ aliases {
 	};
 };
 
+/*
+ * Adjust pcie0's iommu-map to account for the disabled port01.
+ */
+&pcie0 {
+	iommu-map = <0x100 &pcie0_dart_0 1 1>,
+			<0x200 &pcie0_dart_2 1 1>;
+};
+
 &bluetooth0 {
 	brcm,board-type = "apple,santorini";
 };
@@ -36,10 +44,10 @@ &wifi0 {
  */
 
 &port02 {
-	bus-range = <3 3>;
+	bus-range = <2 2>;
 	status = "okay";
 	ethernet0: ethernet@0,0 {
-		reg = <0x30000 0x0 0x0 0x0 0x0>;
+		reg = <0x20000 0x0 0x0 0x0 0x0>;
 		/* To be filled by the loader */
 		local-mac-address = [00 10 18 00 00 00];
 	};
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:41:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368171; cv=none; b=qVr5f7Mcq+tkcqywROpVT/GwinCXUyzF34Jl3uxN84qeMJbJejMkPkv+9tacjzVBas8sc5i/BTtplDJ40aXY2Lwpqzq+fhTZ49LWG9rc7cveIa/MhOfQSHEHJwt6GsR+BQK4hn/fMEIIcfbTq8d2nPLvndfi/eS6gZIswrwF+VE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368171; c=relaxed/simple;
	bh=kFsh0v7+q5yIQ+MKCUVGt/aWmJctvj5YazU91yaTzYQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=PZJM3IXHrttSrD4194yTbd3E4fWac9bRkP0r/eeJJjb85x5joIbm1FZ8goskGiomKL6TzjY5m0ZIoro7YPvDe2MxAtOc8KvB9hyasPfmr6RwLsvJKLmNZGJpzf9q0s+uv/WkcEpcVDuVpTFSTHBfAs8vSrhlHPXZXTQ6eUjLVGs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=o7ZlWCr3; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Nicolas Ferre <[email-masked]>,
	Alexandre Belloni <[email-masked]>,
	Claudiu Beznea <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 035/262] ARM: at91: pm: fix MCKx restore routine
Date: Mon, 13 Oct 2025 16:42:57 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolas Ferre <[email-masked]>

[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ]

The at91_mckx_ps_restore() assembly function is responsible for setting
back MCKx system bus clocks after exiting low power modes.

Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx
to previously saved state.
Tmp2 was used without the needed changes in CSS and DIV. Moreover the
required bit 7, telling that MCR register's content is to be changed
(CMD/write), was not set.

Fix function comment to match tmp variables actually used.

Signed-off-by: Nicolas Ferre <[email-masked]>
Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes")
Link: https://lore.kernel.org/r/[email-masked]
Reviewed-by: Alexandre Belloni <[email-masked]>
[claudiu.beznea: s/sate/state in commit description]
Signed-off-by: Claudiu Beznea <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm/mach-at91/pm_suspend.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
index e5869cca5e791..94dece1839af3 100644
--- a/arch/arm/mach-at91/pm_suspend.S
+++ b/arch/arm/mach-at91/pm_suspend.S
@@ -872,7 +872,7 @@ e_done:
 /**
  * at91_mckx_ps_restore: restore MCK1..4 settings
  *
- * Side effects: overwrites tmp1, tmp2
+ * Side effects: overwrites tmp1, tmp2 and tmp3
  */
 .macro at91_mckx_ps_restore
 #ifdef CONFIG_SOC_SAMA7
@@ -916,7 +916,7 @@ r_ps:
 	bic	tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK
 	orr	tmp3, tmp3, tmp1
 	orr	tmp3, tmp3, #AT91_PMC_MCR_V2_CMD
-	str	tmp2, [pmc, #AT91_PMC_MCR_V2]
+	str	tmp3, [pmc, #AT91_PMC_MCR_V2]
 
 	wait_mckrdy tmp1
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:36:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368150; cv=none; b=V4NiMyg63y59mbf1wTTTNjSoAILyr/e89z+noGZGGvQK1HNwcory8aN3tTmqIQ+v23dzaSjbhUPRRTxlBn0QFD51axF8cWQA8z+Af970Y7WbUyvFkv0Ktr5uELGKKMdpGAItVCXYy7MafBIcRukSv6E3fXggCvk4NDOBJzm4sBA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368150; c=relaxed/simple;
	bh=NtA3/qUiiiW3/uyIBGENbGS/UGfwire103ZVDwNF4xU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=gW+kPy1Sw2HMXhWPhvsFMuiT3hexg7XID3OHZ/NGRQ2iwc9PN+eJ7fmz9NCxi2WUkJt3ciOQnLQPrH96B4Gzm8460GxJejq28e8cJ+Xw2GyVyG71SQyqpDjpO3N58paTwGnRBfOaZWgRbj1DLLxngmB7OwDHV0qE66G7CPIwDtY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zafesFda; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Li Nan <[email-masked]>,
	Yu Kuai <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 034/262] blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
Date: Mon, 13 Oct 2025 16:42:56 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Li Nan <[email-masked]>

[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]

In __blk_mq_update_nr_hw_queues() the return value of
blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx
fails, later changing the number of hw_queues or removing disk will
trigger the following warning:

  kernfs: can not remove 'nr_tags', no directory
  WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160
  Call Trace:
   remove_files.isra.1+0x38/0xb0
   sysfs_remove_group+0x4d/0x100
   sysfs_remove_groups+0x31/0x60
   __kobject_del+0x23/0xf0
   kobject_del+0x17/0x40
   blk_mq_unregister_hctx+0x5d/0x80
   blk_mq_sysfs_unregister_hctxs+0x94/0xd0
   blk_mq_update_nr_hw_queues+0x124/0x760
   nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
   nullb_device_submit_queues_store+0x92/0x120 [null_blk]

kobjct_del() was called unconditionally even if sysfs creation failed.
Fix it by checkig the kobject creation statusbefore deleting it.

Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues")
Signed-off-by: Li Nan <[email-masked]>
Reviewed-by: Yu Kuai <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/blk-mq-sysfs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
index 156e9bb07abf1..2fb234ab467b1 100644
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -150,9 +150,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
 		return;
 
 	hctx_for_each_ctx(hctx, ctx, i)
-		kobject_del(&ctx->kobj);
+		if (ctx->kobj.state_in_sysfs)
+			kobject_del(&ctx->kobj);
 
-	kobject_del(&hctx->kobj);
+	if (hctx->kobj.state_in_sysfs)
+		kobject_del(&hctx->kobj);
 }
 
 static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:43:48 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368119; cv=none; b=Tc+6SfGfm/I91sw0zH4hkBskA1l0yZR2TcoflCsR00WXOCGD9/tHIZbd5PO6D9wwDpbL5K9/jPcsi/cG3WWraSTKsKt4I+RVZaghrhkPyakhnerTlQN5BrOihDYB1VrmKlWJnSL1EqTpA8qEqw+WU5/bkLiuviwoqsFtlSjyhdc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368119; c=relaxed/simple;
	bh=6hLqYnfQMm4KX9Tr776SvGzdoO9Sh7NwkXx6OpyyTvI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Ko/OIpazGRmrkjY3Ne9ocaBca8UA8dcgXNwHsTs+7orX0Eu5dN87FWgG+jtFKw51WUv4+k3OlDzjDXkYtGyycveb6N7Ip+QWpy4PTCrb2EqhQjFYHRv6ZdXbqO/03SccICNqznwPKzG/d1jp/sfDqNzZW/czk8iyLCDkXb9yTGw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Sjt3QJSm; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Da Xue <[email-masked]>,
	Linus Walleij <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 033/262] pinctrl: meson-gxl: add missing i2c_d pinmux
Date: Mon, 13 Oct 2025 16:42:55 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Da Xue <[email-masked]>

[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]

Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.

Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.

Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
Signed-off-by: Da Xue <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Linus Walleij <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
index 9171de657f978..a75762e4d2641 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[]	= { GPIODV_28 };
 static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 };
 static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 };
 
+static const unsigned int i2c_sck_d_pins[]	= { GPIOX_11 };
+static const unsigned int i2c_sda_d_pins[]	= { GPIOX_10 };
+
 static const unsigned int eth_mdio_pins[]	= { GPIOZ_0 };
 static const unsigned int eth_mdc_pins[]	= { GPIOZ_1 };
 static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 };
@@ -411,6 +414,8 @@ static const struct meson_pmx_group meson_gxl_periphs_groups[] = {
 	GPIO_GROUP(GPIO_TEST_N),
 
 	/* Bank X */
+	GROUP(i2c_sda_d,	5,	5),
+	GROUP(i2c_sck_d,	5,	4),
 	GROUP(sdio_d0,		5,	31),
 	GROUP(sdio_d1,		5,	30),
 	GROUP(sdio_d2,		5,	29),
@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = {
 	"i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19",
 };
 
+static const char * const i2c_d_groups[] = {
+	"i2c_sck_d", "i2c_sda_d",
+};
+
 static const char * const eth_groups[] = {
 	"eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv",
 	"eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3",
@@ -777,6 +786,7 @@ static const struct meson_pmx_func meson_gxl_periphs_functions[] = {
 	FUNCTION(i2c_a),
 	FUNCTION(i2c_b),
 	FUNCTION(i2c_c),
+	FUNCTION(i2c_d),
 	FUNCTION(eth),
 	FUNCTION(pwm_a),
 	FUNCTION(pwm_b),
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:26:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368087; cv=none; b=lCsKy33Mx3dAIm+dpIcxKLqOBW4XGoIao113LkVqi6n1tLBpOuX8MB8FgtRuX+e0B9BTBzMhHH2si8868KKtsNU3vs/LlzIfzFdXvbfKrpfcRuKY3r1Lfk5YH8U/vqbUV4KwaPDYoHE6CsCKtVlk6cT9udn2Y6vFEUQd41BMgMY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368087; c=relaxed/simple;
	bh=IXSUWtI9j6i5CK2364GiXtBquU57sl35cqaID5ADqZ0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bH6R9PqO5paZP8JIaswDXC84Dekq2DOdm9czjqBopnwZicu6njP9NbNUMoQcymyctVGNr+2eikZIffPBBURQplUuY98Ncof25z08I6ox0CW3qQ/0joRzA49pxQ+BnVkVnUuCMWxoKGTaT/TA65HtJ3/qzCnR7gJW/QLDSv7xwhM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EIoDYzrB; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Sneh Mankad <[email-masked]>,
	Bjorn Andersson <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 032/262] soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
Date: Mon, 13 Oct 2025 16:42:54 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sneh Mankad <[email-masked]>

[ Upstream commit f87412d18edb5b8393eb8cb1c2d4a54f90185a21 ]

Unconditionally clear the TCS_AMC_MODE_TRIGGER bit when a
transaction completes. Previously this bit was only cleared when
a wake TCS was borrowed as an AMC TCS but not for dedicated
AMC TCS. Leaving this bit set for AMC TCS and entering deeper low
power modes can generate a false completion IRQ.

Prevent this scenario by always clearing the TCS_AMC_MODE_TRIGGER
bit upon receiving a completion IRQ.

Fixes: 15b3bf61b8d4 ("soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS")
Signed-off-by: Sneh Mankad <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Bjorn Andersson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/soc/qcom/rpmh-rsc.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
index 641f29a98cbd2..cc72a31a450e4 100644
--- a/drivers/soc/qcom/rpmh-rsc.c
+++ b/drivers/soc/qcom/rpmh-rsc.c
@@ -453,13 +453,10 @@ static irqreturn_t tcs_tx_done(int irq, void *p)
 
 		trace_rpmh_tx_done(drv, i, req);
 
-		/*
-		 * If wake tcs was re-purposed for sending active
-		 * votes, clear AMC trigger & enable modes and
+		/* Clear AMC trigger & enable modes and
 		 * disable interrupt for this TCS
 		 */
-		if (!drv->tcs[ACTIVE_TCS].num_tcs)
-			__tcs_set_trigger(drv, i, false);
+		__tcs_set_trigger(drv, i, false);
 skip:
 		/* Reclaim the TCS */
 		write_tcs_reg(drv, drv->regs[RSC_DRV_CMD_ENABLE], i, 0);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:48:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368188; cv=none; b=QFssIbv16r+9iKnQtqhMYwqvK9g7jyNhH/fufRZuGrw/QAYLvkGvyyn7bltC8ozrMKKsWj0tkKhGvj22oFKbf17q6qu9LqrJerGDhcfu/855e+y1GiuQqTv5Lvs4y0Qqz9C+QwZbAOgY3sN1lmf8XfGYH1FBDoyYVB7RrEsKDwg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368188; c=relaxed/simple;
	bh=7VdeC7ODruayH2jsWSJ+H0HDohUQ4ODNOu4BE4sssPs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=iPV2TODgGo69tL5dk43e4Uc3iOp/zvWOCSforrHWHj5ZvjUBR9M1gQJaYQZ22dLf3wSR/kDglbzfVF45kjfSg2yQPdQ5BcxIQ83PVNqAHcQUCi3vpOrD0oa30mT3iVh7TlytmdHrtPb7ruJmIW8Sn9mx7RhMMbQn7fouQAUde/M=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OJVhvATk; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Huisong Li <[email-masked]>,
	"Rafael J. Wysocki" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 031/262] ACPI: processor: idle: Fix memory leak when register cpuidle device failed
Date: Mon, 13 Oct 2025 16:42:53 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Huisong Li <[email-masked]>

[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]

The cpuidle device's memory is leaked when cpuidle device registration
fails in acpi_processor_power_init().  Free it as appropriate.

Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
Signed-off-by: Huisong Li <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
[ rjw: Changed the order of the new statements, added empty line after if () ]
[ rjw: Changelog edits ]
Signed-off-by: Rafael J. Wysocki <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/acpi/processor_idle.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 0888e4d618d53..b524cf27213d4 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -1410,6 +1410,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)
 		if (retval) {
 			if (acpi_processor_registered == 0)
 				cpuidle_unregister_driver(&acpi_idle_driver);
+
+			per_cpu(acpi_cpuidle_device, pr->id) = NULL;
+			kfree(dev);
 			return retval;
 		}
 		acpi_processor_registered++;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:26:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368064; cv=none; b=G1G+1NS/mMgDK1eFJ8Sl1cnkiUVT3GciLf9q1rrIFYTocWYIgqHUu5DsLj9/ESEYJadYCBMCV+fW8fXHMqklJosHg3LV48fGKItrhNO5HdAR0uy6gvlEFOKJP+jXd3uvcu52Z7mtDY6RRBwIXC7kBT8AHDv0ohgBceNcjEkNFw4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368064; c=relaxed/simple;
	bh=QKMRw0exnscM1HOXI4E66Jr0Fg94jPioH3jr9XL7T84=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Qc/yWlRR2H5x+YPI1MPV6Fa0W583A8gh/z4jg+3rDDQJGR8F5ItU1VoGuOhdeXYqshlOiQ84+gHF4x0Nr5/Xp/WzB1upXlv8b8hxa1JVauD0EciUDsM0HJcHcpBNkN3uhKBvaecWFG1WpfrTbQceQiBlihTXzzQeLh+NB5f/R0o=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dUhYjyQ/; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Joy Zou <[email-masked]>,
	Peng Fan <[email-masked]>,
	Frank Li <[email-masked]>,
	Shawn Guo <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 030/262] arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid
Date: Mon, 13 Oct 2025 16:42:52 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Joy Zou <[email-masked]>

[ Upstream commit 6fdaf3b1839c861931db0dd11747c056a76b68f9 ]

According to the imx95 RM, the lpuart7 rx and tx DMA's srcid are 88 and 87,
and the lpuart8 rx and tx DMA's srcid are 90 and 89. So correct them.

Fixes: 915fd2e127e8 ("arm64: dts: imx95: add edma[1..3] nodes")
Signed-off-by: Joy Zou <[email-masked]>
Signed-off-by: Peng Fan <[email-masked]>
Reviewed-by: Frank Li <[email-masked]>
Signed-off-by: Shawn Guo <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/freescale/imx95.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/freescale/imx95.dtsi b/arch/arm64/boot/dts/freescale/imx95.dtsi
index 7365d6538a733..ddbc94c375e0c 100644
--- a/arch/arm64/boot/dts/freescale/imx95.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx95.dtsi
@@ -822,7 +822,7 @@ lpuart7: serial@42690000 {
 				interrupts = <GIC_SPI 68 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&scmi_clk IMX95_CLK_LPUART7>;
 				clock-names = "ipg";
-				dmas = <&edma2 26 0 FSL_EDMA_RX>, <&edma2 25 0 0>;
+				dmas = <&edma2 88 0 FSL_EDMA_RX>, <&edma2 87 0 0>;
 				dma-names = "rx", "tx";
 				status = "disabled";
 			};
@@ -834,7 +834,7 @@ lpuart8: serial@426a0000 {
 				interrupts = <GIC_SPI 69 IRQ_TYPE_LEVEL_HIGH>;
 				clocks = <&scmi_clk IMX95_CLK_LPUART8>;
 				clock-names = "ipg";
-				dmas = <&edma2 28 0 FSL_EDMA_RX>, <&edma2 27 0 0>;
+				dmas = <&edma2 90 0 FSL_EDMA_RX>, <&edma2 89 0 0>;
 				dma-names = "rx", "tx";
 				status = "disabled";
 			};
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:22:08 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368059; cv=none; b=KCthyZRzjItS5VfB3QP7H66xi0YpkrdLN9HyyU+yf6QY+JQXfk0XdIc722QSXcD8Kx6K44Ai8/BhyIPgxtlvHy5RjTbBtjZQv8B+8vINJbFWYdIrGe5I2a/EDil9mZ6cvQeYqWgfD1xFrOKW/k8nPLFmSxTtewf82bdxutg4r5o=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368059; c=relaxed/simple;
	bh=DeN2E2L2vJ81Rtx513kvi70v3rArmDvbj6IEfcYcv0Q=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=aJr5UGWcvAOXnlPiyHiNLZWCB1T5+hVj5Yj+8CDBvZYn13zrqfSZiAMgkVximwRDtfprMcTxgrN9lAZ9gxFB5+E9TSJttHSNwRdNzK3X5jqIVqO0j6x2catJ7DYHMGxO+Pm8cqA+Jv7md7G7LBbJ7bI2nkWi3AP21zaDR/vu6BQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=i4PeL6HW; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Frieder Schrempf <[email-masked]>,
	Shawn Guo <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 029/262] arm64: dts: imx93-kontron: Fix USB port assignment
Date: Mon, 13 Oct 2025 16:42:51 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Frieder Schrempf <[email-masked]>

[ Upstream commit c94737568b290e0547bff344046f02df49ed6373 ]

The assignment of the USB ports is wrong and needs to be swapped.
The OTG (USB-C) port is on the first port and the host port with
the onboard hub is on the second port.

Signed-off-by: Frieder Schrempf <[email-masked]>
Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board")
Signed-off-by: Shawn Guo <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../dts/freescale/imx93-kontron-bl-osm-s.dts  | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
index 9a9e5d0daf3ba..c3d2ddd887fdf 100644
--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
@@ -137,6 +137,16 @@ &tpm6 {
 };
 
 &usbotg1 {
+	adp-disable;
+	hnp-disable;
+	srp-disable;
+	disable-over-current;
+	dr_mode = "otg";
+	usb-role-switch;
+	status = "okay";
+};
+
+&usbotg2 {
 	#address-cells = <1>;
 	#size-cells = <0>;
 	disable-over-current;
@@ -149,16 +159,6 @@ usb1@1 {
 	};
 };
 
-&usbotg2 {
-	adp-disable;
-	hnp-disable;
-	srp-disable;
-	disable-over-current;
-	dr_mode = "otg";
-	usb-role-switch;
-	status = "okay";
-};
-
 &usdhc2 {
 	vmmc-supply = <&reg_vdd_3v3>;
 	status = "okay";
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:39:00 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368056; cv=none; b=G45kmLdfJFg5UiM/KMsPBQtpb6yDUYWewCThAsg0tVEJiOG3Tnm9vD8Yu1wOp/DYl7Uhc4Xh5C1Ayn1r3kgXXtaW83+ex4ki5uHjsj9OML+sLQ23BtCfvYE8p+kjhDVrL+bCqlgYLYzx+WGcImWSK5zzpx9RUvgPpeGr9eL1Gjg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368056; c=relaxed/simple;
	bh=HH3oeZDSyADqvX0iubnVbyGIL0X3C8zuwT8++nVKBCs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=MR8iXKHoLFuNNW3FMq4+V/9Qlbta7GOSd10uHVrVvkOos2UAViajPVGiIyRPZ62jw0jCoIJ8UhVTfF2DPJSSKLRHbue94zJ9ivplex6d2XVzU7UqQ2FCMjVv6wjv6BVDMqqH6m/FoezVX0KBxD8NjW4MLqMZ0etjrJS26NQzBcY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=R0iC3lnB; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Annette Kobou <[email-masked]>,
	Frieder Schrempf <[email-masked]>,
	Shawn Guo <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 028/262] arm64: dts: imx93-kontron: Fix GPIO for panel regulator
Date: Mon, 13 Oct 2025 16:42:50 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Annette Kobou <[email-masked]>

[ Upstream commit f3e011388dd08d15e0414e3b6b974f946305e7af ]

The regulator uses the wrong GPIO. Fix this.

Signed-off-by: Annette Kobou <[email-masked]>
Signed-off-by: Frieder Schrempf <[email-masked]>
Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board")
Signed-off-by: Shawn Guo <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../boot/dts/freescale/imx93-kontron-bl-osm-s.dts    | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
index 89e97c604bd3e..9a9e5d0daf3ba 100644
--- a/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
+++ b/arch/arm64/boot/dts/freescale/imx93-kontron-bl-osm-s.dts
@@ -33,7 +33,9 @@ pwm-beeper {
 
 	reg_vcc_panel: regulator-vcc-panel {
 		compatible = "regulator-fixed";
-		gpio = <&gpio4 3 GPIO_ACTIVE_HIGH>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinctrl_reg_vcc_panel>;
+		gpio = <&gpio2 21 GPIO_ACTIVE_HIGH>;
 		enable-active-high;
 		regulator-max-microvolt = <3300000>;
 		regulator-min-microvolt = <3300000>;
@@ -161,3 +163,11 @@ &usdhc2 {
 	vmmc-supply = <&reg_vdd_3v3>;
 	status = "okay";
 };
+
+&iomuxc {
+	pinctrl_reg_vcc_panel: regvccpanelgrp {
+		fsl,pins = <
+			MX93_PAD_GPIO_IO21__GPIO2_IO21		0x31e /* PWM_2 */
+		>;
+	};
+};
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:52:43 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368054; cv=none; b=cDQxVe2+jnrQbensFYgkvXHZ0iZVQqoVgbjQpImwKgtaFRo4DaYEo+Jws1jSv9YYGYy8UBWXG6gPKTRqyJD2HV1vFZBB/bQ7c4oSGZQ5WJcetQ3/V0/yWMHu+I728Y0eFDd3SbmhKPIgNl4omyv5tTb1h5iQBCo2f59xzTajS/Y=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368054; c=relaxed/simple;
	bh=IX2Hv+UU4jUCGUdKuocOXnEobEGrD3hFuX8CeVwqGVw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=SAS+EhZiupoU5cTYwR/OVytm/tcK8NSaergp72/kQHizU86RPjFQ6MtJt/AFogkZLv64BieZQycbezUPEUKgYhwcQ4hWCpWpTBCMN9fOiVqL0BO6ckUHaMEoeakDGKfB36UWz9DRLd2uz/a1R9Rwok0S2PTF1JaJUGGjrr3P0JU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=R9QxyzUe; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Junnan Wu <[email-masked]>,
	Sudeep Holla <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 027/262] firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver
Date: Mon, 13 Oct 2025 16:42:49 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Junnan Wu <[email-masked]>

[ Upstream commit e8faa8a466f61f4ae07069ed6b0872f602f1cba9 ]

After commit 20bda12a0ea0 (“firmware: arm_scmi: Make VirtIO transport a
standalone driver”), the VirtIO transport probes independently. During
scmi_virtio_probe, scmi_probe() is called, which intune invokes
scmi_protocol_acquire() that sends a message over the virtqueue and
waits for a reply.

Previously, DRIVER_OK was only set after scmi_vio_probe, in the core
virtio via virtio_dev_probe(). According to the Virtio spec (3.1 Device
Initialization):
  |  The driver MUST NOT send any buffer available notifications to the
  |  device before setting DRIVER_OK.

Some type-1 hypervisors block available-buffer notifications until the
driver is marked OK. In such cases, scmi_vio_probe stalls in
scmi_wait_for_reply(), and the probe never completes.

Resolve this by setting DRIVER_OK immediately after the device-specific
setup, so scmi_probe() can safely send notifications.

Note after splitting the transports into modules, the probe sequence
changed a bit. We can no longer rely on virtio_device_ready() being
called by the core in virtio_dev_probe(), because scmi_vio_probe()
doesn’t complete until the core SCMI stack runs scmi_probe(), which
immediately issues the initial BASE protocol exchanges.

Fixes: 20bda12a0ea0 ("firmware: arm_scmi: Make VirtIO transport a standalone driver")
Signed-off-by: Junnan Wu <[email-masked]>
Message-Id: <[email-masked]>
Signed-off-by: Sudeep Holla <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/firmware/arm_scmi/transports/virtio.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/firmware/arm_scmi/transports/virtio.c b/drivers/firmware/arm_scmi/transports/virtio.c
index d349766bc0b26..f78b87f334037 100644
--- a/drivers/firmware/arm_scmi/transports/virtio.c
+++ b/drivers/firmware/arm_scmi/transports/virtio.c
@@ -870,6 +870,9 @@ static int scmi_vio_probe(struct virtio_device *vdev)
 	/* Ensure initialized scmi_vdev is visible */
 	smp_store_mb(scmi_vdev, vdev);
 
+	/* Set device ready */
+	virtio_device_ready(vdev);
+
 	ret = platform_driver_register(&scmi_virtio_driver);
 	if (ret) {
 		vdev->priv = NULL;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:32:37 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368050; cv=none; b=JdcgBsbYJr27DDA8MNgPIjPYntsdYbatfBL0A9VzFu6+rs7j1t9KpkbTFlpIMo+OiySrVf4TqKdi+1yS1dQjAnAN1IxrIR24XRLj9HN2qI3wGTSe6D+BY0Am8bEcz+Jeu1Y3EPa6D2AQ8SSUHT+zEsANtmIdRuuh33QshELkZGk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368050; c=relaxed/simple;
	bh=oZINTMPe1DQ37R6RcPs2Q2tPTFBhJyIAUtQ3TjML0LU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=KOw9jf4ICi0mXELkkgvLjMg8l6zRisL0XHiMoP1WCOVxvutCfQqoIV2rG+EKzWduDcR2g6a8x5UdSe+jODr4S6BYVatPg7yFZDNymwu/2HKvdzhYJNU6AX3CaSwunWoCkjevlOD+1EmaeZ7zp3dhkt5mk03v7qIgcY+K3wL6enI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0lQJP+iy; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Florian Fainelli <[email-masked]>,
	Sudeep Holla <[email-masked]>,
	Viresh Kumar <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 026/262] cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
Date: Mon, 13 Oct 2025 16:42:48 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Florian Fainelli <[email-masked]>

[ Upstream commit cd5d4621ba846dad9b2e6b0c2d1518d083fcfa13 ]

Broadcom STB platforms were early adopters (2017) of the SCMI framework and as
a result, not all deployed systems have a Device Tree entry where SCMI
protocol 0x13 (PERFORMANCE) is declared as a clock provider, nor are the
CPU Device Tree node(s) referencing protocol 0x13 as their clock
provider. This was clarified in commit e11c480b6df1 ("dt-bindings:
firmware: arm,scmi: Extend bindings for protocol@13") in 2023.

For those platforms, we allow the checks done by scmi_dev_used_by_cpus()
to continue, and in the event of not having done an early return, we key
off the documented compatible string and give them a pass to continue to
use scmi-cpufreq.

Fixes: 6c9bb8692272 ("cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs")
Signed-off-by: Florian Fainelli <[email-masked]>
Reviewed-by: Sudeep Holla <[email-masked]>
Signed-off-by: Viresh Kumar <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
index beb660ca240cc..a2ec1addafc93 100644
--- a/drivers/cpufreq/scmi-cpufreq.c
+++ b/drivers/cpufreq/scmi-cpufreq.c
@@ -15,6 +15,7 @@
 #include <linux/energy_model.h>
 #include <linux/export.h>
 #include <linux/module.h>
+#include <linux/of.h>
 #include <linux/pm_opp.h>
 #include <linux/slab.h>
 #include <linux/scmi_protocol.h>
@@ -398,6 +399,15 @@ static bool scmi_dev_used_by_cpus(struct device *scmi_dev)
 			return true;
 	}
 
+	/*
+	 * Older Broadcom STB chips had a "clocks" property for CPU node(s)
+	 * that did not match the SCMI performance protocol node, if we got
+	 * there, it means we had such an older Device Tree, therefore return
+	 * true to preserve backwards compatibility.
+	 */
+	if (of_machine_is_compatible("brcm,brcmstb"))
+		return true;
+
 	return false;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:32:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368047; cv=none; b=J0qSzPNris6WQq8qIHFGPKbk/9Te4dTns+HmKfJSNYy2uVxNopqEkCryWBy1F22p7Vgrg/R51Y+eerdxzoimHJBj/yKqGqr4PMOEe7hPxJJkUh6B01+UrrsZPjXekwnxAJ3a9M70MRmzVubXPHh1VIzuIDxUtu8uovM3a9x9d2I=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368047; c=relaxed/simple;
	bh=mJ1FoUP+EEvcnOD5af9KBrYLof0R6Zk1/7XG+VsJiA0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=RDEWRovhvjAReNI0+l/gTi7IWjeKoXwRAI0roNWx5CSXxz00ooYJ66LN0VAUJRzXTVfKcpO2/KDCg2sKjcum0Qugg/dMTm+YT8+FpYYv3ml2pu/DNTz5tpu9teNlMGrwQdl7giQdTAovYIUKsE36agXTsHZzQ/rFGbwHaRjs1Bg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2t5Hd1lz; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ilya Leoshkevich <[email-masked]>,
	Daniel Borkmann <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 025/262] s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG
Date: Mon, 13 Oct 2025 16:42:47 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ilya Leoshkevich <[email-masked]>

[ Upstream commit bc3905a71f02511607d3ccf732360580209cac4c ]

The tailcall_bpf2bpf_hierarchy_fentry test hangs on s390. Its call
graph is as follows:

  entry()
    subprog_tail()
      trampoline()
        fentry()
        the rest of subprog_tail()  # via BPF_TRAMP_F_CALL_ORIG
        return to entry()

The problem is that the rest of subprog_tail() increments the tail call
counter, but the trampoline discards the incremented value. This
results in an astronomically large number of tail calls.

Fix by making the trampoline write the incremented tail call counter
back.

Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()")
Signed-off-by: Ilya Leoshkevich <[email-masked]>
Signed-off-by: Daniel Borkmann <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/s390/net/bpf_jit_comp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index a88d53fe87743..c15be6955cc7f 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -2808,6 +2808,9 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
 		/* stg %r2,retval_off(%r15) */
 		EMIT6_DISP_LH(0xe3000000, 0x0024, REG_2, REG_0, REG_15,
 			      tjit->retval_off);
+		/* mvc tccnt_off(%r15),tail_call_cnt(4,%r15) */
+		_EMIT6(0xd203f000 | tjit->tccnt_off,
+		       0xf000 | offsetof(struct prog_frame, tail_call_cnt));
 
 		im->ip_after_call = jit->prg_buf + jit->prg;
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:41:20 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368044; cv=none; b=LiDhXWvLYFvC6CC3jNrWd2AvnSBhgPFQvpSg+8+2haTyyJi99gKML1sDD3Y5VVfZ31XcbxTuNQ+SAuR8ouvxqbUzwT97tvUlqP5zGYEpxZ352alSu0FinKJDUG41mXtJo1UNpqmeLMsuo7yAkGzRLckFjeD4ys19k589CRNkeBI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368044; c=relaxed/simple;
	bh=MZqDF+eFA91d5Xv74q3X55WuHfWGrrgN5sPNodntr6M=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=RIm3wkG6sM015BSWWAOQochnbdrs3O4/Jv2ArMN0kbq+AwnjC5ATJ4Af/3L8V3JJv4dY7AsSjCinFcvEwJ9h2qKgAEroeXcGEYMaHw3D/SsAQU2etS7uZCPXCD07KI75cR8v4z73X5cifMMn9vLKq1GX2fIE8MP2ze6wgU0iYOs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QwpJGUlZ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ilya Leoshkevich <[email-masked]>,
	Daniel Borkmann <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 024/262] s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL
Date: Mon, 13 Oct 2025 16:42:46 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ilya Leoshkevich <[email-masked]>

[ Upstream commit c861a6b147137d10b5ff88a2c492ba376cd1b8b0 ]

The tailcall_bpf2bpf_hierarchy_1 test hangs on s390. Its call graph is
as follows:

  entry()
    subprog_tail()
      bpf_tail_call_static(0) -> entry + tail_call_start
    subprog_tail()
      bpf_tail_call_static(0) -> entry + tail_call_start

entry() copies its tail call counter to the subprog_tail()'s frame,
which then increments it. However, the incremented result is discarded,
leading to an astronomically large number of tail calls.

Fix by writing the incremented counter back to the entry()'s frame.

Fixes: dd691e847d28 ("s390/bpf: Implement bpf_jit_supports_subprog_tailcalls()")
Signed-off-by: Ilya Leoshkevich <[email-masked]>
Signed-off-by: Daniel Borkmann <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/s390/net/bpf_jit_comp.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index ead8d9ba9032c..a88d53fe87743 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -1775,13 +1775,6 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 		jit->seen |= SEEN_FUNC;
 		/*
 		 * Copy the tail call counter to where the callee expects it.
-		 *
-		 * Note 1: The callee can increment the tail call counter, but
-		 * we do not load it back, since the x86 JIT does not do this
-		 * either.
-		 *
-		 * Note 2: We assume that the verifier does not let us call the
-		 * main program, which clears the tail call counter on entry.
 		 */
 		/* mvc STK_OFF_TCCNT(4,%r15),N(%r15) */
 		_EMIT6(0xd203f000 | STK_OFF_TCCNT,
@@ -1807,6 +1800,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 		call_r1(jit);
 		/* lgr %b0,%r2: load return value into %b0 */
 		EMIT4(0xb9040000, BPF_REG_0, REG_2);
+
+		/*
+		 * Copy the potentially updated tail call counter back.
+		 */
+
+		if (insn->src_reg == BPF_PSEUDO_CALL)
+			/*
+			 * mvc frame_off+tail_call_cnt(%r15),
+			 *     tail_call_cnt(4,%r15)
+			 */
+			_EMIT6(0xd203f000 | (jit->frame_off +
+					     offsetof(struct prog_frame,
+						      tail_call_cnt)),
+			       0xf000 | offsetof(struct prog_frame,
+						 tail_call_cnt));
+
 		break;
 	}
 	case BPF_JMP | BPF_TAIL_CALL: {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:29:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368041; cv=none; b=qlisdKfP5RAVtNmrHkb/YvqS6l7fG5wlczXCN/ELh9wgDL+EhURl8ruwXjwDDcJ50WMhr2JHaUzv8S5CndOhkfBTWAtITy9ZaHTACGLx3r21vrZ6UQx7KCx7oaWVipxiby1CjBBF3ENE11tpG+1tK9EinU1LiIvPw4yg4i1UaP0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368041; c=relaxed/simple;
	bh=2+BgIlFwcYxTFJAKxjZ35M9ugDhbgu8q4mW067En/rA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pNLcfAkX6LIC7bFLZot/aZFnz0VwCrDwEJy+Pq0N7MpdjNPmaneoEGL8WLgo5lK5MLYGndy0qCE/ba2lt+S4sxJxvNeVk5xl9SVXy+PLB5o2mCV3vap2UPPK56ELAY9dSSrvy9VVALP2JOKBjNBLCwPWWOpkq7cydJ9lYFq78Sg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KWGjzqSR; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Fenglin Wu <[email-masked]>,
	Konrad Dybcio <[email-masked]>,
	Lee Jones <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 023/262] leds: flash: leds-qcom-flash: Update torch current clamp setting
Date: Mon, 13 Oct 2025 16:42:45 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Fenglin Wu <[email-masked]>

[ Upstream commit 5974e8f6c3e47ab097c3dd8ece7324d1f88fe739 ]

There is a register to clamp the flash current per LED channel when
safety timer is disabled. It needs to be updated according to the
maximum torch LED current setting to ensure the torch current won't
be clamped unexpectedly.

Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs")
Signed-off-by: Fenglin Wu <[email-masked]>
Reviewed-by: Konrad Dybcio <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Lee Jones <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/leds/flash/leds-qcom-flash.c | 62 ++++++++++++++++------------
 1 file changed, 36 insertions(+), 26 deletions(-)

diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c
index 07a83bb2dfdf6..bb00097b1ae59 100644
--- a/drivers/leds/flash/leds-qcom-flash.c
+++ b/drivers/leds/flash/leds-qcom-flash.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/bitfield.h>
@@ -114,36 +114,39 @@ enum {
 	REG_THERM_THRSH1,
 	REG_THERM_THRSH2,
 	REG_THERM_THRSH3,
+	REG_TORCH_CLAMP,
 	REG_MAX_COUNT,
 };
 
 static const struct reg_field mvflash_3ch_regs[REG_MAX_COUNT] = {
-	REG_FIELD(0x08, 0, 7),			/* status1	*/
-	REG_FIELD(0x09, 0, 7),                  /* status2	*/
-	REG_FIELD(0x0a, 0, 7),                  /* status3	*/
-	REG_FIELD_ID(0x40, 0, 7, 3, 1),         /* chan_timer	*/
-	REG_FIELD_ID(0x43, 0, 6, 3, 1),         /* itarget	*/
-	REG_FIELD(0x46, 7, 7),                  /* module_en	*/
-	REG_FIELD(0x47, 0, 5),                  /* iresolution	*/
-	REG_FIELD_ID(0x49, 0, 2, 3, 1),         /* chan_strobe	*/
-	REG_FIELD(0x4c, 0, 2),                  /* chan_en	*/
-	REG_FIELD(0x56, 0, 2),			/* therm_thrsh1 */
-	REG_FIELD(0x57, 0, 2),			/* therm_thrsh2 */
-	REG_FIELD(0x58, 0, 2),			/* therm_thrsh3 */
+	[REG_STATUS1]		= REG_FIELD(0x08, 0, 7),
+	[REG_STATUS2]		= REG_FIELD(0x09, 0, 7),
+	[REG_STATUS3]		= REG_FIELD(0x0a, 0, 7),
+	[REG_CHAN_TIMER]	= REG_FIELD_ID(0x40, 0, 7, 3, 1),
+	[REG_ITARGET]		= REG_FIELD_ID(0x43, 0, 6, 3, 1),
+	[REG_MODULE_EN]		= REG_FIELD(0x46, 7, 7),
+	[REG_IRESOLUTION]	= REG_FIELD(0x47, 0, 5),
+	[REG_CHAN_STROBE]	= REG_FIELD_ID(0x49, 0, 2, 3, 1),
+	[REG_CHAN_EN]		= REG_FIELD(0x4c, 0, 2),
+	[REG_THERM_THRSH1]	= REG_FIELD(0x56, 0, 2),
+	[REG_THERM_THRSH2]	= REG_FIELD(0x57, 0, 2),
+	[REG_THERM_THRSH3]	= REG_FIELD(0x58, 0, 2),
+	[REG_TORCH_CLAMP]	= REG_FIELD(0xec, 0, 6),
 };
 
 static const struct reg_field mvflash_4ch_regs[REG_MAX_COUNT] = {
-	REG_FIELD(0x06, 0, 7),			/* status1	*/
-	REG_FIELD(0x07, 0, 6),			/* status2	*/
-	REG_FIELD(0x09, 0, 7),			/* status3	*/
-	REG_FIELD_ID(0x3e, 0, 7, 4, 1),		/* chan_timer	*/
-	REG_FIELD_ID(0x42, 0, 6, 4, 1),		/* itarget	*/
-	REG_FIELD(0x46, 7, 7),			/* module_en	*/
-	REG_FIELD(0x49, 0, 3),			/* iresolution	*/
-	REG_FIELD_ID(0x4a, 0, 6, 4, 1),		/* chan_strobe	*/
-	REG_FIELD(0x4e, 0, 3),			/* chan_en	*/
-	REG_FIELD(0x7a, 0, 2),			/* therm_thrsh1 */
-	REG_FIELD(0x78, 0, 2),			/* therm_thrsh2 */
+	[REG_STATUS1]		= REG_FIELD(0x06, 0, 7),
+	[REG_STATUS2]		= REG_FIELD(0x07, 0, 6),
+	[REG_STATUS3]		= REG_FIELD(0x09, 0, 7),
+	[REG_CHAN_TIMER]	= REG_FIELD_ID(0x3e, 0, 7, 4, 1),
+	[REG_ITARGET]		= REG_FIELD_ID(0x42, 0, 6, 4, 1),
+	[REG_MODULE_EN]		= REG_FIELD(0x46, 7, 7),
+	[REG_IRESOLUTION]	= REG_FIELD(0x49, 0, 3),
+	[REG_CHAN_STROBE]	= REG_FIELD_ID(0x4a, 0, 6, 4, 1),
+	[REG_CHAN_EN]		= REG_FIELD(0x4e, 0, 3),
+	[REG_THERM_THRSH1]	= REG_FIELD(0x7a, 0, 2),
+	[REG_THERM_THRSH2]	= REG_FIELD(0x78, 0, 2),
+	[REG_TORCH_CLAMP]	= REG_FIELD(0xed, 0, 6),
 };
 
 struct qcom_flash_data {
@@ -156,6 +159,7 @@ struct qcom_flash_data {
 	u8			max_channels;
 	u8			chan_en_bits;
 	u8			revision;
+	u8			torch_clamp;
 };
 
 struct qcom_flash_led {
@@ -702,6 +706,7 @@ static int qcom_flash_register_led_device(struct device *dev,
 	u32 current_ua, timeout_us;
 	u32 channels[4];
 	int i, rc, count;
+	u8 torch_clamp;
 
 	count = fwnode_property_count_u32(node, "led-sources");
 	if (count <= 0) {
@@ -751,6 +756,12 @@ static int qcom_flash_register_led_device(struct device *dev,
 	current_ua = min_t(u32, current_ua, TORCH_CURRENT_MAX_UA * led->chan_count);
 	led->max_torch_current_ma = current_ua / UA_PER_MA;
 
+	torch_clamp = (current_ua / led->chan_count) / TORCH_IRES_UA;
+	if (torch_clamp != 0)
+		torch_clamp--;
+
+	flash_data->torch_clamp = max_t(u8, flash_data->torch_clamp, torch_clamp);
+
 	if (fwnode_property_present(node, "flash-max-microamp")) {
 		flash->led_cdev.flags |= LED_DEV_CAP_FLASH;
 
@@ -918,8 +929,7 @@ static int qcom_flash_led_probe(struct platform_device *pdev)
 		flash_data->leds_count++;
 	}
 
-	return 0;
-
+	return regmap_field_write(flash_data->r_fields[REG_TORCH_CLAMP], flash_data->torch_clamp);
 release:
 	fwnode_handle_put(child);
 	while (flash_data->v4l2_flash[flash_data->leds_count] && flash_data->leds_count)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:28:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368038; cv=none; b=EheaEXhqwahbxpn36JVS6qpPyn0lOL8J8MY/6+0QfP71J15bVHiy1RF6O+QBq/CBPYamggw7E2R4frZ0Myo8kg35BPGVx+Zs2mz09MBBOju+lF6jAU/I/aniYbtaCUFDGpHxhInyUMBc3fYBg75ReOTvM2t/V1hFPsFUOf5bC74=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368038; c=relaxed/simple;
	bh=rK7Htv5gUeprbWN6enzdxJVWQx4B+pBk8HSpE6azPjQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=dm6Uhu54XAx2GXVi3cjkgmsgDKA1Tt9w+QwDnjpIgi0y9RNtpIUk1YTGBbWUczPV38VRjv/Q+MlIl2caTvpFOt/HrFObK+oFXD2DkiBfuFKyaimEptVFWFCM+xr4KwmeYPlUrsrbDYMGChRyfGviwrpB5YzquHsz20JU078i5Nc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XqQTiTP7; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 022/262] ARM: dts: renesas: porter: Fix CAN pin group
Date: Mon, 13 Oct 2025 16:42:44 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email-masked]>

[ Upstream commit 287066b295051729fb08c3cff12ae17c6fe66133 ]

According to the schematics, the CAN transceiver is connected to pins
GP7_3 and GP7_4, which correspond to CAN0 data group B.

Fixes: 0768fbad7fba1d27 ("ARM: shmobile: porter: add CAN0 DT support")
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Link: https://lore.kernel.org/70ad9[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm/boot/dts/renesas/r8a7791-porter.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
index 93c86e9216455..b255eb228dd74 100644
--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts
+++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts
@@ -290,7 +290,7 @@ vin0_pins: vin0 {
 	};
 
 	can0_pins: can0 {
-		groups = "can0_data";
+		groups = "can0_data_b";
 		function = "can0";
 	};
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:55:13 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368035; cv=none; b=FncQwXuGYxBgydwCONRIg9Cco1J1xECYaky4QYVK392VtwDbiaF0+vJ8E8hoEl9i258Cqy9CUWYZnY69t4ui8sLAxBw6zcug84llajY4Cf8bj77HjV+TerNBCYw1BPrQiS700HSqQ6rRSIb9MgC43NhsMgo8UbwB0p8LfJWocJ4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368035; c=relaxed/simple;
	bh=vbS7YjwnQ9a0rxE93ZvY5cNfOUDOHVH0VYN47uaxREY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=J5DInfqWEmTB0dZw9U9pQTua+gQAWC4Qo0F23/fykXw0UxZAD5cv1ZyCE8GAC/nRYuiefiM/XLde14yqsmFmv8wDRrMqsvaf8pClKtzD1qpqtiQQ/8NIIobWnnBa7/Ut9UOSx5HqYwm0tgeAozCltYMlITZwZdZiQP83BU/IAVg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=plhCMr3X; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yureka Lilian <[email-masked]>,
	Andrii Nakryiko <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 021/262] libbpf: Fix reuse of DEVMAP
Date: Mon, 13 Oct 2025 16:42:43 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yureka Lilian <[email-masked]>

[ Upstream commit 6c6b4146deb12d20f42490d5013f2043df942161 ]

Previously, re-using pinned DEVMAP maps would always fail, because
get_map_info on a DEVMAP always returns flags with BPF_F_RDONLY_PROG set,
but BPF_F_RDONLY_PROG being set on a map during creation is invalid.

Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
get_map_info when checking for compatibility with an existing DEVMAP.

The same problem is handled in a third-party ebpf library:
- https://github.com/cilium/ebpf/issues/925
- https://github.com/cilium/ebpf/pull/930

Fixes: 0cdbb4b09a06 ("devmap: Allow map lookups from eBPF")
Signed-off-by: Yureka Lilian <[email-masked]>
Signed-off-by: Andrii Nakryiko <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/lib/bpf/libbpf.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index e33cf3caf8b64..ac5ad30266a5e 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -5056,6 +5056,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
 		return false;
 	}
 
+	/*
+	 * bpf_get_map_info_by_fd() for DEVMAP will always return flags with
+	 * BPF_F_RDONLY_PROG set, but it generally is not set at map creation time.
+	 * Thus, ignore the BPF_F_RDONLY_PROG flag in the flags returned from
+	 * bpf_get_map_info_by_fd() when checking for compatibility with an
+	 * existing DEVMAP.
+	 */
+	if (map->def.type == BPF_MAP_TYPE_DEVMAP || map->def.type == BPF_MAP_TYPE_DEVMAP_HASH)
+		map_info.map_flags &= ~BPF_F_RDONLY_PROG;
+
 	return (map_info.type == map->def.type &&
 		map_info.key_size == map->def.key_size &&
 		map_info.value_size == map->def.value_size &&
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:26:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368033; cv=none; b=aCzBocwUvu94KUyiLNZt48s3eiRBDnJ8z6+EBKSdLck+5i6a4SFobONOUZig0Zy6J+RcjXsN//Uoobu68Uo64EEiN04ZpdBnWQ+IyBIRr1q+ouW1t1dCSgbECyWd3Ie2iGSrhZqzLkci4GMAg6XF/vKyaOuMaz27qrJ9t+5WeOg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368033; c=relaxed/simple;
	bh=aVNusDdpjQFpZIFBqBWO/hIf4hb/JmCuGTnR/UHXTPM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=YawTWdBQMIT0C5unO3cpCgYLAZs7lc8YWDVfYigICNp9peMYg9ZfTb6bncggCDiAkYgSIwKLjA2k/JE63nJHjhd1cCW274aapW9Srk7o1owCss3o/94+Xham4vLxI/dL9lmhF+RwQGUfzLprOwu6YqCVxRU/9jdd2N6l8GWv71E=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DYnKu/qu; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Tao Chen <[email-masked]>,
	Andrii Nakryiko <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 020/262] bpf: Remove migrate_disable in kprobe_multi_link_prog_run
Date: Mon, 13 Oct 2025 16:42:42 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tao Chen <[email-masked]>

[ Upstream commit abdaf49be5424db74e19d167c10d7dad79a0efc2 ]

Graph tracer framework ensures we won't migrate, kprobe_multi_link_prog_run
called all the way from graph tracer, which disables preemption in
function_graph_enter_regs, as Jiri and Yonghong suggested, there is no
need to use migrate_disable. As a result, some overhead may will be reduced.
And add cant_sleep check for __this_cpu_inc_return.

Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
Signed-off-by: Tao Chen <[email-masked]>
Signed-off-by: Andrii Nakryiko <[email-masked]>
Link: https://lore.kernel.org/bpf/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/trace/bpf_trace.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 3ec7df7dbeec4..4a44451efbcc6 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2759,19 +2759,24 @@ kprobe_multi_link_prog_run(struct bpf_kprobe_multi_link *link,
 	struct bpf_run_ctx *old_run_ctx;
 	int err;
 
+	/*
+	 * graph tracer framework ensures we won't migrate, so there is no need
+	 * to use migrate_disable for bpf_prog_run again. The check here just for
+	 * __this_cpu_inc_return.
+	 */
+	cant_sleep();
+
 	if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {
 		bpf_prog_inc_misses_counter(link->link.prog);
 		err = 0;
 		goto out;
 	}
 
-	migrate_disable();
 	rcu_read_lock();
 	old_run_ctx = bpf_set_run_ctx(&run_ctx.session_ctx.run_ctx);
 	err = bpf_prog_run(link->link.prog, regs);
 	bpf_reset_run_ctx(old_run_ctx);
 	rcu_read_unlock();
-	migrate_enable();
 
  out:
 	__this_cpu_dec(bpf_prog_active);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:26:04 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368027; cv=none; b=Y8tbKgfoyIstN86ION2OSabgsgoznJLdWh+Sww44hkIBe7XNKUYVPmFdSZh1x8+fTGUr40NZ3aVlNtrnQS/lnBBbm4ZJzwnhwwhv/FBX5aDt1HtDLw8mLUJV7QWMpRMBK5W0zPqhknZrXVQ28cwgDu8KDV8KN3xvSJLe1UdXarI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368027; c=relaxed/simple;
	bh=SfmAHpgFDKGqJk7eeubCvdBc5b7Z58NqA14PB4VZIZc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=e/UFsX/8/x90UXObQV+4uz7qJqzgK8FqRYQLTwrxsHhFQ6a/NwK3LZtz+YBdxrIJmuG53PLXmBniYjMEBK8PvVDJ6ekSG/OFmjNejbPLH8pObAMBYTBqydW2gUiTXJU6jiI/w/bR+q0NCTHJn+NIJduBMAxR4QCwDm0OY7dmLWs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=BGBNBsIQ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Matt Bobrowski <[email-masked]>,
	Martin KaFai Lau <[email-masked]>,
	Stanislav Fomichev <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 019/262] bpf/selftests: Fix test_tcpnotify_user
Date: Mon, 13 Oct 2025 16:42:41 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Matt Bobrowski <[email-masked]>

[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ]

Based on a bisect, it appears that commit 7ee988770326 ("timers:
Implement the hierarchical pull model") has somehow inadvertently
broken BPF selftest test_tcpnotify_user. The error that is being
generated by this test is as follows:

	FAILED: Wrong stats Expected 10 calls, got 8

It looks like the change allows timer functions to be run on CPUs
different from the one they are armed on. The test had pinned itself
to CPU 0, and in the past the retransmit attempts also occurred on CPU
0. The test had set the max_entries attribute for
BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling
bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was
likely to be in range. With the change to allow timers to run on other
CPUs, the current CPU tasked with performing the retransmit might be
bumped and in turn fall out of range, as the event will be filtered
out via __bpf_perf_event_output() using:

    if (unlikely(index >= array->map.max_entries))
            return -E2BIG;

A possible change would be to explicitly set the max_entries attribute
for perf_event_map in test_tcpnotify_kern.c to a value that's at least
as large as the number of CPUs. As it turns out however, if the field
is left unset, then the libbpf will determine the number of CPUs available
on the underlying system and update the max_entries attribute accordingly
in map_set_def_max_entries().

A further problem with the test is that it has a thread that continues
running up until the program exits. The main thread cleans up some
LIBBPF data structures, while the other thread continues to use them,
which inevitably will trigger a SIGSEGV. This can be dealt with by
telling the thread to run for as long as necessary and doing a
pthread_join on it before exiting the program.

Finally, I don't think binding the process to CPU 0 is meaningful for
this test any more, so get rid of that.

Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification")
Signed-off-by: Matt Bobrowski <[email-masked]>
Signed-off-by: Martin KaFai Lau <[email-masked]>
Acked-by: Stanislav Fomichev <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../selftests/bpf/progs/test_tcpnotify_kern.c |  1 -
 .../selftests/bpf/test_tcpnotify_user.c       | 20 +++++++++----------
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
index 540181c115a85..ef00d38b0a8d2 100644
--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
+++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
@@ -23,7 +23,6 @@ struct {
 
 struct {
 	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
-	__uint(max_entries, 2);
 	__type(key, int);
 	__type(value, __u32);
 } perf_event_map SEC(".maps");
diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c
index 595194453ff8f..35b4893ccdf8a 100644
--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c
+++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c
@@ -15,20 +15,18 @@
 #include <bpf/libbpf.h>
 #include <sys/ioctl.h>
 #include <linux/rtnetlink.h>
-#include <signal.h>
 #include <linux/perf_event.h>
-#include <linux/err.h>
 
-#include "bpf_util.h"
 #include "cgroup_helpers.h"
 
 #include "test_tcpnotify.h"
-#include "trace_helpers.h"
 #include "testing_helpers.h"
 
 #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L)
 
 pthread_t tid;
+static bool exit_thread;
+
 int rx_callbacks;
 
 static void dummyfn(void *ctx, int cpu, void *data, __u32 size)
@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb)
 {
 	int err;
 
-	while (1) {
+	while (!exit_thread) {
 		err = perf_buffer__poll(pb, 100);
 		if (err < 0 && err != -EINTR) {
 			printf("failed perf_buffer__poll: %d\n", err);
@@ -78,15 +76,10 @@ int main(int argc, char **argv)
 	int error = EXIT_FAILURE;
 	struct bpf_object *obj;
 	char test_script[80];
-	cpu_set_t cpuset;
 	__u32 key = 0;
 
 	libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
 
-	CPU_ZERO(&cpuset);
-	CPU_SET(0, &cpuset);
-	pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset);
-
 	cg_fd = cgroup_setup_and_join(cg_path);
 	if (cg_fd < 0)
 		goto err;
@@ -151,6 +144,13 @@ int main(int argc, char **argv)
 
 	sleep(10);
 
+	exit_thread = true;
+	int ret = pthread_join(tid, NULL);
+	if (ret) {
+		printf("FAILED: pthread_join\n");
+		goto err;
+	}
+
 	if (verify_result(&g)) {
 		printf("FAILED: Wrong stats Expected %d calls, got %d\n",
 			g.ncalls, rx_callbacks);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:26:02 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368024; cv=none; b=eXgWuJuaQLUEMDQy8DrUAHVtQ6N8i7AArs+uGpqRMdjTKOSkDfjEPnXdLsbgmgzUAZPZUbEPqCoTwbVFxXwnhwGwrHXStewDTsUJ0Guzb07/KkV6RfG/0MN3vqMXHWyatno7X/soY1jrYegggLkkc76w4Ht9oSZ+pSBE4Rl5oQ4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368024; c=relaxed/simple;
	bh=7a1gDoXXv1UfwRFLqtsxvV/Vj2XDwOhXdsJT3XePFtM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=S2UNXbalnRoMi5Ji0w48i6Vri0p3JlP7sNkGKeD8LHmUbJqQdM2LjwmnAk+Bq3uiDr4KMO6PRKXK1OnC8n7MMSxoeOGg4lvMVMVp5rbML3L0Os2w1LeKNzR81kQj7rg1P7wjYFYgQHgigJIDpeDIlQWDv40fIu2NqwnLv6esLdU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=jJAtGXjk; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Geert Uytterhoeven <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 018/262] regmap: Remove superfluous check for !config in __regmap_init()
Date: Mon, 13 Oct 2025 16:42:40 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email-masked]>

[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]

The first thing __regmap_init() do is check if config is non-NULL,
so there is no need to check for this again later.

Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config")
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Link: https://patch.msgid.link/a154d[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/base/regmap/regmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index de4e2f3db942a..66b3840bd96e3 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -828,7 +828,7 @@ struct regmap *__regmap_init(struct device *dev,
 		map->read_flag_mask = bus->read_flag_mask;
 	}
 
-	if (config && config->read && config->write) {
+	if (config->read && config->write) {
 		map->reg_read  = _regmap_bus_read;
 		if (config->reg_update_bits)
 			map->reg_update_bits = config->reg_update_bits;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:49:44 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368022; cv=none; b=f7lz7s+LbxhSo0JkoLYsXxGuYL5qLeqwqtgImGAtZhyGeFpNpeNJ7DQs1QjeZmXcN93MPZ6N8cc0XANY2bPUDkcuL+rfO9zZ+E2st1go7hHF581EMQVAzcNWl4NbR2wF7cVYVIPTxZ5TY/zcJpDpNDSDbRM6m10Dpsf1pu2w8iE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368022; c=relaxed/simple;
	bh=dxqr5YYeBOvPCB5fOOPp2RnlHnrlwlnTSJQiV+sYC9Q=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=mz+4CgWRZrd2uX+4caevUwF8tT/CL23+9hcslcqsSVy1VJxkCBsLUmKV1Xr5Odcrd/bqeTX9Y9iUCm18hs1nXSxSo0+IFAomNh+Hwj+GH+Y5VZ1ydNKsUNFRmw8OjrmwNDiyB5QpyZ8CFVq+kBLxgsvda6+HZa8xWSw8oEqfUcA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bqa9k5l+; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Biju Das <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 017/262] arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
Date: Mon, 13 Oct 2025 16:42:39 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Biju Das <[email-masked]>

[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ]

On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we
are deleting a wrong and nonexistent node.  Fixing the wrong node would
invoke a dtb warning message, as channel0 is a required property.
Disable CAN-FD channel0 instead of deleting the node.

Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1")
Signed-off-by: Biju Das <[email-masked]>
Reviewed-by: Geert Uytterhoeven <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
index 377849cbb462e..5785a934c28bf 100644
--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
@@ -48,7 +48,10 @@ sound_card {
 #if (SW_SCIF_CAN || SW_RSPI_CAN)
 &canfd {
 	pinctrl-0 = <&can1_pins>;
-	/delete-node/ channel@0;
+
+	channel0 {
+		status = "disabled";
+	};
 };
 #else
 &canfd {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:40:42 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368018; cv=none; b=WImfLxbZgAwbHJdgs19zn+uU4fNBWnHVeAYAWGMeMoVr6AtthZYHv2A9lxS+v0KFc8w3hyYRCvIGpVlzY7gkAua0zCPnQH78Yno8YJIUNJpAm7phocXRfpxgOnkFYvND0R8qODVS6VvDv38uEkjwgY2IzfNQeH3gH/QlHVwSAqY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368018; c=relaxed/simple;
	bh=+7rkvsG0Ywma1xpaD2a2hQ160AnNgUhmz3tRGyanuEQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=n9MxDV84VmVMeceamiYsf5klNcqcli5O4YAm0k+y5O2kQvej1hmpL5rW8ho8ENgvYxTuHIPzv8sofppmHWpcAeZHuoO22iuZDLojLqmRk7GdXh7un/sRaB7ayc6GA41sAKtvWr+HnhA5y9Jjz8KWHhHk0K/QO6Qbn7JL25f5gGw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=H6XKLQoE; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Lad Prabhakar <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 016/262] pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read()
Date: Mon, 13 Oct 2025 16:42:38 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lad Prabhakar <[email-masked]>

[ Upstream commit 8912b2862b9b74a0dc4e3ea1aacdec2f8abd7e1d ]

rzg3s_oen_read() returns a u32 value, but previously propagated a negative
error code from rzg3s_pin_to_oen_bit(), resulting in an unintended large
positive value due to unsigned conversion. This caused incorrect
output-enable reporting for certain pins.

Without this patch, pins P1_0-P1_4 and P7_0-P7_4 are incorrectly reported
as "output enabled" in the pinconf-pins debugfs file. With this fix, only
P1_0-P1_1 and P7_0-P7_1 are shown as "output enabled", which matches the
hardware manual.

Fix this by returning 0 when the OEN bit lookup fails, treating the pin
as output-disabled by default.

Fixes: a9024a323af2 ("pinctrl: renesas: rzg2l: Clean up and refactor OEN read/write functions")
Signed-off-by: Lad Prabhakar <[email-masked]>
Reviewed-by: Geert Uytterhoeven <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
index bde58f5a743cb..698ab8cc970a6 100644
--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
@@ -1074,7 +1074,7 @@ static u32 rzg3s_oen_read(struct rzg2l_pinctrl *pctrl, unsigned int _pin)
 
 	bit = rzg3s_pin_to_oen_bit(pctrl, _pin);
 	if (bit < 0)
-		return bit;
+		return 0;
 
 	return !(readb(pctrl->base + ETH_MODE) & BIT(bit));
 }
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:25:57 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368016; cv=none; b=FeM/ANyTzieyrUjAsJYDYRBMoqbFMMCAVTMcs+yjQx+8YG+CKLC/Dc69lozTk4mU/YpFauRXPZN9B6wVBlnHv2dmjSZdu1WaY9Z2qvVAaZN5v2fw3Y5bR9Co1BxftRX8761GYDShTVKum1NeqRhjfgFGsUi0FM+iZB668rkeg2E=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368016; c=relaxed/simple;
	bh=7pcTRgnkv16c390QwZVIHbvtzFtm/SlLb/tnr2slnUU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=JyDj2k9LGKy57abt4Mf40WJz0vFldTnvr7zNaYRyrhnk8pmJ6F/QnuOIr+S7huTIKFAFhxH9fBRxj9fwpGD5jhhnR2DrbPRxNEwkq1uCehm/nMeZGAyZcYSRI5U3SUGWpXL61Wf4vjo6ti+yKNUIltkSjM3Kl5DT8vNvx4zuO38=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Rv+Cc1Gj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Daniel Vacek <[email-masked]>,
	Qu Wenruo <[email-masked]>,
	David Sterba <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 015/262] btrfs: return any hit error from extent_writepage_io()
Date: Mon, 13 Oct 2025 16:42:37 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qu Wenruo <[email-masked]>

[ Upstream commit 2d83ed6c6c4607b42ee7927e92a9d2fa31d6f30b ]

Since the support of bs < ps support, extent_writepage_io() will submit
multiple blocks inside the folio.

But if we hit error submitting one sector, but the next sector can still
be submitted successfully, the function extent_writepage_io() will still
return 0.

This will make btrfs to silently ignore the error without setting error
flag for the filemap.

Fix it by recording the first error hit, and always return that value.

Fixes: 8bf334beb349 ("btrfs: fix double accounting race when extent_writepage_io() failed")
Reviewed-by: Daniel Vacek <[email-masked]>
Signed-off-by: Qu Wenruo <[email-masked]>
Signed-off-by: David Sterba <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/btrfs/extent_io.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index afebc91882bef..60fe155b1ce05 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -1479,7 +1479,7 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
 	struct btrfs_fs_info *fs_info = inode->root->fs_info;
 	unsigned long range_bitmap = 0;
 	bool submitted_io = false;
-	bool error = false;
+	int found_error = 0;
 	const u64 folio_start = folio_pos(folio);
 	u64 cur;
 	int bit;
@@ -1536,7 +1536,8 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
 			 */
 			btrfs_mark_ordered_io_finished(inode, folio, cur,
 						       fs_info->sectorsize, false);
-			error = true;
+			if (!found_error)
+				found_error = ret;
 			continue;
 		}
 		submitted_io = true;
@@ -1553,11 +1554,11 @@ static noinline_for_stack int extent_writepage_io(struct btrfs_inode *inode,
 	 * If we hit any error, the corresponding sector will still be dirty
 	 * thus no need to clear PAGECACHE_TAG_DIRTY.
 	 */
-	if (!submitted_io && !error) {
+	if (!submitted_io && !found_error) {
 		btrfs_folio_set_writeback(fs_info, folio, start, len);
 		btrfs_folio_clear_writeback(fs_info, folio, start, len);
 	}
-	return ret;
+	return found_error;
 }
 
 /*
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:21:47 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368013; cv=none; b=kOIBd8Fv2YmTrVXQv1Gu2n5k0P3XzsIrUrcM92b52g6j7wAgWaGEbCvx2Gckfx+mHEzm8GZC9d5HSceKOcRLHTVl9vS0ImoLlLwYtIzcw3mAXcrSU500DTEMuVmApIuAK+R5dJKM1AYTyLqFlht7AzeqJU/a8FkReSaOoe/lwJU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368013; c=relaxed/simple;
	bh=ualfuXBdZOApZF4uCQRs1N9PkN/fkVnBBew3DDLuiRU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=UcXCSWX6XYnvvner5q3mMMXeC0fRMs66M1iMX+1nunu/5Ianoly+1f2MRnOJSIXAeZqfGIeY9Eg8SWJsQ24mjnQ9wkaIgbohgrJnvqSdhNfHc8OCmI2jfdBF3iVYLVQ2xR6pNDZP54drby57OMhSAfwe2A2DSBOU5kATZ9WFrPQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=SF3vXd5Q; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Randy Dunlap <[email-masked]>,
	Paul Moore <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 014/262] lsm: CONFIG_LSM can depend on CONFIG_SECURITY
Date: Mon, 13 Oct 2025 16:42:36 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Randy Dunlap <[email-masked]>

[ Upstream commit 54d94c422fed9575b74167333c1757847a4e6899 ]

When CONFIG_SECURITY is not set, CONFIG_LSM (builtin_lsm_order) does
not need to be visible and settable since builtin_lsm_order is defined in
security.o, which is only built when CONFIG_SECURITY=y.

So make CONFIG_LSM depend on CONFIG_SECURITY.

Fixes: 13e735c0e953 ("LSM: Introduce CONFIG_LSM")
Signed-off-by: Randy Dunlap <[email-masked]>
[PM: subj tweak]
Signed-off-by: Paul Moore <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 security/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/security/Kconfig b/security/Kconfig
index 28e685f53bd1a..ce9f1a651ccc3 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -264,6 +264,7 @@ endchoice
 
 config LSM
 	string "Ordered list of enabled LSMs"
+	depends on SECURITY
 	default "landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,ipe,bpf" if DEFAULT_SECURITY_SMACK
 	default "landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,ipe,bpf" if DEFAULT_SECURITY_APPARMOR
 	default "landlock,lockdown,yama,loadpin,safesetid,tomoyo,ipe,bpf" if DEFAULT_SECURITY_TOMOYO
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:33:49 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368010; cv=none; b=uC29h0RieTABmehGiPSzl6yaQf3by7xf+rdqDU6uM1cglKo85Pp9e7pbThjgo8Tmxtt3tmv4+WCxkf1Oxzl4FSMm3/YvC4QAlUUbf3QspKgzq+NOwmcIc+Eio3k4CQQT65JlZYFnPuaUZqxp5C+UoWMb32AuHGHDWfIusihzAo8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368010; c=relaxed/simple;
	bh=RyH7hujMbH/aRd+ssv+Psrsu0+FDg/g6HXmRLn7V7rQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bbK0KXTPawo6HPXiTUXyixaht0h/DW1Q6s4+U1Z8hb6Ouhh/5DZSZcLXumDNJ9f3rb1FlDchxf5RqjY+B3NGZz+gZY7HBKZILIqCB0uYMHAX7IOdUf9OAHUxoixxPMwI14xMTnD9NgK3zcSF28u9eesInQJhbwCiNF5MPLZ/kCE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=1O0rg21B; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Uros Bizjak <[email-masked]>,
	"Borislav Petkov (AMD)" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 013/262] x86/vdso: Fix output operand size of RDPID
Date: Mon, 13 Oct 2025 16:42:35 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Uros Bizjak <[email-masked]>

[ Upstream commit ac9c408ed19d535289ca59200dd6a44a6a2d6036 ]

RDPID instruction outputs to a word-sized register (64-bit on x86_64 and
32-bit on x86_32). Use an unsigned long variable to store the correct size.

LSL outputs to 32-bit register, use %k operand prefix to always print the
32-bit name of the register.

Use RDPID insn mnemonic while at it as the minimum binutils version of
2.30 supports it.

  [ bp: Merge two patches touching the same function into a single one. ]

Fixes: ffebbaedc861 ("x86/vdso: Introduce helper functions for CPU and node number")
Signed-off-by: Uros Bizjak <[email-masked]>
Signed-off-by: Borislav Petkov (AMD) <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/x86/include/asm/segment.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
index 9d6411c659205..00cefbb59fa98 100644
--- a/arch/x86/include/asm/segment.h
+++ b/arch/x86/include/asm/segment.h
@@ -244,7 +244,7 @@ static inline unsigned long vdso_encode_cpunode(int cpu, unsigned long node)
 
 static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
 {
-	unsigned int p;
+	unsigned long p;
 
 	/*
 	 * Load CPU and node number from the GDT.  LSL is faster than RDTSCP
@@ -254,10 +254,10 @@ static inline void vdso_read_cpunode(unsigned *cpu, unsigned *node)
 	 *
 	 * If RDPID is available, use it.
 	 */
-	alternative_io ("lsl %[seg],%[p]",
-			".byte 0xf3,0x0f,0xc7,0xf8", /* RDPID %eax/rax */
+	alternative_io ("lsl %[seg],%k[p]",
+			"rdpid %[p]",
 			X86_FEATURE_RDPID,
-			[p] "=a" (p), [seg] "r" (__CPUNODE_SEG));
+			[p] "=r" (p), [seg] "r" (__CPUNODE_SEG));
 
 	if (cpu)
 		*cpu = (p & VDSO_CPUNODE_MASK);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:21:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368007; cv=none; b=c85C72QETu5FTr6ouKKJ8vZtJetnlsZ6h0ggP5J6RCFVGs9azyuQqZsKA9PSb6lU4V/yJ8UJPctnt2bZBzRO98ciM/JE8AcR27bm5vcopreTZGnPZkeDykKCUMsd23QHD/hZaDmaFpQZvW80GF3zRzmoFBNfaJOtGkVhXPZOsDg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368007; c=relaxed/simple;
	bh=MWFYCSS0jMU7648f8yYNk+lqoHgALSx8WW5IOGWOZ88=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=aMvesRy5Rf5XVH2Wttaxl7cAhy2XiA1WBNQFlJUJy6DYJmmFzvkgdZvdfJztPE5ml4JaIxaCwqOdzhn4DuiiAj0Z1icmDqF7RFBwDnMipCtGDNdVS2GLFCU8DjhCTHmEIyThIaBJ/0oAa1AJ6UJJ7mCfIkphChFcV14LZqZMK+U=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KU+/nEaE; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jose Jesus Ambriz Meza <[email-masked]>,
	"Chia-Lin Kao (AceLan)" <[email-masked]>,
	Qiuxu Zhuo <[email-masked]>,
	Tony Luck <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 012/262] EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller
Date: Mon, 13 Oct 2025 16:42:34 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qiuxu Zhuo <[email-masked]>

[ Upstream commit 2e6fe1bbefd9c059c3787d1c620fe67343a94dff ]

When loading the i10nm_edac driver on some Intel Granite Rapids servers,
a call trace may appear as follows:

  UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16
  shift exponent -66 is negative
  ...
  __ubsan_handle_shift_out_of_bounds+0x1e3/0x390
  skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common]
  i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac]
  skx_register_mci+0x159/0x220 [skx_edac_common]
  i10nm_init+0xcb0/0x1ff0 [i10nm_edac]
  ...

This occurs because some BIOS may disable a memory controller if there
aren't any memory DIMMs populated on this memory controller. The DIMMMTR
register of this disabled memory controller contains the invalid value
~0, resulting in the call trace above.

Fix this call trace by skipping DIMM enumeration on a disabled memory
controller.

Fixes: ba987eaaabf9 ("EDAC/i10nm: Add Intel Granite Rapids server support")
Reported-by: Jose Jesus Ambriz Meza <[email-masked]>
Reported-by: Chia-Lin Kao (AceLan) <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]/
Signed-off-by: Qiuxu Zhuo <[email-masked]>
Signed-off-by: Tony Luck <[email-masked]>
Tested-by: Chia-Lin Kao (AceLan) <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/edac/i10nm_base.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
index ac4b3d95531c5..d8cd12d906a72 100644
--- a/drivers/edac/i10nm_base.c
+++ b/drivers/edac/i10nm_base.c
@@ -967,6 +967,15 @@ static bool i10nm_check_ecc(struct skx_imc *imc, int chan)
 	return !!GET_BITFIELD(mcmtr, 2, 2);
 }
 
+static bool i10nm_channel_disabled(struct skx_imc *imc, int chan)
+{
+	u32 mcmtr = I10NM_GET_MCMTR(imc, chan);
+
+	edac_dbg(1, "mc%d ch%d mcmtr reg %x\n", imc->mc, chan, mcmtr);
+
+	return (mcmtr == ~0 || GET_BITFIELD(mcmtr, 18, 18));
+}
+
 static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
 				 struct res_config *cfg)
 {
@@ -980,6 +989,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
 		if (!imc->mbase)
 			continue;
 
+		if (i10nm_channel_disabled(imc, i)) {
+			edac_dbg(1, "mc%d ch%d is disabled.\n", imc->mc, i);
+			continue;
+		}
+
 		ndimms = 0;
 
 		if (res_cfg->type != GNR)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:33 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368004; cv=none; b=dXWxfwkbCSrX0zHw6XpziLwEC2HM7UkQqVWb2RLCp0yPECoKEPMvsoCvhQBb71Fnf0iKcDAuPFP/qhMNMQXMR/o7dFYzO3xnFoD4UYagVWq51CCxvQ/3Xl9TVrGa4Qwb337QBPegpNgAeHtL6lgTP+/Z/RxXLEwVuvkI7FcAl6Q=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368004; c=relaxed/simple;
	bh=fLiQFp8kMzuRKwFJFhBrFl72OV+6K1KagPxF/0HHwFY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=KkDM5Ihc3FMPi9hb+MrPyP4lxMS9WKQwSzsyR/5g9YC+MyGT+flERhQhWqxKwmDuW+/e+CbWUkCP4/RS/oU/jFyniPmUYSEJZCrdxDICWcPp/3pAlTVEiU7gdkjj/NwTqEZOMQfYespKbyfV481b8rMlhmWxLpu3FcHFLPDaGpc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=cJm9F7+9; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id D9FEAC4CEE7;
	Mon, 13 Oct 2025 15:06:43 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760368004;
	bh=fLiQFp8kMzuRKwFJFhBrFl72OV+6K1KagPxF/0HHwFY=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=cJm9F7+9qCJ7cqP5IPpDlFTYY+qRij01nx7aa/pgWwrM8REPi8qTtHv/DtezSicYw
	 DaWgUcVFWKyS/qHFsYaYpGuZAjomm8Sf7eyMRpowLTCRGXyvhffzMdyy/K501gMBtg
	 fs7hLNyNUefjzUE8KqIUcob2QA47B/l2cjK5Wz4w=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Namjae Jeon <[email-masked]>,
	Steve French <[email-masked]>,
	Tom Talpey <[email-masked]>,
	[email-masked],
	[email-masked],
	[email-masked],
	Stefan Metzmacher <[email-masked]>,
	Steve French <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 011/262] smb: server: fix IRD/ORD negotiation with the client
Date: Mon, 13 Oct 2025 16:42:33 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Metzmacher <[email-masked]>

[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ]

Already do real negotiation in smb_direct_handle_connect_request()
where we see the requested initiator_depth and responder_resources
from the client.

We should detect legacy iwarp clients using MPA v1
with the custom IRD/ORD negotiation.

We need to send the custom IRD/ORD in big endian,
but we need to try to let clients with broken requests
using little endian (older cifs.ko) to work.

Note the reason why this uses u8 for
initiator_depth and responder_resources is
that the rdma layer also uses it.

Acked-by: Namjae Jeon <[email-masked]>
Cc: Steve French <[email-masked]>
Cc: Tom Talpey <[email-masked]>
Cc: [email-masked]
Cc: [email-masked]
Cc: [email-masked]
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Signed-off-by: Stefan Metzmacher <[email-masked]>
Signed-off-by: Steve French <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++-----
 1 file changed, 85 insertions(+), 14 deletions(-)

diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index d059c890d1428..05dfef7ad67f5 100644
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -152,6 +152,10 @@ struct smb_direct_transport {
 	struct work_struct	disconnect_work;
 
 	bool			negotiation_requested;
+
+	bool			legacy_iwarp;
+	u8			initiator_depth;
+	u8			responder_resources;
 };
 
 #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))
@@ -346,6 +350,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
 	t->cm_id = cm_id;
 	cm_id->context = t;
 
+	t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH;
+	t->responder_resources = 1;
+
 	t->status = SMB_DIRECT_CS_NEW;
 	init_waitqueue_head(&t->wait_status);
 
@@ -1623,21 +1630,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t,
 static int smb_direct_accept_client(struct smb_direct_transport *t)
 {
 	struct rdma_conn_param conn_param;
-	struct ib_port_immutable port_immutable;
-	u32 ird_ord_hdr[2];
+	__be32 ird_ord_hdr[2];
 	int ret;
 
+	/*
+	 * smb_direct_handle_connect_request()
+	 * already negotiated t->initiator_depth
+	 * and t->responder_resources
+	 */
 	memset(&conn_param, 0, sizeof(conn_param));
-	conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom,
-					   SMB_DIRECT_CM_INITIATOR_DEPTH);
-	conn_param.responder_resources = 0;
-
-	t->cm_id->device->ops.get_port_immutable(t->cm_id->device,
-						 t->cm_id->port_num,
-						 &port_immutable);
-	if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) {
-		ird_ord_hdr[0] = conn_param.responder_resources;
-		ird_ord_hdr[1] = 1;
+	conn_param.initiator_depth = t->initiator_depth;
+	conn_param.responder_resources = t->responder_resources;
+
+	if (t->legacy_iwarp) {
+		ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources);
+		ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth);
 		conn_param.private_data = ird_ord_hdr;
 		conn_param.private_data_len = sizeof(ird_ord_hdr);
 	} else {
@@ -2023,10 +2030,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs)
 	return true;
 }
 
-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
+static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id,
+					     struct rdma_cm_event *event)
 {
 	struct smb_direct_transport *t;
 	struct task_struct *handler;
+	u8 peer_initiator_depth;
+	u8 peer_responder_resources;
 	int ret;
 
 	if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) {
@@ -2040,6 +2050,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
 	if (!t)
 		return -ENOMEM;
 
+	peer_initiator_depth = event->param.conn.initiator_depth;
+	peer_responder_resources = event->param.conn.responder_resources;
+	if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) &&
+	    event->param.conn.private_data_len == 8) {
+		/*
+		 * Legacy clients with only iWarp MPA v1 support
+		 * need a private blob in order to negotiate
+		 * the IRD/ORD values.
+		 */
+		const __be32 *ird_ord_hdr = event->param.conn.private_data;
+		u32 ird32 = be32_to_cpu(ird_ord_hdr[0]);
+		u32 ord32 = be32_to_cpu(ird_ord_hdr[1]);
+
+		/*
+		 * cifs.ko sends the legacy IRD/ORD negotiation
+		 * event if iWarp MPA v2 was used.
+		 *
+		 * Here we check that the values match and only
+		 * mark the client as legacy if they don't match.
+		 */
+		if ((u32)event->param.conn.initiator_depth != ird32 ||
+		    (u32)event->param.conn.responder_resources != ord32) {
+			/*
+			 * There are broken clients (old cifs.ko)
+			 * using little endian and also
+			 * struct rdma_conn_param only uses u8
+			 * for initiator_depth and responder_resources,
+			 * so we truncate the value to U8_MAX.
+			 *
+			 * smb_direct_accept_client() will then
+			 * do the real negotiation in order to
+			 * select the minimum between client and
+			 * server.
+			 */
+			ird32 = min_t(u32, ird32, U8_MAX);
+			ord32 = min_t(u32, ord32, U8_MAX);
+
+			t->legacy_iwarp = true;
+			peer_initiator_depth = (u8)ird32;
+			peer_responder_resources = (u8)ord32;
+		}
+	}
+
+	/*
+	 * First set what the we as server are able to support
+	 */
+	t->initiator_depth = min_t(u8, t->initiator_depth,
+				   new_cm_id->device->attrs.max_qp_rd_atom);
+
+	/*
+	 * negotiate the value by using the minimum
+	 * between client and server if the client provided
+	 * non 0 values.
+	 */
+	if (peer_initiator_depth != 0)
+		t->initiator_depth = min_t(u8, t->initiator_depth,
+					   peer_initiator_depth);
+	if (peer_responder_resources != 0)
+		t->responder_resources = min_t(u8, t->responder_resources,
+					       peer_responder_resources);
+
 	ret = smb_direct_connect(t);
 	if (ret)
 		goto out_err;
@@ -2064,7 +2135,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id,
 {
 	switch (event->event) {
 	case RDMA_CM_EVENT_CONNECT_REQUEST: {
-		int ret = smb_direct_handle_connect_request(cm_id);
+		int ret = smb_direct_handle_connect_request(cm_id, event);
 
 		if (ret) {
 			pr_err("Can't create transport: %d\n", ret);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:47:00 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368001; cv=none; b=qVXmEbmuSgzGBalR2cKM/JCXJ9TTAVnKEmvBJ8kGUIRBPjFEWZbl5ju9zCxMoeqL1KhrSHxiLol2aFLIntzvj7DcDIYsF1h7TAuyAeIstLWB0u/37rHIMnVL9FJvXBSL3nFi6lgJrjNe1oTgFpBkHiUzoAmEHv1v7NLmlyYmGEU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368001; c=relaxed/simple;
	bh=56EIppqCiW4JSTYvZcgtig6eu5uBfP/mij7hy5TLKr0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=RAjHqv3N6upaXqNaeZ93aERYr+aYJY7c/vLaFSueHZzAIpWUBfvWOHV94g71aVcsSYaPp6y16lGG1GX/rLqQRpMa7VoZhVsfQbl0hIX6SEELISTugkhJqv/9H03SBXXHUhUtz8yla6LU/D0HmA3U2xI9qQes9VLYASmZrVkgHm8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=O3jHUELY; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Leo Yan <[email-masked]>,
	Will Deacon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 010/262] perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
Date: Mon, 13 Oct 2025 16:42:32 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leo Yan <[email-masked]>

[ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ]

Cast nr_pages to unsigned long to avoid overflow when handling large
AUX buffer sizes (>= 2 GiB).

Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")
Signed-off-by: Leo Yan <[email-masked]>
Signed-off-by: Will Deacon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/perf/arm_spe_pmu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
index 3569050f9cf37..abd23430dc033 100644
--- a/drivers/perf/arm_spe_pmu.c
+++ b/drivers/perf/arm_spe_pmu.c
@@ -96,7 +96,8 @@ struct arm_spe_pmu {
 #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu))
 
 /* Convert a free-running index from perf into an SPE buffer offset */
-#define PERF_IDX2OFF(idx, buf)	((idx) % ((buf)->nr_pages << PAGE_SHIFT))
+#define PERF_IDX2OFF(idx, buf) \
+	((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
 
 /* Keep track of our dynamic hotplug state */
 static enum cpuhp_state arm_spe_pmu_online;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:26:26 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368081; cv=none; b=n+dHq3XTJaVhgc2ml/xE84teZ9n5YT2TlANEPDq5gVdTjmHXH+TaJBKJwE3GEg6JEtpZeqMdOXzj4d0ZSzgg0vCpkSDtRCLafodElWPq6E3eGFYHNQzGPl7rEHTEiImdP9CWWUWhtaAwdha35qRx+UjI/I7/3B5z0qOnKDJiq6M=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368081; c=relaxed/simple;
	bh=B4kqeZBAOGz8rLMynEnwNsnmrBfqJYrIpkOLI/C3i9Q=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=N8+rkxYJy5PhY/bSKUDPDT/16c/gux8L6Nk5yVyfw9/66hXQs8KYC1bfAcrMpZB0uew3OnOUWMp6aWzhtEDdbZtoTR2chBJMFBWPQ8nWCpcXh9pmFaUHpDP/2gxDx+uI7YgM3WgXWi+fadeU8yots0W9CZlz02B1jGFa6MVeLn8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=THmswBU2; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Leo Yan <[email-masked]>,
	Will Deacon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 009/262] coresight: trbe: Prevent overflow in PERF_IDX2OFF()
Date: Mon, 13 Oct 2025 16:42:31 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leo Yan <[email-masked]>

[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ]

Cast nr_pages to unsigned long to avoid overflow when handling large
AUX buffer sizes (>= 2 GiB).

Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
Signed-off-by: Leo Yan <[email-masked]>
Signed-off-by: Will Deacon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-trbe.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
index 96a32b2136699..492b2612f64e0 100644
--- a/drivers/hwtracing/coresight/coresight-trbe.c
+++ b/drivers/hwtracing/coresight/coresight-trbe.c
@@ -22,7 +22,8 @@
 #include "coresight-self-hosted-trace.h"
 #include "coresight-trbe.h"
 
-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
+#define PERF_IDX2OFF(idx, buf) \
+	((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
 
 /*
  * A padding packet that will help the user space tools
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:41:41 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368077; cv=none; b=eVaV2W4khaLEOrcjYG8thwnhmeBDj3rGWIIOflkxCdoD24ojlYwp2KnWOR9sHetDjJtJVTAe3/hWvUtAh34C7f6M4X5z+Zbuy2iOTaU56sxrW51tRjzbL0C/bPpkcS1WAsVShpcl215Bochj5AG/W0kentgyBsLIzBQ+YAvWycA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368077; c=relaxed/simple;
	bh=m5dHlExasWVNvJj2pvuDZ4rq/j7xD/7W5PUwje/u5ko=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=HHdSJs5mj/mT0aKsDmlkvVCcIdZ2QA56sfcskGZNa8/X/ozV/Zam7PofCt46voVQO6ePWtwoJMUMYNwcB8Mz4zNH7B1jpmu1dUa884MoEER8/dtGyRL4EBFUxKPkgYoTDWo1Uac+pZJAnklpxBzNB0vHlO5hdc4YRFDYi/TwtUw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=nNIxn0CJ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Christophe Leroy <[email-masked]>,
	Madhavan Srinivasan <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 007/262] powerpc/603: Really copy kernel PGD entries into all PGDIRs
Date: Mon, 13 Oct 2025 16:42:29 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christophe Leroy <[email-masked]>

[ Upstream commit f2863371f017eb03c230addc253783fa4c7e90f5 ]

Commit 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all
PGDIRs and preallocate execmem page tables") was supposed to extend
to powerpc 603 the copy of kernel PGD entries into all PGDIRs
implemented in a previous patch on the 8xx. But 603 is book3s/32 and
uses a duplicate of pgd_alloc() defined in another header.

So really do the copy at the correct place for the 603.

Fixes: 82ef440f9a38 ("powerpc/603: Copy kernel PGD entries into all PGDIRs and preallocate execmem page tables")
Signed-off-by: Christophe Leroy <[email-masked]>
Signed-off-by: Madhavan Srinivasan <[email-masked]>
Link: https://patch.msgid.link/752ab751[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/powerpc/include/asm/book3s/32/pgalloc.h | 10 ++++++++--
 arch/powerpc/include/asm/nohash/pgalloc.h    |  2 +-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h b/arch/powerpc/include/asm/book3s/32/pgalloc.h
index dd4eb30631758..f4390704d5ba2 100644
--- a/arch/powerpc/include/asm/book3s/32/pgalloc.h
+++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h
@@ -7,8 +7,14 @@
 
 static inline pgd_t *pgd_alloc(struct mm_struct *mm)
 {
-	return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
-			pgtable_gfp_flags(mm, GFP_KERNEL));
+	pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
+				      pgtable_gfp_flags(mm, GFP_KERNEL));
+
+#ifdef CONFIG_PPC_BOOK3S_603
+	memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD,
+	       (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
+#endif
+	return pgd;
 }
 
 static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
diff --git a/arch/powerpc/include/asm/nohash/pgalloc.h b/arch/powerpc/include/asm/nohash/pgalloc.h
index bb5f3e8ea912d..4ef780b291bc3 100644
--- a/arch/powerpc/include/asm/nohash/pgalloc.h
+++ b/arch/powerpc/include/asm/nohash/pgalloc.h
@@ -22,7 +22,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
 	pgd_t *pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
 			pgtable_gfp_flags(mm, GFP_KERNEL));
 
-#if defined(CONFIG_PPC_8xx) || defined(CONFIG_PPC_BOOK3S_603)
+#ifdef CONFIG_PPC_8xx
 	memcpy(pgd + USER_PTRS_PER_PGD, swapper_pg_dir + USER_PTRS_PER_PGD,
 	       (MAX_PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
 #endif
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:37:54 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368073; cv=none; b=nz+r+xdM/aNJ4zE2k2MrKnRWGgKAWMfNvZY0hUuoSySJaeae9eqGL8chtgKJnGwNJaPn1rQzCOhlkfbmemdiCXFL1JmnivYPd/DtPiB9soKGqy3mqn/CkQ81UfKF02PxrUx5H59pcusYgnlUMeNdRkvEYybr1/TbJaLlsXLjfbw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368073; c=relaxed/simple;
	bh=amdayZEiAfoRBvyJ4y1CaLuB3fvePKh4+AXIljkGb5g=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=kuVAhwrrqqnQRcRtAmpuqbIWYceuFFejZjw3PxCwYLlauin5EUQLYcgQ2laOcMHw2PCBrlUYUXmUQ0iGGy/yK77RcBZyZix238skahlZf0KJj+akQ11/aPU6mB6AuwTUcrq6ZRRydx6c1qBblN+hEGbstEBC+b5U6g+eUE87N7o=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=r6LZ1CUc; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Christophe Leroy <[email-masked]>,
	Madhavan Srinivasan <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 006/262] powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler
Date: Mon, 13 Oct 2025 16:42:28 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christophe Leroy <[email-masked]>

[ Upstream commit d9e46de4bf5c5f987075afd5f240bb2a8a5d71ed ]

Commit ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in
DTLB misses") removed the test that needed the valeur in SPRN_EPN but
failed to remove the read.

Remove it.

And remove related comments, including the very same comment
in InstructionTLBMiss that should have been removed by
commit 33c527522f39 ("powerpc/8xx: Inconditionally use task PGDIR in
ITLB misses").

Also update the comment about absence of a second level table which
has been handled implicitely since commit 5ddb75cee5af ("powerpc/8xx:
remove tests on PGDIR entry validity").

Fixes: ac9f97ff8b32 ("powerpc/8xx: Inconditionally use task PGDIR in DTLB misses")
Signed-off-by: Christophe Leroy <[email-masked]>
Signed-off-by: Madhavan Srinivasan <[email-masked]>
Link: https://patch.msgid.link/5811c8d1[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/powerpc/kernel/head_8xx.S | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
index 56c5ebe21b99a..613606400ee99 100644
--- a/arch/powerpc/kernel/head_8xx.S
+++ b/arch/powerpc/kernel/head_8xx.S
@@ -162,7 +162,7 @@ instruction_counter:
  * For the MPC8xx, this is a software tablewalk to load the instruction
  * TLB.  The task switch loads the M_TWB register with the pointer to the first
  * level table.
- * If we discover there is no second level table (value is zero) or if there
+ * If there is no second level table (value is zero) or if there
  * is an invalid pte, we load that into the TLB, which causes another fault
  * into the TLB Error interrupt where we can handle such problems.
  * We have to use the MD_xxx registers for the tablewalk because the
@@ -183,9 +183,6 @@ instruction_counter:
 	mtspr	SPRN_SPRG_SCRATCH2, r10
 	mtspr	SPRN_M_TW, r11
 
-	/* If we are faulting a kernel address, we have to use the
-	 * kernel page tables.
-	 */
 	mfspr	r10, SPRN_SRR0	/* Get effective address of fault */
 	INVALIDATE_ADJACENT_PAGES_CPU15(r10, r11)
 	mtspr	SPRN_MD_EPN, r10
@@ -228,10 +225,6 @@ instruction_counter:
 	mtspr	SPRN_SPRG_SCRATCH2, r10
 	mtspr	SPRN_M_TW, r11
 
-	/* If we are faulting a kernel address, we have to use the
-	 * kernel page tables.
-	 */
-	mfspr	r10, SPRN_MD_EPN
 	mfspr	r10, SPRN_M_TWB	/* Get level 1 table */
 	lwz	r11, (swapper_pg_dir-PAGE_OFFSET)@l(r10)	/* Get level 1 entry */
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:26:22 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368070; cv=none; b=aT+RnSBCIUc7S9OS47npTPMQBA8CVnshwyymJYvVLireXWSPHgY0waZ4weWObrf/k6077wQRIMCzy8lPeG9La86mArE4uBrA3xk+BPRmKi/InnID0Z0w+Zj5DSQNZ0/CQBVoxN5T8wtnCd9Ua/HOOYmdg1+EgsjlySLMDapeM8M=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368070; c=relaxed/simple;
	bh=uRbSfgy0C5DKIckVxmBZvaCvvOmYwK54AcdiM/U0UHk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=YqvqVW6shEcJEf2fLNYEZNnu5RCUCQVVEDaNfBDrRf04rvvumwuopvdV8M+cM1Sne4zCv7WSZWEvPdyovTRs4s8rXcv5OBJKqa3gJDJH2gcLqs/oIr0/L5cJhTqsQYP4dAsbgury0W50dsdyWG8W0J1zP51W1V9Z7QzX236gs3c=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vKeu+UZb; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Andreas Gruenbacher <[email-masked]>,
	Andrew Price <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 005/262] gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote
Date: Mon, 13 Oct 2025 16:42:27 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andreas Gruenbacher <[email-masked]>

[ Upstream commit 061df28b82af6b22fb5fa529a8f2ef00474ee004 ]

Commit 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
added a statement to do_xmote() to clear the GLF_INVALIDATE_IN_PROGRESS
flag a second time after it has already been cleared.  Fix that.

Fixes: 865cc3e9cc0b ("gfs2: fix a deadlock on withdraw-during-mount")
Signed-off-by: Andreas Gruenbacher <[email-masked]>
Reviewed-by: Andrew Price <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/gfs2/glock.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 161fc76ed5b0e..e5558e63e2cba 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -801,8 +801,6 @@ __acquires(&gl->gl_lockref.lock)
 			clear_bit(GLF_DEMOTE_IN_PROGRESS, &gl->gl_flags);
 			gfs2_glock_queue_work(gl, GL_GLOCK_DFT_HOLD);
 			return;
-		} else {
-			clear_bit(GLF_INVALIDATE_IN_PROGRESS, &gl->gl_flags);
 		}
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:40:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368067; cv=none; b=oKiH3iYHeAml7tQ7LOo9RtpgYQBWTjqlLuoxZg+PUo+ibhqNQGDqwfNSZWsZzq3YUjc2RiqZXuvLXPllw5nUcg1cRQ4E5Md2wDZu+CKpB/Fouw3CsMhpZhz/fkrORlDlWx0jAF82b9rE5m3EEENsWP/CFuiABxUFF6TbjrWP2cg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368067; c=relaxed/simple;
	bh=SvWC28SMlSKljUxe1ITsFmCT0/fErZvFrhaNeRhmhrg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=lZfrreF6O29esb/J7hzU7EHYrVWuNKHm7mCn9Kp5jWz+IIVmPUq/t0roceX6IM4LVmZjis2Rg5ZEIHdqRdVz1Xrgx3YaTl63wmYn6+78nHxu6PO0o84kbdsLri6h504n0T933M6+LyLOHF1sNQtBKTv8l2LSZ5XArWXKwbCdKP8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=nSAyPOnK; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Bala-Vignesh-Reddy <[email-masked]>,
	Mark Brown <[email-masked]>,
	Will Deacon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 004/262] selftests: arm64: Check fread return value in exec_target
Date: Mon, 13 Oct 2025 16:42:26 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bala-Vignesh-Reddy <[email-masked]>

[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]

Fix -Wunused-result warning generated when compiled with gcc 13.3.0,
by checking fread's return value and handling errors, preventing
potential failures when reading from stdin.

Fixes compiler warning:
warning: ignoring return value of 'fread' declared with attribute
'warn_unused_result' [-Wunused-result]

Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys")

Signed-off-by: Bala-Vignesh-Reddy <[email-masked]>
Reviewed-by: Mark Brown <[email-masked]>
Signed-off-by: Will Deacon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c
index 4435600ca400d..e597861b26d6b 100644
--- a/tools/testing/selftests/arm64/pauth/exec_target.c
+++ b/tools/testing/selftests/arm64/pauth/exec_target.c
@@ -13,7 +13,12 @@ int main(void)
 	unsigned long hwcaps;
 	size_t val;
 
-	fread(&val, sizeof(size_t), 1, stdin);
+	size_t size = fread(&val, sizeof(size_t), 1, stdin);
+
+	if (size != 1) {
+		fprintf(stderr, "Could not read input from stdin\n");
+		return EXIT_FAILURE;
+	}
 
 	/* don't try to execute illegal (unimplemented) instructions) caller
 	 * should have checked this and keep worker simple
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:29:54 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368062; cv=none; b=GzqXNPYGVZlF7P7PuDkL/9pHO0GdXBrroKzUGSnY/nlIBI0O90rbArs9h4wjAVqGkjJTOm1s5Zn3LT5SyyeshAUGWqPSpPnE4Yg+XTRuPDKJYmeLfaIQlV3S4DSKb3ph8k66pZG9RGquwcA4E5KyesyYxa3MWSlwqIkmZ9KlZto=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368062; c=relaxed/simple;
	bh=c5svn4YyWAUmodHEit3PjNSRCewbdWFyL7Ydx0r7zQs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=VY3/kRqXmow0wSVub7Wz2DrGjEqpSpPJzEJfvLZvcueVqHWlImvReb9GzlfFIZ45DP/EBmDDUYLHqi0ozbAl80fAl7pdpL8GHrQkC3EvDQSzDuq6NRwwXeGsesU0thpgl3dOK4VxnU/qG+15pLNNRoMWl6bA9cK2Ll7m0anuA30=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OHPDyQaT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ali Polatel <[email-masked]>,
	Johannes Nixdorf <[email-masked]>,
	Kees Cook <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 003/262] seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
Date: Mon, 13 Oct 2025 16:42:25 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johannes Nixdorf <[email-masked]>

[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ]

Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an
event to the tracer, and starts to wait interruptibly. With
SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the
message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting
and is subsequently interrupted, the tracee begins to wait again
uninterruptibly (but killable).

This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee
is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a
condition to begin waiting again. In this case the tracee is interrupted
even though the tracer already acted on its behalf. This breaks the
assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure,
namely that the tracer can be sure the syscall is not interrupted or
restarted on the tracee after it is received on the tracer. Fix this
by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to
switch to uninterruptible waiting.

With the condition changed the loop in seccomp_do_user_notification()
would exit immediately after deciding that noninterruptible waiting
is required if the operation already reached SECCOMP_NOTIFY_REPLIED,
skipping the code that processes pending addfd commands first. Prevent
this by executing the remaining loop body one last time in this case.

Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier")
Reported-by: Ali Polatel <[email-masked]>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291
Signed-off-by: Johannes Nixdorf <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Kees Cook <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/seccomp.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 0cd1f8b5a102e..267b00005eaf2 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1124,7 +1124,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn
 static bool should_sleep_killable(struct seccomp_filter *match,
 				  struct seccomp_knotif *n)
 {
-	return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT;
+	return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT;
 }
 
 static int seccomp_do_user_notification(int this_syscall,
@@ -1171,13 +1171,11 @@ static int seccomp_do_user_notification(int this_syscall,
 
 		if (err != 0) {
 			/*
-			 * Check to see if the notifcation got picked up and
-			 * whether we should switch to wait killable.
+			 * Check to see whether we should switch to wait
+			 * killable. Only return the interrupted error if not.
 			 */
-			if (!wait_killable && should_sleep_killable(match, &n))
-				continue;
-
-			goto interrupted;
+			if (!(!wait_killable && should_sleep_killable(match, &n)))
+				goto interrupted;
 		}
 
 		addfd = list_first_entry_or_null(&n.addfd,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:41:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368030; cv=none; b=a4jTHz6eRez617P684asq/dvPauSm0EWqCwnr8IsCe916eylwHEW/ktOP1qPudZhbbsqGE7DOZarEbw+j8I7tR9AAGPFLDHoKisYQKR0GKDmT4WBam8mFe5GG8sQt61JSih5q/fhvHW2ZWX5STpTA6UdYsyf6snPihdqCLDIDio=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368030; c=relaxed/simple;
	bh=N/5BPihtvYNt2xoIYNvQ/k1uW41pannJLsELDzTDOg4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=NHB54O+AlU//GAZukt65lQrIJry5H6YWKpgWI/dO5iHuw7AEi+2cqbfWKrwB9KTGOLo7y63A8DgwcbBi3xpDKi41kNdw1cGN+QoSyGNopnDRQt1yFkUU+6Y9/RN7j52NJAbluSpjJqlLONoOx27StbjmYlnxSeMjtEmCTapNy/0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gfWEjm4/; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Geert Uytterhoeven <[email-masked]>,
	Martin Wilck <[email-masked]>,
	David Disseldorp <[email-masked]>,
	Christian Brauner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 002/262] init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
Date: Mon, 13 Oct 2025 16:42:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email-masked]>

[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ]

INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and
init/initramfs_test.c.  Hence add a dependency on BLK_DEV_INITRD, to
prevent asking the user about this feature when configuring a kernel
without initramfs support.

Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option")
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Reviewed-by: Martin Wilck <[email-masked]>
Reviewed-by: David Disseldorp <[email-masked]>
Signed-off-by: Christian Brauner <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 init/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/init/Kconfig b/init/Kconfig
index 45990792cb4a6..219ccdb0af732 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1440,6 +1440,7 @@ config BOOT_CONFIG_EMBED_FILE
 
 config INITRAMFS_PRESERVE_MTIME
 	bool "Preserve cpio archive mtimes in initramfs"
+	depends on BLK_DEV_INITRD
 	default y
 	help
 	  Each entry in an initramfs cpio archive carries an mtime value. When
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:46:02 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367998; cv=none; b=akauGAUUmBUlcjX7NIqXtc5PeMOjHMazdvbEC81NDBusk1Ah1+cyq0/tNeWcuFDJFBvj17HlxzbzuWVkCxVwTkbvOGL0Onqdn4lbxxYwdq369kqgeScntqXIEoYH+LN5+p+WWNotnnuHCpcXMjBn08wZbDT/B6N6kfXWvAhkcv4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367998; c=relaxed/simple;
	bh=HXMzytvILtbJWDkfmBPcC5ppuj+VZ0xUWZHgQjse+FA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=PAf0sD3Job+gME2XsgLDxE5T01Bz4GDO8491a0yeeOVmtseaQ+V1H0nkKLF0x+n5aYM/T1sI0FX9gTq5s5dsxY34Jp6Uy7LmoIre5lV3RMHWtlPm7so10+sxxNAWBUT3WpblE+zbNEOH+I5oIkEuWJlLmZFQmRPCh7K3nDrzchc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QfXCWB5q; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jeff Layton <[email-masked]>,
	Christian Brauner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.12 001/262] filelock: add FL_RECLAIM to show_fl_flags() macro
Date: Mon, 13 Oct 2025 16:42:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jeff Layton <[email-masked]>

[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]

Show the FL_RECLAIM flag symbolically in tracepoints.

Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims")
Signed-off-by: Jeff Layton <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Christian Brauner <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 include/trace/events/filelock.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h
index b8d1e00a7982c..2dfeb158e848a 100644
--- a/include/trace/events/filelock.h
+++ b/include/trace/events/filelock.h
@@ -27,7 +27,8 @@
 		{ FL_SLEEP,		"FL_SLEEP" },			\
 		{ FL_DOWNGRADE_PENDING,	"FL_DOWNGRADE_PENDING" },	\
 		{ FL_UNLOCK_PENDING,	"FL_UNLOCK_PENDING" },		\
-		{ FL_OFDLCK,		"FL_OFDLCK" })
+		{ FL_OFDLCK,		"FL_OFDLCK" },			\
+		{ FL_RECLAIM,		"FL_RECLAIM"})
 
 #define show_fl_type(val)				\
 	__print_symbolic(val,				\
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:45:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760368084; cv=none; b=o6Q8XCUvVi2Jl3zxtmdLZZ+9exBln//YAV8XgRmCBajTYsv4dojPVBHyrYLDCEAZ4lV15xSfP70TOKnMKqEBwFYMQ7ioS/iCnBlJhVlToUGo9cd3gIK3SFmtxl8T54xPs/K7UrsQ1J033iiFeEB1D1VD0w7MQ9uDddSToyQhw4o=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760368084; c=relaxed/simple;
	bh=iLY6U2KNE2DVV/Ea18w/K+W/FTodNpqaeZWaJNAPWOE=;
	h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=Xy3IXMnFADWn+/l3q58PBJRL9+0Pubtr9W9PF/d/0a6TZfidVpvVXm2ncuZZIsc6kbNaWv3tzmKb6ih6eZBZaQBTsNGz1BmaYCdm8Ik07MrZgd2mbofSm5UtWi+0TMeNy8TCFeYYCMNRXmhNONgIY9TqqsYpeyXfbBajM6HiWqI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=h9nmj6MZ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked]
Subject: [PATCH 6.12 000/262] 6.12.53-rc1 review
Date: Mon, 13 Oct 2025 16:42:22 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

This is the start of the stable review cycle for the 6.12.53 release.
There are 262 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.53-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email-masked]>
    Linux 6.12.53-rc1

Miaoqian Lin <[email-masked]>
    usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call

Konrad Dybcio <[email-masked]>
    arm64: dts: qcom: qcm2290: Disable USB SS bus instances in park mode

Sven Peter <[email-masked]>
    usb: typec: tipd: Clear interrupts first

Oleksij Rempel <[email-masked]>
    net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock

Dominique Martinet <[email-masked]>
    net/9p: Fix buffer overflow in USB transport layer

Salah Triki <[email-masked]>
    bus: fsl-mc: Check return value of platform_get_resource()

Bartosz Golaszewski <[email-masked]>
    pinctrl: check the return value of pinmux_ops::get_function_name()

Jens Wiklander <[email-masked]>
    tee: fix register_shm_helper()

Zhen Ni <[email-masked]>
    remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable()

Lei Lu <[email-masked]>
    sunrpc: fix null pointer dereference on zero-length checksum

Zhen Ni <[email-masked]>
    Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak

Marek Vasut <[email-masked]>
    Input: atmel_mxt_ts - allow reset GPIO to sleep

Ling Xu <[email-masked]>
    misc: fastrpc: Skip reference for DMA handles

Ling Xu <[email-masked]>
    misc: fastrpc: fix possible map leak in fastrpc_put_args

Ling Xu <[email-masked]>
    misc: fastrpc: Fix fastrpc_map_lookup operation

Ling Xu <[email-masked]>
    misc: fastrpc: Save actual DMA size in fastrpc_map structure

Guangshuo Li <[email-masked]>
    nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()

Yang Shi <[email-masked]>
    mm: hugetlb: avoid soft lockup when mprotect to large memory area

Janne Grunau <[email-masked]>
    fbdev: simplefb: Fix use after free in simplefb_detach_genpds()

Sean Christopherson <[email-masked]>
    KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid

Jan Kara <[email-masked]>
    ext4: fix checks for orphan inodes

Namjae Jeon <[email-masked]>
    ksmbd: add max ip connections parameter

Matvey Kovalev <[email-masked]>
    ksmbd: fix error code overwriting in smb2_get_info_filesystem()

Yunseong Kim <[email-masked]>
    ksmbd: Fix race condition in RPC handle list access

Youling Tang <[email-masked]>
    LoongArch: Automatically disable kaslr if boot from kexec_file

Zheng Qixing <[email-masked]>
    dm: fix NULL pointer dereference in __dm_suspend()

Zheng Qixing <[email-masked]>
    dm: fix queue start/stop imbalance under suspend/load/resume races

Bartosz Golaszewski <[email-masked]>
    mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()

Cosmin Tanislav <[email-masked]>
    mfd: rz-mtu3: Fix MTU5 NFCR register offset

Deepak Sharma <[email-masked]>
    net: nfc: nci: Add parameter validation for packet data

Larshin Sergey <[email-masked]>
    fs: udf: fix OOB read in lengthAllocDescs handling

Srinivas Kandagatla <[email-masked]>
    ASoC: codecs: wcd937x: make stub functions inline

Srinivas Kandagatla <[email-masked]>
    ASoC: codecs: wcd937x: set the comp soundwire port correctly

Ranjani Sridharan <[email-masked]>
    ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down

Ma Ke <[email-masked]>
    ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()

Jens Axboe <[email-masked]>
    io_uring/waitid: always prune wait queue entry in io_waitid_wait()

Naman Jain <[email-masked]>
    uio_hv_generic: Let userspace take care of interrupt mask

Phillip Lougher <[email-masked]>
    Squashfs: fix uninit-value in squashfs_get_parent

Jarkko Sakkinen <[email-masked]>
    tpm: Disable TPM2_TCG_HMAC by default

Yazhou Tang <[email-masked]>
    bpf: Reject negative offsets for ALU ops

zhang jiao <[email-masked]>
    vhost: vringh: Modify the return value check

Jakub Kicinski <[email-masked]>
    Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"

Enzo Matsumiya <[email-masked]>
    smb: client: fix crypto buffers in non-linear memory

Moshe Shemesh <[email-masked]>
    net/mlx5: fw reset, add reset timeout work

Shay Drory <[email-masked]>
    net/mlx5: pagealloc: Fix reclaim race during command interface teardown

Moshe Shemesh <[email-masked]>
    net/mlx5: Stop polling for command response if interface goes down

Yeounsu Moon <[email-masked]>
    net: dlink: handle copy_thresh allocation failure

Kohei Enju <[email-masked]>
    net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable

Kohei Enju <[email-masked]>
    nfp: fix RSS hash key size when RSS is not supported

Alok Tiwari <[email-masked]>
    idpf: fix mismatched free function for dma_alloc_coherent

Alok Tiwari <[email-masked]>
    PCI: j721e: Fix incorrect error message in probe()

Erick Karanja <[email-masked]>
    mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands

Donet Tom <[email-masked]>
    drivers/base/node: fix double free in register_one_node()

Dan Carpenter <[email-masked]>
    ocfs2: fix double free in user_cluster_connect()

Nishanth Menon <[email-masked]>
    hwrng: ks-sa - fix division by zero in ks_sa_rng_init

Fan Wu <[email-masked]>
    KEYS: X.509: Fix Basic Constraints CA flag parsing

Luiz Augusto von Dentz <[email-masked]>
    Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements

Pauli Virtanen <[email-masked]>
    Bluetooth: ISO: don't leak skb in ISO_CONT RX

Pauli Virtanen <[email-masked]>
    Bluetooth: ISO: free rx_skb if not consumed

Luiz Augusto von Dentz <[email-masked]>
    Bluetooth: ISO: Fix possible UAF on iso_conn_free

Luiz Augusto von Dentz <[email-masked]>
    Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO

Michael S. Tsirkin <[email-masked]>
    vhost: vringh: Fix copy_to_iter return value check

I Viswanath <[email-masked]>
    ptp: Add a upper bound on max_vclocks

I Viswanath <[email-masked]>
    net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast

Bernard Metzler <[email-masked]>
    RDMA/siw: Always report immediate post SQ errors

Lu Baolu <[email-masked]>
    iommu/vt-d: Disallow dirty tracking if incoherent page walk

Marek Vasut <[email-masked]>
    PCI: rcar-gen4: Fix inverted break condition in PHY initialization

Marek Vasut <[email-masked]>
    PCI: rcar-gen4: Assure reset occurs before DBI access

Marek Vasut <[email-masked]>
    PCI: rcar-gen4: Add missing 1ms delay after PWR reset assertion

Cristian Ciocaltea <[email-masked]>
    usb: vhci-hcd: Prevent suspending virtually attached devices

Ranjan Kumar <[email-masked]>
    scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()

Fernando Fernandez Mancera <[email-masked]>
    netfilter: nfnetlink: reset nlh pointer during batch replay

Slavin Liu <[email-masked]>
    ipvs: Defer ip_vs_ftp unregister during netns cleanup

Anthony Iliopoulos <[email-masked]>
    NFSv4.1: fix backchannel max_resp_sz verification check

Lin Yujun <[email-masked]>
    coresight: Fix incorrect handling for return value of devm_kzalloc

Jie Gan <[email-masked]>
    coresight: tpda: fix the logic to setup the element size

Leo Yan <[email-masked]>
    coresight: trbe: Return NULL pointer for allocation failures

Leo Yan <[email-masked]>
    coresight: etm4x: Support atclk

Leo Yan <[email-masked]>
    coresight: catu: Support atclk

Leo Yan <[email-masked]>
    coresight: tmc: Support atclk

Yuanfang Zhang <[email-masked]>
    coresight-etm4x: Conditionally access register TRCEXTINSELR

Ivan Abramov <[email-masked]>
    dm vdo: return error on corrupted metadata in start_restoring_volume functions

Stephan Gerhold <[email-masked]>
    remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice

Nagarjuna Kristam <[email-masked]>
    PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert()

Fedor Pchelkin <[email-masked]>
    wifi: rtw89: avoid circular locking dependency in ser_state_run()

Gui-Dong Han <[email-masked]>
    RDMA/rxe: Fix race in do_task() when draining

Chenghai Huang <[email-masked]>
    crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs

Zilin Guan <[email-masked]>
    vfio/pds: replace bitmap_free with vfree

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_{from,to}_user for M7

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_to_user for Niagara 4

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC

Richard Fitzgerald <[email-masked]>
    ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback

Aditya Kumar Singh <[email-masked]>
    wifi: mac80211: fix Rx packet handling when pubsta information is not available

Vineeth Pillai (Google) <[email-masked]>
    iommu/vt-d: debugfs: Fix legacy mode page table dump logic

Baochen Qiang <[email-masked]>
    wifi: ath10k: avoid unnecessary wait for service ready message

Baochen Qiang <[email-masked]>
    wifi: ath12k: fix wrong logging ID used for CE

Bagas Sanjaya <[email-masked]>
    Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram

Vlad Dumitrescu <[email-masked]>
    IB/sa: Fix sa_local_svc_timeout_ms read race

Parav Pandit <[email-masked]>
    RDMA/core: Resolve MAC of next-hop device without ARP support

Michal Pecio <[email-masked]>
    Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"

wangzijie <[email-masked]>
    f2fs: fix zero-sized extent for precache extents

Benjamin Tissoires <[email-masked]>
    HID: hidraw: tighten ioctl command parsing

Qianfeng Rong <[email-masked]>
    scsi: qla2xxx: Fix incorrect sign of error code in qla_nvme_xmt_ls_rsp()

Qianfeng Rong <[email-masked]>
    scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()

Qianfeng Rong <[email-masked]>
    scsi: qla2xxx: edif: Fix incorrect sign of error code

Colin Ian King <[email-masked]>
    ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message

Sebastian Andrzej Siewior <[email-masked]>
    ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT

Chao Yu <[email-masked]>
    f2fs: fix to mitigate overhead of f2fs_zero_post_eof_page()

Chao Yu <[email-masked]>
    f2fs: fix to truncate first page in error path of f2fs_truncate()

Chao Yu <[email-masked]>
    f2fs: fix to update map->m_next_extent correctly in f2fs_map_blocks()

Zhi-Jun You <[email-masked]>
    wifi: mt76: mt7915: fix mt7981 pre-calibration

Lorenzo Bianconi <[email-masked]>
    wifi: mt76: mt7996: Convert mt7996_wed_rro_addr to LE

Lorenzo Bianconi <[email-masked]>
    wifi: mt76: mt7996: Fix RX packets configuration for primary WED device

Abdun Nihaal <[email-masked]>
    wifi: mt76: fix potential memory leak in mt76_wmac_probe()

Håkon Bugge <[email-masked]>
    RDMA/cm: Rate limit destroy CM ID timeout error message

Donet Tom <[email-masked]>
    drivers/base/node: handle error properly in register_one_node()

Christophe Leroy <[email-masked]>
    watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog

Zhang Tengfei <[email-masked]>
    ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable

Zhen Ni <[email-masked]>
    netfilter: ipset: Remove unused htable_bits in macro ahash_region

Hans de Goede <[email-masked]>
    iio: consumers: Fix offset handling in iio_convert_raw_to_processed()

Hans de Goede <[email-masked]>
    iio: consumers: Fix handling of negative channel scale in iio_convert_raw_to_processed()

Moon Hee Lee <[email-masked]>
    fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist

Vitaly Grigoryev <[email-masked]>
    fs: ntfs3: Fix integer overflow in run_unpack()

Qianfeng Rong <[email-masked]>
    drm/msm/dpu: fix incorrect type for ret

Takashi Iwai <[email-masked]>
    ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping

Takashi Iwai <[email-masked]>
    ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping

Takashi Iwai <[email-masked]>
    ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping

Alexander Lobakin <[email-masked]>
    idpf: fix Rx descriptor ready check barrier in splitq

Liao Yuanhong <[email-masked]>
    wifi: iwlwifi: Remove redundant header files

Wang Liang <[email-masked]>
    pps: fix warning in pps_register_cdev when register device fail

Colin Ian King <[email-masked]>
    misc: genwqe: Fix incorrect cmd field being reported in error

Seppo Takalo <[email-masked]>
    tty: n_gsm: Don't block input queue by waiting MSC

William Wu <[email-masked]>
    usb: gadget: configfs: Correctly set use_os_string at bind

Xichao Zhao <[email-masked]>
    usb: phy: twl6030: Fix incorrect type for ret

Qianfeng Rong <[email-masked]>
    drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()

Eric Dumazet <[email-masked]>
    tcp: fix __tcp_close() to only send RST when required

Alok Tiwari <[email-masked]>
    PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation

Stefan Kerkmann <[email-masked]>
    wifi: mwifiex: send world regulatory domain to driver

Timur Kristóf <[email-masked]>
    drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Adjust si_upload_smc_data register programming (v3)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Fix si_upload_smc_data (v3)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Disable ULV even if unsupported (v3)

Timur Kristóf <[email-masked]>
    drm/amdgpu: Power up UVD 3 for FW validation (v2)

Yuanfang Zhang <[email-masked]>
    coresight: Only register perf symlink for sinks with alloc_buffer

Eric Dumazet <[email-masked]>
    inet: ping: check sock_net() in ping_get_port() and ping_lookup()

Zhushuai Yin <[email-masked]>
    crypto: hisilicon/qm - check whether the input function and PF are on the same device

Chenghai Huang <[email-masked]>
    crypto: hisilicon - re-enable address prefetch after device resuming

Chenghai Huang <[email-masked]>
    crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations

Arnd Bergmann <[email-masked]>
    media: st-delta: avoid excessive stack usage

Qianfeng Rong <[email-masked]>
    ALSA: lx_core: use int type to store negative error codes

Nirmoy Das <[email-masked]>
    PCI/ACPI: Fix pci_acpi_preserve_config() memory leak

Patrisious Haddad <[email-masked]>
    RDMA/mlx5: Fix vport loopback forcing for MPV device

Or Har-Toov <[email-masked]>
    RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count

Zhang Shurong <[email-masked]>
    media: rj54n1cb0c: Fix memleak in rj54n1_probe()

Thorsten Blum <[email-masked]>
    crypto: octeontx2 - Call strscpy() with correct size argument

Thomas Fourier <[email-masked]>
    scsi: myrs: Fix dma_alloc_coherent() error check

Niklas Cassel <[email-masked]>
    scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod

Arnd Bergmann <[email-masked]>
    hwrng: nomadik - add ARM_AMBA dependency

Thomas Fourier <[email-masked]>
    crypto: keembay - Add missing check after sg_nents_for_len()

Liao Yuanhong <[email-masked]>
    drm/amd/display: Remove redundant semicolons

Dan Carpenter <[email-masked]>
    serial: max310x: Add error checking in probe()

Komal Bajaj <[email-masked]>
    usb: misc: qcom_eud: Access EUD_MODE_MANAGER2 through secure calls

Dan Carpenter <[email-masked]>
    usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup

Jonas Karlman <[email-masked]>
    phy: rockchip: naneng-combphy: Enable U3 OTG port for RK3568

Jacopo Mondi <[email-masked]>
    media: zoran: Remove zoran_fh structure

Chia-I Wu <[email-masked]>
    drm/bridge: it6505: select REGMAP_I2C

Chao Yu <[email-masked]>
    f2fs: fix condition in __allow_reserved_blocks()

Brahmajit Das <[email-masked]>
    drm/radeon/r600_cs: clean up of dead code in r600_cs

Brigham Campbell <[email-masked]>
    drm/panel: novatek-nt35560: Fix invalid return value

Daniel Borkmann <[email-masked]>
    bpf: Enforce expected_attach_type for tailcall compatibility

D. Wythe <[email-masked]>
    libbpf: Fix error when st-prefix_ops and ops from differ btf

Kunihiko Hayashi <[email-masked]>
    i2c: designware: Add disabling clocks when probe fails

Kunihiko Hayashi <[email-masked]>
    i2c: designware: Fix clock issue when PM is disabled

Leilk.Liu <[email-masked]>
    i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD

Dmitry Baryshkov <[email-masked]>
    thermal/drivers/qcom/lmh: Add missing IRQ includes

Dmitry Baryshkov <[email-masked]>
    thermal/drivers/qcom: Make LMH select QCOM_SCM

Vadim Pasternak <[email-masked]>
    hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems

Qi Xi <[email-masked]>
    once: fix race by moving DO_ONCE to separate section

Andrea Righi <[email-masked]>
    bpf: Mark kfuncs as __noclone

Jonas Gorski <[email-masked]>
    spi: fix return code when spi device has too many chipselects

Zhouyi Zhou <[email-masked]>
    tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers

Rafael J. Wysocki <[email-masked]>
    smp: Fix up and expand the smp_call_function_many() kerneldoc

Hengqi Chen <[email-masked]>
    bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()

Paul Chaignon <[email-masked]>
    bpf: Explicitly check accesses to bpf_sock_addr

Akhilesh Patil <[email-masked]>
    selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported

Stanley Chu <[email-masked]>
    i3c: master: svc: Recycle unused IBI slot

Stanley Chu <[email-masked]>
    i3c: master: svc: Use manual response for IBI events

Daniel Wagner <[email-masked]>
    nvmet-fc: move lsop put work to nvmet_fc_ls_req_op

Hengqi Chen <[email-masked]>
    riscv, bpf: Sign extend struct ops return values properly

Dmitry Antipov <[email-masked]>
    ACPICA: Fix largest possible resource descriptor index

Uwe Kleine-König <[email-masked]>
    pwm: tiehrpwm: Fix corner case in clock divisor calculation

Uwe Kleine-König <[email-masked]>
    pwm: tiehrpwm: Fix various off-by-one errors in duty-cycle calculation

Uwe Kleine-König <[email-masked]>
    pwm: tiehrpwm: Make code comment in .free() more useful

Uwe Kleine-König <[email-masked]>
    pwm: tiehrpwm: Don't drop runtime PM reference in .free()

AngeloGioacchino Del Regno <[email-masked]>
    arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible

AngeloGioacchino Del Regno <[email-masked]>
    arm64: dts: mediatek: mt8395-kontron-i1200: Fix MT6360 regulator nodes

AngeloGioacchino Del Regno <[email-masked]>
    arm64: dts: mediatek: mt6795-xperia-m5: Fix mmc0 latch-ck value

Bean Huo <[email-masked]>
    mmc: core: Fix variable shadowing in mmc_route_rpmb_frames()

AngeloGioacchino Del Regno <[email-masked]>
    arm64: dts: mediatek: mt6331: Fix pmic, regulators, rtc, keys node names

Chen-Yu Tsai <[email-masked]>
    arm64: dts: mediatek: mt8186-tentacruel: Fix touchscreen model

Johan Hovold <[email-masked]>
    cpuidle: qcom-spm: fix device and OF node leaks at probe

Johan Hovold <[email-masked]>
    soc: mediatek: mtk-svs: fix device leaks on mt8192 probe failure

Johan Hovold <[email-masked]>
    soc: mediatek: mtk-svs: fix device leaks on mt8183 probe failure

Johan Hovold <[email-masked]>
    firmware: firmware: meson-sm: fix compile-test default

Nicolas Frattaroli <[email-masked]>
    PM / devfreq: rockchip-dfi: double count on RK3588

Eric Dumazet <[email-masked]>
    nbd: restrict sockets to TCP and UDP

Guoqing Jiang <[email-masked]>
    arm64: dts: mediatek: mt8195: Remove suspend-breaking reset from pcie0

Thomas Weißschuh <[email-masked]>
    selftests: vDSO: vdso_test_abi: Correctly skip whole test with missing vDSO

Thomas Weißschuh <[email-masked]>
    selftests: vDSO: Fix -Wunitialized in powerpc VDSO_CALL() wrapper

Genjian Zhang <[email-masked]>
    null_blk: Fix the description of the cache_size module argument

Qianfeng Rong <[email-masked]>
    pinctrl: renesas: Use int type to store negative error codes

Andy Yan <[email-masked]>
    power: supply: cw2015: Fix a alignment coding style issue

Dan Carpenter <[email-masked]>
    PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()

Jihed Chaibi <[email-masked]>
    ARM: dts: omap: am335x-cm-t335: Remove unused mcasp num-serializer property

Jihed Chaibi <[email-masked]>
    ARM: dts: ti: omap: omap3-devkit8000-lcd: Fix ti,keep-vref-on property to use correct boolean syntax in DTS

Jihed Chaibi <[email-masked]>
    ARM: dts: ti: omap: am335x-baltos: Fix ti,en-ck32k-xtal property in DTS to use correct boolean syntax

Thomas Weißschuh <[email-masked]>
    vdso: Add struct __kernel_old_timeval forward declaration to gettime.h

Rafael J. Wysocki <[email-masked]>
    PM: sleep: core: Clear power.must_resume in noirq suspend error path

Qianfeng Rong <[email-masked]>
    block: use int to store blk_stack_limits() return value

Andrei Lalaev <[email-masked]>
    leds: leds-lp55xx: Use correct address for memory programming

Benjamin Berg <[email-masked]>
    selftests/nolibc: fix EXPECT_NZ macro

Qianfeng Rong <[email-masked]>
    regulator: scmi: Use int type to store negative error codes

Janne Grunau <[email-masked]>
    arm64: dts: apple: t8103-j457: Fix PCIe ethernet iommu-map

Nicolas Ferre <[email-masked]>
    ARM: at91: pm: fix MCKx restore routine

Li Nan <[email-masked]>
    blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx

Da Xue <[email-masked]>
    pinctrl: meson-gxl: add missing i2c_d pinmux

Sneh Mankad <[email-masked]>
    soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS

Huisong Li <[email-masked]>
    ACPI: processor: idle: Fix memory leak when register cpuidle device failed

Joy Zou <[email-masked]>
    arm64: dts: imx95: Correct the lpuart7 and lpuart8 srcid

Frieder Schrempf <[email-masked]>
    arm64: dts: imx93-kontron: Fix USB port assignment

Annette Kobou <[email-masked]>
    arm64: dts: imx93-kontron: Fix GPIO for panel regulator

Junnan Wu <[email-masked]>
    firmware: arm_scmi: Mark VirtIO ready before registering scmi_virtio_driver

Florian Fainelli <[email-masked]>
    cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()

Ilya Leoshkevich <[email-masked]>
    s390/bpf: Write back tail call counter for BPF_TRAMP_F_CALL_ORIG

Ilya Leoshkevich <[email-masked]>
    s390/bpf: Write back tail call counter for BPF_PSEUDO_CALL

Fenglin Wu <[email-masked]>
    leds: flash: leds-qcom-flash: Update torch current clamp setting

Geert Uytterhoeven <[email-masked]>
    ARM: dts: renesas: porter: Fix CAN pin group

Yureka Lilian <[email-masked]>
    libbpf: Fix reuse of DEVMAP

Tao Chen <[email-masked]>
    bpf: Remove migrate_disable in kprobe_multi_link_prog_run

Matt Bobrowski <[email-masked]>
    bpf/selftests: Fix test_tcpnotify_user

Geert Uytterhoeven <[email-masked]>
    regmap: Remove superfluous check for !config in __regmap_init()

Biju Das <[email-masked]>
    arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0

Lad Prabhakar <[email-masked]>
    pinctrl: renesas: rzg2l: Fix invalid unsigned return in rzg3s_oen_read()

Qu Wenruo <[email-masked]>
    btrfs: return any hit error from extent_writepage_io()

Randy Dunlap <[email-masked]>
    lsm: CONFIG_LSM can depend on CONFIG_SECURITY

Uros Bizjak <[email-masked]>
    x86/vdso: Fix output operand size of RDPID

Qiuxu Zhuo <[email-masked]>
    EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller

Stefan Metzmacher <[email-masked]>
    smb: server: fix IRD/ORD negotiation with the client

Leo Yan <[email-masked]>
    perf: arm_spe: Prevent overflow in PERF_IDX2OFF()

Leo Yan <[email-masked]>
    coresight: trbe: Prevent overflow in PERF_IDX2OFF()

Jeremy Linton <[email-masked]>
    uprobes: uprobe_warn should use passed task

Christophe Leroy <[email-masked]>
    powerpc/603: Really copy kernel PGD entries into all PGDIRs

Christophe Leroy <[email-masked]>
    powerpc/8xx: Remove left-over instruction and comments in DataStoreTLBMiss handler

Andreas Gruenbacher <[email-masked]>
    gfs2: Fix GLF_INVALIDATE_IN_PROGRESS flag clearing in do_xmote

Bala-Vignesh-Reddy <[email-masked]>
    selftests: arm64: Check fread return value in exec_target

Johannes Nixdorf <[email-masked]>
    seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast

Geert Uytterhoeven <[email-masked]>
    init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD

Jeff Layton <[email-masked]>
    filelock: add FL_RECLAIM to show_fl_flags() macro

-------------

Diffstat:

 Documentation/trace/histogram-design.rst           |   4 +-
 Makefile                                           |   4 +-
 arch/arm/boot/dts/renesas/r8a7791-porter.dts       |   2 +-
 arch/arm/boot/dts/ti/omap/am335x-baltos.dtsi       |   2 +-
 arch/arm/boot/dts/ti/omap/am335x-cm-t335.dts       |   2 -
 .../dts/ti/omap/omap3-devkit8000-lcd-common.dtsi   |   2 +-
 arch/arm/mach-at91/pm_suspend.S                    |   4 +-
 arch/arm64/boot/dts/apple/t8103-j457.dts           |  12 +-
 .../boot/dts/freescale/imx93-kontron-bl-osm-s.dts  |  32 ++-
 arch/arm64/boot/dts/freescale/imx95.dtsi           |   4 +-
 arch/arm64/boot/dts/mediatek/mt6331.dtsi           |  10 +-
 .../boot/dts/mediatek/mt6795-sony-xperia-m5.dts    |   2 +-
 .../boot/dts/mediatek/mt8186-corsola-krabby.dtsi   |   8 +-
 .../mt8186-corsola-tentacruel-sku262144.dts        |   4 +
 arch/arm64/boot/dts/mediatek/mt8195.dtsi           |   3 -
 .../dts/mediatek/mt8395-kontron-3-5-sbc-i1200.dts  |  16 +-
 arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts    |   2 +-
 arch/arm64/boot/dts/qcom/qcm2290.dtsi              |   1 +
 arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi      |   5 +-
 arch/arm64/net/bpf_jit_comp.c                      |   3 +-
 arch/loongarch/kernel/relocate.c                   |   4 +
 arch/powerpc/include/asm/book3s/32/pgalloc.h       |  10 +-
 arch/powerpc/include/asm/nohash/pgalloc.h          |   2 +-
 arch/powerpc/kernel/head_8xx.S                     |   9 +-
 arch/riscv/net/bpf_jit_comp64.c                    |  42 +++-
 arch/s390/net/bpf_jit_comp.c                       |  26 +-
 arch/sparc/lib/M7memcpy.S                          |  20 +-
 arch/sparc/lib/Memcpy_utils.S                      |   9 +
 arch/sparc/lib/NG4memcpy.S                         |   2 +-
 arch/sparc/lib/NGmemcpy.S                          |  29 ++-
 arch/sparc/lib/U1memcpy.S                          |  19 +-
 arch/sparc/lib/U3memcpy.S                          |   2 +-
 arch/x86/include/asm/segment.h                     |   8 +-
 arch/x86/kvm/svm/svm.c                             |  12 +-
 block/blk-mq-sysfs.c                               |   6 +-
 block/blk-settings.c                               |   3 +-
 crypto/asymmetric_keys/x509_cert_parser.c          |  16 +-
 drivers/acpi/acpica/aclocal.h                      |   2 +-
 drivers/acpi/nfit/core.c                           |   2 +-
 drivers/acpi/processor_idle.c                      |   3 +
 drivers/base/node.c                                |   4 +
 drivers/base/power/main.c                          |  14 +-
 drivers/base/regmap/regmap.c                       |   2 +-
 drivers/block/nbd.c                                |   8 +
 drivers/block/null_blk/main.c                      |   2 +-
 drivers/bus/fsl-mc/fsl-mc-bus.c                    |   3 +
 drivers/char/hw_random/Kconfig                     |   1 +
 drivers/char/hw_random/ks-sa-rng.c                 |   4 +
 drivers/char/tpm/Kconfig                           |   2 +-
 drivers/cpufreq/scmi-cpufreq.c                     |  10 +
 drivers/cpuidle/cpuidle-qcom-spm.c                 |   7 +-
 drivers/crypto/hisilicon/debugfs.c                 |   1 +
 drivers/crypto/hisilicon/hpre/hpre_main.c          |   3 +-
 drivers/crypto/hisilicon/qm.c                      |   7 +-
 drivers/crypto/hisilicon/sec2/sec_main.c           |  80 +++----
 drivers/crypto/hisilicon/zip/zip_main.c            |  17 +-
 .../crypto/intel/keembay/keembay-ocs-hcu-core.c    |   5 +-
 .../crypto/marvell/octeontx2/otx2_cptpf_ucode.c    |   2 +-
 drivers/devfreq/event/rockchip-dfi.c               |   7 +-
 drivers/devfreq/mtk-cci-devfreq.c                  |   3 +-
 drivers/edac/i10nm_base.c                          |  14 ++
 drivers/firmware/arm_scmi/transports/virtio.c      |   3 +
 drivers/firmware/meson/Kconfig                     |   2 +-
 drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c              |  29 ++-
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c               |   2 +-
 .../display/dc/dml/dcn32/display_rq_dlg_calc_32.c  |   1 -
 drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c       |   7 +
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c         |  92 +++++---
 drivers/gpu/drm/bridge/Kconfig                     |   1 +
 .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c    |   2 +-
 drivers/gpu/drm/panel/panel-novatek-nt35560.c      |   2 +-
 drivers/gpu/drm/radeon/r600_cs.c                   |   4 +-
 drivers/hid/hidraw.c                               | 262 +++++++++++----------
 drivers/hwmon/mlxreg-fan.c                         |  24 +-
 drivers/hwtracing/coresight/coresight-catu.c       |  22 +-
 drivers/hwtracing/coresight/coresight-catu.h       |   1 +
 drivers/hwtracing/coresight/coresight-core.c       |   5 +-
 drivers/hwtracing/coresight/coresight-etm4x-core.c |  31 ++-
 drivers/hwtracing/coresight/coresight-etm4x.h      |   6 +-
 drivers/hwtracing/coresight/coresight-tmc-core.c   |  22 +-
 drivers/hwtracing/coresight/coresight-tmc.h        |   2 +
 drivers/hwtracing/coresight/coresight-tpda.c       |   3 +
 drivers/hwtracing/coresight/coresight-trbe.c       |  11 +-
 drivers/i2c/busses/i2c-designware-platdrv.c        |   5 +-
 drivers/i2c/busses/i2c-mt65xx.c                    |  17 +-
 drivers/i3c/master/svc-i3c-master.c                |  31 ++-
 drivers/iio/inkern.c                               |  30 +--
 drivers/infiniband/core/addr.c                     |  10 +-
 drivers/infiniband/core/cm.c                       |   4 +-
 drivers/infiniband/core/sa_query.c                 |   6 +-
 drivers/infiniband/hw/mlx5/main.c                  |  67 +++++-
 drivers/infiniband/hw/mlx5/mlx5_ib.h               |   1 +
 drivers/infiniband/sw/rxe/rxe_task.c               |   8 +-
 drivers/infiniband/sw/siw/siw_verbs.c              |  25 +-
 drivers/input/misc/uinput.c                        |   1 +
 drivers/input/touchscreen/atmel_mxt_ts.c           |   2 +-
 drivers/iommu/intel/debugfs.c                      |  17 +-
 drivers/iommu/intel/iommu.h                        |   3 +-
 drivers/leds/flash/leds-qcom-flash.c               |  62 +++--
 drivers/leds/leds-lp55xx-common.c                  |   2 +-
 drivers/md/dm-core.h                               |   1 +
 drivers/md/dm-vdo/indexer/volume-index.c           |   4 +-
 drivers/md/dm.c                                    |  13 +-
 drivers/media/i2c/rj54n1cb0c.c                     |   9 +-
 drivers/media/pci/zoran/zoran.h                    |   6 -
 drivers/media/pci/zoran/zoran_driver.c             |   3 +-
 .../media/platform/st/sti/delta/delta-mjpeg-dec.c  |  20 +-
 drivers/mfd/rz-mtu3.c                              |   2 +-
 drivers/mfd/vexpress-sysreg.c                      |   6 +-
 drivers/misc/fastrpc.c                             |  89 ++++---
 drivers/misc/genwqe/card_ddcb.c                    |   2 +-
 drivers/mmc/core/block.c                           |   6 +-
 drivers/mtd/nand/raw/atmel/nand-controller.c       |   4 +-
 drivers/net/ethernet/amazon/ena/ena_ethtool.c      |   5 +-
 drivers/net/ethernet/dlink/dl2k.c                  |   7 +-
 drivers/net/ethernet/intel/idpf/idpf_txrx.c        |   8 +-
 drivers/net/ethernet/intel/idpf/idpf_virtchnl.c    |   6 +-
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c      |   6 +-
 .../ethernet/mellanox/mlx5/core/en/port_buffer.h   |  12 -
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |  17 +-
 drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c |  24 ++
 .../net/ethernet/mellanox/mlx5/core/pagealloc.c    |   7 +-
 .../net/ethernet/netronome/nfp/nfp_net_ethtool.c   |   2 +-
 drivers/net/usb/asix_devices.c                     |  29 +++
 drivers/net/usb/rtl8150.c                          |   2 -
 drivers/net/wireless/ath/ath10k/wmi.c              |  39 ++-
 drivers/net/wireless/ath/ath12k/ce.c               |   2 +-
 drivers/net/wireless/ath/ath12k/debug.h            |   1 +
 drivers/net/wireless/intel/iwlwifi/fw/regulatory.h |   1 -
 drivers/net/wireless/marvell/mwifiex/cfg80211.c    |   7 +-
 drivers/net/wireless/mediatek/mt76/mt7603/soc.c    |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h |   6 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c    |  29 +--
 drivers/net/wireless/mediatek/mt76/mt7996/init.c   |   8 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h |  11 +-
 drivers/net/wireless/mediatek/mt76/mt7996/pci.c    |   2 +-
 drivers/net/wireless/realtek/rtw89/ser.c           |   3 +-
 drivers/nvme/target/fc.c                           |  19 +-
 drivers/pci/controller/cadence/pci-j721e.c         |   2 +-
 drivers/pci/controller/dwc/pcie-rcar-gen4.c        |  26 +-
 drivers/pci/controller/dwc/pcie-tegra194.c         |   4 +-
 drivers/pci/controller/pci-tegra.c                 |   2 +-
 drivers/pci/pci-acpi.c                             |   6 +-
 drivers/perf/arm_spe_pmu.c                         |   3 +-
 drivers/phy/rockchip/phy-rockchip-naneng-combphy.c |  12 +
 drivers/pinctrl/meson/pinctrl-meson-gxl.c          |  10 +
 drivers/pinctrl/pinmux.c                           |   2 +-
 drivers/pinctrl/renesas/pinctrl-rzg2l.c            |   2 +-
 drivers/pinctrl/renesas/pinctrl.c                  |   3 +-
 drivers/power/supply/cw2015_battery.c              |   3 +-
 drivers/pps/kapi.c                                 |   5 +-
 drivers/pps/pps.c                                  |   5 +-
 drivers/ptp/ptp_private.h                          |   1 +
 drivers/ptp/ptp_sysfs.c                            |   2 +-
 drivers/pwm/pwm-tiehrpwm.c                         | 154 +++++-------
 drivers/regulator/scmi-regulator.c                 |   3 +-
 drivers/remoteproc/pru_rproc.c                     |   3 +-
 drivers/remoteproc/qcom_q6v5.c                     |   3 -
 drivers/scsi/mpt3sas/mpt3sas_transport.c           |   8 +-
 drivers/scsi/myrs.c                                |   8 +-
 drivers/scsi/pm8001/pm8001_sas.c                   |   9 +-
 drivers/scsi/qla2xxx/qla_edif.c                    |   4 +-
 drivers/scsi/qla2xxx/qla_init.c                    |   4 +-
 drivers/scsi/qla2xxx/qla_nvme.c                    |   2 +-
 drivers/soc/mediatek/mtk-svs.c                     |  23 ++
 drivers/soc/qcom/rpmh-rsc.c                        |   7 +-
 drivers/spi/spi.c                                  |   2 +-
 drivers/tee/tee_shm.c                              |   8 +
 drivers/thermal/qcom/Kconfig                       |   3 +-
 drivers/thermal/qcom/lmh.c                         |   2 +
 drivers/tty/n_gsm.c                                |  25 +-
 drivers/tty/serial/max310x.c                       |   2 +
 drivers/uio/uio_hv_generic.c                       |   7 +-
 drivers/usb/cdns3/cdnsp-pci.c                      |   5 +-
 drivers/usb/gadget/configfs.c                      |   2 +
 drivers/usb/host/max3421-hcd.c                     |   2 +-
 drivers/usb/host/xhci-ring.c                       |  11 +-
 drivers/usb/misc/Kconfig                           |   1 +
 drivers/usb/misc/qcom_eud.c                        |  33 ++-
 drivers/usb/phy/phy-twl6030-usb.c                  |   3 +-
 drivers/usb/typec/tipd/core.c                      |  24 +-
 drivers/usb/usbip/vhci_hcd.c                       |  22 ++
 drivers/vfio/pci/pds/dirty.c                       |   2 +-
 drivers/vhost/vringh.c                             |  14 +-
 drivers/video/fbdev/simplefb.c                     |  31 ++-
 drivers/watchdog/mpc8xxx_wdt.c                     |   2 +
 fs/btrfs/extent_io.c                               |   9 +-
 fs/ext4/ext4.h                                     |  10 +
 fs/ext4/file.c                                     |   2 +-
 fs/ext4/inode.c                                    |   2 +-
 fs/ext4/orphan.c                                   |   6 +-
 fs/ext4/super.c                                    |   4 +-
 fs/f2fs/data.c                                     |   9 +-
 fs/f2fs/f2fs.h                                     |   4 +-
 fs/f2fs/file.c                                     |  49 ++--
 fs/gfs2/glock.c                                    |   2 -
 fs/nfs/nfs4proc.c                                  |   2 +-
 fs/ntfs3/index.c                                   |  10 +
 fs/ntfs3/run.c                                     |  12 +-
 fs/ocfs2/stack_user.c                              |   1 +
 fs/smb/client/smb2ops.c                            |  17 +-
 fs/smb/server/ksmbd_netlink.h                      |   5 +-
 fs/smb/server/mgmt/user_session.c                  |  26 +-
 fs/smb/server/server.h                             |   1 +
 fs/smb/server/smb2pdu.c                            |   3 +-
 fs/smb/server/transport_ipc.c                      |   3 +
 fs/smb/server/transport_rdma.c                     |  97 +++++++-
 fs/smb/server/transport_tcp.c                      |  27 ++-
 fs/squashfs/inode.c                                |   7 +
 fs/squashfs/squashfs_fs_i.h                        |   2 +-
 fs/udf/inode.c                                     |   3 +
 include/asm-generic/vmlinux.lds.h                  |   1 +
 include/linux/bpf.h                                |   1 +
 include/linux/btf.h                                |   2 +-
 include/linux/once.h                               |   4 +-
 include/trace/events/filelock.h                    |   3 +-
 include/uapi/linux/hidraw.h                        |   2 +
 include/vdso/gettime.h                             |   1 +
 init/Kconfig                                       |   1 +
 io_uring/waitid.c                                  |   3 +-
 kernel/bpf/core.c                                  |   5 +
 kernel/bpf/verifier.c                              |   4 +-
 kernel/events/uprobes.c                            |   2 +-
 kernel/seccomp.c                                   |  12 +-
 kernel/smp.c                                       |  11 +-
 kernel/trace/bpf_trace.c                           |   9 +-
 mm/hugetlb.c                                       |   2 +
 net/9p/trans_usbg.c                                |  16 +-
 net/bluetooth/hci_sync.c                           |  10 +-
 net/bluetooth/iso.c                                |  11 +-
 net/bluetooth/mgmt.c                               |  10 +-
 net/core/filter.c                                  |  16 +-
 net/ipv4/ping.c                                    |  14 +-
 net/ipv4/tcp.c                                     |   9 +-
 net/mac80211/rx.c                                  |  28 ++-
 net/netfilter/ipset/ip_set_hash_gen.h              |   8 +-
 net/netfilter/ipvs/ip_vs_conn.c                    |   4 +-
 net/netfilter/ipvs/ip_vs_core.c                    |  11 +-
 net/netfilter/ipvs/ip_vs_ctl.c                     |   6 +-
 net/netfilter/ipvs/ip_vs_est.c                     |  16 +-
 net/netfilter/ipvs/ip_vs_ftp.c                     |   4 +-
 net/netfilter/nfnetlink.c                          |   2 +
 net/nfc/nci/ntf.c                                  | 135 ++++++++---
 net/sunrpc/auth_gss/svcauth_gss.c                  |   2 +-
 security/Kconfig                                   |   1 +
 sound/core/pcm_native.c                            |  21 +-
 sound/pci/lx6464es/lx_core.c                       |   4 +-
 sound/soc/codecs/wcd934x.c                         |  17 +-
 sound/soc/codecs/wcd937x.c                         |   4 +-
 sound/soc/codecs/wcd937x.h                         |   6 +-
 sound/soc/intel/boards/bytcht_es8316.c             |  20 +-
 sound/soc/intel/boards/bytcr_rt5640.c              |   7 +-
 sound/soc/intel/boards/bytcr_rt5651.c              |  26 +-
 sound/soc/intel/boards/sof_sdw.c                   |   2 +-
 sound/soc/sof/ipc3-topology.c                      |  10 +-
 tools/include/nolibc/std.h                         |   2 +-
 tools/lib/bpf/libbpf.c                             |  46 ++--
 tools/testing/nvdimm/test/ndtest.c                 |  13 +-
 tools/testing/selftests/arm64/pauth/exec_target.c  |   7 +-
 .../selftests/bpf/progs/test_tcpnotify_kern.c      |   1 -
 tools/testing/selftests/bpf/test_tcpnotify_user.c  |  20 +-
 tools/testing/selftests/nolibc/nolibc-test.c       |   4 +-
 tools/testing/selftests/vDSO/vdso_call.h           |   7 +-
 tools/testing/selftests/vDSO/vdso_test_abi.c       |   9 +-
 tools/testing/selftests/watchdog/watchdog-test.c   |   6 +
 265 files changed, 2074 insertions(+), 1143 deletions(-)

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:16:38 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367634; cv=none; b=Ap6TWGMGBXYcsyx6ikpzr8uPim3/iknETZB9lUEGXmN9vTYcqvHvtdXScDRhuOAbwTJakVHJz6lw41kj1aaEUR9G0T49bl4MbXWxK/zAz5x1R80kxKOSxTCzk7ygmT+NHd7MCKaOvh5qslhGIJlJU3Jodd5aV3v5Yzgz0nyW0FE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367634; c=relaxed/simple;
	bh=bhM//TLWjuoky3gUJuDpKMEg1m9sIINyg57Lg6NvuAM=;
	h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:
	 Content-Type:Content-Disposition:In-Reply-To; b=K9t/qxb0wjACK+JyJ/+2YvKnzSFEcSrtV/GUuNQgK2AG3eb4TbVGoW7lWmKZhtHat4p0v22EYeKHVFONijUh5IkgJk0aWPRMNcweALPEAsp11UzHNcbCID7xe2g/WCFmJmazN9Wrw/L6w0Uj72MIc4tGE1jeqBlevkIJsTMXqMM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=ideasonboard.com; spf=pass smtp.mailfrom=ideasonboard.com; dkim=pass (1024-bit key) header.d=ideasonboard.com header.i=@ideasonboard.com header.b=EzFHmfnk; arc=none smtp.client-ip=213.167.242.64
Date: Mon, 13 Oct 2025 18:00:22 +0300
From: Laurent Pinchart <[email-masked]>
To: Greg Kroah-Hartman <[email-masked]>
Cc: [email-masked], [email-masked],
	[email-masked],
	[email-masked],
	Youngjun Lee <[email-masked]>,
	Thadeu Lima de Souza Cascardo <[email-masked]>,
	Ricardo Ribalda <[email-masked]>,
	Hans de Goede <[email-masked]>,
	Hans Verkuil <[email-masked]>
Subject: Re: [PATCH 6.1 013/196] media: uvcvideo: Mark invalid entities with
 id UVC_INVALID_ENTITY_ID
DKIMCheck: Server passes DKIM test, 0 Spam score
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: syzkaller.appspot.com]
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
SpamTally: Final spam score: 4

Hi Greg,

On Mon, Oct 13, 2025 at 04:43:06PM +0200, Greg KH wrote:
> 6.1-stable review patch.  If anyone has any objections, please let me know.

This is causing a regression as reported in [1]. Ricardo is trying to
get his hands on a device to try and develop a proper fix. In the
meantime, can we avoid backporting this patch to any stable tree ?

[1] https://lore.kernel.org/r/CAOzBiVuS7ygUjjhCbyWg-KiNx+HFTYnqH5+GJhd6cYsNLT=[email-masked]

> ------------------
> 
> From: Thadeu Lima de Souza Cascardo <[email-masked]>
> 
> commit 0e2ee70291e64a30fe36960c85294726d34a103e upstream.
> 
> Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero
> unique ID.
> 
> ```
> Each Unit and Terminal within the video function is assigned a unique
> identification number, the Unit ID (UID) or Terminal ID (TID), contained in
> the bUnitID or bTerminalID field of the descriptor. The value 0x00 is
> reserved for undefined ID,
> ```
> 
> If we add a new entity with id 0 or a duplicated ID, it will be marked
> as UVC_INVALID_ENTITY_ID.
> 
> In a previous attempt commit 3dd075fe8ebb ("media: uvcvideo: Require
> entities to have a non-zero unique ID"), we ignored all the invalid units,
> this broke a lot of non-compatible cameras. Hopefully we are more lucky
> this time.
> 
> This also prevents some syzkaller reproducers from triggering warnings due
> to a chain of entities referring to themselves. In one particular case, an
> Output Unit is connected to an Input Unit, both with the same ID of 1. But
> when looking up for the source ID of the Output Unit, that same entity is
> found instead of the input entity, which leads to such warnings.
> 
> In another case, a backward chain was considered finished as the source ID
> was 0. Later on, that entity was found, but its pads were not valid.
> 
> Here is a sample stack trace for one of those cases.
> 
> [   20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd
> [   20.830206] usb 1-1: Using ep0 maxpacket: 8
> [   20.833501] usb 1-1: config 0 descriptor??
> [   21.038518] usb 1-1: string descriptor 0 read error: -71
> [   21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201)
> [   21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized!
> [   21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized!
> [   21.042218] ------------[ cut here ]------------
> [   21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0
> [   21.043195] Modules linked in:
> [   21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444
> [   21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
> [   21.044639] Workqueue: usb_hub_wq hub_event
> [   21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0
> [   21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00
> [   21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246
> [   21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1
> [   21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290
> [   21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000
> [   21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003
> [   21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000
> [   21.049648] FS:  0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
> [   21.050271] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0
> [   21.051136] PKRU: 55555554
> [   21.051331] Call Trace:
> [   21.051480]  <TASK>
> [   21.051611]  ? __warn+0xc4/0x210
> [   21.051861]  ? media_create_pad_link+0x2c4/0x2e0
> [   21.052252]  ? report_bug+0x11b/0x1a0
> [   21.052540]  ? trace_hardirqs_on+0x31/0x40
> [   21.052901]  ? handle_bug+0x3d/0x70
> [   21.053197]  ? exc_invalid_op+0x1a/0x50
> [   21.053511]  ? asm_exc_invalid_op+0x1a/0x20
> [   21.053924]  ? media_create_pad_link+0x91/0x2e0
> [   21.054364]  ? media_create_pad_link+0x2c4/0x2e0
> [   21.054834]  ? media_create_pad_link+0x91/0x2e0
> [   21.055131]  ? _raw_spin_unlock+0x1e/0x40
> [   21.055441]  ? __v4l2_device_register_subdev+0x202/0x210
> [   21.055837]  uvc_mc_register_entities+0x358/0x400
> [   21.056144]  uvc_register_chains+0x1fd/0x290
> [   21.056413]  uvc_probe+0x380e/0x3dc0
> [   21.056676]  ? __lock_acquire+0x5aa/0x26e0
> [   21.056946]  ? find_held_lock+0x33/0xa0
> [   21.057196]  ? kernfs_activate+0x70/0x80
> [   21.057533]  ? usb_match_dynamic_id+0x1b/0x70
> [   21.057811]  ? find_held_lock+0x33/0xa0
> [   21.058047]  ? usb_match_dynamic_id+0x55/0x70
> [   21.058330]  ? lock_release+0x124/0x260
> [   21.058657]  ? usb_match_one_id_intf+0xa2/0x100
> [   21.058997]  usb_probe_interface+0x1ba/0x330
> [   21.059399]  really_probe+0x1ba/0x4c0
> [   21.059662]  __driver_probe_device+0xb2/0x180
> [   21.059944]  driver_probe_device+0x5a/0x100
> [   21.060170]  __device_attach_driver+0xe9/0x160
> [   21.060427]  ? __pfx___device_attach_driver+0x10/0x10
> [   21.060872]  bus_for_each_drv+0xa9/0x100
> [   21.061312]  __device_attach+0xed/0x190
> [   21.061812]  device_initial_probe+0xe/0x20
> [   21.062229]  bus_probe_device+0x4d/0xd0
> [   21.062590]  device_add+0x308/0x590
> [   21.062912]  usb_set_configuration+0x7b6/0xaf0
> [   21.063403]  usb_generic_driver_probe+0x36/0x80
> [   21.063714]  usb_probe_device+0x7b/0x130
> [   21.063936]  really_probe+0x1ba/0x4c0
> [   21.064111]  __driver_probe_device+0xb2/0x180
> [   21.064577]  driver_probe_device+0x5a/0x100
> [   21.065019]  __device_attach_driver+0xe9/0x160
> [   21.065403]  ? __pfx___device_attach_driver+0x10/0x10
> [   21.065820]  bus_for_each_drv+0xa9/0x100
> [   21.066094]  __device_attach+0xed/0x190
> [   21.066535]  device_initial_probe+0xe/0x20
> [   21.066992]  bus_probe_device+0x4d/0xd0
> [   21.067250]  device_add+0x308/0x590
> [   21.067501]  usb_new_device+0x347/0x610
> [   21.067817]  hub_event+0x156b/0x1e30
> [   21.068060]  ? process_scheduled_works+0x48b/0xaf0
> [   21.068337]  process_scheduled_works+0x5a3/0xaf0
> [   21.068668]  worker_thread+0x3cf/0x560
> [   21.068932]  ? kthread+0x109/0x1b0
> [   21.069133]  kthread+0x197/0x1b0
> [   21.069343]  ? __pfx_worker_thread+0x10/0x10
> [   21.069598]  ? __pfx_kthread+0x10/0x10
> [   21.069908]  ret_from_fork+0x32/0x40
> [   21.070169]  ? __pfx_kthread+0x10/0x10
> [   21.070424]  ret_from_fork_asm+0x1a/0x30
> [   21.070737]  </TASK>
> 
> Reported-by: [email-masked]
> Closes: https://syzkaller.appspot.com/bug?extid=0584f746fde3d52b4675
> Reported-by: [email-masked]
> Closes: https://syzkaller.appspot.com/bug?extid=dd320d114deb3f5bb79b
> Reported-by: Youngjun Lee <[email-masked]>
> Fixes: a3fbc2e6bb05 ("media: mc-entity.c: use WARN_ON, validate link pads")
> Cc: [email-masked]
> Signed-off-by: Thadeu Lima de Souza Cascardo <[email-masked]>
> Co-developed-by: Ricardo Ribalda <[email-masked]>
> Signed-off-by: Ricardo Ribalda <[email-masked]>
> Reviewed-by: Laurent Pinchart <[email-masked]>
> Reviewed-by: Hans de Goede <[email-masked]>
> Signed-off-by: Hans de Goede <[email-masked]>
> Signed-off-by: Laurent Pinchart <[email-masked]>
> Signed-off-by: Hans Verkuil <[email-masked]>
> Signed-off-by: Greg Kroah-Hartman <[email-masked]>
> ---
>  drivers/media/usb/uvc/uvc_driver.c |   73 +++++++++++++++++++++++--------------
>  drivers/media/usb/uvc/uvcvideo.h   |    2 +
>  2 files changed, 48 insertions(+), 27 deletions(-)
> 
> --- a/drivers/media/usb/uvc/uvc_driver.c
> +++ b/drivers/media/usb/uvc/uvc_driver.c
> @@ -134,6 +134,9 @@ struct uvc_entity *uvc_entity_by_id(stru
>  {
>  	struct uvc_entity *entity;
>  
> +	if (id == UVC_INVALID_ENTITY_ID)
> +		return NULL;
> +
>  	list_for_each_entry(entity, &dev->entities, list) {
>  		if (entity->id == id)
>  			return entity;
> @@ -757,14 +760,27 @@ static const u8 uvc_media_transport_inpu
>  	UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT;
>  static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING;
>  
> -static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id,
> -		unsigned int num_pads, unsigned int extra_size)
> +static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type,
> +					       u16 id, unsigned int num_pads,
> +					       unsigned int extra_size)
>  {
>  	struct uvc_entity *entity;
>  	unsigned int num_inputs;
>  	unsigned int size;
>  	unsigned int i;
>  
> +	/* Per UVC 1.1+ spec 3.7.2, the ID should be non-zero. */
> +	if (id == 0) {
> +		dev_err(&dev->intf->dev, "Found Unit with invalid ID 0\n");
> +		id = UVC_INVALID_ENTITY_ID;
> +	}
> +
> +	/* Per UVC 1.1+ spec 3.7.2, the ID is unique. */
> +	if (uvc_entity_by_id(dev, id)) {
> +		dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n", id);
> +		id = UVC_INVALID_ENTITY_ID;
> +	}
> +
>  	extra_size = roundup(extra_size, sizeof(*entity->pads));
>  	if (num_pads)
>  		num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1;
> @@ -774,7 +790,7 @@ static struct uvc_entity *uvc_alloc_enti
>  	     + num_inputs;
>  	entity = kzalloc(size, GFP_KERNEL);
>  	if (entity == NULL)
> -		return NULL;
> +		return ERR_PTR(-ENOMEM);
>  
>  	entity->id = id;
>  	entity->type = type;
> @@ -865,10 +881,10 @@ static int uvc_parse_vendor_control(stru
>  			break;
>  		}
>  
> -		unit = uvc_alloc_entity(UVC_VC_EXTENSION_UNIT, buffer[3],
> -					p + 1, 2*n);
> -		if (unit == NULL)
> -			return -ENOMEM;
> +		unit = uvc_alloc_new_entity(dev, UVC_VC_EXTENSION_UNIT,
> +					    buffer[3], p + 1, 2 * n);
> +		if (IS_ERR(unit))
> +			return PTR_ERR(unit);
>  
>  		memcpy(unit->guid, &buffer[4], 16);
>  		unit->extension.bNumControls = buffer[20];
> @@ -978,10 +994,10 @@ static int uvc_parse_standard_control(st
>  			return -EINVAL;
>  		}
>  
> -		term = uvc_alloc_entity(type | UVC_TERM_INPUT, buffer[3],
> -					1, n + p);
> -		if (term == NULL)
> -			return -ENOMEM;
> +		term = uvc_alloc_new_entity(dev, type | UVC_TERM_INPUT,
> +					    buffer[3], 1, n + p);
> +		if (IS_ERR(term))
> +			return PTR_ERR(term);
>  
>  		if (UVC_ENTITY_TYPE(term) == UVC_ITT_CAMERA) {
>  			term->camera.bControlSize = n;
> @@ -1038,10 +1054,10 @@ static int uvc_parse_standard_control(st
>  			return 0;
>  		}
>  
> -		term = uvc_alloc_entity(type | UVC_TERM_OUTPUT, buffer[3],
> -					1, 0);
> -		if (term == NULL)
> -			return -ENOMEM;
> +		term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT,
> +					    buffer[3], 1, 0);
> +		if (IS_ERR(term))
> +			return PTR_ERR(term);
>  
>  		memcpy(term->baSourceID, &buffer[7], 1);
>  
> @@ -1062,9 +1078,10 @@ static int uvc_parse_standard_control(st
>  			return -EINVAL;
>  		}
>  
> -		unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, 0);
> -		if (unit == NULL)
> -			return -ENOMEM;
> +		unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3],
> +					    p + 1, 0);
> +		if (IS_ERR(unit))
> +			return PTR_ERR(unit);
>  
>  		memcpy(unit->baSourceID, &buffer[5], p);
>  
> @@ -1086,9 +1103,9 @@ static int uvc_parse_standard_control(st
>  			return -EINVAL;
>  		}
>  
> -		unit = uvc_alloc_entity(buffer[2], buffer[3], 2, n);
> -		if (unit == NULL)
> -			return -ENOMEM;
> +		unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], 2, n);
> +		if (IS_ERR(unit))
> +			return PTR_ERR(unit);
>  
>  		memcpy(unit->baSourceID, &buffer[4], 1);
>  		unit->processing.wMaxMultiplier =
> @@ -1117,9 +1134,10 @@ static int uvc_parse_standard_control(st
>  			return -EINVAL;
>  		}
>  
> -		unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, n);
> -		if (unit == NULL)
> -			return -ENOMEM;
> +		unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3],
> +					    p + 1, n);
> +		if (IS_ERR(unit))
> +			return PTR_ERR(unit);
>  
>  		memcpy(unit->guid, &buffer[4], 16);
>  		unit->extension.bNumControls = buffer[20];
> @@ -1260,9 +1278,10 @@ static int uvc_gpio_parse(struct uvc_dev
>  		return dev_err_probe(&dev->intf->dev, irq,
>  				     "No IRQ for privacy GPIO\n");
>  
> -	unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1);
> -	if (!unit)
> -		return -ENOMEM;
> +	unit = uvc_alloc_new_entity(dev, UVC_EXT_GPIO_UNIT,
> +				    UVC_EXT_GPIO_UNIT_ID, 0, 1);
> +	if (IS_ERR(unit))
> +		return PTR_ERR(unit);
>  
>  	unit->gpio.gpio_privacy = gpio_privacy;
>  	unit->gpio.irq = irq;
> --- a/drivers/media/usb/uvc/uvcvideo.h
> +++ b/drivers/media/usb/uvc/uvcvideo.h
> @@ -41,6 +41,8 @@
>  #define UVC_EXT_GPIO_UNIT		0x7ffe
>  #define UVC_EXT_GPIO_UNIT_ID		0x100
>  
> +#define UVC_INVALID_ENTITY_ID          0xffff
> +
>  /* ------------------------------------------------------------------------
>   * Driver specific constants.
>   */

-- 
Regards,

Laurent Pinchart

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:37:09 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367423; cv=none; b=KH12S+gRl1zhBMqMFv6VU16gs//NDo1DtExoeTuZyalr3RzjWMmTIquoR+M7ss5pIHxpUPpaowgktJjdmzWxfWMnIZL1PFtkafKxe4MSLUxLUVGTUp6Jg6CRftPyNzemwRITERIJ5WjD15cQnod3c9Zw9xNhqgkStcLlviOi4OM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367423; c=relaxed/simple;
	bh=WsncMvwM61F8z+h+RP2U9gO9Q76IhEwlBLqvsBYGFpY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DRoCW7I+f3xoxupocAKjteZVDsHplBndkL2Gf7T2Vfpdrv3wh/OzZSvvbNQhNPM/WlEX6wkt0dnFe+v/a1bpc8lS3GybFuEvVH8jbC+yTlRW2dCULA0+WprSBLskHdy8iLftX5os4Da1nE7DMfXdNv9t2ihUu3krPUMvrmuLWtU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=znNiN5Lw; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	K Prateek Nayak <[email-masked]>,
	Yicong Yang <[email-masked]>,
	Sudeep Holla <[email-masked]>
Subject: [PATCH 6.1 196/196] drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug
Date: Mon, 13 Oct 2025 16:46:09 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: K Prateek Nayak <[email-masked]>

commit c26fabe73330d983c7ce822c6b6ec0879b4da61f upstream.

Until commit 5c2712387d48 ("cacheinfo: Fix LLC is not exported through
sysfs"), cacheinfo called populate_cache_leaves() for CPU coming online
which let the arch specific functions handle (at least on x86)
populating the shared_cpu_map. However, with the changes in the
aforementioned commit, populate_cache_leaves() is not called when a CPU
comes online as a result of hotplug since last_level_cache_is_valid()
returns true as the cacheinfo data is not discarded. The CPU coming
online is not present in shared_cpu_map, however, it will not be added
since the cpu_cacheinfo->cpu_map_populated flag is set (it is set in
populate_cache_leaves() when cacheinfo is first populated for x86)

This can lead to inconsistencies in the shared_cpu_map when an offlined
CPU comes online again. Example below depicts the inconsistency in the
shared_cpu_list in cacheinfo when CPU8 is offlined and onlined again on
a 3rd Generation EPYC processor:

  # for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
    /sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136
    /sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136
    /sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136
    /sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143

  # echo 0 > /sys/devices/system/cpu/cpu8/online
  # echo 1 > /sys/devices/system/cpu/cpu8/online

  # for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
    /sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8
    /sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8
    /sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8
    /sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8

  # cat /sys/devices/system/cpu/cpu136/cache/index0/shared_cpu_list
    136

  # cat /sys/devices/system/cpu/cpu136/cache/index3/shared_cpu_list
    9-15,136-143

Clear the flag when the CPU is removed from shared_cpu_map when
cache_shared_cpu_map_remove() is called during CPU hotplug. This will
allow cache_shared_cpu_map_setup() to add the CPU coming back online in
the shared_cpu_map. Set the flag again when the shared_cpu_map is setup.
Following are results of performing the same test as described above with
the changes:

  # for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
    /sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136
    /sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136
    /sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136
    /sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143

  # echo 0 > /sys/devices/system/cpu/cpu8/online
  # echo 1 > /sys/devices/system/cpu/cpu8/online

  # for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
    /sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136
    /sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136
    /sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136
    /sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143

  # cat /sys/devices/system/cpu/cpu136/cache/index0/shared_cpu_list
    8,136

  # cat /sys/devices/system/cpu/cpu136/cache/index3/shared_cpu_list
    8-15,136-143

Fixes: 5c2712387d48 ("cacheinfo: Fix LLC is not exported through sysfs")
Signed-off-by: K Prateek Nayak <[email-masked]>
Reviewed-by: Yicong Yang <[email-masked]>
Reviewed-by: Sudeep Holla <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/base/cacheinfo.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -365,11 +365,14 @@ static int cache_shared_cpu_map_setup(un
 			coherency_max_size = this_leaf->coherency_line_size;
 	}
 
+	/* shared_cpu_map is now populated for the cpu */
+	this_cpu_ci->cpu_map_populated = true;
 	return 0;
 }
 
 static void cache_shared_cpu_map_remove(unsigned int cpu)
 {
+	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
 	struct cacheinfo *this_leaf, *sib_leaf;
 	unsigned int sibling, index, sib_index;
 
@@ -404,6 +407,9 @@ static void cache_shared_cpu_map_remove(
 		if (of_have_populated_dt())
 			of_node_put(this_leaf->fw_token);
 	}
+
+	/* cpu is no longer populated in the shared map */
+	this_cpu_ci->cpu_map_populated = false;
 }
 
 static void free_cache_attributes(unsigned int cpu)

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:23:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367420; cv=none; b=DCtTHC7Bdqwz1N+1SDmkqqm3aCZbbNGAVJV0Wcn6J9E8RtUhslX3Xpz8RLuf4HxtteXj9BQ5dWovFuF1Rv525qFoM9dDuJsU81e9J1jYNN3iVv/GPanNS6shJ/V/HQm8yCpmweAlfaXINDt/MVVuKg3y+R1BnHJ2tJzkAi+70jM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367420; c=relaxed/simple;
	bh=q5CQu7NsdPDYOvHTTswwRtl6ABcGEqY/XR6/218t5O4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=GU2JeE96cFYkDTMtb/IaxXMhmkUuT3Af7axY0x2Tsw8xqBHj/w+rJB/wsl3au1zZ3MMCuN1eo1htjxwv7oDxToTmEXLCaxtNrSrojLwTY42e5D5VUoSLXgqAReDFem/jicXrUNzzKo5+Vts2AEQ8PmEVZfTsPicpIK9U3u7nHh0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YqrpL0jL; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yicong Yang <[email-masked]>,
	Pierre Gondois <[email-masked]>,
	Sudeep Holla <[email-masked]>
Subject: [PATCH 6.1 195/196] cacheinfo: Fix LLC is not exported through sysfs
Date: Mon, 13 Oct 2025 16:46:08 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yicong Yang <[email-masked]>

commit 5c2712387d4850e0b64121d5fd3e6c4e84ea3266 upstream.

After entering 6.3-rc1 the LLC cacheinfo is not exported on our ACPI
based arm64 server. This is because the LLC cacheinfo is partly reset
when secondary CPUs boot up. On arm64 the primary cpu will allocate
and setup cacheinfo:
init_cpu_topology()
  for_each_possible_cpu()
    fetch_cache_info() // Allocate cacheinfo and init levels
detect_cache_attributes()
  cache_shared_cpu_map_setup()
    if (!last_level_cache_is_valid()) // not valid, setup LLC
      cache_setup_properties() // setup LLC

On secondary CPU boot up:
detect_cache_attributes()
  populate_cache_leaves()
    get_cache_type() // Get cache type from clidr_el1,
                     // for LLC type=CACHE_TYPE_NOCACHE
  cache_shared_cpu_map_setup()
    if (!last_level_cache_is_valid()) // Valid and won't go to this branch,
                                      // leave LLC's type=CACHE_TYPE_NOCACHE

The last_level_cache_is_valid() use cacheinfo->{attributes, fw_token} to
test it's valid or not, but populate_cache_leaves() will only reset
LLC's type, so we won't try to re-setup LLC's type and leave it
CACHE_TYPE_NOCACHE and won't export it through sysfs.

This patch tries to fix this by not re-populating the cache leaves if
the LLC is valid.

Fixes: 5944ce092b97 ("arch_topology: Build cacheinfo from primary CPU")
Signed-off-by: Yicong Yang <[email-masked]>
Reviewed-by: Pierre Gondois <[email-masked]>
Reviewed-by: Sudeep Holla <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/base/cacheinfo.c |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -490,12 +490,18 @@ int detect_cache_attributes(unsigned int
 
 populate_leaves:
 	/*
-	 * populate_cache_leaves() may completely setup the cache leaves and
-	 * shared_cpu_map or it may leave it partially setup.
+	 * If LLC is valid the cache leaves were already populated so just go to
+	 * update the cpu map.
 	 */
-	ret = populate_cache_leaves(cpu);
-	if (ret)
-		goto free_ci;
+	if (!last_level_cache_is_valid(cpu)) {
+		/*
+		 * populate_cache_leaves() may completely setup the cache leaves and
+		 * shared_cpu_map or it may leave it partially setup.
+		 */
+		ret = populate_cache_leaves(cpu);
+		if (ret)
+			goto free_ci;
+	}
 
 	/*
 	 * For systems using DT for cache hierarchy, fw_token

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:17:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367417; cv=none; b=o2oK7697CmeLX+Z7OBjKY8XBQxGqlRwZmGHPWzXqrc+OJd9MOEEaUhI4VhLclS50reCE7gXohe5MGpNH6bl+8bJ53SY+hsCglJvImLCeMsvvfx6DBS4sDrk4uLc/v2uF5ivU613LdSDaTSLTtSPh/2Zdj5j21lG+yi4PTxnzcx4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367417; c=relaxed/simple;
	bh=SY5ANba5mQAEQ5B4+DJUpHnANAcVBNpxAE1wsIJsLl0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=PgWzcWdrjCana/PjR0n/0BVG2OQ13AMaCSNWahOeWMiT56BBCBQ0qulY1X4WGlw3ohK8uKu51c8kSTy2AwDx7saCnFP0tJRsL42eBw0y6uNLjXaa+SDdvGOCqELOvLlnBRrz04LGzKiEzowpn1Bk+xXdJPg4wKiNBX3q5MIMKrE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ygpVjzxM; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	kernel test robot <[email-masked]>,
	Dan Carpenter <[email-masked]>,
	Pierre Gondois <[email-masked]>,
	Conor Dooley <[email-masked]>
Subject: [PATCH 6.1 194/196] cacheinfo: Initialize variables in fetch_cache_info()
Date: Mon, 13 Oct 2025 16:46:07 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Pierre Gondois <[email-masked]>

commit ecaef469920fd6d2c7687f19081946f47684a423 upstream.

Set potentially uninitialized variables to 0. This is particularly
relevant when CONFIG_ACPI_PPTT is not set.

Reported-by: kernel test robot <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]/
Reported-by: Dan Carpenter <[email-masked]>
Link: https://lore.kernel.org/all/Y86iruJPuwNN7rZw@kili/
Fixes: 5944ce092b97 ("arch_topology: Build cacheinfo from primary CPU")
Signed-off-by: Pierre Gondois <[email-masked]>
Reviewed-by: Conor Dooley <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/base/cacheinfo.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -440,7 +440,7 @@ int allocate_cache_info(int cpu)
 int fetch_cache_info(unsigned int cpu)
 {
 	struct cpu_cacheinfo *this_cpu_ci;
-	unsigned int levels, split_levels;
+	unsigned int levels = 0, split_levels = 0;
 	int ret;
 
 	if (acpi_disabled) {

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:17:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367425; cv=none; b=L/erOHvPQrOuaJnPDSqB9gr9US8us9OR5zdShYAjTqlqmrMgeV6vIBDDPdIEpJsASoTPwv3wNwI3nj1Y2uAkqejwpi867NgrlRgIicOVN9ytnpLfB3thiAEtCvTLkYaiXrIiDfaN6gVCufqRFUItZsWLTJWgJpSLIUTJWrAiTqM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367425; c=relaxed/simple;
	bh=B8wNVsGHWbA4Uu85oN2hUfDWgqkmd8XhXZVvSVk2pwM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=t6WVwosFxv2RHhUcfL295FgAzI8sKXuGoy+myWZh95WDnUodM1Jagv8Y79MEOvkrCsfLsoSw7Ble3lDthAemA3l9XZvLDe4iwtmYV2Q27b8XL17ks6evTjhmtfaNX13+xGuVVeVkcMhdN4evFICeakVdrhN/ljyTYrk94jf1c7E=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YSmKKvIH; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Miaoqian Lin <[email-masked]>
Subject: [PATCH 6.1 193/196] usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
Date: Mon, 13 Oct 2025 16:46:06 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miaoqian Lin <[email-masked]>

commit e9c206324eeb213957a567a9d066bdeb355c7491 upstream.

The cdnsp-pci driver uses pcim_enable_device() to enable a PCI device,
which means the device will be automatically disabled on driver detach
through the managed device framework. The manual pci_disable_device()
call in the error path is therefore redundant.

Found via static anlaysis and this is similar to commit 99ca0b57e49f
("thermal: intel: int340x: processor: Fix warning during module unload").

Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver")
Cc: [email-masked]
Signed-off-by: Miaoqian Lin <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/usb/cdns3/cdnsp-pci.c |    5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

--- a/drivers/usb/cdns3/cdnsp-pci.c
+++ b/drivers/usb/cdns3/cdnsp-pci.c
@@ -90,7 +90,7 @@ static int cdnsp_pci_probe(struct pci_de
 		cdnsp = kzalloc(sizeof(*cdnsp), GFP_KERNEL);
 		if (!cdnsp) {
 			ret = -ENOMEM;
-			goto disable_pci;
+			goto put_pci;
 		}
 	}
 
@@ -173,9 +173,6 @@ free_cdnsp:
 	if (!pci_is_enabled(func))
 		kfree(cdnsp);
 
-disable_pci:
-	pci_disable_device(pdev);
-
 put_pci:
 	pci_dev_put(func);

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:26:11 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367394; cv=none; b=Y9BeqdCAari6/Dg4/Ky+1SKAO92SLxtDyHcos5pU58bqTUqSG45QoAyfzeUPiHWoiXkg89zjTZ/kGOoXZXxpdqJC9QLwKB2FpdSXazcGLzZgxRKdSddV4Bgbkl1wKVLmEtTPZupyq4oID/WHc75xkoFlJV3xRdt8emgiZ87XlTs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367394; c=relaxed/simple;
	bh=2PrLHXKLAAK9GvgEdBu7jYd/NHUNZqlOKM+ftSObTzQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=u/k98yJvxeGi7O5Qu0K/UNYGARHRz+O4luCaNdwt3Ge0Vb5IH5GsTy0I7S6OG+Zo+hDWaw51GeKT4hQr8MMqwo8GCSBkxAhvXHUmQh9DjuBscVFM5X+p0YrC6uaLKWRwfMjUtnG0aZESGav/0K9dgEllMu40zLVcU0cuCPlFTBk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=P/HuwrKr; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Heikki Krogerus <[email-masked]>,
	Neal Gompa <[email-masked]>,
	Sven Peter <[email-masked]>
Subject: [PATCH 6.1 192/196] usb: typec: tipd: Clear interrupts first
Date: Mon, 13 Oct 2025 16:46:05 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sven Peter <[email-masked]>

commit be5ae730ffa6fd774a00a4705c1e11e078b08ca1 upstream.

Right now the interrupt handler first reads all updated status registers
and only then clears the interrupts. It's possible that a duplicate
interrupt for a changed register or plug state comes in after the
interrupts have been processed but before they have been cleared:

* plug is inserted, TPS_REG_INT_PLUG_EVENT is set
* TPS_REG_INT_EVENT1 is read
* tps6598x_handle_plug_event() has run and registered the plug
* plug is removed again, TPS_REG_INT_PLUG_EVENT is set (again)
* TPS_REG_INT_CLEAR1 is written, TPS_REG_INT_PLUG_EVENT is cleared

We then have no plug connected and no pending interrupt but the tipd
core still thinks there is a plug. It's possible to trigger this with
e.g. a slightly broken Type-C to USB A converter.

Fix this by first clearing the interrupts and only then reading the
updated registers.

Fixes: 45188f27b3d0 ("usb: typec: tipd: Add support for Apple CD321X")
Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
Cc: [email-masked]
Reviewed-by: Heikki Krogerus <[email-masked]>
Reviewed-by: Neal Gompa <[email-masked]>
Signed-off-by: Sven Peter <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/usb/typec/tipd/core.c |   24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

--- a/drivers/usb/typec/tipd/core.c
+++ b/drivers/usb/typec/tipd/core.c
@@ -491,24 +491,23 @@ static irqreturn_t cd321x_interrupt(int
 	if (!event)
 		goto err_unlock;
 
+	tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event);
+
 	if (!tps6598x_read_status(tps, &status))
-		goto err_clear_ints;
+		goto err_unlock;
 
 	if (event & APPLE_CD_REG_INT_POWER_STATUS_UPDATE)
 		if (!tps6598x_read_power_status(tps))
-			goto err_clear_ints;
+			goto err_unlock;
 
 	if (event & APPLE_CD_REG_INT_DATA_STATUS_UPDATE)
 		if (!tps6598x_read_data_status(tps))
-			goto err_clear_ints;
+			goto err_unlock;
 
 	/* Handle plug insert or removal */
 	if (event & APPLE_CD_REG_INT_PLUG_EVENT)
 		tps6598x_handle_plug_event(tps, status);
 
-err_clear_ints:
-	tps6598x_write64(tps, TPS_REG_INT_CLEAR1, event);
-
 err_unlock:
 	mutex_unlock(&tps->lock);
 
@@ -555,25 +554,24 @@ static irqreturn_t tps6598x_interrupt(in
 	if (!(event1[0] | event1[1] | event2[0] | event2[1]))
 		goto err_unlock;
 
+	tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, intev_len);
+	tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, intev_len);
+
 	if (!tps6598x_read_status(tps, &status))
-		goto err_clear_ints;
+		goto err_unlock;
 
 	if ((event1[0] | event2[0]) & TPS_REG_INT_POWER_STATUS_UPDATE)
 		if (!tps6598x_read_power_status(tps))
-			goto err_clear_ints;
+			goto err_unlock;
 
 	if ((event1[0] | event2[0]) & TPS_REG_INT_DATA_STATUS_UPDATE)
 		if (!tps6598x_read_data_status(tps))
-			goto err_clear_ints;
+			goto err_unlock;
 
 	/* Handle plug insert or removal */
 	if ((event1[0] | event2[0]) & TPS_REG_INT_PLUG_EVENT)
 		tps6598x_handle_plug_event(tps, status);
 
-err_clear_ints:
-	tps6598x_block_write(tps, TPS_REG_INT_CLEAR1, event1, intev_len);
-	tps6598x_block_write(tps, TPS_REG_INT_CLEAR2, event2, intev_len);
-
 err_unlock:
 	mutex_unlock(&tps->lock);

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:36:04 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367392; cv=none; b=u+zMPWLjwtRZonOIDNtGMcVRg1iG+U1aMwHe0UtW55W0/e4rRK2cRjlwtlM3nthBQapzbJyzc58rur7tk0Lo06i2KIePbxjL4q8Fi0krW/DGM3eH0WAihnnJK9tPpr/QyMG8CyAMUzKMebRU6KGfk2j7ACmjgQ9bHttkjOL+FF4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367392; c=relaxed/simple;
	bh=dlAHIWq7AeTcknK8hxTo6DjKYQH8jXOuMJS06zZ0LCE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=MURyljUDqXz2jfWhQdu4VuFBaX8MJdOyjhvmOD2i6+BKo9H+vUOW4sbeXGcBL0mQzrTMFtMBAKK7jWgeVWOa6VjpmD9kJU7wCLzCrxjx6s6Hc62l10XVXoKFi0fH4hTMl7h9fZEsS8ZxGCbRIZL112e5OYQt6TyMjbI3mlNpY+w=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=qKxH0vOg; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Hubert=20Wi=C5=9Bniewski?= <[email-masked]>,
	Marek Szyprowski <[email-masked]>,
	Oleksij Rempel <[email-masked]>,
	Paolo Abeni <[email-masked]>
Subject: [PATCH 6.1 191/196] net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
Date: Mon, 13 Oct 2025 16:46:04 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Oleksij Rempel <[email-masked]>

commit 3d3c4cd5c62f24bb3cb4511b7a95df707635e00a upstream.

Prevent USB runtime PM (autosuspend) for AX88772* in bind.

usbnet enables runtime PM (autosuspend) by default, so disabling it via
the usb_driver flag is ineffective. On AX88772B, autosuspend shows no
measurable power saving with current driver (no link partner, admin
up/down). The ~0.453 W -> ~0.248 W drop on v6.1 comes from phylib powering
the PHY off on admin-down, not from USB autosuspend.

The real hazard is that with runtime PM enabled, ndo_open() (under RTNL)
may synchronously trigger autoresume (usb_autopm_get_interface()) into
asix_resume() while the USB PM lock is held. Resume paths then invoke
phylink/phylib and MDIO, which also expect RTNL, leading to possible
deadlocks or PM lock vs MDIO wake issues.

To avoid this, keep the device runtime-PM active by taking a usage
reference in ax88772_bind() and dropping it in unbind(). A non-zero PM
usage count blocks runtime suspend regardless of userspace policy
(.../power/control - pm_runtime_allow/forbid), making this approach
robust against sysfs overrides.

Holding a runtime-PM usage ref does not affect system-wide suspend;
system sleep/resume callbacks continue to run as before.

Fixes: 4a2c7217cd5a ("net: usb: asix: ax88772: manage PHY PM from MAC")
Reported-by: Hubert Wiśniewski <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]
Tested-by: Hubert Wiśniewski <[email-masked]>
Reported-by: Marek Szyprowski <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]
Cc: [email-masked]
Signed-off-by: Oleksij Rempel <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Paolo Abeni <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/net/usb/asix_devices.c |   29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -625,6 +625,21 @@ static void ax88772_suspend(struct usbne
 		   asix_read_medium_status(dev, 1));
 }
 
+/* Notes on PM callbacks and locking context:
+ *
+ * - asix_suspend()/asix_resume() are invoked for both runtime PM and
+ *   system-wide suspend/resume. For struct usb_driver the ->resume()
+ *   callback does not receive pm_message_t, so the resume type cannot
+ *   be distinguished here.
+ *
+ * - The MAC driver must hold RTNL when calling phylink interfaces such as
+ *   phylink_suspend()/resume(). Those calls will also perform MDIO I/O.
+ *
+ * - Taking RTNL and doing MDIO from a runtime-PM resume callback (while
+ *   the USB PM lock is held) is fragile. Since autosuspend brings no
+ *   measurable power saving here, we block it by holding a PM usage
+ *   reference in ax88772_bind().
+ */
 static int asix_suspend(struct usb_interface *intf, pm_message_t message)
 {
 	struct usbnet *dev = usb_get_intfdata(intf);
@@ -922,6 +937,13 @@ static int ax88772_bind(struct usbnet *d
 	if (ret)
 		goto initphy_err;
 
+	/* Keep this interface runtime-PM active by taking a usage ref.
+	 * Prevents runtime suspend while bound and avoids resume paths
+	 * that could deadlock (autoresume under RTNL while USB PM lock
+	 * is held, phylink/MDIO wants RTNL).
+	 */
+	pm_runtime_get_noresume(&intf->dev);
+
 	return 0;
 
 initphy_err:
@@ -951,6 +973,8 @@ static void ax88772_unbind(struct usbnet
 	phylink_destroy(priv->phylink);
 	ax88772_mdio_unregister(priv);
 	asix_rx_fixup_common_free(dev->driver_priv);
+	/* Drop the PM usage ref taken in bind() */
+	pm_runtime_put(&intf->dev);
 }
 
 static void ax88178_unbind(struct usbnet *dev, struct usb_interface *intf)
@@ -1575,6 +1599,11 @@ static struct usb_driver asix_driver = {
 	.resume =	asix_resume,
 	.reset_resume =	asix_resume,
 	.disconnect =	usbnet_disconnect,
+	/* usbnet enables autosuspend by default (supports_autosuspend=1).
+	 * We keep runtime-PM active for AX88772* by taking a PM usage
+	 * reference in ax88772_bind() (pm_runtime_get_noresume()) and
+	 * dropping it in unbind(), which effectively blocks autosuspend.
+	 */
 	.supports_autosuspend = 1,
 	.disable_hub_initiated_lpm = 1,
 };

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:32:16 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367389; cv=none; b=rrJPUF+1WcFflRiTBPa9lo/BZ5F+Yjbp0K7RAxyS+G/UKGbdbdDICe1yEjntjWAzkCJO8O2D3xzZ6ZUqJNNxA8C5XNvwGzqbUSTYWp9j07//qbiYU3ulXYhxtCaZcrdSon7n4RwdYLTKyMRk62X1I4wzOGYE4B0b5MPvMCm4zYQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367389; c=relaxed/simple;
	bh=5yg5qJ5/zM49pWD7vxt7FAPJpmcUH8Q5KWP6u/rgIxc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=LLVuNZY1v4wTr2sxQfmfV3FkTsYVD8yYL0RHunPpn5CxJae3z+7S1cBdLVBZDSdDw3qszQHan6yqCyNX1brTsT9A8auLJ7ixevklqbAc28D6ZrNsrBh/AGzmfZhVYo3cuFPczbXkfXqWzORXLNoCzGNh89DmUO6XkNyLooRH+zU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Q/UXOm9p; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Salah Triki <[email-masked]>,
	Ioana Ciornei <[email-masked]>,
	Christophe Leroy <[email-masked]>
Subject: [PATCH 6.1 190/196] bus: fsl-mc: Check return value of platform_get_resource()
Date: Mon, 13 Oct 2025 16:46:03 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Salah Triki <[email-masked]>

commit 25f526507b8ccc6ac3a43bc094d09b1f9b0b90ae upstream.

platform_get_resource() returns NULL in case of failure, so check its
return value and propagate the error in order to prevent NULL pointer
dereference.

Fixes: 6305166c8771 ("bus: fsl-mc: Add ACPI support for fsl-mc")
Cc: [email-masked]
Signed-off-by: Salah Triki <[email-masked]>
Acked-by: Ioana Ciornei <[email-masked]>
Link: https://lore.kernel.org/r/aKwuK6TRr5XNYQ8u@pc
Signed-off-by: Christophe Leroy <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/bus/fsl-mc/fsl-mc-bus.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
@@ -1172,6 +1172,9 @@ static int fsl_mc_bus_probe(struct platf
 	 * Get physical address of MC portal for the root DPRC:
 	 */
 	plat_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!plat_res)
+		return -EINVAL;
+
 	mc_portal_phys_addr = plat_res->start;
 	mc_portal_size = resource_size(plat_res);
 	mc_portal_base_phys_addr = mc_portal_phys_addr & ~0x3ffffff;

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:21:54 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367386; cv=none; b=mzTHkpBg2RSMlwlzdoduJ9CR7WzHx89hdez9AJ7zZO/vdvebcvgfK89ttSXpHaaiQ7p6ILqm8eURfZE/wSJT3xvMZzlrBV65haP34vFvhx/mjF1xc2Ld2pPl+7BwLw4ufmB9dDTT+Zx9TEHB+rTEm4/w0G+KLkViDB+K4KC+z2U=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367386; c=relaxed/simple;
	bh=Vm4IuV33O9Xb2xveG7BmLChEFI40tphhmArYYN4F7K8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Gn10ZS9u+UHiSYuTHANfIz8ZXbycckO6jOgvGER8bjxIJ75E2FYobVfBo/FCz2IYK0f0dFVtCIME65TYoWCCnYFA92reFpfIiGMJK81p+HqRv1gGGqboXVZsCgPNsg7qYJHDkAncrltwQHarJwjUzs1+2MwWOWssIaVM8Yu2QOI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bcxCWnYj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Neil Armstrong <[email-masked]>,
	Bartosz Golaszewski <[email-masked]>,
	Linus Walleij <[email-masked]>
Subject: [PATCH 6.1 189/196] pinctrl: check the return value of pinmux_ops::get_function_name()
Date: Mon, 13 Oct 2025 16:46:02 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bartosz Golaszewski <[email-masked]>

commit 4002ee98c022d671ecc1e4a84029e9ae7d8a5603 upstream.

While the API contract in docs doesn't specify it explicitly, the
generic implementation of the get_function_name() callback from struct
pinmux_ops - pinmux_generic_get_function_name() - can fail and return
NULL. This is already checked in pinmux_check_ops() so add a similar
check in pinmux_func_name_to_selector() instead of passing the returned
pointer right down to strcmp() where the NULL can get dereferenced. This
is normal operation when adding new pinfunctions.

Cc: [email-masked]
Tested-by: Neil Armstrong <[email-masked]>
Signed-off-by: Bartosz Golaszewski <[email-masked]>
Signed-off-by: Linus Walleij <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/pinctrl/pinmux.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/pinctrl/pinmux.c
+++ b/drivers/pinctrl/pinmux.c
@@ -328,7 +328,7 @@ static int pinmux_func_name_to_selector(
 	while (selector < nfuncs) {
 		const char *fname = ops->get_function_name(pctldev, selector);
 
-		if (!strcmp(function, fname))
+		if (fname && !strcmp(function, fname))
 			return selector;
 
 		selector++;

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:55 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367384; cv=none; b=Igq7mhpKfQdFFVCt4ixiLVPn/333WKqzvsYv996G4V+HnU+9KbXjXsMywC/w6jDMhpSb4t8AuuwZZwZ24ey5qPi73xeSdxybzN+zGGL5hsY6IPHh07yJDNbV8/tAAV9CA/3SPhawv9JW5rRNVdwvLBPjY5X0WqepnH+nrFTnC9E=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367384; c=relaxed/simple;
	bh=NRU6DhYo1slGQD9ZV3RPLoNnSOsD5M9cK1jNW9Pb1CI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=izt4w4jrE4CfiewRIUENTc/qLdFjxb2OcXCPu5kwRRfOwWBsKyp/XJC83hcmphI6hZtEPlK6v0lh9ZDTwtz7lH7CJ/YPC45mMbj0VnOnHaOHAUjVId69/NbYjYetlTjZXtPOUNWVs65h61XrcMg3Aqy0G0VWdPS69RCWIfCOVO4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=l/0z+LE0; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhen Ni <[email-masked]>,
	Dmitry Torokhov <[email-masked]>
Subject: [PATCH 6.1 188/196] Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
Date: Mon, 13 Oct 2025 16:46:01 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhen Ni <[email-masked]>

commit d3366a04770eea807f2826cbdb96934dd8c9bf79 upstream.

Struct ff_effect_compat is embedded twice inside
uinput_ff_upload_compat, contains internal padding. In particular, there
is a hole after struct ff_replay to satisfy alignment requirements for
the following union member. Without clearing the structure,
copy_to_user() may leak stack data to userspace.

Initialize ff_up_compat to zero before filling valid fields.

Fixes: 2d56f3a32c0e ("Input: refactor evdev 32bit compat to be shareable with uinput")
Cc: [email-masked]
Signed-off-by: Zhen Ni <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Dmitry Torokhov <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/input/misc/uinput.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -741,6 +741,7 @@ static int uinput_ff_upload_to_user(char
 	if (in_compat_syscall()) {
 		struct uinput_ff_upload_compat ff_up_compat;
 
+		memset(&ff_up_compat, 0, sizeof(ff_up_compat));
 		ff_up_compat.request_id = ff_up->request_id;
 		ff_up_compat.retval = ff_up->retval;
 		/*

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:17:04 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367380; cv=none; b=Gc6dPROK0sAimxN1kU3FdK8Cw5w7rOkhT52LqtgYekK7kyWpW1gJB1AnWzBWTGGjsubRAe9Vwi2aFLi2SwFmMPZZ20JJsbcZXiv2atKonse2farswOB6un41hlKgnVLqiluT2rgmlQKqFKzn2aO3Xon+Q2UquqsZXZqfKdojM4o=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367380; c=relaxed/simple;
	bh=BRF2YHbp493wZiUm9YBlo2WGrd9qDyWaAVCnnHN2Oi0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ootOImWmVQmpmot5qx7fa8L0FpcNF5Bd2+eDUEk7fgDPJ1gnc0AZDE8LumWmE3IwSZbbLeCwNs6mEopli4mGyq4dcMwZAZEVKfcSXU9nMBx7aDrvJSThac9koO+7Z0VKkrXN3FCe44dUlFax39s+MZ/mmL2BRhySv9XtWF3RUIY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=MZbzm4Ha; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Marek Vasut <[email-masked]>,
	Dmitry Torokhov <[email-masked]>
Subject: [PATCH 6.1 187/196] Input: atmel_mxt_ts - allow reset GPIO to sleep
Date: Mon, 13 Oct 2025 16:46:00 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marek Vasut <[email-masked]>

commit c7866ee0a9ddd9789faadf58cdac6abd7aabf045 upstream.

The reset GPIO is not toggled in any critical section where it couldn't
sleep, allow the reset GPIO to sleep. This allows the driver to operate
reset GPIOs connected to I2C GPIO expanders.

Signed-off-by: Marek Vasut <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Cc: [email-masked]
Signed-off-by: Dmitry Torokhov <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/input/touchscreen/atmel_mxt_ts.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -3239,7 +3239,7 @@ static int mxt_probe(struct i2c_client *
 	if (data->reset_gpio) {
 		/* Wait a while and then de-assert the RESET GPIO line */
 		msleep(MXT_RESET_GPIO_TIME);
-		gpiod_set_value(data->reset_gpio, 0);
+		gpiod_set_value_cansleep(data->reset_gpio, 0);
 		msleep(MXT_RESET_INVALID_CHG);
 	}

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:16:48 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367374; cv=none; b=lUXkl0+X+wUTf2vCTTzGJI/rPVkDhWMbHVqTXJe3mEoKKQA/JZtijg1i7MWwYFdLfUJdc3E9FyXysoo2GFbRbLkOYaUk5M4wdQW8yYMS7cD9/NakiDLbWMMyw+ORyUY8EZHfT7MFuaJaaUqTqk36LHKzwzcNBKU7LoxpxPCs03g=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367374; c=relaxed/simple;
	bh=Af8dOZ/wOGYaWvYUBNBGjgnK7UOCrHArNAgGlvCfRnA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=YocS2rFhOTLYkLIODk4ZSBQDIzcVLePwqBp3b4epRf+ql7IsaEOpI/N8yyBRY3i3QY66wO0+tGn3MZpRTrz7/ZnwtuDe6WftRzlAyAPpuPF2GoJmHhn3SIZrzUt5wpEIta+EXbD08VkJggQ45wBkgfUgvCHig0/HxBHNZAmsmAc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=iAFW2wKH; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Ekansh Gupta <[email-masked]>,
	Ling Xu <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Srinivas Kandagatla <[email-masked]>
Subject: [PATCH 6.1 186/196] misc: fastrpc: Skip reference for DMA handles
Date: Mon, 13 Oct 2025 16:45:59 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ling Xu <[email-masked]>

commit 10df039834f84a297c72ec962c0f9b7c8c5ca31a upstream.

If multiple dma handles are passed with same fd over a remote call
the kernel driver takes a reference and expects that put for the
map will be called as many times to free the map. But DSP only
updates the fd one time in the fd list when the DSP refcount
goes to zero and hence kernel make put call only once for the
fd. This can cause SMMU fault issue as the same fd can be used
in future for some other call.

Fixes: 35a82b87135d ("misc: fastrpc: Add dma handle implementation")
Cc: [email-masked]
Co-developed-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ling Xu <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Srinivas Kandagatla <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/misc/fastrpc.c |   45 +++++++++++++++++++++++++++------------------
 1 file changed, 27 insertions(+), 18 deletions(-)

--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -342,9 +342,8 @@ static int fastrpc_map_get(struct fastrp

 static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd,
-			    struct fastrpc_map **ppmap, bool take_ref)
+			    struct fastrpc_map **ppmap)
 {
-	struct fastrpc_session_ctx *sess = fl->sctx;
 	struct fastrpc_map *map = NULL;
 	struct dma_buf *buf;
 	int ret = -ENOENT;
@@ -358,15 +357,6 @@ static int fastrpc_map_lookup(struct fas
 		if (map->fd != fd || map->buf != buf)
 			continue;
 
-		if (take_ref) {
-			ret = fastrpc_map_get(map);
-			if (ret) {
-				dev_dbg(sess->dev, "%s: Failed to get map fd=%d ret=%d\n",
-					__func__, fd, ret);
-				break;
-			}
-		}
-
 		*ppmap = map;
 		ret = 0;
 		break;
@@ -711,7 +701,7 @@ static const struct dma_buf_ops fastrpc_
 	.release = fastrpc_release,
 };
 
-static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
+static int fastrpc_map_attach(struct fastrpc_user *fl, int fd,
 			      u64 len, u32 attr, struct fastrpc_map **ppmap)
 {
 	struct fastrpc_session_ctx *sess = fl->sctx;
@@ -719,9 +709,6 @@ static int fastrpc_map_create(struct fas
 	struct sg_table *table;
 	int err = 0;
 
-	if (!fastrpc_map_lookup(fl, fd, ppmap, true))
-		return 0;
-
 	map = kzalloc(sizeof(*map), GFP_KERNEL);
 	if (!map)
 		return -ENOMEM;
@@ -789,6 +776,24 @@ get_err:
 	return err;
 }
 
+static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
+			      u64 len, u32 attr, struct fastrpc_map **ppmap)
+{
+	struct fastrpc_session_ctx *sess = fl->sctx;
+	int err = 0;
+
+	if (!fastrpc_map_lookup(fl, fd, ppmap)) {
+		if (!fastrpc_map_get(*ppmap))
+			return 0;
+		dev_dbg(sess->dev, "%s: Failed to get map fd=%d\n",
+			__func__, fd);
+	}
+
+	err = fastrpc_map_attach(fl, fd, len, attr, ppmap);
+
+	return err;
+}
+
 /*
  * Fastrpc payload buffer with metadata looks like:
  *
@@ -861,8 +866,12 @@ static int fastrpc_create_maps(struct fa
 		    ctx->args[i].length == 0)
 			continue;
 
-		err = fastrpc_map_create(ctx->fl, ctx->args[i].fd,
-			 ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
+		if (i < ctx->nbufs)
+			err = fastrpc_map_create(ctx->fl, ctx->args[i].fd,
+				 ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
+		else
+			err = fastrpc_map_attach(ctx->fl, ctx->args[i].fd,
+				 ctx->args[i].length, ctx->args[i].attr, &ctx->maps[i]);
 		if (err) {
 			dev_err(dev, "Error Creating map %d\n", err);
 			return -EINVAL;
@@ -1049,7 +1058,7 @@ cleanup_fdlist:
 	for (i = 0; i < FASTRPC_MAX_FDLIST; i++) {
 		if (!fdlist[i])
 			break;
-		if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap, false))
+		if (!fastrpc_map_lookup(fl, (int)fdlist[i], &mmap))
 			fastrpc_map_put(mmap);
 	}

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:35:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367370; cv=none; b=PlZTC4Tqp6VrE8xwqGv+W10raWQUSbWzyDZ8iHIna/qIGllHO6ABHtHWQa6jrCEjF+x/19IknHciqu+QQDwj1c7lA6/Qo8FmgLj0WcRLYde+iA+Pm9ZdlpCJEwTNcVw+nWQMMGZ+tMd80kscVyeOE7XBYATX1A8uXcqgjz4qgOI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367370; c=relaxed/simple;
	bh=maw307nq1PXyc7LvQmlZTdXZuEu4YqdRlMQEEH9Oyco=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=KVgL796h7RoH6pe9I0ijjkf4NfCtGQfMa4E2J4vuNvkjLzMPSyMHtnj+1wC/flmLZecbi1PYGXXLnb/ZC+1RncEqwZJcw7ddaEwOvSTv9KGRMgv61xrPqR53bkXRvWDcqYrSHAXIa1vSTVWUjnZc7djUcnFO0D1EI/0GjJRQWOQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=P6QKXjub; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Ekansh Gupta <[email-masked]>,
	Ling Xu <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Srinivas Kandagatla <[email-masked]>
Subject: [PATCH 6.1 185/196] misc: fastrpc: fix possible map leak in fastrpc_put_args
Date: Mon, 13 Oct 2025 16:45:58 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ling Xu <[email-masked]>

commit da1ba64176e0138f2bfa96f9e43e8c3640d01e1e upstream.

copy_to_user() failure would cause an early return without cleaning up
the fdlist, which has been updated by the DSP. This could lead to map
leak. Fix this by redirecting to a cleanup path on failure, ensuring
that all mapped buffers are properly released before returning.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: [email-masked]
Co-developed-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ling Xu <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Srinivas Kandagatla <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/misc/fastrpc.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1018,6 +1018,7 @@ static int fastrpc_put_args(struct fastr
 	struct fastrpc_phy_page *pages;
 	u64 *fdlist;
 	int i, inbufs, outbufs, handles;
+	int ret = 0;
 
 	inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);
 	outbufs = REMOTE_SCALARS_OUTBUFS(ctx->sc);
@@ -1033,14 +1034,17 @@ static int fastrpc_put_args(struct fastr
 			u64 len = rpra[i].buf.len;
 
 			if (!kernel) {
-				if (copy_to_user((void __user *)dst, src, len))
-					return -EFAULT;
+				if (copy_to_user((void __user *)dst, src, len)) {
+					ret = -EFAULT;
+					goto cleanup_fdlist;
+				}
 			} else {
 				memcpy(dst, src, len);
 			}
 		}
 	}
 
+cleanup_fdlist:
 	/* Clean up fdlist which is updated by DSP */
 	for (i = 0; i < FASTRPC_MAX_FDLIST; i++) {
 		if (!fdlist[i])
@@ -1049,7 +1053,7 @@ static int fastrpc_put_args(struct fastr
 			fastrpc_map_put(mmap);
 	}
 
-	return 0;
+	return ret;
 }
 
 static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx,

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:16:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367368; cv=none; b=kocpHomDgDPqU1dCwCf4BvIAa/Hu7dsVGfrfLgNvy64Ycyo7pRO8/tvi6Y4S3bu1FFBX80wYfuKw0lwJmsv7YsTzdcI+uATKljZgzZp+Y3FWQoYvOOCXniYIFieCPPrkNYP9cJ3Zn18pEHreLfu4VPrtJPCDQFWiC1jpgq8yinQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367368; c=relaxed/simple;
	bh=l9uapisybX8hf/uMYxvD6nkctmV6InbHYtTTyWe38i4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=CotzDz4O7XBaKpIYMylDQaYlgU9rOwy7Isr+lmREAiHU9QtDJoW41scMir0c/57hZ1uWuKlqK9euT4E1zIgO2I/lYX2Zi6rAmoh7T20PhYhIfQ1DEW6TRH0mxKkbq+n7wPPa1zjVjzk/gkfh+ZZODMTeO2XPUoVYi5+xg95Aqn0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FO5VLFqG; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Ekansh Gupta <[email-masked]>,
	Ling Xu <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Srinivas Kandagatla <[email-masked]>
Subject: [PATCH 6.1 184/196] misc: fastrpc: Fix fastrpc_map_lookup operation
Date: Mon, 13 Oct 2025 16:45:57 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ling Xu <[email-masked]>

commit 9031626ade38b092b72638dfe0c6ffce8d8acd43 upstream.

Fastrpc driver creates maps for user allocated fd buffers. Before
creating a new map, the map list is checked for any already existing
maps using map fd. Checking with just map fd is not sufficient as the
user can pass offsetted buffer with less size when the map is created
and then a larger size the next time which could result in memory
issues. Check for dma_buf object also when looking up for the map.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: [email-masked]
Co-developed-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ekansh Gupta <[email-masked]>
Signed-off-by: Ling Xu <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Srinivas Kandagatla <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/misc/fastrpc.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -346,11 +346,16 @@ static int fastrpc_map_lookup(struct fas
 {
 	struct fastrpc_session_ctx *sess = fl->sctx;
 	struct fastrpc_map *map = NULL;
+	struct dma_buf *buf;
 	int ret = -ENOENT;
 
+	buf = dma_buf_get(fd);
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);
+
 	spin_lock(&fl->lock);
 	list_for_each_entry(map, &fl->maps, node) {
-		if (map->fd != fd)
+		if (map->fd != fd || map->buf != buf)
 			continue;
 
 		if (take_ref) {

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:35:32 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367365; cv=none; b=sJomm3B0qTFPqiP+0BrwBW/MOUuVAj9Ad72GruwZhz1m66QnRarOxWpBFiE5BWrA4OdQVKloaSQCP0siWgKMV//vMibdpb8X1uEAQylLjzZUetPSnuz8kOGLZkocmOe1AMKC/a5zAzPsktbcytVTKeX7vsQ2Pw88SgIGJ1ZZa+o=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367365; c=relaxed/simple;
	bh=nPh1PYa+a+C2R6s92eRd1T4Go0CbQ92mHM4eKcGpp9o=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ayH05i7Z7ufjLo2ppdtPyEsjKmlnhxRfkisja1knn40IldJGXdfOx7LBZq3J+LQxuaQdByHm9ejhxmdwi3GtsoT6Xo3OpF3GJT/w/phUDd9KhbuSwhnywKuauAVUI7DERM7ZtFDgU0ij644zmq058jnTajwu3TmeQDigTXnQ/0g=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zzVpd3ye; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Guangshuo Li <[email-masked]>,
	Alison Schofield <[email-masked]>,
	Ira Weiny <[email-masked]>,
	Dave Jiang <[email-masked]>
Subject: [PATCH 6.1 183/196] nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
Date: Mon, 13 Oct 2025 16:45:56 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guangshuo Li <[email-masked]>

commit a9e6aa994917ee602798bbb03180a194b37865bb upstream.

devm_kcalloc() may fail. ndtest_probe() allocates three DMA address
arrays (dcr_dma, label_dma, dimm_dma) and later unconditionally uses
them in ndtest_nvdimm_init(), which can lead to a NULL pointer
dereference under low-memory conditions.

Check all three allocations and return -ENOMEM if any allocation fails,
jumping to the common error path. Do not emit an extra error message
since the allocator already warns on allocation failure.

Fixes: 9399ab61ad82 ("ndtest: Add dimms to the two buses")
Cc: [email-masked]
Signed-off-by: Guangshuo Li <[email-masked]>
Reviewed-by: Alison Schofield <[email-masked]>
Reviewed-by: Ira Weiny <[email-masked]>
Reviewed-by: Dave Jiang <[email-masked]>
Signed-off-by: Ira Weiny <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 tools/testing/nvdimm/test/ndtest.c |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

--- a/tools/testing/nvdimm/test/ndtest.c
+++ b/tools/testing/nvdimm/test/ndtest.c
@@ -845,11 +845,22 @@ static int ndtest_probe(struct platform_
 
 	p->dcr_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR,
 				 sizeof(dma_addr_t), GFP_KERNEL);
+	if (!p->dcr_dma) {
+		rc = -ENOMEM;
+		goto err;
+	}
 	p->label_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR,
 				   sizeof(dma_addr_t), GFP_KERNEL);
+	if (!p->label_dma) {
+		rc = -ENOMEM;
+		goto err;
+	}
 	p->dimm_dma = devm_kcalloc(&p->pdev.dev, NUM_DCR,
 				  sizeof(dma_addr_t), GFP_KERNEL);
-
+	if (!p->dimm_dma) {
+		rc = -ENOMEM;
+		goto err;
+	}
 	rc = ndtest_nvdimm_init(p);
 	if (rc)
 		goto err;

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:21:44 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367361; cv=none; b=efrOqZtD5zpDhYknKx07ihk8p8+G6VXi3IB9B/RCZkAV2yZ27yiGN/Ebc5HgMVJUuvxZan1udSLdwy/J+Yq3HUlLn+J8pnDqGUbrxIYqMn4HwqP3n3csqFggRYYmNOhRSqFZWDxB2vOxK7SKYhKfOADXekqrvChi/eLHQEjHMA8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367361; c=relaxed/simple;
	bh=xxW+ByaBBlox/3sVZlvKIaY7jHZkO4G9/jETwXPSZCM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=cKxeBSejw1aR0miXew0X+N07IgzaHFq9cdaQRo70uaeGcN1V5jYeAvO4P+fqN3Uqtjyz2850Ea9J+Qz1d5Bu/tLqY5BCXAbJR9Npiuuhl6A2J0EuRha6JDwAa0WjLCEGfigHijcPwSGuOSghngO7tnI6GQwYxaDCvlWXSDPiQ2I=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FsaPyBez; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id DD70BC4CEE7;
	Mon, 13 Oct 2025 14:56:00 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760367361;
	bh=xxW+ByaBBlox/3sVZlvKIaY7jHZkO4G9/jETwXPSZCM=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=FsaPyBezbFk4GW01Fq+KPRTuFX8B0z4ZYOQpQ+uIH94FX/o7x9PFQYinXEQ66dsX2
	 4MiNJMZe4PAs1b1m/dVVnVT1DJ/jYwmxYgV39FzA4fqklPK2aRM67bz42tbEd096Xw
	 m1lRX+EGIA8qpVra2PLEXluShg2pUE8Le8g74kj4=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yang Shi <[email-masked]>,
	Carl Worth <[email-masked]>,
	"Christoph Lameter (Ampere)" <[email-masked]>,
	Catalin Marinas <[email-masked]>,
	David Hildenbrand <[email-masked]>,
	Oscar Salvador <[email-masked]>,
	Anshuman Khandual <[email-masked]>,
	Dev Jain <[email-masked]>,
	Muchun Song <[email-masked]>,
	Will Deacon <[email-masked]>,
	Andrew Morton <[email-masked]>
Subject: [PATCH 6.1 182/196] mm: hugetlb: avoid soft lockup when mprotect to large memory area
Date: Mon, 13 Oct 2025 16:45:55 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yang Shi <[email-masked]>

commit f52ce0ea90c83a28904c7cc203a70e6434adfecb upstream.

When calling mprotect() to a large hugetlb memory area in our customer's
workload (~300GB hugetlb memory), soft lockup was observed:

watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916]

CPU: 98 PID: 126916 Comm: t2_new_sysv Kdump: loaded Not tainted 6.17-rc7
Hardware name: GIGACOMPUTING R2A3-T40-AAV1/Jefferson CIO, BIOS 5.4.4.1 07/15/2025
pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : mte_clear_page_tags+0x14/0x24
lr : mte_sync_tags+0x1c0/0x240
sp : ffff80003150bb80
x29: ffff80003150bb80 x28: ffff00739e9705a8 x27: 0000ffd2d6a00000
x26: 0000ff8e4bc00000 x25: 00e80046cde00f45 x24: 0000000000022458
x23: 0000000000000000 x22: 0000000000000004 x21: 000000011b380000
x20: ffff000000000000 x19: 000000011b379f40 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc875e0aa5e2c
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : fffffc01ce7a5c00 x4 : 00000000046cde00 x3 : fffffc0000000000
x2 : 0000000000000004 x1 : 0000000000000040 x0 : ffff0046cde7c000

Call trace:
  mte_clear_page_tags+0x14/0x24
  set_huge_pte_at+0x25c/0x280
  hugetlb_change_protection+0x220/0x430
  change_protection+0x5c/0x8c
  mprotect_fixup+0x10c/0x294
  do_mprotect_pkey.constprop.0+0x2e0/0x3d4
  __arm64_sys_mprotect+0x24/0x44
  invoke_syscall+0x50/0x160
  el0_svc_common+0x48/0x144
  do_el0_svc+0x30/0xe0
  el0_svc+0x30/0xf0
  el0t_64_sync_handler+0xc4/0x148
  el0t_64_sync+0x1a4/0x1a8

Soft lockup is not triggered with THP or base page because there is
cond_resched() called for each PMD size.

Although the soft lockup was triggered by MTE, it should be not MTE
specific.  The other processing which takes long time in the loop may
trigger soft lockup too.

So add cond_resched() for hugetlb to avoid soft lockup.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: 8f860591ffb2 ("[PATCH] Enable mprotect on huge pages")
Signed-off-by: Yang Shi <[email-masked]>
Tested-by: Carl Worth <[email-masked]>
Reviewed-by: Christoph Lameter (Ampere) <[email-masked]>
Reviewed-by: Catalin Marinas <[email-masked]>
Acked-by: David Hildenbrand <[email-masked]>
Acked-by: Oscar Salvador <[email-masked]>
Reviewed-by: Anshuman Khandual <[email-masked]>
Reviewed-by: Dev Jain <[email-masked]>
Cc: Muchun Song <[email-masked]>
Cc: Will Deacon <[email-masked]>
Cc: <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 mm/hugetlb.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -6779,6 +6779,8 @@ unsigned long hugetlb_change_protection(
 						make_pte_marker(PTE_MARKER_UFFD_WP));
 		}
 		spin_unlock(ptl);
+
+		cond_resched();
 	}
 	/*
 	 * Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:16:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367358; cv=none; b=cJpXS4chXvzvKPd+eluKj0W7d1t++ho7Bw+xRgVSxx+cPJ3WkEw5RaVN6kSxGBgm3etq91VgFf5qFauQLu1QDcc0ARfZK72JdL0NooYKbo7qo05qqxi+owlaPhjRvZp37Mh4X0kqh/vXpOE66TYrIomXG/JgkaGUvX0lBjSp99M=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367358; c=relaxed/simple;
	bh=zH6EcuSC/04eYEUtKR9zTvE6sUADSgPN/XYDn54u3rc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DIR0vbOtHT5xSVEQncw6qVxQOUbjdwO0LCG0hiG1+zYFVnoRJIS0M+4DWb4yWhWg8URkraFJivGRffwy11D6cw9kflyENaFa2d7yPtQuABm4gbEEik+R/KNzMPhgpQ0uA3n8yg/YwFrJ+/1Om5wF1cjAmvecV6aSQYXs0863rFo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=evFZVKaO; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Jan Kara <[email-masked]>,
	Zhang Yi <[email-masked]>,
	Theodore Tso <[email-masked]>
Subject: [PATCH 6.1 181/196] ext4: fix checks for orphan inodes
Date: Mon, 13 Oct 2025 16:45:54 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jan Kara <[email-masked]>

commit acf943e9768ec9d9be80982ca0ebc4bfd6b7631e upstream.

When orphan file feature is enabled, inode can be tracked as orphan
either in the standard orphan list or in the orphan file. The first can
be tested by checking ei->i_orphan list head, the second is recorded by
EXT4_STATE_ORPHAN_FILE inode state flag. There are several places where
we want to check whether inode is tracked as orphan and only some of
them properly check for both possibilities. Luckily the consequences are
mostly minor, the worst that can happen is that we track an inode as
orphan although we don't need to and e2fsck then complains (resulting in
occasional ext4/307 xfstest failures). Fix the problem by introducing a
helper for checking whether an inode is tracked as orphan and use it in
appropriate places.

Fixes: 4a79a98c7b19 ("ext4: Improve scalability of ext4 orphan file handling")
Cc: [email-masked]
Signed-off-by: Jan Kara <[email-masked]>
Reviewed-by: Zhang Yi <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Theodore Ts'o <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 fs/ext4/ext4.h   |   10 ++++++++++
 fs/ext4/file.c   |    2 +-
 fs/ext4/inode.c  |    2 +-
 fs/ext4/orphan.c |    6 +-----
 fs/ext4/super.c  |    4 ++--
 5 files changed, 15 insertions(+), 9 deletions(-)

--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1962,6 +1962,16 @@ static inline bool ext4_verity_in_progre
 #define NEXT_ORPHAN(inode) EXT4_I(inode)->i_dtime
 
 /*
+ * Check whether the inode is tracked as orphan (either in orphan file or
+ * orphan list).
+ */
+static inline bool ext4_inode_orphan_tracked(struct inode *inode)
+{
+	return ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) ||
+		!list_empty(&EXT4_I(inode)->i_orphan);
+}
+
+/*
  * Codes for operating systems
  */
 #define EXT4_OS_LINUX		0
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -344,7 +344,7 @@ static void ext4_inode_extension_cleanup
 	 * to cleanup the orphan list in ext4_handle_inode_extension(). Do it
 	 * now.
 	 */
-	if (!list_empty(&EXT4_I(inode)->i_orphan) && inode->i_nlink) {
+	if (ext4_inode_orphan_tracked(inode) && inode->i_nlink) {
 		handle_t *handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
 
 		if (IS_ERR(handle)) {
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4394,7 +4394,7 @@ static int ext4_fill_raw_inode(struct in
 		 * old inodes get re-used with the upper 16 bits of the
 		 * uid/gid intact.
 		 */
-		if (ei->i_dtime && list_empty(&ei->i_orphan)) {
+		if (ei->i_dtime && !ext4_inode_orphan_tracked(inode)) {
 			raw_inode->i_uid_high = 0;
 			raw_inode->i_gid_high = 0;
 		} else {
--- a/fs/ext4/orphan.c
+++ b/fs/ext4/orphan.c
@@ -109,11 +109,7 @@ int ext4_orphan_add(handle_t *handle, st
 
 	WARN_ON_ONCE(!(inode->i_state & (I_NEW | I_FREEING)) &&
 		     !inode_is_locked(inode));
-	/*
-	 * Inode orphaned in orphan file or in orphan list?
-	 */
-	if (ext4_test_inode_state(inode, EXT4_STATE_ORPHAN_FILE) ||
-	    !list_empty(&EXT4_I(inode)->i_orphan))
+	if (ext4_inode_orphan_tracked(inode))
 		return 0;
 
 	/*
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1379,9 +1379,9 @@ static void ext4_free_in_core_inode(stru
 
 static void ext4_destroy_inode(struct inode *inode)
 {
-	if (!list_empty(&(EXT4_I(inode)->i_orphan))) {
+	if (ext4_inode_orphan_tracked(inode)) {
 		ext4_msg(inode->i_sb, KERN_ERR,
-			 "Inode %lu (%p): orphan list check failed!",
+			 "Inode %lu (%p): inode tracked as orphan!",
 			 inode->i_ino, EXT4_I(inode));
 		print_hex_dump(KERN_INFO, "", DUMP_PREFIX_ADDRESS, 16, 4,
 				EXT4_I(inode), sizeof(struct ext4_inode_info),

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:16:38 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367355; cv=none; b=f2ylpBRR+aTeMntqpRy13Hsmd7Znw3PJOOhDVG2mXIzni0uyX8v8swdDv1LWkcz5DXbCsLJpVo1/sDp0sPMnkgMDGq8EvldyP6HW+aW6yRcbkaC8TOWkTL2c/26ThAUPuaoFrfP3Xtn6VGIM5+cLd4EDqftrO4vf5GCyeuBsURw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367355; c=relaxed/simple;
	bh=jCu5KqEwKF3xDmmXm1tuvl1mNDZK33ESROoacAATyOI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=AuOAXi3VwBjSp5AU7Z/FZFtzUU6v+gnAZqy/Ta1H40TfdYORXexIOdMTNV1z3ter1Wx6wOhWRp8I9/reoww6jcjLSJG8xWaEcMbf7A/1Xx678CFA6ndkwLSgfg657UF1EQRvm8Y7C+qN87iBpNC6O8E7x7WMweKpgx3/XfAjOzg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hIJ8J3md; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Matvey Kovalev <[email-masked]>,
	Namjae Jeon <[email-masked]>,
	Steve French <[email-masked]>
Subject: [PATCH 6.1 180/196] ksmbd: fix error code overwriting in smb2_get_info_filesystem()
Date: Mon, 13 Oct 2025 16:45:53 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Matvey Kovalev <[email-masked]>

commit 88daf2f448aad05a2e6df738d66fe8b0cf85cee0 upstream.

If client doesn't negotiate with SMB3.1.1 POSIX Extensions,
then proper error code won't be returned due to overwriting.

Return error immediately.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: e2f34481b24db ("cifsd: add server-side procedures for SMB3")
Cc: [email-masked]
Signed-off-by: Matvey Kovalev <[email-masked]>
Acked-by: Namjae Jeon <[email-masked]>
Signed-off-by: Steve French <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 fs/smb/server/smb2pdu.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -5233,7 +5233,8 @@ static int smb2_get_info_filesystem(stru
 
 		if (!work->tcon->posix_extensions) {
 			pr_err("client doesn't negotiate with SMB3.1.1 POSIX Extensions\n");
-			rc = -EOPNOTSUPP;
+			path_put(&path);
+			return -EOPNOTSUPP;
 		} else {
 			info = (struct filesystem_posix_info *)(rsp->Buffer);
 			info->OptimalTransferSize = cpu_to_le32(stfs.f_bsize);

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:16:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367353; cv=none; b=ZCeSYxTtThRdPV4IbcAtt+TRz6CEq/3sWYxUjP19uwAcfY4HuM5xXn1Yb6ZEFEmaO+ZtCJW9sYaSrP6eFQTFU16Y5m1HsbhIKYxJxIWpyy8Mh1tKyxd5XinoipFedAY3STJwaCcPpEG6ZdkrK+p+CfirmCbo8pXJ/pD3AS6yBO0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367353; c=relaxed/simple;
	bh=FdxdZRSRB9ZUFHAKLYaZveNpbkDDaVP90nSzhrlqEpY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DgT0q1JpE+gJLK7TZXE1sRHhaLRRocF6wFHDxSRXBajwWd0l2OLr6w4zHabYKXehQAFod2Y7Dxz8cibhhQ0qpHwnZg0W7IZCVS8HJTigaqHQ10RVpTGfah/v8ROG96SLpWtweU2pVNTH8xlgKF46kzFUjbaIZgVrht7kQTDvvaw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0PIYwvng; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zheng Qixing <[email-masked]>,
	Mikulas Patocka <[email-masked]>
Subject: [PATCH 6.1 179/196] dm: fix NULL pointer dereference in __dm_suspend()
Date: Mon, 13 Oct 2025 16:45:52 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zheng Qixing <[email-masked]>

commit 8d33a030c566e1f105cd5bf27f37940b6367f3be upstream.

There is a race condition between dm device suspend and table load that
can lead to null pointer dereference. The issue occurs when suspend is
invoked before table load completes:

BUG: kernel NULL pointer dereference, address: 0000000000000054
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014
RIP: 0010:blk_mq_wait_quiesce_done+0x0/0x50
Call Trace:
  <TASK>
  blk_mq_quiesce_queue+0x2c/0x50
  dm_stop_queue+0xd/0x20
  __dm_suspend+0x130/0x330
  dm_suspend+0x11a/0x180
  dev_suspend+0x27e/0x560
  ctl_ioctl+0x4cf/0x850
  dm_ctl_ioctl+0xd/0x20
  vfs_ioctl+0x1d/0x50
  __se_sys_ioctl+0x9b/0xc0
  __x64_sys_ioctl+0x19/0x30
  x64_sys_call+0x2c4a/0x4620
  do_syscall_64+0x9e/0x1b0

The issue can be triggered as below:

T1 						T2
dm_suspend					table_load
__dm_suspend					dm_setup_md_queue
						dm_mq_init_request_queue
						blk_mq_init_allocated_queue
						=> q->mq_ops = set->ops; (1)
dm_stop_queue / dm_wait_for_completion
=> q->tag_set NULL pointer!	(2)
						=> q->tag_set = set; (3)

Fix this by checking if a valid table (map) exists before performing
request-based suspend and waiting for target I/O. When map is NULL,
skip these table-dependent suspend steps.

Even when map is NULL, no I/O can reach any target because there is
no table loaded; I/O submitted in this state will fail early in the
DM layer. Skipping the table-dependent suspend logic in this case
is safe and avoids NULL pointer dereferences.

Fixes: c4576aed8d85 ("dm: fix request-based dm's use of dm_wait_for_completion")
Cc: [email-masked]
Signed-off-by: Zheng Qixing <[email-masked]>
Signed-off-by: Mikulas Patocka <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/md/dm.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2668,7 +2668,7 @@ static int __dm_suspend(struct mapped_de
 {
 	bool do_lockfs = suspend_flags & DM_SUSPEND_LOCKFS_FLAG;
 	bool noflush = suspend_flags & DM_SUSPEND_NOFLUSH_FLAG;
-	int r;
+	int r = 0;
 
 	lockdep_assert_held(&md->suspend_lock);
 
@@ -2720,7 +2720,7 @@ static int __dm_suspend(struct mapped_de
 	 * Stop md->queue before flushing md->wq in case request-based
 	 * dm defers requests to md->wq from md->queue.
 	 */
-	if (dm_request_based(md)) {
+	if (map && dm_request_based(md)) {
 		dm_stop_queue(md->queue);
 		set_bit(DMF_QUEUE_STOPPED, &md->flags);
 	}
@@ -2732,7 +2732,8 @@ static int __dm_suspend(struct mapped_de
 	 * We call dm_wait_for_completion to wait for all existing requests
 	 * to finish.
 	 */
-	r = dm_wait_for_completion(md, task_state);
+	if (map)
+		r = dm_wait_for_completion(md, task_state);
 	if (!r)
 		set_bit(dmf_suspended_flag, &md->flags);

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:24:25 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367350; cv=none; b=XRp9AyZTI81Bx4yMpSGaaGh/zM/jlz4oeT4jFa4L4s8MaQAmJzKu+lD9kM9U+3tgRQ6ggaBKNCz41HgpiSoTtjIt7q9U7Uyg1pitOidkGxB8TW7ZdeOoRGH7QvC/4OODcUUncR6sb1wSZAjU9IEQIu66nzrCIHWOnIRv5btCU3Q=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367350; c=relaxed/simple;
	bh=YXR+Vagoev1l9n3xH17K+ponOxGVyVKt/pAOAX7JoP8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Vb2+Juh0yF61z498Th/txGqanC1SlKZSiwizE6NdT21HjOml9gA2eLqkpuuQ4SBOOw0i/L9aeWJRzSsmW3JqRqgcGT7GpHzYs3WzSCpwIL158zAncL5RSQD3vcsHME85pcDt6NqNeZIUKz9qYC2sCc5SKlQltEtUhBZpfT/QENI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ap5U8fOF; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zheng Qixing <[email-masked]>,
	Mikulas Patocka <[email-masked]>
Subject: [PATCH 6.1 178/196] dm: fix queue start/stop imbalance under suspend/load/resume races
Date: Mon, 13 Oct 2025 16:45:51 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zheng Qixing <[email-masked]>

commit 7f597c2cdb9d3263a6fce07c4fc0a9eaa8e8fc43 upstream.

When suspend and load run concurrently, before q->mq_ops is set in
blk_mq_init_allocated_queue(), __dm_suspend() skip dm_stop_queue(). As a
result, the queue's quiesce depth is not incremented.

Later, once table load has finished and __dm_resume() runs, which triggers
q->quiesce_depth ==0 warning in blk_mq_unquiesce_queue():
Call Trace:
 <TASK>
 dm_start_queue+0x16/0x20 [dm_mod]
 __dm_resume+0xac/0xb0 [dm_mod]
 dm_resume+0x12d/0x150 [dm_mod]
 do_resume+0x2c2/0x420 [dm_mod]
 dev_suspend+0x30/0x130 [dm_mod]
 ctl_ioctl+0x402/0x570 [dm_mod]
 dm_ctl_ioctl+0x23/0x30 [dm_mod]

Fix this by explicitly tracking whether the request queue was
stopped in __dm_suspend() via a new DMF_QUEUE_STOPPED flag.
Only call dm_start_queue() in __dm_resume() if the queue was
actually stopped.

Fixes: e70feb8b3e68 ("blk-mq: support concurrent queue quiesce/unquiesce")
Cc: [email-masked]
Signed-off-by: Zheng Qixing <[email-masked]>
Signed-off-by: Mikulas Patocka <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/md/dm-core.h |    1 +
 drivers/md/dm.c      |    8 +++++---
 2 files changed, 6 insertions(+), 3 deletions(-)

--- a/drivers/md/dm-core.h
+++ b/drivers/md/dm-core.h
@@ -160,6 +160,7 @@ struct mapped_device {
 #define DMF_SUSPENDED_INTERNALLY 7
 #define DMF_POST_SUSPENDING 8
 #define DMF_EMULATE_ZONE_APPEND 9
+#define DMF_QUEUE_STOPPED 10
 
 void disable_discard(struct mapped_device *md);
 void disable_write_zeroes(struct mapped_device *md);
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2720,8 +2720,10 @@ static int __dm_suspend(struct mapped_de
 	 * Stop md->queue before flushing md->wq in case request-based
 	 * dm defers requests to md->wq from md->queue.
 	 */
-	if (dm_request_based(md))
+	if (dm_request_based(md)) {
 		dm_stop_queue(md->queue);
+		set_bit(DMF_QUEUE_STOPPED, &md->flags);
+	}
 
 	flush_workqueue(md->wq);
 
@@ -2743,7 +2745,7 @@ static int __dm_suspend(struct mapped_de
 	if (r < 0) {
 		dm_queue_flush(md);
 
-		if (dm_request_based(md))
+		if (test_and_clear_bit(DMF_QUEUE_STOPPED, &md->flags))
 			dm_start_queue(md->queue);
 
 		unlock_fs(md);
@@ -2826,7 +2828,7 @@ static int __dm_resume(struct mapped_dev
 	 * so that mapping of targets can work correctly.
 	 * Request-based dm is queueing the deferred I/Os in its request_queue.
 	 */
-	if (dm_request_based(md))
+	if (test_and_clear_bit(DMF_QUEUE_STOPPED, &md->flags))
 		dm_start_queue(md->queue);
 
 	unlock_fs(md);

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:24:12 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367347; cv=none; b=m0yRl/O3j/XALvL7AJrSsmQeckbWtfWsIltPCfisJepyq6qKDqXUwzcN2QgoLQsB3AsoevRaCC7RNNXLUhG+FdBV5hRTo2etg0aFGsZWSKkskhds2g/H64H9y9ik0N0pYmC3R4DfR0RN0n2XnE6pgHNaXp9elv/UHi5n75QhqRI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367347; c=relaxed/simple;
	bh=/xnOoXMqhwsGL+Ys22+axOnvvWJnFeyxKqSsV7YsdW4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=FgLjhnNQsGhkwHp7eI1ipkVLg4rlwzH5ZSk7Hwcob7kMuOKobVx0nDFQt+OO6pHEpSlIy/ZhuuOGRyM5p+G+ltOpcU3tmg1vtkCHqKAkGiPmsntnNCzm4bHeeyWeYKdiddqASaWy9ie+A6+cBvRem4JqF0JFSQk7CZM1uPtAmAQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=E5vU6v7c; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Bartosz Golaszewski <[email-masked]>,
	Linus Walleij <[email-masked]>,
	Lee Jones <[email-masked]>
Subject: [PATCH 6.1 177/196] mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
Date: Mon, 13 Oct 2025 16:45:50 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bartosz Golaszewski <[email-masked]>

commit 1efbee6852f1ff698a9981bd731308dd027189fb upstream.

Commit 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
removed the return value check from the call to gpiochip_add_data() (or
rather gpiochip_add() back then and later converted to devres) with no
explanation. This function however can still fail, so check the return
value and bail-out if it does.

Cc: [email-masked]
Fixes: 974cc7b93441 ("mfd: vexpress: Define the device as MFD cells")
Signed-off-by: Bartosz Golaszewski <[email-masked]>
Reviewed-by: Linus Walleij <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Lee Jones <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/mfd/vexpress-sysreg.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/mfd/vexpress-sysreg.c
+++ b/drivers/mfd/vexpress-sysreg.c
@@ -98,6 +98,7 @@ static int vexpress_sysreg_probe(struct
 	struct resource *mem;
 	void __iomem *base;
 	struct gpio_chip *mmc_gpio_chip;
+	int ret;
 
 	mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (!mem)
@@ -118,7 +119,10 @@ static int vexpress_sysreg_probe(struct
 	bgpio_init(mmc_gpio_chip, &pdev->dev, 0x4, base + SYS_MCI,
 			NULL, NULL, NULL, NULL, 0);
 	mmc_gpio_chip->ngpio = 2;
-	devm_gpiochip_add_data(&pdev->dev, mmc_gpio_chip, NULL);
+
+	ret = devm_gpiochip_add_data(&pdev->dev, mmc_gpio_chip, NULL);
+	if (ret)
+		return ret;
 
 	return devm_mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO,
 			vexpress_sysreg_cells,

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:22:03 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367341; cv=none; b=YblgUYUusFh7XPnigeQ+7kXz6AfAdKSopuPYXz1zOd6vv7EnN0o9blR9TkKnplFL5oSM7yKd/EUD7IjBEtWGrOhkWVn2Q81CyjS0UTlcGMCE82G/bA3hgibuT0aRspOcYYel6yylEKqFdx9dEmnj88FwT9VteJHBBxxc9qiVjek=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367341; c=relaxed/simple;
	bh=PceMNClNoePXSqOLWTIjcHI6Uqyc9EGCP5LBOZ0yX9g=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=XwhXADPXN2SaqVTsQTi7M/0lyO+vZfUgFiaVx29x83KrkxCfy4xXIjPaplskHbdRcLSLA1+KQjf9qzubkUrXosZG5DWkI8b6gdMUH+7T69XluRGWbwK9DjEXaJc7PdKekplzGwPzirPTtz1yULq2jv9YXtvszhOxXOoXFEgIDOg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=jPNiwpwt; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Deepak Sharma <[email-masked]>,
	Vadim Fedorenko <[email-masked]>,
	Paolo Abeni <[email-masked]>
Subject: [PATCH 6.1 176/196] net: nfc: nci: Add parameter validation for packet data
Date: Mon, 13 Oct 2025 16:45:49 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Deepak Sharma <[email-masked]>

commit 9c328f54741bd5465ca1dc717c84c04242fac2e1 upstream.

Syzbot reported an uninitialized value bug in nci_init_req, which was
introduced by commit 5aca7966d2a7 ("Merge tag
'perf-tools-fixes-for-v6.17-2025-09-16' of
git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools").

This bug arises due to very limited and poor input validation
that was done at nic_valid_size(). This validation only
validates the skb->len (directly reflects size provided at the
userspace interface) with the length provided in the buffer
itself (interpreted as NCI_HEADER). This leads to the processing
of memory content at the address assuming the correct layout
per what opcode requires there. This leads to the accesses to
buffer of `skb_buff->data` which is not assigned anything yet.

Following the same silent drop of packets of invalid sizes at
`nic_valid_size()`, add validation of the data in the respective
handlers and return error values in case of failure. Release
the skb if error values are returned from handlers in
`nci_nft_packet` and effectively do a silent drop

Possible TODO: because we silently drop the packets, the
call to `nci_request` will be waiting for completion of request
and will face timeouts. These timeouts can get excessively logged
in the dmesg. A proper handling of them may require to export
`nci_request_cancel` (or propagate error handling from the
nft packets handlers).

Reported-by: [email-masked]
Closes: https://syzkaller.appspot.com/bug?extid=740e04c2a93467a0f8c8
Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation")
Tested-by: [email-masked]
Cc: [email-masked]
Signed-off-by: Deepak Sharma <[email-masked]>
Reviewed-by: Vadim Fedorenko <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Paolo Abeni <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 net/nfc/nci/ntf.c |  135 +++++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 99 insertions(+), 36 deletions(-)

--- a/net/nfc/nci/ntf.c
+++ b/net/nfc/nci/ntf.c
@@ -27,11 +27,16 @@
 
 /* Handle NCI Notification packets */
 
-static void nci_core_reset_ntf_packet(struct nci_dev *ndev,
-				      const struct sk_buff *skb)
+static int nci_core_reset_ntf_packet(struct nci_dev *ndev,
+				     const struct sk_buff *skb)
 {
 	/* Handle NCI 2.x core reset notification */
-	const struct nci_core_reset_ntf *ntf = (void *)skb->data;
+	const struct nci_core_reset_ntf *ntf;
+
+	if (skb->len < sizeof(struct nci_core_reset_ntf))
+		return -EINVAL;
+
+	ntf = (struct nci_core_reset_ntf *)skb->data;
 
 	ndev->nci_ver = ntf->nci_ver;
 	pr_debug("nci_ver 0x%x, config_status 0x%x\n",
@@ -42,15 +47,22 @@ static void nci_core_reset_ntf_packet(st
 		__le32_to_cpu(ntf->manufact_specific_info);
 
 	nci_req_complete(ndev, NCI_STATUS_OK);
+
+	return 0;
 }
 
-static void nci_core_conn_credits_ntf_packet(struct nci_dev *ndev,
-					     struct sk_buff *skb)
+static int nci_core_conn_credits_ntf_packet(struct nci_dev *ndev,
+					    struct sk_buff *skb)
 {
-	struct nci_core_conn_credit_ntf *ntf = (void *) skb->data;
+	struct nci_core_conn_credit_ntf *ntf;
 	struct nci_conn_info *conn_info;
 	int i;
 
+	if (skb->len < sizeof(struct nci_core_conn_credit_ntf))
+		return -EINVAL;
+
+	ntf = (struct nci_core_conn_credit_ntf *)skb->data;
+
 	pr_debug("num_entries %d\n", ntf->num_entries);
 
 	if (ntf->num_entries > NCI_MAX_NUM_CONN)
@@ -68,7 +80,7 @@ static void nci_core_conn_credits_ntf_pa
 		conn_info = nci_get_conn_info_by_conn_id(ndev,
 							 ntf->conn_entries[i].conn_id);
 		if (!conn_info)
-			return;
+			return 0;
 
 		atomic_add(ntf->conn_entries[i].credits,
 			   &conn_info->credits_cnt);
@@ -77,12 +89,19 @@ static void nci_core_conn_credits_ntf_pa
 	/* trigger the next tx */
 	if (!skb_queue_empty(&ndev->tx_q))
 		queue_work(ndev->tx_wq, &ndev->tx_work);
+
+	return 0;
 }
 
-static void nci_core_generic_error_ntf_packet(struct nci_dev *ndev,
-					      const struct sk_buff *skb)
+static int nci_core_generic_error_ntf_packet(struct nci_dev *ndev,
+					     const struct sk_buff *skb)
 {
-	__u8 status = skb->data[0];
+	__u8 status;
+
+	if (skb->len < 1)
+		return -EINVAL;
+
+	status = skb->data[0];
 
 	pr_debug("status 0x%x\n", status);
 
@@ -91,12 +110,19 @@ static void nci_core_generic_error_ntf_p
 		   (the state remains the same) */
 		nci_req_complete(ndev, status);
 	}
+
+	return 0;
 }
 
-static void nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev,
-						struct sk_buff *skb)
+static int nci_core_conn_intf_error_ntf_packet(struct nci_dev *ndev,
+					       struct sk_buff *skb)
 {
-	struct nci_core_intf_error_ntf *ntf = (void *) skb->data;
+	struct nci_core_intf_error_ntf *ntf;
+
+	if (skb->len < sizeof(struct nci_core_intf_error_ntf))
+		return -EINVAL;
+
+	ntf = (struct nci_core_intf_error_ntf *)skb->data;
 
 	ntf->conn_id = nci_conn_id(&ntf->conn_id);
 
@@ -105,6 +131,8 @@ static void nci_core_conn_intf_error_ntf
 	/* complete the data exchange transaction, if exists */
 	if (test_bit(NCI_DATA_EXCHANGE, &ndev->flags))
 		nci_data_exchange_complete(ndev, NULL, ntf->conn_id, -EIO);
+
+	return 0;
 }
 
 static const __u8 *
@@ -329,13 +357,18 @@ void nci_clear_target_list(struct nci_de
 	ndev->n_targets = 0;
 }
 
-static void nci_rf_discover_ntf_packet(struct nci_dev *ndev,
-				       const struct sk_buff *skb)
+static int nci_rf_discover_ntf_packet(struct nci_dev *ndev,
+				      const struct sk_buff *skb)
 {
 	struct nci_rf_discover_ntf ntf;
-	const __u8 *data = skb->data;
+	const __u8 *data;
 	bool add_target = true;
 
+	if (skb->len < sizeof(struct nci_rf_discover_ntf))
+		return -EINVAL;
+
+	data = skb->data;
+
 	ntf.rf_discovery_id = *data++;
 	ntf.rf_protocol = *data++;
 	ntf.rf_tech_and_mode = *data++;
@@ -390,6 +423,8 @@ static void nci_rf_discover_ntf_packet(s
 		nfc_targets_found(ndev->nfc_dev, ndev->targets,
 				  ndev->n_targets);
 	}
+
+	return 0;
 }
 
 static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev,
@@ -531,14 +566,19 @@ static int nci_store_general_bytes_nfc_d
 	return NCI_STATUS_OK;
 }
 
-static void nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
-					     const struct sk_buff *skb)
+static int nci_rf_intf_activated_ntf_packet(struct nci_dev *ndev,
+					    const struct sk_buff *skb)
 {
 	struct nci_conn_info *conn_info;
 	struct nci_rf_intf_activated_ntf ntf;
-	const __u8 *data = skb->data;
+	const __u8 *data;
 	int err = NCI_STATUS_OK;
 
+	if (skb->len < sizeof(struct nci_rf_intf_activated_ntf))
+		return -EINVAL;
+
+	data = skb->data;
+
 	ntf.rf_discovery_id = *data++;
 	ntf.rf_interface = *data++;
 	ntf.rf_protocol = *data++;
@@ -645,7 +685,7 @@ exit:
 	if (err == NCI_STATUS_OK) {
 		conn_info = ndev->rf_conn_info;
 		if (!conn_info)
-			return;
+			return 0;
 
 		conn_info->max_pkt_payload_len = ntf.max_data_pkt_payload_size;
 		conn_info->initial_num_credits = ntf.initial_num_credits;
@@ -691,19 +731,26 @@ listen:
 				pr_err("error when signaling tm activation\n");
 		}
 	}
+
+	return 0;
 }
 
-static void nci_rf_deactivate_ntf_packet(struct nci_dev *ndev,
-					 const struct sk_buff *skb)
+static int nci_rf_deactivate_ntf_packet(struct nci_dev *ndev,
+					const struct sk_buff *skb)
 {
 	const struct nci_conn_info *conn_info;
-	const struct nci_rf_deactivate_ntf *ntf = (void *)skb->data;
+	const struct nci_rf_deactivate_ntf *ntf;
+
+	if (skb->len < sizeof(struct nci_rf_deactivate_ntf))
+		return -EINVAL;
+
+	ntf = (struct nci_rf_deactivate_ntf *)skb->data;
 
 	pr_debug("entry, type 0x%x, reason 0x%x\n", ntf->type, ntf->reason);
 
 	conn_info = ndev->rf_conn_info;
 	if (!conn_info)
-		return;
+		return 0;
 
 	/* drop tx data queue */
 	skb_queue_purge(&ndev->tx_q);
@@ -735,14 +782,20 @@ static void nci_rf_deactivate_ntf_packet
 	}
 
 	nci_req_complete(ndev, NCI_STATUS_OK);
+
+	return 0;
 }
 
-static void nci_nfcee_discover_ntf_packet(struct nci_dev *ndev,
-					  const struct sk_buff *skb)
+static int nci_nfcee_discover_ntf_packet(struct nci_dev *ndev,
+					 const struct sk_buff *skb)
 {
 	u8 status = NCI_STATUS_OK;
-	const struct nci_nfcee_discover_ntf *nfcee_ntf =
-				(struct nci_nfcee_discover_ntf *)skb->data;
+	const struct nci_nfcee_discover_ntf *nfcee_ntf;
+
+	if (skb->len < sizeof(struct nci_nfcee_discover_ntf))
+		return -EINVAL;
+
+	nfcee_ntf = (struct nci_nfcee_discover_ntf *)skb->data;
 
 	/* NFCForum NCI 9.2.1 HCI Network Specific Handling
 	 * If the NFCC supports the HCI Network, it SHALL return one,
@@ -753,6 +806,8 @@ static void nci_nfcee_discover_ntf_packe
 	ndev->cur_params.id = nfcee_ntf->nfcee_id;
 
 	nci_req_complete(ndev, status);
+
+	return 0;
 }
 
 void nci_ntf_packet(struct nci_dev *ndev, struct sk_buff *skb)
@@ -779,35 +834,43 @@ void nci_ntf_packet(struct nci_dev *ndev
 
 	switch (ntf_opcode) {
 	case NCI_OP_CORE_RESET_NTF:
-		nci_core_reset_ntf_packet(ndev, skb);
+		if (nci_core_reset_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_CORE_CONN_CREDITS_NTF:
-		nci_core_conn_credits_ntf_packet(ndev, skb);
+		if (nci_core_conn_credits_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_CORE_GENERIC_ERROR_NTF:
-		nci_core_generic_error_ntf_packet(ndev, skb);
+		if (nci_core_generic_error_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_CORE_INTF_ERROR_NTF:
-		nci_core_conn_intf_error_ntf_packet(ndev, skb);
+		if (nci_core_conn_intf_error_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_RF_DISCOVER_NTF:
-		nci_rf_discover_ntf_packet(ndev, skb);
+		if (nci_rf_discover_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_RF_INTF_ACTIVATED_NTF:
-		nci_rf_intf_activated_ntf_packet(ndev, skb);
+		if (nci_rf_intf_activated_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_RF_DEACTIVATE_NTF:
-		nci_rf_deactivate_ntf_packet(ndev, skb);
+		if (nci_rf_deactivate_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_NFCEE_DISCOVER_NTF:
-		nci_nfcee_discover_ntf_packet(ndev, skb);
+		if (nci_nfcee_discover_ntf_packet(ndev, skb))
+			goto end;
 		break;
 
 	case NCI_OP_RF_NFCEE_ACTION_NTF:

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:08 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367338; cv=none; b=ZWq/RT4+wZMla5xFybkBJLb9NUognaqVnwXSAGdTAflb+8Gj0jYX+QhEsyJQZLS1MF1aPfdP06wioYD+tXX0+BdvAWzyyJBIbb2zK+hJ2NnzjxIBhOGT5qGHNiUmTPs0kJIPrqev4wkK4GpxqlPGYyE2/Z8B5alArJBUyJxAu64=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367338; c=relaxed/simple;
	bh=VujhJ2wlSwNAIEJ5KCif6qHDW3OniC1i5G2G4LOXadE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=quHFC3+WxWJzzHKh3WxEgayOH4FZjyKBfiAk9ZEGiNOyAGLcMLb2OUpcucimzy5LJRnlCtTBveXJxr9ZWIUP9OX6ThUh6vJUQjmsyoC2l5kfnb1176szaDTFlC1fBr5zsLq10mEtvwKV1SNMZQUQetKNBzU7c6XCfH6QrxztCyA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=k4N6nVwU; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Larshin Sergey <[email-masked]>,
	Jan Kara <[email-masked]>
Subject: [PATCH 6.1 175/196] fs: udf: fix OOB read in lengthAllocDescs handling
Date: Mon, 13 Oct 2025 16:45:48 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: syzkaller.appspot.com]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Larshin Sergey <[email-masked]>

commit 3bd5e45c2ce30e239d596becd5db720f7eb83c99 upstream.

When parsing Allocation Extent Descriptor, lengthAllocDescs comes from
on-disk data and must be validated against the block size. Crafted or
corrupted images may set lengthAllocDescs so that the total descriptor
length (sizeof(allocExtDesc) + lengthAllocDescs) exceeds the buffer,
leading udf_update_tag() to call crc_itu_t() on out-of-bounds memory and
trigger a KASAN use-after-free read.

BUG: KASAN: use-after-free in crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60
Read of size 1 at addr ffff888041e7d000 by task syz-executor317/5309

CPU: 0 UID: 0 PID: 5309 Comm: syz-executor317 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:488
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60
 udf_update_tag+0x70/0x6a0 fs/udf/misc.c:261
 udf_write_aext+0x4d8/0x7b0 fs/udf/inode.c:2179
 extent_trunc+0x2f7/0x4a0 fs/udf/truncate.c:46
 udf_truncate_tail_extent+0x527/0x7e0 fs/udf/truncate.c:106
 udf_release_file+0xc1/0x120 fs/udf/file.c:185
 __fput+0x23f/0x880 fs/file_table.c:431
 task_work_run+0x24f/0x310 kernel/task_work.c:239
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0xa2f/0x28e0 kernel/exit.c:939
 do_group_exit+0x207/0x2c0 kernel/exit.c:1088
 __do_sys_exit_group kernel/exit.c:1099 [inline]
 __se_sys_exit_group kernel/exit.c:1097 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097
 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

Validate the computed total length against epos->bh->b_size.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Reported-by: [email-masked]
Closes: https://syzkaller.appspot.com/bug?extid=8743fca924afed42f93e
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: [email-masked]
Signed-off-by: Larshin Sergey <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jan Kara <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 fs/udf/inode.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -2112,6 +2112,9 @@ int udf_current_aext(struct inode *inode
 		if (check_add_overflow(sizeof(struct allocExtDesc),
 				le32_to_cpu(header->lengthAllocDescs), &alen))
 			return -1;
+
+		if (alen > epos->bh->b_size)
+			return -1;
 	}
 
 	switch (iinfo->i_alloc_type) {

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:27:12 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367335; cv=none; b=Pn3lJQbt7sogMKOT2H87UtPjjlQ1GIIqNFuwZ+iuH3G+plDFI0TsmF1FI3/qpiK5ZEn6qBqLrCz4bFFuAIIu9i1bo3jIdxxo7f2Mepg5Xhf9MnCvhujGY0F93Ee9LU6EgF+JWK5JaQylr0ek6OgpEWe7q02OohW51tDt/FlivI0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367335; c=relaxed/simple;
	bh=dUyo29ntA04VL1Ad0MBHKTGPtANMK9lD/OjUY4bjHyQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=rUlS/Oyz4+UCIAGJWpz++6QPUbiSwf9IYQ07A+lD1oQ9DO91E4TsgDb4vSLDFcdAYpby1/W80myPNuf+hV91BVzF/UXqEdGldUMlBLU1QRCCySc2C8FluyoPM7IXjI0XBaPwbTef3j2K8CgYEWdmrA42JaBpwJezz9QuuGp5M98=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=G1eB3ltg; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	John Starks <[email-masked]>,
	Naman Jain <[email-masked]>,
	Michael Kelley <[email-masked]>,
	Long Li <[email-masked]>,
	Tianyu Lan <[email-masked]>
Subject: [PATCH 6.1 174/196] uio_hv_generic: Let userspace take care of interrupt mask
Date: Mon, 13 Oct 2025 16:45:47 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Naman Jain <[email-masked]>

commit b15b7d2a1b09ef5428a8db260251897405a19496 upstream.

Remove the logic to set interrupt mask by default in uio_hv_generic
driver as the interrupt mask value is supposed to be controlled
completely by the user space. If the mask bit gets changed
by the driver, concurrently with user mode operating on the ring,
the mask bit may be set when it is supposed to be clear, and the
user-mode driver will miss an interrupt which will cause a hang.

For eg- when the driver sets inbound ring buffer interrupt mask to 1,
the host does not interrupt the guest on the UIO VMBus channel.
However, setting the mask does not prevent the host from putting a
message in the inbound ring buffer. So let’s assume that happens,
the host puts a message into the ring buffer but does not interrupt.

Subsequently, the user space code in the guest sets the inbound ring
buffer interrupt mask to 0, saying “Hey, I’m ready for interrupts”.
User space code then calls pread() to wait for an interrupt.
Then one of two things happens:

* The host never sends another message. So the pread() waits forever.
* The host does send another message. But because there’s already a
  message in the ring buffer, it doesn’t generate an interrupt.
  This is the correct behavior, because the host should only send an
  interrupt when the inbound ring buffer transitions from empty to
  not-empty. Adding an additional message to a ring buffer that is not
  empty is not supposed to generate an interrupt on the guest.
  Since the guest is waiting in pread() and not removing messages from
  the ring buffer, the pread() waits forever.

This could be easily reproduced in hv_fcopy_uio_daemon if we delay
setting interrupt mask to 0.

Similarly if hv_uio_channel_cb() sets the interrupt_mask to 1,
there’s a race condition. Once user space empties the inbound ring
buffer, but before user space sets interrupt_mask to 0, the host could
put another message in the ring buffer but it wouldn’t interrupt.
Then the next pread() would hang.

Fix these by removing all instances where interrupt_mask is changed,
while keeping the one in set_event() unchanged to enable userspace
control the interrupt mask by writing 0/1 to /dev/uioX.

Fixes: 95096f2fbd10 ("uio-hv-generic: new userspace i/o driver for VMBus")
Suggested-by: John Starks <[email-masked]>
Signed-off-by: Naman Jain <[email-masked]>
Cc: [email-masked]
Reviewed-by: Michael Kelley <[email-masked]>
Reviewed-by: Long Li <[email-masked]>
Reviewed-by: Tianyu Lan <[email-masked]>
Tested-by: Tianyu Lan <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/uio/uio_hv_generic.c |    7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

--- a/drivers/uio/uio_hv_generic.c
+++ b/drivers/uio/uio_hv_generic.c
@@ -96,7 +96,6 @@ static void hv_uio_channel_cb(void *cont
 	struct hv_device *hv_dev = chan->device_obj;
 	struct hv_uio_private_data *pdata = hv_get_drvdata(hv_dev);
 
-	chan->inbound.ring_buffer->interrupt_mask = 1;
 	virt_mb();
 
 	uio_event_notify(&pdata->info);
@@ -173,8 +172,6 @@ hv_uio_new_channel(struct vmbus_channel
 		return;
 	}
 
-	/* Disable interrupts on sub channel */
-	new_sc->inbound.ring_buffer->interrupt_mask = 1;
 	set_channel_read_mode(new_sc, HV_CALL_ISR);
 
 	ret = sysfs_create_bin_file(&new_sc->kobj, &ring_buffer_bin_attr);
@@ -218,9 +215,7 @@ hv_uio_open(struct uio_info *info, struc
 
 	ret = vmbus_connect_ring(dev->channel,
 				 hv_uio_channel_cb, dev->channel);
-	if (ret == 0)
-		dev->channel->inbound.ring_buffer->interrupt_mask = 1;
-	else
+	if (ret)
 		atomic_dec(&pdata->refcnt);
 
 	return ret;

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:37:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367333; cv=none; b=ZZFSauhwUZLbyGFaz1EQ8HUN/PU7Z05WaNBxWlqCqzSPuzNn+oR5lEys20HALgVzg79sXCeV4HYRo6kH4ThNYoOR3lT77a7ACTzGwsw+IEsmJ51IKfaw1ajDG+JUqCoyHoNkIOhajAxlPsCCxRpC9c7tj8tyPQIeLEcnDQep+j0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367333; c=relaxed/simple;
	bh=XcyyiI+61EJHadHh/nCXelaj1RbYIO6gL3nYRddTpdQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Fp7oF1o6yY/9bEQaL+5FPZJl2pL0pYKbcgmM2AbqtBmnig7alP94MI24Xc3w3nhs6p1DzY3gymNkSgeAPt2JDaYFga4/A2PdL5cI5R9dE2GkWblXFyJ4QyO/EYz8KOA6eZDwQzJC9qB/PnHCY7sAX2/nng4h6UZ0yESbXnHX+GI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=d2HCyXxg; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Phillip Lougher <[email-masked]>,
	[email-masked],
	Andrew Morton <[email-masked]>
Subject: [PATCH 6.1 173/196] Squashfs: fix uninit-value in squashfs_get_parent
Date: Mon, 13 Oct 2025 16:45:46 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Phillip Lougher <[email-masked]>

commit 74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf upstream.

Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug.

This is caused by open_by_handle_at() being called with a file handle
containing an invalid parent inode number.  In particular the inode number
is that of a symbolic link, rather than a directory.

Squashfs_get_parent() gets called with that symbolic link inode, and
accesses the parent member field.

	unsigned int parent_ino = squashfs_i(inode)->parent;

Because non-directory inodes in Squashfs do not have a parent value, this
is uninitialised, and this causes an uninitialised value access.

The fix is to initialise parent with the invalid inode 0, which will cause
an EINVAL error to be returned.

Regular inodes used to share the parent field with the block_list_start
field.  This is removed in this commit to enable the parent field to
contain the invalid inode number 0.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: 122601408d20 ("Squashfs: export operations")
Signed-off-by: Phillip Lougher <[email-masked]>
Reported-by: [email-masked]
Closes: https://lore.kernel.org/all/[email-masked]/
Cc: <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 fs/squashfs/inode.c         |    7 +++++++
 fs/squashfs/squashfs_fs_i.h |    2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

--- a/fs/squashfs/inode.c
+++ b/fs/squashfs/inode.c
@@ -165,6 +165,7 @@ int squashfs_read_inode(struct inode *in
 		squashfs_i(inode)->start = le32_to_cpu(sqsh_ino->start_block);
 		squashfs_i(inode)->block_list_start = block;
 		squashfs_i(inode)->offset = offset;
+		squashfs_i(inode)->parent = 0;
 		inode->i_data.a_ops = &squashfs_aops;
 
 		TRACE("File inode %x:%x, start_block %llx, block_list_start "
@@ -212,6 +213,7 @@ int squashfs_read_inode(struct inode *in
 		squashfs_i(inode)->start = le64_to_cpu(sqsh_ino->start_block);
 		squashfs_i(inode)->block_list_start = block;
 		squashfs_i(inode)->offset = offset;
+		squashfs_i(inode)->parent = 0;
 		inode->i_data.a_ops = &squashfs_aops;
 
 		TRACE("File inode %x:%x, start_block %llx, block_list_start "
@@ -292,6 +294,7 @@ int squashfs_read_inode(struct inode *in
 		inode->i_mode |= S_IFLNK;
 		squashfs_i(inode)->start = block;
 		squashfs_i(inode)->offset = offset;
+		squashfs_i(inode)->parent = 0;
 
 		if (type == SQUASHFS_LSYMLINK_TYPE) {
 			__le32 xattr;
@@ -329,6 +332,7 @@ int squashfs_read_inode(struct inode *in
 		set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
 		rdev = le32_to_cpu(sqsh_ino->rdev);
 		init_special_inode(inode, inode->i_mode, new_decode_dev(rdev));
+		squashfs_i(inode)->parent = 0;
 
 		TRACE("Device inode %x:%x, rdev %x\n",
 				SQUASHFS_INODE_BLK(ino), offset, rdev);
@@ -353,6 +357,7 @@ int squashfs_read_inode(struct inode *in
 		set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
 		rdev = le32_to_cpu(sqsh_ino->rdev);
 		init_special_inode(inode, inode->i_mode, new_decode_dev(rdev));
+		squashfs_i(inode)->parent = 0;
 
 		TRACE("Device inode %x:%x, rdev %x\n",
 				SQUASHFS_INODE_BLK(ino), offset, rdev);
@@ -373,6 +378,7 @@ int squashfs_read_inode(struct inode *in
 			inode->i_mode |= S_IFSOCK;
 		set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
 		init_special_inode(inode, inode->i_mode, 0);
+		squashfs_i(inode)->parent = 0;
 		break;
 	}
 	case SQUASHFS_LFIFO_TYPE:
@@ -392,6 +398,7 @@ int squashfs_read_inode(struct inode *in
 		inode->i_op = &squashfs_inode_ops;
 		set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
 		init_special_inode(inode, inode->i_mode, 0);
+		squashfs_i(inode)->parent = 0;
 		break;
 	}
 	default:
--- a/fs/squashfs/squashfs_fs_i.h
+++ b/fs/squashfs/squashfs_fs_i.h
@@ -16,6 +16,7 @@ struct squashfs_inode_info {
 	u64		xattr;
 	unsigned int	xattr_size;
 	int		xattr_count;
+	int		parent;
 	union {
 		struct {
 			u64		fragment_block;
@@ -27,7 +28,6 @@ struct squashfs_inode_info {
 			u64		dir_idx_start;
 			int		dir_idx_offset;
 			int		dir_idx_cnt;
-			int		parent;
 		};
 	};
 	struct inode	vfs_inode;

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:22:03 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367330; cv=none; b=q1dP2Y3FG7HpRyj38wSPkUqg7CVc7oBsYmW/gLFcVzb51fLKM7DRhqy2yKJJI53gtK5qdZQfkyXnP6xXBDdYdlkILEQ2RfadUkm1Tw2SYpZrZmeu3UfNyDlG/hh0oMKsU6GphgRMvM8zunVDuO+KKE2498hRgM9mf1fc8lhc9Gc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367330; c=relaxed/simple;
	bh=yE2ahAN22Je5YlmOhd/A0jKNx+xf0cTB2sVTIM4x0xY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=juj8GEtVmDdK52nq7M4qv9M4I4m4x4LGcbdH76qADG2SFR5/ENSbnday2Xi3esPboC7pliG9a3zHWXgNDiRTtqzL1ETnorXL9wrulcIV2V29PkPsKjv0WOV2Yh7qyCvdTBaEeH/LgDoQ559x2X7xDhJ4l6IYyhFPZzs+sExn3Sw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vwKrCbg3; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	"Stefano Garzarella" <[email-masked]>,
	zhang jiao <[email-masked]>,
	"Michael S. Tsirkin" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 172/196] vhost: vringh: Modify the return value check
Date: Mon, 13 Oct 2025 16:45:45 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: zhang jiao <[email-masked]>

[ Upstream commit 82a8d0fda55b35361ee7f35b54fa2b66d7847d2b ]

The return value of copy_from_iter and copy_to_iter can't be negative,
check whether the copied lengths are equal.

Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
Cc: "Stefano Garzarella" <[email-masked]>
Signed-off-by: zhang jiao <[email-masked]>
Message-Id: <[email-masked]>
Signed-off-by: Michael S. Tsirkin <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/vhost/vringh.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index c570d214d5b68..d89c2bce94cbf 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -1162,6 +1162,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
 		struct iov_iter iter;
 		u64 translated;
 		int ret;
+		size_t size;
 
 		ret = iotlb_translate(vrh, (u64)(uintptr_t)src,
 				      len - total_translated, &translated,
@@ -1173,9 +1174,9 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
 
 		iov_iter_bvec(&iter, ITER_SOURCE, iov, ret, translated);
 
-		ret = copy_from_iter(dst, translated, &iter);
-		if (ret < 0)
-			return ret;
+		size = copy_from_iter(dst, translated, &iter);
+		if (size != translated)
+			return -EFAULT;
 
 		src += translated;
 		dst += translated;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:16:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367327; cv=none; b=T2Ep96UPxX4c9iHsEYZPGlnPSA8jBkCDsp+rEnxQKfgg1h8aFrc0Sse9lT578yxeSYK5OQvZ4MoOo6OsaFoabS6ciIb+nTeuayPD5Ck+UOyeH6jDfvSgOHc0PbPv8B8BcUuyfuKr2PGdPz1u9yLoyoUAkG3LzMBomVdMWKHUU/U=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367327; c=relaxed/simple;
	bh=RufJthQFIXN2B7rizFFO5P7ZmtjwmbZ+KU78nrvP8ks=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DBeGDItsmoqp0GxnNNViXXdeoUMXUVeaIzsgCminKPM85CtK5asiaEPV1gdQ2hb5TM4P4hBkoprlPYSNuUS8X3Wwt2nnSCFuyx7BLmW0nBdw2vKYJRBwAfe3J6TtZk5cSGxkZcuX3jvf2vuL/eLvpNoZ0GZuuMPKWtoFNv3v0Uc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ofp0bRGL; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jakub Kicinski <[email-masked]>,
	Tariq Toukan <[email-masked]>,
	Paolo Abeni <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 171/196] Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
Date: Mon, 13 Oct 2025 16:45:44 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jakub Kicinski <[email-masked]>

[ Upstream commit 6f5dacf88a32b3fd8b52c8ea781bf188c42aaa95 ]

This reverts commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb.

Commit in question breaks the mapping of PGs to pools for some SKUs.
Specifically multi-host NICs seem to be shipped with a custom buffer
configuration which maps the lossy PG to pool 4. But the bad commit
overrides this with pool 0 which does not have sufficient buffer space
reserved. Resulting in ~40% packet loss. The commit also breaks BMC /
OOB connection completely (100% packet loss).

Revert, similarly to commit 3fbfe251cc9f ("Revert "net/mlx5e: Update and
set Xon/Xoff upon port speed set""). The breakage is exactly the same,
the only difference is that quoted commit would break the NIC immediately
on boot, and the currently reverted commit only when MTU is changed.

Note: "good" kernels do not restore the configuration, so downgrade isn't
enough to recover machines. A NIC power cycle seems to be necessary to
return to a healthy state (or overriding the relevant registers using
a custom patch).

Fixes: ceddedc969f0 ("net/mlx5e: Update and set Xon/Xoff upon MTU set")
Signed-off-by: Jakub Kicinski <[email-masked]>
Reviewed-by: Tariq Toukan <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Paolo Abeni <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../mellanox/mlx5/core/en/port_buffer.h         | 12 ------------
 .../net/ethernet/mellanox/mlx5/core/en_main.c   | 17 +----------------
 2 files changed, 1 insertion(+), 28 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
index a23e3d810f3e4..80af7a5ac6046 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
@@ -63,23 +63,11 @@ struct mlx5e_port_buffer {
 	struct mlx5e_bufferx_reg  buffer[MLX5E_MAX_BUFFER];
 };
 
-#ifdef CONFIG_MLX5_CORE_EN_DCB
 int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
 				    u32 change, unsigned int mtu,
 				    struct ieee_pfc *pfc,
 				    u32 *buffer_size,
 				    u8 *prio2buffer);
-#else
-static inline int
-mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
-				u32 change, unsigned int mtu,
-				void *pfc,
-				u32 *buffer_size,
-				u8 *prio2buffer)
-{
-	return 0;
-}
-#endif
 
 int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
 			    struct mlx5e_port_buffer *port_buffer);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 7612070b66160..887d446354006 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -42,7 +42,6 @@
 #include "eswitch.h"
 #include "en.h"
 #include "en/txrx.h"
-#include "en/port_buffer.h"
 #include "en_tc.h"
 #include "en_rep.h"
 #include "en_accel/ipsec.h"
@@ -2641,11 +2640,9 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
 	struct mlx5e_params *params = &priv->channels.params;
 	struct net_device *netdev = priv->netdev;
 	struct mlx5_core_dev *mdev = priv->mdev;
-	u16 mtu, prev_mtu;
+	u16 mtu;
 	int err;
 
-	mlx5e_query_mtu(mdev, params, &prev_mtu);
-
 	err = mlx5e_set_mtu(mdev, params, params->sw_mtu);
 	if (err)
 		return err;
@@ -2655,18 +2652,6 @@ int mlx5e_set_dev_port_mtu(struct mlx5e_priv *priv)
 		netdev_warn(netdev, "%s: VPort MTU %d is different than netdev mtu %d\n",
 			    __func__, mtu, params->sw_mtu);
 
-	if (mtu != prev_mtu && MLX5_BUFFER_SUPPORTED(mdev)) {
-		err = mlx5e_port_manual_buffer_config(priv, 0, mtu,
-						      NULL, NULL, NULL);
-		if (err) {
-			netdev_warn(netdev, "%s: Failed to set Xon/Xoff values with MTU %d (err %d), setting back to previous MTU %d\n",
-				    __func__, mtu, err, prev_mtu);
-
-			mlx5e_set_mtu(mdev, params, prev_mtu);
-			return err;
-		}
-	}
-
 	params->sw_mtu = mtu;
 	return 0;
 }
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:26:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367324; cv=none; b=Pe0fg1psMJEP3CcfLlw9fjXaOi4mjmkMqXRRPE4dqwncHBoM/xxK4TCUOv9EiunBGvGzxQJXEFsGU2h4JxNo9JKV9chrPoXkX99sQ15sAEN/pyhlBeEwnx0aUIoZLwms5e7hFZLi6JnQDfsm+x9rc/rZ9HPK1+PIcQ4isp7v8xQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367324; c=relaxed/simple;
	bh=HWqI8NPW67XRKY0NUvxW1nQ8Z80xWx+DtfsglwslHIk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Gh+vE+qYz07Qx+0mcLrCPT6z7bm4sb3hgK/YmtYlnkOuQw0E7+JDbg7le8cZHd5U0d0IHRjYVtlj/ej0PcgLSLslghR1dk9sopYPPhFdLzRX9ERzqWeAYI0I8pzjlyfQk6LUElMQYFLR0qbkvihtTdG4lkGUgCgi+5MRYOO2VuU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Ujv0vAng; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Moshe Shemesh <[email-masked]>,
	Shay Drori <[email-masked]>,
	Tariq Toukan <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 170/196] net/mlx5: fw reset, add reset timeout work
Date: Mon, 13 Oct 2025 16:45:43 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Moshe Shemesh <[email-masked]>

[ Upstream commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 ]

Add sync reset timeout to stop poll_sync_reset in case there was no
reset done or abort event within timeout. Otherwise poll sync reset will
just continue and in case of fw fatal error no health reporting will be
done.

Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event")
Signed-off-by: Moshe Shemesh <[email-masked]>
Reviewed-by: Shay Drori <[email-masked]>
Signed-off-by: Tariq Toukan <[email-masked]>
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../ethernet/mellanox/mlx5/core/fw_reset.c    | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
index 1a818759a9aac..de130c75de64e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
@@ -22,6 +22,7 @@ struct mlx5_fw_reset {
 	struct work_struct reset_reload_work;
 	struct work_struct reset_now_work;
 	struct work_struct reset_abort_work;
+	struct delayed_work reset_timeout_work;
 	unsigned long reset_flags;
 	struct timer_list timer;
 	struct completion done;
@@ -180,6 +181,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool
 		return -EALREADY;
 	}
 
+	if (current_work() != &fw_reset->reset_timeout_work.work)
+		cancel_delayed_work(&fw_reset->reset_timeout_work);
 	mlx5_stop_sync_reset_poll(dev);
 	if (poll_health)
 		mlx5_start_health_poll(dev);
@@ -250,6 +253,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev)
 	}
 	mlx5_stop_health_poll(dev, true);
 	mlx5_start_sync_reset_poll(dev);
+
+	if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS,
+		      &fw_reset->reset_flags))
+		schedule_delayed_work(&fw_reset->reset_timeout_work,
+			msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE)));
 	return 0;
 }
 
@@ -445,6 +453,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct
 	}
 }
 
+static void mlx5_sync_reset_timeout_work(struct work_struct *work)
+{
+	struct delayed_work *dwork = container_of(work, struct delayed_work,
+						  work);
+	struct mlx5_fw_reset *fw_reset =
+		container_of(dwork, struct mlx5_fw_reset, reset_timeout_work);
+	struct mlx5_core_dev *dev = fw_reset->dev;
+
+	if (mlx5_sync_reset_clear_reset_requested(dev, true))
+		return;
+	mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n");
+}
+
 static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data)
 {
 	struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb);
@@ -513,6 +534,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev)
 	cancel_work_sync(&fw_reset->reset_reload_work);
 	cancel_work_sync(&fw_reset->reset_now_work);
 	cancel_work_sync(&fw_reset->reset_abort_work);
+	cancel_delayed_work(&fw_reset->reset_timeout_work);
 }
 
 int mlx5_fw_reset_init(struct mlx5_core_dev *dev)
@@ -535,6 +557,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev)
 	INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work);
 	INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event);
 	INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event);
+	INIT_DELAYED_WORK(&fw_reset->reset_timeout_work,
+			  mlx5_sync_reset_timeout_work);
 
 	init_completion(&fw_reset->done);
 	return 0;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:35:14 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367321; cv=none; b=ZC3sOWPpccafgo59xRbk0CGAs87U73BiiwuScLrpIexX56tBR4R9kvgY0PndAuXhZd+jW58wHePVu9dME9temFbNCmDWa4c3ka6Y3CzSMwYxIigyBC+pbqJGFsDryN/lleeFpdMtWK+psA3J/B63Q0JRukJSj+LUNEMUoNt+DmM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367321; c=relaxed/simple;
	bh=SsqTnDHw0m4CU3s2fBFpEEHaD3Zq3E+VOjdeE5+rKoU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=IroIFj3XWsZfkisf1ZgaT/UdynC05NJaNownILfFdc1VEYEteppkVC4yxiQubPT+o4SvIrEHLoOZnN3XTN1hVOugLaMMDMbdb9JLkBP9RnkjnrUkLmwqaU1V2J05r1s7CG/D3z21owOkLYjUd+tjhsBqqGTqvwEEkeT5PmMpgsQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EPH+V+cV; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Shay Drory <[email-masked]>,
	Moshe Shemesh <[email-masked]>,
	Tariq Toukan <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 169/196] net/mlx5: pagealloc: Fix reclaim race during command interface teardown
Date: Mon, 13 Oct 2025 16:45:42 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Shay Drory <[email-masked]>

[ Upstream commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 ]

The reclaim_pages_cmd() function sends a command to the firmware to
reclaim pages if the command interface is active.

A race condition can occur if the command interface goes down (e.g., due
to a PCI error) while the mlx5_cmd_do() call is in flight. In this
case, mlx5_cmd_do() will return an error. The original code would
propagate this error immediately, bypassing the software-based page
reclamation logic that is supposed to run when the command interface is
down.

Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark
that command interface is down. If this is the case, fall through to
the software reclamation path. If the command failed for any another
reason, or finished successfully, return as before.

Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
Signed-off-by: Shay Drory <[email-masked]>
Reviewed-by: Moshe Shemesh <[email-masked]>
Signed-off-by: Tariq Toukan <[email-masked]>
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
index 99909c74a2144..cab25eb30ca66 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
@@ -483,9 +483,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
 	u32 func_id;
 	u32 npages;
 	u32 i = 0;
+	int err;
 
-	if (!mlx5_cmd_is_down(dev))
-		return mlx5_cmd_do(dev, in, in_size, out, out_size);
+	err = mlx5_cmd_do(dev, in, in_size, out, out_size);
+	/* If FW is gone (-ENXIO), proceed to forceful reclaim */
+	if (err != -ENXIO)
+		return err;
 
 	/* No hard feelings, we want our pages back! */
 	npages = MLX5_GET(manage_pages_in, in, input_num_entries);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:19:49 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367318; cv=none; b=EvImCfswtWEt1v2hHRx4us4UeIGCiD6CBkjt4pH91Ga2CZ2G7uqAM3U6kxPt5RTkFzcFY1GMTZsWNeQaT8L+FsuQNSb/Fmr1hhnI5yMpzZ9F4QT81slhPExbzOZkHxYNrXjD5dVOSx33Ec6I/SMrOS/hmEV/8owU89PZCW8dicM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367318; c=relaxed/simple;
	bh=GnKU+ZNBmaVfBRgnNAo+l6EXM4mR8k5kwUHLEcwZvhg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=QHAQZ37QHaH3O15AyKxe7ArvZzMz6Z76QiiX46cgSqdjS4mxn8aHnA+tJ/EYDXgR6hbX8Gr8kxARm4LYHma4AZ8ONdH4mJNL2GVhZ8jOWKRFwGMcpj/bti6Ettu9whzFokKStIILoJxA4kJVAkxc1VuWhVvP4gFAJNiPjYTjBMA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=SK1vrtnj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Moshe Shemesh <[email-masked]>,
	Shay Drori <[email-masked]>,
	Tariq Toukan <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 168/196] net/mlx5: Stop polling for command response if interface goes down
Date: Mon, 13 Oct 2025 16:45:41 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Moshe Shemesh <[email-masked]>

[ Upstream commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 ]

Stop polling on firmware response to command in polling mode if the
command interface got down. This situation can occur, for example, if a
firmware fatal error is detected during polling.

This change halts the polling process when the command interface goes
down, preventing unnecessary waits.

Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible")
Signed-off-by: Moshe Shemesh <[email-masked]>
Reviewed-by: Shay Drori <[email-masked]>
Signed-off-by: Tariq Toukan <[email-masked]>
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index c83523395d5ee..4c614a256ee05 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -289,6 +289,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent)
 			return;
 		}
 		cond_resched();
+		if (mlx5_cmd_is_down(dev)) {
+			ent->ret = -ENXIO;
+			return;
+		}
 	} while (time_before(jiffies, poll_end));
 
 	ent->ret = -ETIMEDOUT;
@@ -1056,7 +1060,7 @@ static void cmd_work_handler(struct work_struct *work)
 		poll_timeout(ent);
 		/* make sure we read the descriptor after ownership is SW */
 		rmb();
-		mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT));
+		mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret);
 	}
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:21:12 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367315; cv=none; b=JazyjUGlUWYXiwJOQeSPs9yeCAVboJ9TaVojWI6OCTcWcnEWR16G7+pnr9/8IQjyn6UmeX9x2QCIX9J0STyEruL+nlSV0Mam+hW24qhuiIJJxcC4/ss/SfjN6TyMP5qUwSXpOLB8SXOHjVVDFP0lJSzX6eUqvqpGwJhJ/g/YUiY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367315; c=relaxed/simple;
	bh=LVUuu9mY8N3vRN0eXhqweO0C/WhPxOqMr22JzvR4BOQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=FYo80VA6dBA/BvRs3lVSnr8/jqIHxy3hSfZ+Ucxr0biZmp3xkXqZ4bHRS0Vkjmr4llGJ39kCw9lDVpzaf+BN/vLeNGufDCIMsjYqwadzQ6deGZyBiv4qTcn7mjtWY0TlLO707C64zjuEuSauig23125U5jbSayQBTGF0rYypVuE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=cJe63nc4; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jakub Kicinski <[email-masked]>,
	Yeounsu Moon <[email-masked]>,
	Andrew Lunn <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 167/196] net: dlink: handle copy_thresh allocation failure
Date: Mon, 13 Oct 2025 16:45:40 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yeounsu Moon <[email-masked]>

[ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ]

The driver did not handle failure of `netdev_alloc_skb_ip_align()`.
If the allocation failed, dereferencing `skb->protocol` could lead to
a NULL pointer dereference.

This patch tries to allocate `skb`. If the allocation fails, it falls
back to the normal path.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Suggested-by: Jakub Kicinski <[email-masked]>
Tested-on: D-Link DGE-550T Rev-A3
Signed-off-by: Yeounsu Moon <[email-masked]>
Reviewed-by: Andrew Lunn <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/dlink/dl2k.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
index 2acb63b547c35..bf58181589bf2 100644
--- a/drivers/net/ethernet/dlink/dl2k.c
+++ b/drivers/net/ethernet/dlink/dl2k.c
@@ -956,15 +956,18 @@ receive_packet (struct net_device *dev)
 		} else {
 			struct sk_buff *skb;
 
+			skb = NULL;
 			/* Small skbuffs for short packets */
-			if (pkt_len > copy_thresh) {
+			if (pkt_len <= copy_thresh)
+				skb = netdev_alloc_skb_ip_align(dev, pkt_len);
+			if (!skb) {
 				dma_unmap_single(&np->pdev->dev,
 						 desc_to_dma(desc),
 						 np->rx_buf_sz,
 						 DMA_FROM_DEVICE);
 				skb_put (skb = np->rx_skbuff[entry], pkt_len);
 				np->rx_skbuff[entry] = NULL;
-			} else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) {
+			} else {
 				dma_sync_single_for_cpu(&np->pdev->dev,
 							desc_to_dma(desc),
 							np->rx_buf_sz,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:17:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367412; cv=none; b=R40uPbx1raPnpURtQ409YfRyRDZ5b4qaOuURnkzxWy1t8htHz2jU9Lb9gGNg5bP0TULUEcHYGVfAOdJJt+7c0vgJJ89hDYn6UgCPOiMDAnnWpYJi65+wpEr9/ngYEcUlEckZY4CuTQxJkoBzMAOGsuP3w5UdZD45IjOwdl1M/vY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367412; c=relaxed/simple;
	bh=lO8ZEIPF28ASxHKhbC6YwHLY2bXGKP1GQg0RS8NhYsY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=NvzvaydvmqfgQ1GrFG5SeZ/ZhnCvymgLlBWhZgeCAhV4uWDXulpZonQe122sPkE9KBEWSit7bMwi0NgD0cClKJZflz70KaYKHT0VSV3c4GO1LuMELqYCppOlfUyNCeA339hyCtLGgnMF1Aj2HaGSxiTPx6RnGUjYje0kAwHw4vA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=vvK8c4KU; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Kohei Enju <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 166/196] net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
Date: Mon, 13 Oct 2025 16:45:39 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kohei Enju <[email-masked]>

[ Upstream commit f017156aea60db8720e47591ed1e041993381ad2 ]

In EC2 instances where the RSS hash key is not configurable, ethtool
shows bogus RSS hash key since ena_get_rxfh_key_size() unconditionally
returns ENA_HASH_KEY_SIZE.

Commit 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not
supported") added proper handling for devices that don't support RSS
hash key configuration, but ena_get_rxfh_key_size() has been unchanged.

When the RSS hash key is not configurable, return 0 instead of
ENA_HASH_KEY_SIZE to clarify getting the value is not supported.

Tested on m5 instance families.

Without patch:
 # ethtool -x ens5 | grep -A 1 "RSS hash key"
 RSS hash key:
 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00

With patch:
 # ethtool -x ens5 | grep -A 1 "RSS hash key"
 RSS hash key:
 Operation not supported

Fixes: 6a4f7dc82d1e ("net: ena: rss: do not allocate key when not supported")
Signed-off-by: Kohei Enju <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/amazon/ena/ena_ethtool.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
index 444ccef76da29..b93abcc4d64b0 100644
--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
@@ -695,7 +695,10 @@ static u32 ena_get_rxfh_indir_size(struct net_device *netdev)
 
 static u32 ena_get_rxfh_key_size(struct net_device *netdev)
 {
-	return ENA_HASH_KEY_SIZE;
+	struct ena_adapter *adapter = netdev_priv(netdev);
+	struct ena_rss *rss = &adapter->ena_dev->rss;
+
+	return rss->hash_key ? ENA_HASH_KEY_SIZE : 0;
 }
 
 static int ena_indirection_table_set(struct ena_adapter *adapter,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:27:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367409; cv=none; b=XRz5cD+5Y6Nzyo3KIUjXZUrQreZ2AwtxFMYCgxDCq02OTUPK22ro96+YkiFhOF3WvO6oREFspRUAqq5WDEiXtJJTvIeczxKk5U4aMtd6VDMyZudPof5vd3jzcaV8QggmJyE4ZbdHys5SH8g5By5uNCB97plggwVYQFjocz3FG80=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367409; c=relaxed/simple;
	bh=ynQfTQpppMfOdjERChb5buOrcBF+KI6y5Gu7lNKjVFw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=G3PdT92xOwFRJMo3j3HwQbFuBqC/dlM7/60yonnBe3MGaAZ1SLnS+wKn4y7/O8K4jW2NS5n5pm5Y6gAYMQRuYOZwCmZYOkokpU9pttY5ca5njG31O1MrUDUsIlPTIJeAxYWErUrTs9kMfjGXpb4xYFo8VdljJd8F9rKbSLATIl4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ME6OnKQA; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Kohei Enju <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 165/196] nfp: fix RSS hash key size when RSS is not supported
Date: Mon, 13 Oct 2025 16:45:38 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kohei Enju <[email-masked]>

[ Upstream commit 8425161ac1204d2185e0a10f5ae652bae75d2451 ]

The nfp_net_get_rxfh_key_size() function returns -EOPNOTSUPP when
devices don't support RSS, and callers treat the negative value as a
large positive value since the return type is u32.

Return 0 when devices don't support RSS, aligning with the ethtool
interface .get_rxfh_key_size() that requires returning 0 in such cases.

Fixes: 9ff304bfaf58 ("nfp: add support for reporting CRC32 hash function")
Signed-off-by: Kohei Enju <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
index af376b9000677..7ee919201985f 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
@@ -1409,7 +1409,7 @@ static u32 nfp_net_get_rxfh_key_size(struct net_device *netdev)
 	struct nfp_net *nn = netdev_priv(netdev);
 
 	if (!(nn->cap & NFP_NET_CFG_CTRL_RSS_ANY))
-		return -EOPNOTSUPP;
+		return 0;
 
 	return nfp_net_rss_key_sz(nn);
 }
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:17:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367406; cv=none; b=k7D1bEp9VQAb8MGXOYcqifnrsgm2WhPTVgUXfFi2wDjzhMsxgHRbV2qMZeSVuiQ1584FHYp6BXYUWtVxVJs9N+oh1b1Hd9id0dpMq2EG/LMAzV3GIqRPZytPTFmr3ud4M1AzpNVgY9h7fv6AbxfyeqbZsMUmJt0rgqfYY6U7cDY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367406; c=relaxed/simple;
	bh=TYEVtNvxvBjWeZhJ7lAIclThH8shAw50q8ZAW1WXN6A=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=l2aauP9scuGf0lDpmB0XYVF18vNkufjl5qIjQnURGEV53+kFiqjwpBK07tN+sJVxz7uiwBDy8h+a8rNaoP+A/HsKIrkFpgL7DsQMG0WBJepRC10XvU8RavSCePk7PM1YgJhUSCFHhXeoUBXSwAr4GyTfaMg7hkPyWHx1IlMtI+g=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Eg2ioAzd; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Erick Karanja <[email-masked]>,
	Miquel Raynal <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 164/196] mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands
Date: Mon, 13 Oct 2025 16:45:37 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Erick Karanja <[email-masked]>

[ Upstream commit 8ed4728eb9f10b57c3eb02e0f6933a89ffcb8a91 ]

In case of a jump to the  err label due to atmel_nand_create() or
atmel_nand_controller_add_nand() failure, the reference to nand_np
need to be released

Use for_each_child_of_node_scoped() to fix the issue.

Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")

Signed-off-by: Erick Karanja <[email-masked]>
Signed-off-by: Miquel Raynal <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
index 78f317ac04afa..56fd897721ad5 100644
--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
@@ -1859,7 +1859,7 @@ atmel_nand_controller_legacy_add_nands(struct atmel_nand_controller *nc)
 
 static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
 {
-	struct device_node *np, *nand_np;
+	struct device_node *np;
 	struct device *dev = nc->dev;
 	int ret, reg_cells;
 	u32 val;
@@ -1886,7 +1886,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc)
 
 	reg_cells += val;
 
-	for_each_child_of_node(np, nand_np) {
+	for_each_child_of_node_scoped(np, nand_np) {
 		struct atmel_nand *nand;
 
 		nand = atmel_nand_create(nc, nand_np, reg_cells);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:17:17 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367403; cv=none; b=RZ8zVNf+w+k+nueFXCWN07g+fcXGR2XWTOjJidP9UOb1RUi7Hc2nno6uxhbespAFxvcy2grxZFUs5NdExg/IO/m8K8gmfeFPoQA7SgLd5S2Gk2neMfUxI9dd9inVfvlueh8VnsjZl0bcLMO2R9rR+LFZZTlDP+hJEQNzvWmdemE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367403; c=relaxed/simple;
	bh=LEnHzOzRRaeg5kgKX5AdWlc+0aSt2WPbKws0maYZs64=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=cm5035U5xoMZ4d8uaaiedhEps13SLixiqQuVt1i4T8KXvZP2l+/xpSvALPeqtC/MwA6NGQQG/VK78pKHljCQCF1O0kLQtz/jUbsPNNTSj9n3y0b7avTrg0inHbb3uGXQ2NQRkPKiSVUHz52g5BSyFx73AYek62mdfA+i7sRYI/4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yXtJHwgJ; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id A99B9C4CEE7;
	Mon, 13 Oct 2025 14:56:42 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760367403;
	bh=LEnHzOzRRaeg5kgKX5AdWlc+0aSt2WPbKws0maYZs64=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=yXtJHwgJAHh5KaKz8SBilOSxTfYnknlA9S8nxM8cZLikpITYnUqGSB65UEIp+MfMr
	 TBbaBiLch3OMNoSaOO6ckh45kx4VylIrwSU0e9fTBJzCTA4rKPDM2wyirNyuERFCO+
	 Ok21CLDupksVWDuz908NC6lYEt25yshB6hgNdAlI=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Donet Tom <[email-masked]>,
	David Hildenbrand <[email-masked]>,
	Oscar Salvador <[email-masked]>,
	Alison Schofield <[email-masked]>,
	Chris Mason <[email-masked]>,
	Danilo Krummrich <[email-masked]>,
	Dave Jiang <[email-masked]>,
	Hiroyouki Kamezawa <[email-masked]>,
	Joanthan Cameron <[email-masked]>,
	"Ritesh Harjani (IBM)" <[email-masked]>,
	"Yury Norov (NVIDIA)" <[email-masked]>,
	Zi Yan <[email-masked]>,
	Andrew Morton <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 163/196] drivers/base/node: fix double free in register_one_node()
Date: Mon, 13 Oct 2025 16:45:36 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Donet Tom <[email-masked]>

[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]

When device_register() fails in register_node(), it calls
put_device(&node->dev).  This triggers node_device_release(), which calls
kfree(to_node(dev)), thereby freeing the entire node structure.

As a result, when register_node() returns an error, the node memory has
already been freed.  Calling kfree(node) again in register_one_node()
leads to a double free.

This patch removes the redundant kfree(node) from register_one_node() to
prevent the double free.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
Signed-off-by: Donet Tom <[email-masked]>
Acked-by: David Hildenbrand <[email-masked]>
Acked-by: Oscar Salvador <[email-masked]>
Cc: Alison Schofield <[email-masked]>
Cc: Chris Mason <[email-masked]>
Cc: Danilo Krummrich <[email-masked]>
Cc: Dave Jiang <[email-masked]>
Cc: Greg Kroah-Hartman <[email-masked]>
Cc: Hiroyouki Kamezawa <[email-masked]>
Cc: Joanthan Cameron <[email-masked]>
Cc: "Ritesh Harjani (IBM)" <[email-masked]>
Cc: Yury Norov (NVIDIA) <[email-masked]>
Cc: Zi Yan <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/base/node.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/base/node.c b/drivers/base/node.c
index cbaa4e2eddcef..6153dbd5be903 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -871,7 +871,6 @@ int __register_one_node(int nid)
 	error = register_node(node_devices[nid], nid);
 	if (error) {
 		node_devices[nid] = NULL;
-		kfree(node);
 		return error;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:24:04 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367400; cv=none; b=dU0UUi2Hwj8CuXj5UMgCfCzYcIQ2MZzPjt31U3uFw6FITFVLQvJENPPH67b4lHpx7s9jTsVJ9zg2QXXfQ/F0AGklzgGjwKuydneGM9w55qTndTa8srnpAdGchGDZrI/GD4bY0BshFozmeiDbIbuf4vqGZm25NRrP5/GoXFT+4M0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367400; c=relaxed/simple;
	bh=uorLUQrmCpj3zaBZnO1GHjmeeJiGQNVScMOTjhRsnHg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=AhnDMmhGFKbAdrqn88+xhdMNlv8cxDV36Dmu1g/L6u0EJAxn63sKSci6nmuqaY8xR63CEcDeSsrvp8MqeVH4EZRnNSFU4kcuu55j7lH4YGZDn1ukPytcMLhyiL/fbu8edTC7MH4W0huziRm5hlEAPSfD79PQ5Qt1Fn5MEqYXVKY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uY3wA6C7; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id D44AAC4CEE7;
	Mon, 13 Oct 2025 14:56:39 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760367400;
	bh=uorLUQrmCpj3zaBZnO1GHjmeeJiGQNVScMOTjhRsnHg=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=uY3wA6C75indbq/El5Q5AfzT3O0I4149M8ZtUa0ut4xRJX/IIeG1NRMQmaf678ztJ
	 kJ6m24E6RBlPeGPwMDUW9bw/PzC+MgKGAtUsCZ/QEMsqyu0M5r0kj2sXbXO9vI50le
	 s32P2+sdYnkRkjdsFCL7qIdsUrFnkZHfn1o+3qsU=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	Joseph Qi <[email-masked]>,
	Goldwyn Rodrigues <[email-masked]>,
	Mark Fasheh <[email-masked]>,
	Joel Becker <[email-masked]>,
	Junxiao Bi <[email-masked]>,
	Changwei Ge <[email-masked]>,
	Jun Piao <[email-masked]>,
	Andrew Morton <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 162/196] ocfs2: fix double free in user_cluster_connect()
Date: Mon, 13 Oct 2025 16:45:35 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email-masked]>

[ Upstream commit 8f45f089337d924db24397f55697cda0e6960516 ]

user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then
the error handling frees "lc" a second time.  Set "lc" to NULL on this
path to avoid a double free.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: c994c2ebdbbc ("ocfs2: use the new DLM operation callbacks while requesting new lockspace")
Signed-off-by: Dan Carpenter <[email-masked]>
Reviewed-by: Joseph Qi <[email-masked]>
Reviewed-by: Goldwyn Rodrigues <[email-masked]>
Cc: Mark Fasheh <[email-masked]>
Cc: Joel Becker <[email-masked]>
Cc: Junxiao Bi <[email-masked]>
Cc: Changwei Ge <[email-masked]>
Cc: Jun Piao <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/ocfs2/stack_user.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index 64e6ddcfe329a..e28905e58bd6a 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -1024,6 +1024,7 @@ static int user_cluster_connect(struct ocfs2_cluster_connection *conn)
 			printk(KERN_ERR "ocfs2: Could not determine"
 					" locking version\n");
 			user_cluster_disconnect(conn);
+			lc = NULL;
 			goto out;
 		}
 		wait_event(lc->oc_wait, (atomic_read(&lc->oc_this_node) > 0));
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:29:22 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367397; cv=none; b=gmWqMABlhHl4B1LSUZlLaeg72i98Xkyqs/7wS4Cxdv/YKZ6Zj7DDmHws3PuFTkf0BUMRm7WPXoXsMKdpjkJw/6t+JmooNDA5Gw0P7Ms9auYT2KCKSgA5C+/SxfvPOZ9ppu2h1ntsBUNLp6RR45p/tCQk4S4Dm1omGtWNmfiq9DQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367397; c=relaxed/simple;
	bh=nqyeynbYbjUzr9Yt2+quL04I73r0tVUTSMp9x5MfnlM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=GUnvChFPfw3ppUdjLT0xt1vhapDTQdnYvvuqaxV1T3mvc+/KMhDvOhq6OGnZgbnq5bPVxYMd24OWxHfJHialWnEH0ON+R4D+sKTQ1C0d+zSmHSPOvDNGv3nmGvLbjU446dnJuN8OBvV+Ppsj3d/wCXMXW7Kd0yIsL8AGDGyaoBs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ULp+uVDZ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Nishanth Menon <[email-masked]>,
	Alexander Sverdlin <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 161/196] hwrng: ks-sa - fix division by zero in ks_sa_rng_init
Date: Mon, 13 Oct 2025 16:45:34 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nishanth Menon <[email-masked]>

[ Upstream commit 612b1dfeb414dfa780a6316014ceddf9a74ff5c0 ]

Fix division by zero in ks_sa_rng_init caused by missing clock
pointer initialization. The clk_get_rate() call is performed on
an uninitialized clk pointer, resulting in division by zero when
calculating delay values.

Add clock initialization code before using the clock.

Fixes: 6d01d8511dce ("hwrng: ks-sa - Add minimum sleep time before ready-polling")
Signed-off-by: Nishanth Menon <[email-masked]>

 drivers/char/hw_random/ks-sa-rng.c | 7 +++++++
 1 file changed, 7 insertions(+)
Reviewed-by: Alexander Sverdlin <[email-masked]>

Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/char/hw_random/ks-sa-rng.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/char/hw_random/ks-sa-rng.c b/drivers/char/hw_random/ks-sa-rng.c
index 2f2f21f1b659e..d7b42888f25c2 100644
--- a/drivers/char/hw_random/ks-sa-rng.c
+++ b/drivers/char/hw_random/ks-sa-rng.c
@@ -240,6 +240,10 @@ static int ks_sa_rng_probe(struct platform_device *pdev)
 		return -EINVAL;
 	}
 
+	ks_sa_rng->clk = devm_clk_get_enabled(dev, NULL);
+	if (IS_ERR(ks_sa_rng->clk))
+		return dev_err_probe(dev, PTR_ERR(ks_sa_rng->clk), "Failed to get clock\n");
+
 	pm_runtime_enable(dev);
 	ret = pm_runtime_resume_and_get(dev);
 	if (ret < 0) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:21:13 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367377; cv=none; b=XDWRrMZMaEpngjPKwm5kRcrcI07zIJWni9cXzNGVgcWO2XN4VtSemXKSyMjUZj/fXGEhc59azOEKwWSUHKNsm4tWBuCLoFsliM7qLEXET65XuIjQpXpUQVlGBf072YKyllyhLDgUaYDIy++9caNhtk1NVMK5XEuHbJGuuxgYd5c=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367377; c=relaxed/simple;
	bh=zlRivWcastJA2kNX65gFrtLUQHc+0Xj3MBy5TAHQ8Lo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=kMi6110v/8+xgbUDCgGGRyNx0Fy2o+tW/DTOZ9BiJwDwnALZVhkmFYzUoy1Q3L1zypq9kUe4Rt0zmJ7EZ3TRjC3+IF4wqaR/A0HyFCm4oP39WNll7fwYzLggyhMMcehaECqm68xQTgvGV0byEZ/jWRT84jmExQ3Q9w5dVBWG1i8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=SWIq8Dj6; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Luiz Augusto von Dentz <[email-masked]>,
	Paul Menzel <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 160/196] Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements
Date: Mon, 13 Oct 2025 16:45:33 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Luiz Augusto von Dentz <[email-masked]>

[ Upstream commit 03ddb4ac251463ec5b7b069395d9ab89163dd56c ]

When creating an advertisement for BIG the address shall not be
non-resolvable since in case of acting as BASS/Broadcast Assistant the
address must be the same as the connection in order to use the PAST
method and even when PAST/BASS are not in the picture a Periodic
Advertisement can still be synchronized thus the same argument as to
connectable advertisements still stand.

Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections")
Signed-off-by: Luiz Augusto von Dentz <[email-masked]>
Reviewed-by: Paul Menzel <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/bluetooth/hci_sync.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 4c1b2468989a8..851a43a5aee0c 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -1304,7 +1304,7 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
 {
 	struct hci_cp_le_set_ext_adv_params cp;
 	struct hci_rp_le_set_ext_adv_params rp;
-	bool connectable;
+	bool connectable, require_privacy;
 	u32 flags;
 	bdaddr_t random_addr;
 	u8 own_addr_type;
@@ -1342,10 +1342,12 @@ int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
 		return -EPERM;
 
 	/* Set require_privacy to true only when non-connectable
-	 * advertising is used. In that case it is fine to use a
-	 * non-resolvable private address.
+	 * advertising is used and it is not periodic.
+	 * In that case it is fine to use a non-resolvable private address.
 	 */
-	err = hci_get_random_address(hdev, !connectable,
+	require_privacy = !connectable && !(adv && adv->periodic);
+
+	err = hci_get_random_address(hdev, require_privacy,
 				     adv_use_rpa(hdev, flags), adv,
 				     &own_addr_type, &random_addr);
 	if (err < 0)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:24:11 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367344; cv=none; b=tCxzuvo8j4m2UvgDn1EXXLnv4yKmut2Mv/BJ2ulxRTqbZK8tMbcFoLFqs9jDWH6BYnc0q8b32akOdRBYxgHiHXFBdNkOvZjMAYoZkLCIXtK5gQmmKkWd3YRmmAEJ25ThBPuGEh/KEvcQI0UGCijbEiVkRHezvA/F+5nRHkWELFw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367344; c=relaxed/simple;
	bh=CXl+XaegYARTfqaVnhfg2yWH662CfmnDGW5vuSzPumg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=AQnuV38x+6i9OKJ0ByTppbTJF9THjUEhiwCT9/lUqEhghAYxzL+V+7J94vYlBjJVqdycwQgDypunUL7wqU0ygKHMEaxZ6HjomgV7bzes2SLZ49DZlC87wnYtD0jZiHMRperoQeeSzJWz2Bw2l95luRKIoIGF3QkGe+66FCht+Fo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=n390vnhs; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Pauli Virtanen <[email-masked]>,
	Luiz Augusto von Dentz <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 159/196] Bluetooth: ISO: dont leak skb in ISO_CONT RX
Date: Mon, 13 Oct 2025 16:45:32 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Pauli Virtanen <[email-masked]>

[ Upstream commit 5bf863f4c5da055c1eb08887ae4f26d99dbc4aac ]

For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the
skb is leaked.

Free skb after copying its data.

Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Pauli Virtanen <[email-masked]>
Signed-off-by: Luiz Augusto von Dentz <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/bluetooth/iso.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 5f6e4c79e190b..c542497f040cc 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -1729,7 +1729,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
 		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
 					  skb->len);
 		conn->rx_len -= skb->len;
-		return;
+		break;
 
 	case ISO_END:
 		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:16:08 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367313; cv=none; b=akvgP09GtVlHxLBgvX2pj4aK6zeX2+a2w7lY06WQtiwIBDbxv4nmP3rRNU3yeGerFNP8T+j+66d2yddNP0cniamiRfSlsjjMtIh7Gv5OUnWowrzjoOrO56TIxCWSePjc9aAiWDrA8zRvtJwdl0IxCsUNnAvZzOAGH3oUh39jR6U=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367313; c=relaxed/simple;
	bh=IYPRq0vzMyHLOpZTRAYNEkqnR3Cr7OM9TiEimWDZHC8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=dqqQEmvPZOnvZ1bYgUpmXcCitcmZFGrqp0w+9z4KHM/uOyV5m1KMmo7y+snbcob+YWFzrz3vbmOG30m5Ge1vYPgcu2JXuXoKrxvxLGlZrYEdBr+hser1iNHmCFroy+7VxJt2qAVK3FkhwjWMeAltA8w3jXB7ornv8OUtBmGVBdQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YfYRbIEy; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Luiz Augusto von Dentz <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 158/196] Bluetooth: ISO: Fix possible UAF on iso_conn_free
Date: Mon, 13 Oct 2025 16:45:31 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Luiz Augusto von Dentz <[email-masked]>

[ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ]

This attempt to fix similar issue to sco_conn_free where if the
conn->sk is not set to NULL may lead to UAF on iso_conn_free.

Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Luiz Augusto von Dentz <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/bluetooth/iso.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 437cbeaa96193..5f6e4c79e190b 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -581,6 +581,13 @@ static void iso_sock_kill(struct sock *sk)
 
 	BT_DBG("sk %p state %d", sk, sk->sk_state);
 
+	/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
+	if (iso_pi(sk)->conn) {
+		iso_conn_lock(iso_pi(sk)->conn);
+		iso_pi(sk)->conn->sk = NULL;
+		iso_conn_unlock(iso_pi(sk)->conn);
+	}
+
 	/* Kill poor orphan */
 	bt_sock_unlink(&iso_sk_list, sk);
 	sock_set_flag(sk, SOCK_DEAD);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:17:38 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367414; cv=none; b=Wbulk+kULVRjwmGymqNuY6Anskg+ko0APxZzU0cq4FkVV9fInIvNPD3AQSp+7P2Fj4zosYGa8mHy28qA4AE79XXu/ZghhkLZyhjAwfLkKT3ttWXV8i/x7p/lEWyp0IvPCQqOYxlBtkotVOdmqshlqOCg1lk1Kl/D4ks0+GtF2tM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367414; c=relaxed/simple;
	bh=LPSoChytQXcG257U3t3ySbJ0YppEvpfcMCw+5OCVldA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=NYdEEKFLy+MckyX2ibkek63+I8FKJAgMqtwZNSPP/4YeB45tWXthK1BXAxUJitSSYnc4l4Ozm5gHpwh+qRN9+ALgfn6ful96PaAYGQNeAEkyg/2wvMPGX6fV5yZgnO+eqDqw2KcVXQwyqb0LIB4NT21kk0NN53BdkfJ9rVR8UXY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=oabWaaj/; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Luiz Augusto von Dentz <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 157/196] Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
Date: Mon, 13 Oct 2025 16:45:30 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Luiz Augusto von Dentz <[email-masked]>

[ Upstream commit 79e562a52adea4afa0601a15964498fae66c823c ]

The debug UUID was only getting set if MGMT_OP_READ_EXP_FEATURES_INFO
was not called with a specific index which breaks the likes of
bluetoothd since it only invokes MGMT_OP_READ_EXP_FEATURES_INFO when an
adapter is plugged, so instead of depending hdev not to be set just
enable the UUID on any index like it was done with iso_sock_uuid.

Fixes: e625e50ceee1 ("Bluetooth: Introduce debug feature when dynamic debug is disabled")
Signed-off-by: Luiz Augusto von Dentz <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/bluetooth/mgmt.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 27876512c63a4..a11d25c389f8f 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -4483,13 +4483,11 @@ static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
 		return -ENOMEM;
 
 #ifdef CONFIG_BT_FEATURE_DEBUG
-	if (!hdev) {
-		flags = bt_dbg_get() ? BIT(0) : 0;
+	flags = bt_dbg_get() ? BIT(0) : 0;
 
-		memcpy(rp->features[idx].uuid, debug_uuid, 16);
-		rp->features[idx].flags = cpu_to_le32(flags);
-		idx++;
-	}
+	memcpy(rp->features[idx].uuid, debug_uuid, 16);
+	rp->features[idx].flags = cpu_to_le32(flags);
+	idx++;
 #endif
 
 	if (hdev && hci_dev_le_state_simultaneous(hdev)) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:12:30 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367290; cv=none; b=XuWzQjT6gorkRUv86tJMfy0auLxSfuwnwQgysU0OMrirbzvPlggIngwwIA+GgcApYRQAsZO63aWvxVYCUy4Bu6oxJ/bEcRnZmVizxXFaZl18GJqGlEy98CywY3xYSHHiJVP5IJcmhNpsGkclGrJMGgERNl2Bv0i3AHBbssItvOw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367290; c=relaxed/simple;
	bh=u82e+pLHyakCKJnPPKFjW2M+6d5Cyk7oxIHdVoFLbko=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=sIOXLsbNfTelIVGHBjzGuoReAXcvB/TPYeRAS0MlINbQsOmxNekuNUozgFAvJ1btoIvKQCrKbde6eFwitGJbCv25rPwGBMT9lVbaoh7msuMjKNpDD+ZgW74igxyKiI6+lQeqx5MbbUJZgbPX83LjHYkNtsF4TyI02a863xOU9O0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=TKNC3iWz; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	zhang jiao <[email-masked]>,
	"Michael S. Tsirkin" <[email-masked]>,
	Simon Horman <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 156/196] vhost: vringh: Fix copy_to_iter return value check
Date: Mon, 13 Oct 2025 16:45:29 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [213.196.21.55 listed in list.dnswl.org]
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael S. Tsirkin <[email-masked]>

[ Upstream commit 439263376c2c4e126cac0d07e4987568de4eaba5 ]

The return value of copy_to_iter can't be negative, check whether the
copied length is equal to the requested length instead of checking for
negative values.

Cc: zhang jiao <[email-masked]>
Link: https://lore.kernel.org/all/[email-masked]
Signed-off-by: Michael S. Tsirkin <[email-masked]>
Reviewed-by: Simon Horman <[email-masked]>
Fixes: 309bba39c945 ("vringh: iterate on iotlb_translate to handle large translations")
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/vhost/vringh.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 10bfc5f1c50d5..c570d214d5b68 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -1195,6 +1195,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
 		struct iov_iter iter;
 		u64 translated;
 		int ret;
+		size_t size;
 
 		ret = iotlb_translate(vrh, (u64)(uintptr_t)dst,
 				      len - total_translated, &translated,
@@ -1206,9 +1207,9 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
 
 		iov_iter_bvec(&iter, ITER_DEST, iov, ret, translated);
 
-		ret = copy_to_iter(src, translated, &iter);
-		if (ret < 0)
-			return ret;
+		size = copy_to_iter(src, translated, &iter);
+		if (size != translated)
+			return -EFAULT;
 
 		src += translated;
 		dst += translated;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:19:44 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367286; cv=none; b=fwgnRJnwBAc9WVzlKQu9hhdPokmc94KTuuScjPgToYXCcKJNCk9Z537t0uui0/I8aCCV3rTy8LVDJH/8g/uyXr9zC1OLQzSNkXeyo8xzvXkFe+IvHGt0+F2jxJxFsf2Tg++/AUlQ6bWUJCmtADg4tO+mcL4ckzuwibusCOJ2Zio=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367286; c=relaxed/simple;
	bh=DQHbmzGSmzTeZDfqRlihEFNYsd8p5Ou7imqRaMcjIgk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bkaFQtqe/NHn34XGb9bQEU3eRXayzwK2gCKEmFgR0C4s9b6974tOu1RkrderIPWJl7gvYmSo6U+IA7Mbtf26ob2W/ka3FmM45sJQDPyEStSm3zQskjLvWrtfjxl2BFtFAT/JQr+cu8ccaP9eccvupF2Kogbocm2gEwboCFpeqmE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zMcohmsH; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michal Pecio <[email-masked]>,
	I Viswanath <[email-masked]>,
	Jakub Kicinski <[email-masked]>,
	Sasha Levin <[email-masked]>,
	[email-masked]
Subject: [PATCH 6.1 155/196] net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
Date: Mon, 13 Oct 2025 16:45:28 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: I Viswanath <[email-masked]>

[ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ]

syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb.
This is the sequence of events that leads to the warning:

rtl8150_start_xmit() {
	netif_stop_queue();
	usb_submit_urb(dev->tx_urb);
}

rtl8150_set_multicast() {
	netif_stop_queue();
	netif_wake_queue();		<-- wakes up TX queue before URB is done
}

rtl8150_start_xmit() {
	netif_stop_queue();
	usb_submit_urb(dev->tx_urb);	<-- double submission
}

rtl8150_set_multicast being the ndo_set_rx_mode callback should not be
calling netif_stop_queue and notif_start_queue as these handle
TX queue synchronization.

The net core function dev_set_rx_mode handles the synchronization
for rtl8150_set_multicast making it safe to remove these locks.

Reported-and-tested-by: [email-masked]
Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Tested-by: Michal Pecio <[email-masked]>
Signed-off-by: I Viswanath <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/usb/rtl8150.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index ddff6f19ff98e..92add3daadbb1 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
 	rtl8150_t *dev = netdev_priv(netdev);
 	u16 rx_creg = 0x9e;
 
-	netif_stop_queue(netdev);
 	if (netdev->flags & IFF_PROMISC) {
 		rx_creg |= 0x0001;
 		dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name);
@@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev)
 		rx_creg &= 0x00fc;
 	}
 	async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg);
-	netif_wake_queue(netdev);
 }
 
 static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:27:22 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367283; cv=none; b=J9lU3aMrsxxwTZjlgCmU0PcmYOMVZdf5GoO/tzGItgKz/EbxlBRleIrjBAUQZbhm2SGfCn6t4irOkbpjnbgx88M/CALhIcMQ6ac8g924cZvoDzw1AahdUQRALdG+GUyC2QKI2cP3nqLYZXQKr8dd1QKbHpgusXFhom5a+PHXNhA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367283; c=relaxed/simple;
	bh=965D2CY6vzZiESy5vz+SDcAsXhkkz1rvEFXPYDGZeAk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=UqHS0xFF+1XCyIM10kHy51Y4ZehbjopNNT9lP+oQpTZYdEm97Yp/JBqpvfbffXiNjqVad+VNGUphqfy0cRb4BAr3YXG40u5opR19egfiKZujYP1u5VJNXyaI0u9YWSyAIGUfqD1Ycw4rr8vfeDT9dprGkDgT/Pm7hnz5dIxt4R0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Lna6d695; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Stefan Metzmacher <[email-masked]>,
	Bernard Metzler <[email-masked]>,
	Jason Gunthorpe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 154/196] RDMA/siw: Always report immediate post SQ errors
Date: Mon, 13 Oct 2025 16:45:27 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bernard Metzler <[email-masked]>

[ Upstream commit fdd0fe94d68649322e391c5c27dd9f436b4e955e ]

In siw_post_send(), any immediate error encountered during processing of
the work request list must be reported to the caller, even if previous
work requests in that list were just accepted and added to the send queue.

Not reporting those errors confuses the caller, which would wait
indefinitely for the failing and potentially subsequently aborted work
requests completion.

This fixes a case where immediate errors were overwritten by subsequent
code in siw_post_send().

Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
Link: https://patch.msgid.link/r/[email-masked]
Suggested-by: Stefan Metzmacher <[email-masked]>
Signed-off-by: Bernard Metzler <[email-masked]>
Signed-off-by: Jason Gunthorpe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/sw/siw/siw_verbs.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
index 193f7d58d3845..dce86f5aee1f7 100644
--- a/drivers/infiniband/sw/siw/siw_verbs.c
+++ b/drivers/infiniband/sw/siw/siw_verbs.c
@@ -761,7 +761,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
 	struct siw_wqe *wqe = tx_wqe(qp);
 
 	unsigned long flags;
-	int rv = 0;
+	int rv = 0, imm_err = 0;
 
 	if (wr && !rdma_is_kernel_res(&qp->base_qp.res)) {
 		siw_dbg_qp(qp, "wr must be empty for user mapped sq\n");
@@ -947,9 +947,17 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
 	 * Send directly if SQ processing is not in progress.
 	 * Eventual immediate errors (rv < 0) do not affect the involved
 	 * RI resources (Verbs, 8.3.1) and thus do not prevent from SQ
-	 * processing, if new work is already pending. But rv must be passed
-	 * to caller.
+	 * processing, if new work is already pending. But rv and pointer
+	 * to failed work request must be passed to caller.
 	 */
+	if (unlikely(rv < 0)) {
+		/*
+		 * Immediate error
+		 */
+		siw_dbg_qp(qp, "Immediate error %d\n", rv);
+		imm_err = rv;
+		*bad_wr = wr;
+	}
 	if (wqe->wr_status != SIW_WR_IDLE) {
 		spin_unlock_irqrestore(&qp->sq_lock, flags);
 		goto skip_direct_sending;
@@ -974,15 +982,10 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr,
 
 	up_read(&qp->state_lock);
 
-	if (rv >= 0)
-		return 0;
-	/*
-	 * Immediate error
-	 */
-	siw_dbg_qp(qp, "error %d\n", rv);
+	if (unlikely(imm_err))
+		return imm_err;
 
-	*bad_wr = wr;
-	return rv;
+	return (rv >= 0) ? 0 : rv;
 }
 
 /*
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:24:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367281; cv=none; b=oe7LvKR3YNWYG3T3K+3gvayQf6ikd6QNF6TOo0SCitMvmb3dEJNgQEI/1dbmDsl5lUA4aHjfjL6dV9yOJHyzVJobUxQhNC1tkLDpxkcf22oN4SadmOTH8Z3ewLRrbWXMLrHL5XiKT4J9RBd28c7NNq+EHZqNoDq4NDtrlBqIjsI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367281; c=relaxed/simple;
	bh=0o+Rg0zo4EmVySgy+4qtUyvO5zglJ9KgwQXzoYjjoxw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=BRy6EPOU/ahWetQyRb9ksRIIyM386XM3N1dV3HOvY4cvj9NDOT+GPIbzhbeMhC8FuoFWtX0PNEfWQnEQoU1R0LFJyoxhUiFLEiIqE9Ge+coM405dmPIuKs3vyznTddlvgnOtujNEvFMB+CoknQ4iWsMySeqLTmkQL5e7NYrmFKE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Rrk+jbe3; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Cristian Ciocaltea <[email-masked]>,
	Shuah Khan <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 153/196] usb: vhci-hcd: Prevent suspending virtually attached devices
Date: Mon, 13 Oct 2025 16:45:26 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Cristian Ciocaltea <[email-masked]>

[ Upstream commit e40b984b6c4ce3f80814f39f86f87b2a48f2e662 ]

The VHCI platform driver aims to forbid entering system suspend when at
least one of the virtual USB ports are bound to an active USB/IP
connection.

However, in some cases, the detection logic doesn't work reliably, i.e.
when all devices attached to the virtual root hub have been already
suspended, leading to a broken suspend state, with unrecoverable resume.

Ensure the virtually attached devices do not enter suspend by setting
the syscore PM flag.  Note this is currently limited to the client side
only, since the server side doesn't implement system suspend prevention.

Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
Signed-off-by: Cristian Ciocaltea <[email-masked]>
Acked-by: Shuah Khan <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/usb/usbip/vhci_hcd.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 6b98f5ab6dfed..e3c8483d7ba40 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -764,6 +764,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
 				 ctrlreq->wValue, vdev->rhport);
 
 			vdev->udev = usb_get_dev(urb->dev);
+			/*
+			 * NOTE: A similar operation has been done via
+			 * USB_REQ_GET_DESCRIPTOR handler below, which is
+			 * supposed to always precede USB_REQ_SET_ADDRESS.
+			 *
+			 * It's not entirely clear if operating on a different
+			 * usb_device instance here is a real possibility,
+			 * otherwise this call and vdev->udev assignment above
+			 * should be dropped.
+			 */
+			dev_pm_syscore_device(&vdev->udev->dev, true);
 			usb_put_dev(old);
 
 			spin_lock(&vdev->ud.lock);
@@ -784,6 +795,17 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
 					"Not yet?:Get_Descriptor to device 0 (get max pipe size)\n");
 
 			vdev->udev = usb_get_dev(urb->dev);
+			/*
+			 * Set syscore PM flag for the virtually attached
+			 * devices to ensure they will not enter suspend on
+			 * the client side.
+			 *
+			 * Note this doesn't have any impact on the physical
+			 * devices attached to the host system on the server
+			 * side, hence there is no need to undo the operation
+			 * on disconnect.
+			 */
+			dev_pm_syscore_device(&vdev->udev->dev, true);
 			usb_put_dev(old);
 			goto out;
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:23:07 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367278; cv=none; b=R3ztKnVKylT/BHhw0j3hmjetZxc4w8rn/8oMLTPZ66MOzXLKxGxmg/meuoRbfHV1J1DQwsqDp2lSOB/weRPcFplCGMAqwcQD+kXLwTUXr9t3YLS+hJRhTGPRd0/FUfKzOTtM7r9kI8C3j18XFPKZxFkT2J8RPyROwJa8B75t4no=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367278; c=relaxed/simple;
	bh=f0SJlzFAtyhDgnrdilbkmNR801QPtuzeyaLVJKRmS/A=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=b1icyazxU4SVsk5WF5mIUFVxX6Y+mb7FtgV7A85bX3p5mk3zGg1NOCqr+TzY4zNEs5w7XLOvgMMja+Q4y8/w/qiZRLBF0RNwFZ6nxCqY4Abz22CaFWC439ebQUlWrkwfn1sGzkerGoKQSMZV+ODYQ4X2qiAdJOsfqFoXsWP+QR4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PTZfm9K1; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ranjan Kumar <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 152/196] scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
Date: Mon, 13 Oct 2025 16:45:25 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ranjan Kumar <[email-masked]>

[ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ]

During mpt3sas_transport_port_remove(), messages were logged with
dev_printk() against &mpt3sas_port->port->dev. At this point the SAS
transport device may already be partially unregistered or freed, leading
to a crash when accessing its struct device.

Using ioc_info(), which logs via the PCI device (ioc->pdev->dev),
guaranteed to remain valid until driver removal.

[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI
[83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G           OE       6.16.0-rc1+ #1 PREEMPT(voluntary)
[83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024
[83428.295799] RIP: 0010:__dev_printk+0x1f/0x70
[83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff
[83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206
[83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32
[83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845
[83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8
[83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000
[83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30
[83428.295833] FS:  00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000
[83428.295837] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0
[83428.295844] PKRU: 55555554
[83428.295846] Call Trace:
[83428.295848]  <TASK>
[83428.295850]  _dev_printk+0x5c/0x80
[83428.295857]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.295863]  mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas]
[83428.295882]  _scsih_remove_device+0x21b/0x280 [mpt3sas]
[83428.295894]  ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas]
[83428.295906]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.295910]  mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas]
[83428.295921]  _scsih_expander_node_remove+0x129/0x140 [mpt3sas]
[83428.295933]  _scsih_expander_node_remove+0x6a/0x140 [mpt3sas]
[83428.295944]  scsih_remove+0x3f0/0x4a0 [mpt3sas]
[83428.295957]  pci_device_remove+0x3b/0xb0
[83428.295962]  device_release_driver_internal+0x193/0x200
[83428.295968]  driver_detach+0x44/0x90
[83428.295971]  bus_remove_driver+0x69/0xf0
[83428.295975]  pci_unregister_driver+0x2a/0xb0
[83428.295979]  _mpt3sas_exit+0x1f/0x300 [mpt3sas]
[83428.295991]  __do_sys_delete_module.constprop.0+0x174/0x310
[83428.295997]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.296000]  ? __x64_sys_getdents64+0x9a/0x110
[83428.296005]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.296009]  ? syscall_trace_enter+0xf6/0x1b0
[83428.296014]  do_syscall_64+0x7b/0x2c0
[83428.296019]  ? srso_alias_return_thunk+0x5/0xfbef5
[83428.296023]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
Signed-off-by: Ranjan Kumar <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
index e8a4750f6ec47..7d6e4fe31ceed 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
@@ -991,11 +991,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
 	list_for_each_entry_safe(mpt3sas_phy, next_phy,
 	    &mpt3sas_port->phy_list, port_siblings) {
 		if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
-			dev_printk(KERN_INFO, &mpt3sas_port->port->dev,
-			    "remove: sas_addr(0x%016llx), phy(%d)\n",
-			    (unsigned long long)
-			    mpt3sas_port->remote_identify.sas_address,
-			    mpt3sas_phy->phy_id);
+			ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n",
+				(unsigned long long) mpt3sas_port->remote_identify.sas_address,
+					mpt3sas_phy->phy_id);
 		mpt3sas_phy->phy_belongs_to_port = 0;
 		if (!ioc->remove_host)
 			sas_port_delete_phy(mpt3sas_port->port,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:21:27 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367275; cv=none; b=ab5qe5GFyfsp48OaFNhBAFgnGD6vskqpdA1AB5eV4iQUG7WX9sNKERCyUANN/4t/Hg8gI34KYH69eKQvE7uYWeOL1/DYDAA4eCyyaEojexGT9nrX8RijPfrfbcM/3e5t0CIm+nYcf/nBjTdXW4W83okWLtXktl6ygtseJw1NWaM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367275; c=relaxed/simple;
	bh=IExKoojoE4V4lpcaS0BwynnJo+9sAbZ/XGpqplYpVvI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=L7KMGXATz3rUrr8o5kzYfCE+7AHD8XwlZ72WaXeEizYpiG29coehjzuAacRKcCcgCtXCtxtuvIaQb6K69DMZ2Vq5zHBV1Is7an9qeomiJOwx3QRDAK33Eszo6foW9K3GT8GbfVttYvsopKenXpMu878WwkBJZDQz6nSE3LhJ8RU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=O1zbjnlx; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Julian Anastasov <[email-masked]>,
	Slavin Liu <[email-masked]>,
	Florian Westphal <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 151/196] ipvs: Defer ip_vs_ftp unregister during netns cleanup
Date: Mon, 13 Oct 2025 16:45:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Slavin Liu <[email-masked]>

[ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ]

On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp
before connections with valid cp->app pointers are flushed, leading to a
use-after-free.

Fix this by introducing a global `exiting_module` flag, set to true in
ip_vs_ftp_exit() before unregistering the pernet subsystem. In
__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns
cleanup (when exiting_module is false) and defer it to
__ip_vs_cleanup_batch(), which unregisters all apps after all connections
are flushed. If called during module exit, unregister ip_vs_ftp
immediately.

Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
Suggested-by: Julian Anastasov <[email-masked]>
Signed-off-by: Slavin Liu <[email-masked]>
Signed-off-by: Julian Anastasov <[email-masked]>
Signed-off-by: Florian Westphal <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/netfilter/ipvs/ip_vs_ftp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index ef1f45e43b630..61d3797fb7995 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -53,6 +53,7 @@ enum {
 	IP_VS_FTP_EPSV,
 };
 
+static bool exiting_module;
 /*
  * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
  * First port is set to the default port.
@@ -605,7 +606,7 @@ static void __ip_vs_ftp_exit(struct net *net)
 {
 	struct netns_ipvs *ipvs = net_ipvs(net);
 
-	if (!ipvs)
+	if (!ipvs || !exiting_module)
 		return;
 
 	unregister_ip_vs_app(ipvs, &ip_vs_ftp);
@@ -627,6 +628,7 @@ static int __init ip_vs_ftp_init(void)
  */
 static void __exit ip_vs_ftp_exit(void)
 {
+	exiting_module = true;
 	unregister_pernet_subsys(&ip_vs_ftp_ops);
 	/* rcu_barrier() is called by netns */
 }
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:29:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367269; cv=none; b=Ez3tim8Zrfc3whPNbQJZZ2Exhqa9sl7VWFae1dJxGBUbRrDaV+yiYQ0dHykmGww16iwo1Wgq/qJOAUoGW2kJxqVKuY6q7xVqaSWHyjC/5B2/hJF12uNITgovP5gvG77ChvLi1xOvJai4qzNw4U0jCCmIzN8qhzv9s7tqVL2yzyo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367269; c=relaxed/simple;
	bh=HucGJrqNmmajxGFkKAEkxSR/ilrNqP5UGSkxYHSGoaI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=EnLUf3aS3Sf/iu/C4rsORYh4/RoTN4nXc8xsgWypnQjt6dQCp0nRj3y2zH+3Fg/MQUmuk920gurhA0uI44sas7vKP8/iR4O8MKySlazLrwIUAPSpO8aIPC8khfB6xsUf8+9hoAELgnrtMJSlVM1CIN/WnMdr+ghi4vYh0Cye4OU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=c/OL1GST; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Anthony Iliopoulos <[email-masked]>,
	Benjamin Coddington <[email-masked]>,
	Anna Schumaker <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 150/196] NFSv4.1: fix backchannel max_resp_sz verification check
Date: Mon, 13 Oct 2025 16:45:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Anthony Iliopoulos <[email-masked]>

[ Upstream commit 191512355e520dfc45c8bc3b56d4de59c3ade33e ]

When the client max_resp_sz is larger than what the server encodes in
its reply, the nfs4_verify_back_channel_attrs() check fails and this
causes nfs4_proc_create_session() to fail, in cases where the client
page size is larger than that of the server and the server does not want
to negotiate upwards.

While this is not a problem with the linux nfs server that will reflect
the proposed value in its reply irrespective of the local page size,
other nfs server implementations may insist on their own max_resp_sz
value, which could be smaller.

Fix this by accepting smaller max_resp_sz values from the server, as
this does not violate the protocol. The server is allowed to decrease
but not increase proposed the size, and as such values smaller than the
client-proposed ones are valid.

Fixes: 43c2e885be25 ("nfs4: fix channel attribute sanity-checks")
Signed-off-by: Anthony Iliopoulos <[email-masked]>
Reviewed-by: Benjamin Coddington <[email-masked]>
Signed-off-by: Anna Schumaker <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/nfs/nfs4proc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index f8a91d15982dc..cbcff4603232b 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -9231,7 +9231,7 @@ static int nfs4_verify_back_channel_attrs(struct nfs41_create_session_args *args
 		goto out;
 	if (rcvd->max_rqst_sz > sent->max_rqst_sz)
 		return -EINVAL;
-	if (rcvd->max_resp_sz < sent->max_resp_sz)
+	if (rcvd->max_resp_sz > sent->max_resp_sz)
 		return -EINVAL;
 	if (rcvd->max_resp_sz_cached > sent->max_resp_sz_cached)
 		return -EINVAL;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:15:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367266; cv=none; b=CfVvynNmhiupMPVlj6SXe/SnLkk0M+OTaGQJnLwdeI5/Jib4MfceoioupgL6t+Wvu3Uqxr5RfMpGm9GOQxKpAhm+dLruouQyJFtys1LzPbgUs3f5c3D0UP/wQ+W15LPSXzMByRXqu1V37ZBbCPsXS6CnoAdPVTVCYkL7prIy4+c=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367266; c=relaxed/simple;
	bh=wz+rbvpanliI/udJNjTaftv1SgWFr1V94rpUHtL5aNo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=lwDGFCb9gZ2Q+hG5nD3bXN2MUcvek/LxC8J3VkElbys0k4LGPza/5UTj1IfY6AK/uhu0vtAie52ZFbEeok1g7Mr5or11IKSFW4KVBXz8Lof9EUpycKEfOsNbM3hxfSfrBXXJc3aNGH4g1PkLeZmEigIohWcZ/TqCFrE/ym7tAH8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IRyIlZSL; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Tamas Zsoldos <[email-masked]>,
	Leo Yan <[email-masked]>,
	James Clark <[email-masked]>,
	Suzuki K Poulose <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 149/196] coresight: trbe: Return NULL pointer for allocation failures
Date: Mon, 13 Oct 2025 16:45:22 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leo Yan <[email-masked]>

[ Upstream commit 8a55c161f7f9c1aa1c70611b39830d51c83ef36d ]

When the TRBE driver fails to allocate a buffer, it currently returns
the error code "-ENOMEM". However, the caller etm_setup_aux() only
checks for a NULL pointer, so it misses the error. As a result, the
driver continues and eventually causes a kernel panic.

Fix this by returning a NULL pointer from arm_trbe_alloc_buffer() on
allocation failures. This allows that the callers can properly handle
the failure.

Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
Reported-by: Tamas Zsoldos <[email-masked]>
Signed-off-by: Leo Yan <[email-masked]>
Reviewed-by: James Clark <[email-masked]>
Signed-off-by: Suzuki K Poulose <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-trbe.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
index bc6e247443e80..a584e5e83fb57 100644
--- a/drivers/hwtracing/coresight/coresight-trbe.c
+++ b/drivers/hwtracing/coresight/coresight-trbe.c
@@ -743,12 +743,12 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
 
 	buf = kzalloc_node(sizeof(*buf), GFP_KERNEL, trbe_alloc_node(event));
 	if (!buf)
-		return ERR_PTR(-ENOMEM);
+		return NULL;
 
 	pglist = kcalloc(nr_pages, sizeof(*pglist), GFP_KERNEL);
 	if (!pglist) {
 		kfree(buf);
-		return ERR_PTR(-ENOMEM);
+		return NULL;
 	}
 
 	for (i = 0; i < nr_pages; i++)
@@ -758,7 +758,7 @@ static void *arm_trbe_alloc_buffer(struct coresight_device *csdev,
 	if (!buf->trbe_base) {
 		kfree(pglist);
 		kfree(buf);
-		return ERR_PTR(-ENOMEM);
+		return NULL;
 	}
 	buf->trbe_limit = buf->trbe_base + nr_pages * PAGE_SIZE;
 	buf->trbe_write = buf->trbe_base;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:31:42 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367263; cv=none; b=VfbI0j/yMUWWmIK8dEx59HZoefEuGNJ8Z1a8zkfVuRYlSOOa4GUrBswu7bz/Mng+JkpqUQpMXkEwhC8ugRvQlNm03jM4bT6ZaYpPJ4L+sOWI0K1FYTRrUyYQvN1jK21VioPNXuBVsYN8f1M3Z5742yg4by/hM0ClZuRQx2LgEOg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367263; c=relaxed/simple;
	bh=NgKfNaBgMR+AWIy0tdQ7f6IgRzh18A4JfqXxRbI3zzc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bjyTXiNYHfK3E5nM//oznmjdDtIUc/VwJCwGjPLf708PsvnS1L0ssfDbNao5ThcxrumbmPJcBxq2dhhMCROIdsC39vWU+AC67nUmcEuBZQkejk+5s/1ITcTvnA9BHmZy1yl9hSL1RyFU5vyJpB/ENV6PYU6pwZ3jJde70REV/Qk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ZUW0QIYC; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yuanfang Zhang <[email-masked]>,
	James Clark <[email-masked]>,
	Mike Leach <[email-masked]>,
	Suzuki K Poulose <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 148/196] coresight-etm4x: Conditionally access register TRCEXTINSELR
Date: Mon, 13 Oct 2025 16:45:21 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yuanfang Zhang <[email-masked]>

[ Upstream commit dcdc42f5dcf9b9197c51246c62966e2d54a033d8 ]

The TRCEXTINSELR is only implemented if TRCIDR5.NUMEXTINSEL > 0.
To avoid invalid accesses, introduce a check on numextinsel
(derived from TRCIDR5[11:9]) before reading or writing to this register.

Fixes: f5bd523690d2 ("coresight: etm4x: Convert all register accesses")
Signed-off-by: Yuanfang Zhang <[email-masked]>
Reviewed-by: James Clark <[email-masked]>
Reviewed-by: Mike Leach <[email-masked]>
Signed-off-by: Suzuki K Poulose <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-etm4x-core.c | 11 ++++++++---
 drivers/hwtracing/coresight/coresight-etm4x.h      |  2 ++
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index 1ad689db74da1..d89153d0517ec 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -451,7 +451,8 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
 		etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR);
 		etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR);
 	}
-	etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
+	if (drvdata->numextinsel)
+		etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR);
 	for (i = 0; i < drvdata->nr_cntr; i++) {
 		etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i));
 		etm4x_relaxed_write32(csa, config->cntr_ctrl[i], TRCCNTCTLRn(i));
@@ -1239,6 +1240,7 @@ static void etm4_init_arch_data(void *info)
 	etmidr5 = etm4x_relaxed_read32(csa, TRCIDR5);
 	/* NUMEXTIN, bits[8:0] number of external inputs implemented */
 	drvdata->nr_ext_inp = FIELD_GET(TRCIDR5_NUMEXTIN_MASK, etmidr5);
+	drvdata->numextinsel = FIELD_GET(TRCIDR5_NUMEXTINSEL_MASK, etmidr5);
 	/* TRACEIDSIZE, bits[21:16] indicates the trace ID width */
 	drvdata->trcid_size = FIELD_GET(TRCIDR5_TRACEIDSIZE_MASK, etmidr5);
 	/* ATBTRIG, bit[22] implementation can support ATB triggers? */
@@ -1671,7 +1673,9 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata)
 		state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR);
 		state->trcseqstr = etm4x_read32(csa, TRCSEQSTR);
 	}
-	state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
+
+	if (drvdata->numextinsel)
+		state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
 
 	for (i = 0; i < drvdata->nr_cntr; i++) {
 		state->trccntrldvr[i] = etm4x_read32(csa, TRCCNTRLDVRn(i));
@@ -1803,7 +1807,8 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata)
 		etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR);
 		etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR);
 	}
-	etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
+	if (drvdata->numextinsel)
+		etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
 
 	for (i = 0; i < drvdata->nr_cntr; i++) {
 		etm4x_relaxed_write32(csa, state->trccntrldvr[i], TRCCNTRLDVRn(i));
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
index 31754173091b9..b183d1d12f129 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.h
+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
@@ -162,6 +162,7 @@
 #define TRCIDR4_NUMVMIDC_MASK			GENMASK(31, 28)
 
 #define TRCIDR5_NUMEXTIN_MASK			GENMASK(8, 0)
+#define TRCIDR5_NUMEXTINSEL_MASK               GENMASK(11, 9)
 #define TRCIDR5_TRACEIDSIZE_MASK		GENMASK(21, 16)
 #define TRCIDR5_ATBTRIG				BIT(22)
 #define TRCIDR5_LPOVERRIDE			BIT(23)
@@ -995,6 +996,7 @@ struct etmv4_drvdata {
 	u8				nr_cntr;
 	u8				nr_ext_inp;
 	u8				numcidc;
+	u8				numextinsel;
 	u8				numvmidc;
 	u8				nrseqstate;
 	u8				nr_event;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:20:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367260; cv=none; b=eGP7HYEXj4jTnNIzXXYaE5OMtekldZp3PunKH5MrllrmHi3SurqgRg6CnGsozYvjS81OQxyKZAbChPaNDrEWoYZdj/tMp6NyZYsyrG+ZsDyszJLAa0+z91/QJrgrjsfXuIsP0cmUGHA/63L95zLDQkxfLp7XRXCMHSFsOdEVXF4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367260; c=relaxed/simple;
	bh=L1IK29+S10OOcHhDWZwQJ5w9ICY2lZ8/DogndxN6PfU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=eA1a3d2QIv44sXkkKQATwf3VZhMqpguaMiCIeyLbg8YDbbYGv0oQFKerJ/Ajr5FlWbF4E968cXk3LxXGi/NYIXDBNEQY3vmu33cZ2PvyZgWbHaQoI0Rkjx30QU0rXsrzCnqUljU7PdryJs5Ek+znn2tLjhLKsYKJ97LLB+2qF8M=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=NTzyzsRN; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dmitry Baryshkov <[email-masked]>,
	Stephan Gerhold <[email-masked]>,
	Bjorn Andersson <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 147/196] remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
Date: Mon, 13 Oct 2025 16:45:20 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stephan Gerhold <[email-masked]>

[ Upstream commit 110be46f5afe27b66caa2d12473a84cd397b1925 ]

enable_irq() and disable_irq() are reference counted, so we must make sure
that each enable_irq() is always paired with a single disable_irq(). If we
call disable_irq() twice followed by just a single enable_irq(), the IRQ
will remain disabled forever.

For the error handling path in qcom_q6v5_wait_for_start(), disable_irq()
will end up being called twice, because disable_irq() also happens in
qcom_q6v5_unprepare() when rolling back the call to qcom_q6v5_prepare().

Fix this by dropping disable_irq() in qcom_q6v5_wait_for_start(). Since
qcom_q6v5_prepare() is the function that calls enable_irq(), it makes more
sense to have the rollback handled always by qcom_q6v5_unprepare().

Fixes: 3b415c8fb263 ("remoteproc: q6v5: Extract common resource handling")
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Stephan Gerhold <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Bjorn Andersson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/remoteproc/qcom_q6v5.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
index 497acfb33f8f8..6cce6dd9fd232 100644
--- a/drivers/remoteproc/qcom_q6v5.c
+++ b/drivers/remoteproc/qcom_q6v5.c
@@ -162,9 +162,6 @@ int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)
 	int ret;
 
 	ret = wait_for_completion_timeout(&q6v5->start_done, timeout);
-	if (!ret)
-		disable_irq(q6v5->handover_irq);
-
 	return !ret ? -ETIMEDOUT : 0;
 }
 EXPORT_SYMBOL_GPL(qcom_q6v5_wait_for_start);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:27:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367259; cv=none; b=FpZbu+zP7NmI0sJO+D0zbePnwHBQkaw9O23pD368f0ymEL3zbnYwYVjqnIbe4Wd6i14/eNbhICuzo8/vZ5fzQ7HDgoXWkZstcA5BX1QFZqOFaH4VwW70KuO6k9NXxrR9g5N3vkd+8ANUx0LTcoPTorFAtwSbo/2tjYMiY1ky2d0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367259; c=relaxed/simple;
	bh=sDG3BOs6IXiGqIqJMiq8ApyOT05qfFKp6roIi7uEJHI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=jLyX8WDkHZ50a20jAaw27vgZLSsFa6Wg6hhrzvDlls5quKrOQgdJZNMXUXbF0WlRuVdAVMWVAhplJjTKGjWscR5yPTlhFVXb88DibhVy+gKoW/w0FRF+bByukWtye7mdl9PXeehQ4nSKVS4cE/fwimmYk1PQd1PSduz9nceCiuQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zWbBlIh6; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Nagarjuna Kristam <[email-masked]>,
	Niklas Cassel <[email-masked]>,
	Manivannan Sadhasivam <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 146/196] PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert()
Date: Mon, 13 Oct 2025 16:45:19 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nagarjuna Kristam <[email-masked]>

[ Upstream commit 4f152338e384a3a47dd61909e1457539fa93f5a4 ]

During PERST# assertion tegra_pcie_bpmp_set_pll_state() is currently
called twice.

pex_ep_event_pex_rst_assert() should do the opposite of
pex_ep_event_pex_rst_deassert(), so it is obvious that the duplicate
tegra_pcie_bpmp_set_pll_state() is a mistake, and that the duplicate
tegra_pcie_bpmp_set_pll_state() call should instead be a call to
tegra_pcie_bpmp_set_ctrl_state().

With this, the uninitialization sequence also matches that of
tegra_pcie_unconfig_controller().

Fixes: a54e19073718 ("PCI: tegra194: Add Tegra234 PCIe support")
Signed-off-by: Nagarjuna Kristam <[email-masked]>
[cassel: improve commit log]
Signed-off-by: Niklas Cassel <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
[mani: added Fixes tag]
Signed-off-by: Manivannan Sadhasivam <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pci/controller/dwc/pcie-tegra194.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
index 0839454fe4994..5100d2a53b8ab 100644
--- a/drivers/pci/controller/dwc/pcie-tegra194.c
+++ b/drivers/pci/controller/dwc/pcie-tegra194.c
@@ -1720,9 +1720,9 @@ static void pex_ep_event_pex_rst_assert(struct tegra_pcie_dw *pcie)
 				ret);
 	}
 
-	ret = tegra_pcie_bpmp_set_pll_state(pcie, false);
+	ret = tegra_pcie_bpmp_set_ctrl_state(pcie, false);
 	if (ret)
-		dev_err(pcie->dev, "Failed to turn off UPHY: %d\n", ret);
+		dev_err(pcie->dev, "Failed to disable controller: %d\n", ret);
 
 	pcie->ep_state = EP_STATE_DISABLED;
 	dev_dbg(pcie->dev, "Uninitialization of endpoint is completed\n");
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:14:26 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367254; cv=none; b=V4BhV4DIc7FY3mCUgn83AI3xKcHLOxwVnVLAIr9mujuCkytrXe4T/RwoQmgtHX3QTjTvDGSSoR0Z8HflxcDpt/Omf+fI+TP842rniTQYeydbDfyAHfw84OydR1eSD4R2N+n4hix0cHJK94uHENH54IEsTUhA4/BzKX41Y0vXfMk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367254; c=relaxed/simple;
	bh=mmHbqoN7rHPvbpal5WqRsNZ0OMT142yLSjcfx1K6QlA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=nvWTtDtukroJkSvB7UxsSqS1sixUQ4u/NKkf8ki1PWfaRrikp0pSyal4KD58AdYqQya1hWSjIjgkTZgZx9dNprvnBI0KHBi9sTcHmCQ7baMB90OiQfkUZqTyk0MZ+CMx3EuFlDFx1AcdFbSdhKOHgBjXOl8lzF7hL86VWhUoYok=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xkLFV93Q; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Fedor Pchelkin <[email-masked]>,
	Ping-Ke Shih <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 145/196] wifi: rtw89: avoid circular locking dependency in ser_state_run()
Date: Mon, 13 Oct 2025 16:45:18 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Fedor Pchelkin <[email-masked]>

[ Upstream commit 570f94511766f9236d3462dfb8a3c719c2b54c23 ]

Lockdep gives a splat [1] when ser_hdl_work item is executed.  It is
scheduled at mac80211 workqueue via ieee80211_queue_work() and takes a
wiphy lock inside.  However, this workqueue can be flushed when e.g.
closing the interface and wiphy lock is already taken in that case.

Choosing wiphy_work_queue() for SER is likely not suitable.  Back on to
the global workqueue.

[1]:

 WARNING: possible circular locking dependency detected
 6.17.0-rc2 #17 Not tainted
 ------------------------------------------------------
 kworker/u32:1/61 is trying to acquire lock:
 ffff88811bc00768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ser_state_run+0x5e/0x180 [rtw89_core]

 but task is already holding lock:
 ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -> #2 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}:
        process_one_work+0x7c6/0x1450
        worker_thread+0x49e/0xd00
        kthread+0x313/0x640
        ret_from_fork+0x221/0x300
        ret_from_fork_asm+0x1a/0x30

 -> #1 ((wq_completion)phy0){+.+.}-{0:0}:
        touch_wq_lockdep_map+0x8e/0x180
        __flush_workqueue+0x129/0x10d0
        ieee80211_stop_device+0xa8/0x110
        ieee80211_do_stop+0x14ce/0x2880
        ieee80211_stop+0x13a/0x2c0
        __dev_close_many+0x18f/0x510
        __dev_change_flags+0x25f/0x670
        netif_change_flags+0x7b/0x160
        do_setlink.isra.0+0x1640/0x35d0
        rtnl_newlink+0xd8c/0x1d30
        rtnetlink_rcv_msg+0x700/0xb80
        netlink_rcv_skb+0x11d/0x350
        netlink_unicast+0x49a/0x7a0
        netlink_sendmsg+0x759/0xc20
        ____sys_sendmsg+0x812/0xa00
        ___sys_sendmsg+0xf7/0x180
        __sys_sendmsg+0x11f/0x1b0
        do_syscall_64+0xbb/0x360
        entry_SYSCALL_64_after_hwframe+0x77/0x7f

 -> #0 (&rdev->wiphy.mtx){+.+.}-{4:4}:
        __lock_acquire+0x124c/0x1d20
        lock_acquire+0x154/0x2e0
        __mutex_lock+0x17b/0x12f0
        ser_state_run+0x5e/0x180 [rtw89_core]
        rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
        process_one_work+0x82d/0x1450
        worker_thread+0x49e/0xd00
        kthread+0x313/0x640
        ret_from_fork+0x221/0x300
        ret_from_fork_asm+0x1a/0x30

 other info that might help us debug this:

 Chain exists of:
   &rdev->wiphy.mtx --> (wq_completion)phy0 --> (work_completion)(&ser->ser_hdl_work)

  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock((work_completion)(&ser->ser_hdl_work));
                                lock((wq_completion)phy0);
                                lock((work_completion)(&ser->ser_hdl_work));
   lock(&rdev->wiphy.mtx);

  *** DEADLOCK ***

 2 locks held by kworker/u32:1/61:
  #0: ffff888103835148 ((wq_completion)phy0){+.+.}-{0:0}, at: process_one_work+0xefa/0x1450
  #1: ffffc9000048fd30 ((work_completion)(&ser->ser_hdl_work)){+.+.}-{0:0}, at: process_one_work+0x7b5/0x1450

 stack backtrace:
 CPU: 0 UID: 0 PID: 61 Comm: kworker/u32:1 Not tainted 6.17.0-rc2 #17 PREEMPT(voluntary)
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS edk2-20250523-14.fc42 05/23/2025
 Workqueue: phy0 rtw89_ser_hdl_work [rtw89_core]
 Call Trace:
  <TASK>
  dump_stack_lvl+0x5d/0x80
  print_circular_bug.cold+0x178/0x1be
  check_noncircular+0x14c/0x170
  __lock_acquire+0x124c/0x1d20
  lock_acquire+0x154/0x2e0
  __mutex_lock+0x17b/0x12f0
  ser_state_run+0x5e/0x180 [rtw89_core]
  rtw89_ser_hdl_work+0x119/0x220 [rtw89_core]
  process_one_work+0x82d/0x1450
  worker_thread+0x49e/0xd00
  kthread+0x313/0x640
  ret_from_fork+0x221/0x300
  ret_from_fork_asm+0x1a/0x30
  </TASK>

Found by Linux Verification Center (linuxtesting.org).

Fixes: ebfc9199df05 ("wifi: rtw89: add wiphy_lock() to work that isn't held wiphy_lock() yet")
Signed-off-by: Fedor Pchelkin <[email-masked]>
Acked-by: Ping-Ke Shih <[email-masked]>
Signed-off-by: Ping-Ke Shih <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/realtek/rtw89/ser.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c
index f5dacdc4d11ab..24a9025e5bea8 100644
--- a/drivers/net/wireless/realtek/rtw89/ser.c
+++ b/drivers/net/wireless/realtek/rtw89/ser.c
@@ -204,7 +204,6 @@ static void rtw89_ser_hdl_work(struct work_struct *work)
 
 static int ser_send_msg(struct rtw89_ser *ser, u8 event)
 {
-	struct rtw89_dev *rtwdev = container_of(ser, struct rtw89_dev, ser);
 	struct ser_msg *msg = NULL;
 
 	if (test_bit(RTW89_SER_DRV_STOP_RUN, ser->flags))
@@ -220,7 +219,7 @@ static int ser_send_msg(struct rtw89_ser *ser, u8 event)
 	list_add(&msg->list, &ser->msg_q);
 	spin_unlock_irq(&ser->msg_q_lock);
 
-	ieee80211_queue_work(rtwdev->hw, &ser->ser_hdl_work);
+	schedule_work(&ser->ser_hdl_work);
 	return 0;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:18:34 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367252; cv=none; b=iWAvghD+ABYQfdalDEyZ1J9dNBtYxV5PV4E3/6dznJZYaSgDUuGelkK8ZgdiZ3h3WcPPT8NCyrlUrAHRooBTWx3mpioWDVseLEzF+R84r7OgTcF+DQ2q7+Vr6J5p9YVuIvRzu7lQRfU7zrirMNdFT3y20ZYKp5tPwzamNUoFKfc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367252; c=relaxed/simple;
	bh=b3X0uHSg21ZW2VUFc3VLSjsDPljx1AGJ51fsvjHisy0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=qNzHEERn7I5N5K60mXFSq+hwoEPqPaQTi+59JwwU5U6Aj/7TvJA4jYD461m6oVIFxqHtwQc8OEmkptL0v73GhV3y2RaPOz4Hxp9Lvac8C1VL48GfyeH9YWScPfxV6mSBtYJIRx+X/kjoxlSH0H4EeDmN5Hl7bmXBWOja9HLZiZE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=wSBh7ATP; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chenghai Huang <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 144/196] crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs
Date: Mon, 13 Oct 2025 16:45:17 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chenghai Huang <[email-masked]>

[ Upstream commit f0cafb02de883b3b413d34eb079c9680782a9cc1 ]

When the initialization of qm->debug.acc_diff_reg fails,
the probe process does not exit. However, after qm->debug.qm_diff_regs is
freed, it is not set to NULL. This can lead to a double free when the
remove process attempts to free it again. Therefore, qm->debug.qm_diff_regs
should be set to NULL after it is freed.

Fixes: 8be091338971 ("crypto: hisilicon/debugfs - Fix debugfs uninit process issue")
Signed-off-by: Chenghai Huang <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/crypto/hisilicon/debugfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/crypto/hisilicon/debugfs.c b/drivers/crypto/hisilicon/debugfs.c
index a1d41ee39816b..cb27a44671ca1 100644
--- a/drivers/crypto/hisilicon/debugfs.c
+++ b/drivers/crypto/hisilicon/debugfs.c
@@ -815,6 +815,7 @@ static int qm_diff_regs_init(struct hisi_qm *qm,
 		dfx_regs_uninit(qm, qm->debug.qm_diff_regs, ARRAY_SIZE(qm_diff_regs));
 		ret = PTR_ERR(qm->debug.acc_diff_regs);
 		qm->debug.acc_diff_regs = NULL;
+		qm->debug.qm_diff_regs = NULL;
 		return ret;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:18:19 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367249; cv=none; b=MwHXAEKxsuqfm9IwBT7FNGndnT8PXaOVrRZkyjOx9zAl1jGMqNFYOioIcy3qiA9yaRIxHGccvMksZ47Ui12/2c8BrEtuQFfSxh5WKEZ6Ng7Ry+48S+L2l26ldcIlwC96hsMjcuvqKXE9bmNTI4qDn1rYn6NUcQI6DgRQ15BfdpU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367249; c=relaxed/simple;
	bh=/stDWgmJ6Qj6YWtEHZMRs+e3VQKqmysqkjtEC8tctVI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=THp74IA5BB0TXichLozZj3kljbrFrd1uggyH19mIP7Ua52kvgh/aaI9TagBwryQjY24XPQQqd/ayWus30cb3geq8IzUVM6ERrnL40/8yM9/4ccNxzsIYt7oN2ZvuC8vfgAt5XnPH4CuqNeDTbZCjh6a0y6MbpBGkO+iwfsL5QKg=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=t2musyeT; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michael Karcher <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Sasha Levin <[email-masked]>,
	John Paul Adrian Glaubitz <[email-masked]>,
	Tony Rodriguez <[email-masked]>
Subject: [PATCH 6.1 143/196] sparc: fix accurate exception reporting in copy_{from,to}_user for M7
Date: Mon, 13 Oct 2025 16:45:16 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Karcher <[email-masked]>

[ Upstream commit 936fb512752af349fc30ccbe0afe14a2ae6d7159 ]

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a couple of bad
calculations. This will fix the return value of copy_from_user and
copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.

Fixes: 34060b8fffa7 ("arch/sparc: Add accurate exception reporting in M7memcpy")
Tested-by: John Paul Adrian Glaubitz <[email-masked]> # on Oracle SPARC S7
Tested-by: Tony Rodriguez <[email-masked]> # S7, see https://lore.kernel.org/r/[email-masked]
Signed-off-by: Michael Karcher <[email-masked]>
Reviewed-by: Andreas Larsson <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Andreas Larsson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/sparc/lib/M7memcpy.S     | 20 ++++++++++----------
 arch/sparc/lib/Memcpy_utils.S |  9 +++++++++
 2 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/arch/sparc/lib/M7memcpy.S b/arch/sparc/lib/M7memcpy.S
index cbd42ea7c3f7c..99357bfa8e82a 100644
--- a/arch/sparc/lib/M7memcpy.S
+++ b/arch/sparc/lib/M7memcpy.S
@@ -696,16 +696,16 @@ FUNC_NAME:
 	EX_LD_FP(LOAD(ldd, %o4+40, %f26), memcpy_retl_o2_plus_o5_plus_40)
 	faligndata %f24, %f26, %f10
 	EX_ST_FP(STORE(std, %f6, %o0+24), memcpy_retl_o2_plus_o5_plus_40)
-	EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_40)
+	EX_LD_FP(LOAD(ldd, %o4+48, %f28), memcpy_retl_o2_plus_o5_plus_32)
 	faligndata %f26, %f28, %f12
-	EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_40)
+	EX_ST_FP(STORE(std, %f8, %o0+32), memcpy_retl_o2_plus_o5_plus_32)
 	add	%o4, 64, %o4
-	EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_40)
+	EX_LD_FP(LOAD(ldd, %o4-8, %f30), memcpy_retl_o2_plus_o5_plus_24)
 	faligndata %f28, %f30, %f14
-	EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_40)
-	EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_40)
+	EX_ST_FP(STORE(std, %f10, %o0+40), memcpy_retl_o2_plus_o5_plus_24)
+	EX_ST_FP(STORE(std, %f12, %o0+48), memcpy_retl_o2_plus_o5_plus_16)
 	add	%o0, 64, %o0
-	EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_40)
+	EX_ST_FP(STORE(std, %f14, %o0-8), memcpy_retl_o2_plus_o5_plus_8)
 	fsrc2	%f30, %f14
 	bgu,pt	%xcc, .Lunalign_sloop
 	 prefetch [%o4 + (8 * BLOCK_SIZE)], 20
@@ -728,7 +728,7 @@ FUNC_NAME:
 	add	%o4, 8, %o4
 	faligndata %f0, %f2, %f16
 	subcc	%o5, 8, %o5
-	EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5)
+	EX_ST_FP(STORE(std, %f16, %o0), memcpy_retl_o2_plus_o5_plus_8)
 	fsrc2	%f2, %f0
 	bgu,pt	%xcc, .Lunalign_by8
 	 add	%o0, 8, %o0
@@ -772,7 +772,7 @@ FUNC_NAME:
 	subcc	%o5, 0x20, %o5
 	EX_ST(STORE(stx, %o3, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
 	EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
-	EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
+	EX_ST(STORE(stx, %g7, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
 	EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
 	bne,pt	%xcc, 1b
 	 add	%o0, 0x20, %o0
@@ -804,12 +804,12 @@ FUNC_NAME:
 	brz,pt	%o3, 2f
 	 sub	%o2, %o3, %o2
 
-1:	EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_g1)
+1:	EX_LD(LOAD(ldub, %o1 + 0x00, %g2), memcpy_retl_o2_plus_o3)
 	add	%o1, 1, %o1
 	subcc	%o3, 1, %o3
 	add	%o0, 1, %o0
 	bne,pt	%xcc, 1b
-	 EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_g1_plus_1)
+	 EX_ST(STORE(stb, %g2, %o0 - 0x01), memcpy_retl_o2_plus_o3_plus_1)
 2:
 	and	%o1, 0x7, %o3
 	brz,pn	%o3, .Lmedium_noprefetch_cp
diff --git a/arch/sparc/lib/Memcpy_utils.S b/arch/sparc/lib/Memcpy_utils.S
index 64fbac28b3db1..207343367bb2d 100644
--- a/arch/sparc/lib/Memcpy_utils.S
+++ b/arch/sparc/lib/Memcpy_utils.S
@@ -137,6 +137,15 @@ ENTRY(memcpy_retl_o2_plus_63_8)
 	ba,pt	%xcc, __restore_asi
 	 add	%o2, 8, %o0
 ENDPROC(memcpy_retl_o2_plus_63_8)
+ENTRY(memcpy_retl_o2_plus_o3)
+	ba,pt	%xcc, __restore_asi
+	 add	%o2, %o3, %o0
+ENDPROC(memcpy_retl_o2_plus_o3)
+ENTRY(memcpy_retl_o2_plus_o3_plus_1)
+	add	%o3, 1, %o3
+	ba,pt	%xcc, __restore_asi
+	 add	%o2, %o3, %o0
+ENDPROC(memcpy_retl_o2_plus_o3_plus_1)
 ENTRY(memcpy_retl_o2_plus_o5)
 	ba,pt	%xcc, __restore_asi
 	 add	%o2, %o5, %o0
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:35:38 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367246; cv=none; b=edvLRywvMN5ugi63gwuxIyX+4PYBrooCvkIw2avKfT2dsBADQKvzn3AoCPHYgU3kjmjnAQAam0M8wItDmfQNFEIEP1FGro4l08F3X5WBGs+reznNacSHFShXvm5lcI+Bv+riu5UqXpINVDc8460ZTBzwiwbK1n3DXhsud+pQoww=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367246; c=relaxed/simple;
	bh=kVADdgyoxBtsiO1zp2+75yla5n9Qc5VwdIjzBoVffFc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=MSEfRy84JA48iR0JF3GG08GoWQJyMI5ndMY8sFIpG16eBeEs768+EDmg8cSzWIXUbrrnqp4hh7xCkr++9Swqav5SnwMlxz1FKvQDddV+JHFWTPcTV7iTH9lYi4aV8M0xuX7pbrqAaoakNfd6Dx0RXxRJrOqYYuzfyIG2Q4zEus4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=exjtRQbB; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michael Karcher <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Sasha Levin <[email-masked]>,
	John Paul Adrian Glaubitz <[email-masked]>
Subject: [PATCH 6.1 142/196] sparc: fix accurate exception reporting in copy_to_user for Niagara 4
Date: Mon, 13 Oct 2025 16:45:15 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Karcher <[email-masked]>

[ Upstream commit 5a746c1a2c7980de6c888b6373299f751ad7790b ]

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a bad calculation.
This will fix the return value of copy_to_user in a specific faulting case.
The behaviour of memcpy stays unchanged.

Fixes: 957077048009 ("sparc64: Convert NG4copy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <[email-masked]> # on Oracle SPARC T4-1
Signed-off-by: Michael Karcher <[email-masked]>
Reviewed-by: Andreas Larsson <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Andreas Larsson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/sparc/lib/NG4memcpy.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
index 7ad58ebe0d009..df0ec1bd19489 100644
--- a/arch/sparc/lib/NG4memcpy.S
+++ b/arch/sparc/lib/NG4memcpy.S
@@ -281,7 +281,7 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 	subcc		%o5, 0x20, %o5
 	EX_ST(STORE(stx, %g1, %o0 + 0x00), memcpy_retl_o2_plus_o5_plus_32)
 	EX_ST(STORE(stx, %g2, %o0 + 0x08), memcpy_retl_o2_plus_o5_plus_24)
-	EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_24)
+	EX_ST(STORE(stx, GLOBAL_SPARE, %o0 + 0x10), memcpy_retl_o2_plus_o5_plus_16)
 	EX_ST(STORE(stx, %o4, %o0 + 0x18), memcpy_retl_o2_plus_o5_plus_8)
 	bne,pt		%icc, 1b
 	 add		%o0, 0x20, %o0
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:19:27 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367243; cv=none; b=DwlX2q7bPmgmeghmDmGRJ5KXaze6kbzmhiaSZvoX3Zqi7pX6D0rkQaSNRN8S896GciGs1CvAQMxufJvCoVHYrLFIsfhG0e7LP9N8Lrm0iZug8JFwsxrfUSNg/0vjjuIZMaVUoeod47Y7CVlF6UYJjJRk48SL38kuT6fKqUHq2lA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367243; c=relaxed/simple;
	bh=u0LYykkE2auTIeMHz16O2a4NAIEkzM5afEg4s+0cgyE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=MXtM6xPKkx5qXdtJ2AvIy7C7HsFmO+heYzTWt1oeKXE662vXyCo5SjDVCaT558hFy+rmSO19/Zty60PGWVM/WEGvgtYhrVA0pR683QYlLLHxmU/MHfgIN+Q8LqerDRIpdMBhBj1JvQXneqEIhGT0IwufR0VCAQ5IvJAdL3xkaLU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xgXiO5e4; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michael Karcher <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Sasha Levin <[email-masked]>,
	John Paul Adrian Glaubitz <[email-masked]>,
	Magnus Lindholm <[email-masked]>,
	Ethan Hawke <[email-masked]>,
	Ken Link <[email-masked]>
Subject: [PATCH 6.1 141/196] sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
Date: Mon, 13 Oct 2025 16:45:14 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Karcher <[email-masked]>

[ Upstream commit 0b67c8fc10b13a9090340c5f8a37d308f4e1571c ]

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a couple of bad
calculations and a broken epilogue in the exception handlers. This will
prevent crashes and ensure correct return values of copy_from_user and
copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.

Fixes: 7ae3aaf53f16 ("sparc64: Convert NGcopy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <[email-masked]> # on SPARC T4 with modified kernel to use Niagara 1 code
Tested-by: Magnus Lindholm <[email-masked]> # on Sun Fire T2000
Signed-off-by: Michael Karcher <[email-masked]>
Tested-by: Ethan Hawke <[email-masked]> # on Sun Fire T2000
Tested-by: Ken Link <[email-masked]> # on Sun Fire T1000
Reviewed-by: Andreas Larsson <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Andreas Larsson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/sparc/lib/NGmemcpy.S | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
index ee51c12306894..bbd3ea0a64822 100644
--- a/arch/sparc/lib/NGmemcpy.S
+++ b/arch/sparc/lib/NGmemcpy.S
@@ -79,8 +79,8 @@
 #ifndef EX_RETVAL
 #define EX_RETVAL(x)	x
 __restore_asi:
-	ret
 	wr	%g0, ASI_AIUS, %asi
+	ret
 	 restore
 ENTRY(NG_ret_i2_plus_i4_plus_1)
 	ba,pt	%xcc, __restore_asi
@@ -125,15 +125,16 @@ ENTRY(NG_ret_i2_plus_g1_minus_56)
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, %g1, %i0
 ENDPROC(NG_ret_i2_plus_g1_minus_56)
-ENTRY(NG_ret_i2_plus_i4)
+ENTRY(NG_ret_i2_plus_i4_plus_16)
+        add     %i4, 16, %i4
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, %i4, %i0
-ENDPROC(NG_ret_i2_plus_i4)
-ENTRY(NG_ret_i2_plus_i4_minus_8)
-	sub	%i4, 8, %i4
+ENDPROC(NG_ret_i2_plus_i4_plus_16)
+ENTRY(NG_ret_i2_plus_i4_plus_8)
+	add	%i4, 8, %i4
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, %i4, %i0
-ENDPROC(NG_ret_i2_plus_i4_minus_8)
+ENDPROC(NG_ret_i2_plus_i4_plus_8)
 ENTRY(NG_ret_i2_plus_8)
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, 8, %i0
@@ -160,6 +161,12 @@ ENTRY(NG_ret_i2_and_7_plus_i4)
 	ba,pt	%xcc, __restore_asi
 	 add	%i2, %i4, %i0
 ENDPROC(NG_ret_i2_and_7_plus_i4)
+ENTRY(NG_ret_i2_and_7_plus_i4_plus_8)
+	and	%i2, 7, %i2
+	add	%i4, 8, %i4
+	ba,pt	%xcc, __restore_asi
+	 add	%i2, %i4, %i0
+ENDPROC(NG_ret_i2_and_7_plus_i4)
 #endif
 
 	.align		64
@@ -405,13 +412,13 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
 	andn		%i2, 0xf, %i4
 	and		%i2, 0xf, %i2
 1:	subcc		%i4, 0x10, %i4
-	EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4)
+	EX_LD(LOAD(ldx, %i1, %o4), NG_ret_i2_plus_i4_plus_16)
 	add		%i1, 0x08, %i1
-	EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4)
+	EX_LD(LOAD(ldx, %i1, %g1), NG_ret_i2_plus_i4_plus_16)
 	sub		%i1, 0x08, %i1
-	EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4)
+	EX_ST(STORE(stx, %o4, %i1 + %i3), NG_ret_i2_plus_i4_plus_16)
 	add		%i1, 0x8, %i1
-	EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_minus_8)
+	EX_ST(STORE(stx, %g1, %i1 + %i3), NG_ret_i2_plus_i4_plus_8)
 	bgu,pt		%XCC, 1b
 	 add		%i1, 0x8, %i1
 73:	andcc		%i2, 0x8, %g0
@@ -468,7 +475,7 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
 	subcc		%i4, 0x8, %i4
 	srlx		%g3, %i3, %i5
 	or		%i5, %g2, %i5
-	EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4)
+	EX_ST(STORE(stx, %i5, %o0), NG_ret_i2_and_7_plus_i4_plus_8)
 	add		%o0, 0x8, %o0
 	bgu,pt		%icc, 1b
 	 sllx		%g3, %g1, %g2
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:34:34 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367237; cv=none; b=YUlcE1zhyk1x2gVapcgZmvdpQtWQBe0JhdT5BLzbefIVCW+TwMfbhwVzZxauWboAT3aZAu6elDnHnpXNvYIoSQuLXq6TZ5R/1kOQPG/JW6BeVO00CDOuUHu4MuPbaWUggrUQCPPxVRR7tv0y5Z9SYIn8JBydFVKfszWluGHwFac=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367237; c=relaxed/simple;
	bh=SpQoJY4qBgx2CaqXdBXY8rgT8/c9Jq4hUz8EcL5jNjA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=kpIwbKK8ogqy1mZ6cxZaWb5YxoIorAjgxsRQ3Fu36Wkf7IPhCHAPTBV8ApDfxfEwENfEseF9Wn/dKzOZOVCimmoYjmJsoQUZgk+E7MRI/N67A5SKUfx7ilPHHpJ20+V/0TVoKNbhkg6jN/8Ozk4FfVrfEPsGu1UWkYLzgp8Pu2g=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0cNdi+HZ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Anthony Yznaga <[email-masked]>,
	Michael Karcher <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Sasha Levin <[email-masked]>,
	John Paul Adrian Glaubitz <[email-masked]>,
	=?UTF-8?q?Ren=C3=A9=20Rebe?= <[email-masked]>
Subject: [PATCH 6.1 140/196] sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
Date: Mon, 13 Oct 2025 16:45:13 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Karcher <[email-masked]>

[ Upstream commit 47b49c06eb62504075f0f2e2227aee2e2c2a58b3 ]

Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios
enabled resulted from copy_from_user() returning impossibly large values
greater than the size to be copied. This lead to __copy_from_iter()
returning impossible values instead of the actual number of bytes it was
able to copy.

The BUG_ON has been reported in
https://lore.kernel.org/r/[email-masked]

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. The exception handlers expect that
%o2 has already been masked during the bulk copy loop, but the masking was
performed after that loop. This will fix the return value of copy_from_user
and copy_to_user in the faulting case. The behaviour of memcpy stays
unchanged.

Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <[email-masked]> # on Sun Netra 240
Reviewed-by: Anthony Yznaga <[email-masked]>
Tested-by: René Rebe <[email-masked]> # on UltraSparc III+ and UltraSparc IIIi
Signed-off-by: Michael Karcher <[email-masked]>
Reviewed-by: Andreas Larsson <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Andreas Larsson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/sparc/lib/U3memcpy.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
index 9248d59c734ce..bace3a18f836f 100644
--- a/arch/sparc/lib/U3memcpy.S
+++ b/arch/sparc/lib/U3memcpy.S
@@ -267,6 +267,7 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 	faligndata	%f10, %f12, %f26
 	EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2)
 
+	and		%o2, 0x3f, %o2
 	subcc		GLOBAL_SPARE, 0x80, GLOBAL_SPARE
 	add		%o1, 0x40, %o1
 	bgu,pt		%XCC, 1f
@@ -336,7 +337,6 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
 	 * Also notice how this code is careful not to perform a
 	 * load past the end of the src buffer.
 	 */
-	and		%o2, 0x3f, %o2
 	andcc		%o2, 0x38, %g2
 	be,pn		%XCC, 2f
 	 subcc		%g2, 0x8, %g2
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:25:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367234; cv=none; b=WkX31bOWsZVCjVPfArg8nt91N/la+FbKiuRaRmGTxlP+vEUf4H1JcRL1i0dfC7R8NAopfB0l57TiYU8Eb0VgWuE99EG90rswUq2v0PMlxosKdvh0j7kNkzQAyP5ZCSNdODE0mqboPiHfnX3Pnbu1lcLYeAcTnRoc7kWY6JmBqPI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367234; c=relaxed/simple;
	bh=nwkov1einR6KCzuS54eq1MF9YZTlSfmQoywfyfJ+mFM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=iF5SRuKk2F2fdSECcdhFkPL+WqGpGnoW/oSPsoXldAtcp3ZgdGHm4V2Gc5kCzil7mRvecmX0AmxQPcQ16zuhtAnCawoOEQAijnoiKXHwWjW9+fk0ZR60jJ1iboE8dcDINWHt7TxskZpIxYyfsOo1+KUQWOGjCXwSZIwt6gTf3bA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XnQkVw1C; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michael Karcher <[email-masked]>,
	Andreas Larsson <[email-masked]>,
	Sasha Levin <[email-masked]>,
	John Paul Adrian Glaubitz <[email-masked]>,
	=?UTF-8?q?Ren=C3=A9=20Rebe?= <[email-masked]>,
	Jonathan 'theJPster' Pallant <[email-masked]>
Subject: [PATCH 6.1 139/196] sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
Date: Mon, 13 Oct 2025 16:45:12 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Karcher <[email-masked]>

[ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ]

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. This commit fixes a couple of bad
calculations. This will fix the return value of copy_from_user and
copy_to_user in the faulting case. The behaviour of memcpy stays unchanged.

Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <[email-masked]> # on QEMU 10.0.3
Tested-by: René Rebe <[email-masked]> # on Ultra 5 UltraSparc IIi
Tested-by: Jonathan 'theJPster' Pallant <[email-masked]> # on Sun Netra T1
Signed-off-by: Michael Karcher <[email-masked]>
Reviewed-by: Andreas Larsson <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Andreas Larsson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/sparc/lib/U1memcpy.S | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S
index a6f4ee3918977..021b94a383d13 100644
--- a/arch/sparc/lib/U1memcpy.S
+++ b/arch/sparc/lib/U1memcpy.S
@@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp)
 	retl
 	 add		%o0, %o2, %o0
 ENDPROC(U1_gs_40_fp)
-ENTRY(U1_g3_0_fp)
-	VISExitHalf
-	retl
-	 add		%g3, %o2, %o0
-ENDPROC(U1_g3_0_fp)
 ENTRY(U1_g3_8_fp)
 	VISExitHalf
 	add		%g3, 8, %g3
 	retl
 	 add		%g3, %o2, %o0
 ENDPROC(U1_g3_8_fp)
+ENTRY(U1_g3_16_fp)
+	VISExitHalf
+	add		%g3, 16, %g3
+	retl
+	 add		%g3, %o2, %o0
+ENDPROC(U1_g3_16_fp)
 ENTRY(U1_o2_0_fp)
 	VISExitHalf
 	retl
@@ -547,18 +548,18 @@ FUNC_NAME:		/* %o0=dst, %o1=src, %o2=len */
 62:	FINISH_VISCHUNK(o0, f44, f46)
 63:	UNEVEN_VISCHUNK_LAST(o0, f46, f0)
 
-93:	EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp)
+93:	EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp)
 	add		%o1, 8, %o1
 	subcc		%g3, 8, %g3
 	faligndata	%f0, %f2, %f8
-	EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
+	EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
 	bl,pn		%xcc, 95f
 	 add		%o0, 8, %o0
-	EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp)
+	EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp)
 	add		%o1, 8, %o1
 	subcc		%g3, 8, %g3
 	faligndata	%f2, %f0, %f8
-	EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp)
+	EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp)
 	bge,pt		%xcc, 93b
 	 add		%o0, 8, %o0
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:08:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367231; cv=none; b=CGlV9WBQHdo5IHdn+rhhtKdSSnoGSJgvhIL6zK+FvSMYLFH3aZ0ij3Gn6bwJrnmjnukf5NU4GyVvwFqqYphu1HzwaUSQQWuBAjLdQuigQ6QzBM9tAhywF+f0+hJeGAzGjRHbp6rjGTMSzlNI5T8pcqdfnPOhb9HUgsv+5W7zGdw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367231; c=relaxed/simple;
	bh=KdYrs9I4QF1W/PE8R8fEhyWPlR//YoO9FkHUgjDtUu8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bokM+bVzo/xVuxkG3Huee0YCsu59VG+84U7TUvKTCYgFQS58k+XdvH1tAPjgnwNfSYVNjzFmbHM9RXkJo4OmfL7/ySpYK+aNCWXQTz+eNpOR7LRzLG7Kh3LJbFE0e++GWXM+8QT6EcQQQu1i69lwH0vVWi0HA1ordRDVa1GYUTc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Et58Biae; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Vasanthakumar Thiagarajan <[email-masked]>,
	Aditya Kumar Singh <[email-masked]>,
	Johannes Berg <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 138/196] wifi: mac80211: fix Rx packet handling when pubsta information is not available
Date: Mon, 13 Oct 2025 16:45:11 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Aditya Kumar Singh <[email-masked]>

[ Upstream commit 32d340ae675800672e1219444a17940a8efe5cca ]

In ieee80211_rx_handle_packet(), if the caller does not provide pubsta
information, an attempt is made to find the station using the address 2
(source address) field in the header. Since pubsta is missing, link
information such as link_valid and link_id is also unavailable. Now if such
a situation comes, and if a matching ML station entry is found based on
the source address, currently the packet is dropped due to missing link ID
in the status field which is not correct.

Hence, to fix this issue, if link_valid is not set and the station is an
ML station, make an attempt to find a link station entry using the source
address. If a valid link station is found, derive the link ID and proceed
with packet processing. Otherwise, drop the packet as per the existing
flow.

Fixes: ea9d807b5642 ("wifi: mac80211: add link information in ieee80211_rx_status")
Suggested-by: Vasanthakumar Thiagarajan <[email-masked]>
Signed-off-by: Aditya Kumar Singh <[email-masked]>
Link: https://patch.msgid.link/2025[email-masked]
Signed-off-by: Johannes Berg <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/mac80211/rx.c | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 8c9267acb227b..776f9fcf05abe 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -5106,12 +5106,20 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 			}
 
 			rx.sdata = prev_sta->sdata;
+			if (!status->link_valid && prev_sta->sta.mlo) {
+				struct link_sta_info *link_sta;
+
+				link_sta = link_sta_info_get_bss(rx.sdata,
+								 hdr->addr2);
+				if (!link_sta)
+					continue;
+
+				link_id = link_sta->link_id;
+			}
+
 			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
 				goto out;
 
-			if (!status->link_valid && prev_sta->sta.mlo)
-				continue;
-
 			ieee80211_prepare_and_rx_handle(&rx, skb, false);
 
 			prev_sta = sta;
@@ -5119,10 +5127,18 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 
 		if (prev_sta) {
 			rx.sdata = prev_sta->sdata;
-			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
-				goto out;
+			if (!status->link_valid && prev_sta->sta.mlo) {
+				struct link_sta_info *link_sta;
+
+				link_sta = link_sta_info_get_bss(rx.sdata,
+								 hdr->addr2);
+				if (!link_sta)
+					goto out;
 
-			if (!status->link_valid && prev_sta->sta.mlo)
+				link_id = link_sta->link_id;
+			}
+
+			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
 				goto out;
 
 			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:07:44 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367227; cv=none; b=cavNaJ/mWPxf+WqI5ebg9wvlNX3kCk1PFDKlv3vf7aB7JhmoUDvYp3V3kbIqQMId2TqHT3Vx0aOy/OMlJ+6pXUPMc+2zdD01GQICWO2fWHGYwa44FuHmFMgon1RFguu1N4bj62qBKvLUjdRzjWoZqBIhAGAAqjyGh5ahtEXPR2s=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367227; c=relaxed/simple;
	bh=hBABAieH0plv6Pp3rwdA4Qx4ku9mnjzRDVwK+0SsPoc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=uxxu3LjOrd/7qgusE/Lkd01zdcFukIGDkXtSC59Rd6IwWEI9nAH+Nzgm2TnlaJi8f5lE1pNv6lWbBzHAF2KyXeHGBdoPMmcBc5twRkZlhYaaNHGD5/qvg1lLLDQ0ex767cgr1Dc7BMzm5tdyu/x0SRo17clULRBrhUbp8nqS3Mo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zhUO9xFH; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Paul Menzel <[email-masked]>,
	Baochen Qiang <[email-masked]>,
	Vasanthakumar Thiagarajan <[email-masked]>,
	Jeff Johnson <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 137/196] wifi: ath10k: avoid unnecessary wait for service ready message
Date: Mon, 13 Oct 2025 16:45:10 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Baochen Qiang <[email-masked]>

[ Upstream commit 51a73f1b2e56b0324b4a3bb8cebc4221b5be4c7a ]

Commit e57b7d62a1b2 ("wifi: ath10k: poll service ready message before
failing") works around the failure in waiting for the service ready
message by active polling. Note the polling is triggered after initial
wait timeout, which means that the wait-till-timeout can not be avoided
even the message is ready.

A possible fix is to do polling once before wait as well, however this
can not handle the race that the message arrives right after polling.
So the solution is to do periodic polling until timeout.

Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00309-QCARMSWPZ-1

Fixes: e57b7d62a1b2 ("wifi: ath10k: poll service ready message before failing")
Reported-by: Paul Menzel <[email-masked]>
Closes: https://lore.kernel.org/all/[email-masked]
Signed-off-by: Baochen Qiang <[email-masked]>
Reviewed-by: Vasanthakumar Thiagarajan <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jeff Johnson <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/ath/ath10k/wmi.c | 39 +++++++++++++--------------
 1 file changed, 19 insertions(+), 20 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index b126ffba480f1..2fda5ca3e6ee9 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -1762,33 +1762,32 @@ void ath10k_wmi_put_wmi_channel(struct ath10k *ar, struct wmi_channel *ch,
 
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
 {
+	unsigned long timeout = jiffies + WMI_SERVICE_READY_TIMEOUT_HZ;
 	unsigned long time_left, i;
 
-	time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
-						WMI_SERVICE_READY_TIMEOUT_HZ);
-	if (!time_left) {
-		/* Sometimes the PCI HIF doesn't receive interrupt
-		 * for the service ready message even if the buffer
-		 * was completed. PCIe sniffer shows that it's
-		 * because the corresponding CE ring doesn't fires
-		 * it. Workaround here by polling CE rings once.
-		 */
-		ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
-
+	/* Sometimes the PCI HIF doesn't receive interrupt
+	 * for the service ready message even if the buffer
+	 * was completed. PCIe sniffer shows that it's
+	 * because the corresponding CE ring doesn't fires
+	 * it. Workaround here by polling CE rings. Since
+	 * the message could arrive at any time, continue
+	 * polling until timeout.
+	 */
+	do {
 		for (i = 0; i < CE_COUNT; i++)
 			ath10k_hif_send_complete_check(ar, i, 1);
 
+		/* The 100 ms granularity is a tradeoff considering scheduler
+		 * overhead and response latency
+		 */
 		time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
-							WMI_SERVICE_READY_TIMEOUT_HZ);
-		if (!time_left) {
-			ath10k_warn(ar, "polling timed out\n");
-			return -ETIMEDOUT;
-		}
-
-		ath10k_warn(ar, "service ready completion received, continuing normally\n");
-	}
+							msecs_to_jiffies(100));
+		if (time_left)
+			return 0;
+	} while (time_before(jiffies, timeout));
 
-	return 0;
+	ath10k_warn(ar, "failed to receive service ready completion\n");
+	return -ETIMEDOUT;
 }
 
 int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:12:56 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367225; cv=none; b=T5O6E3WaggCUXBeIJLbeiBNztPKQdPd3YbHQtGByJgBcWnMqplLRulUmkoeqPu3g1fyIJuYb/8IMP6kceX348ahed7j//S9VfR5GgwJu46MduEeatLqT0S4U7Xp4eouzLAPLCsgimr0nDuKvfalOcoL1O6SFgDgckr3mYv3bMfc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367225; c=relaxed/simple;
	bh=XLod/wEImOpU2+WBFKVVb8koN125XEiUX2EmpskuoRc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Xddfl553VtrCYmTOe+Wij6Icz5tlr6t7Zq5X8gWqIwvfUnh0ptuxRSvqqhGTyFKUdplR5Y3aboHPhKMMqeN8VTrlFVL9OJ70QP6k7EPh9ShxJ67BTPCILz/7rt/IZz2RamB0og9+89f90kTuCo1P1TuFfggfiPYVnyfBGZgXJO8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=z33mjSup; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Tom Zanussi <[email-masked]>,
	"Masami Hiramatsu (Google)" <[email-masked]>,
	Bagas Sanjaya <[email-masked]>,
	"Steven Rostedt (Google)" <[email-masked]>,
	Jonathan Corbet <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 136/196] Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
Date: Mon, 13 Oct 2025 16:45:09 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bagas Sanjaya <[email-masked]>

[ Upstream commit 8c716e87ea33519920811338100d6d8a7fb32456 ]

Section heading for sched_waking histogram is shown as normal paragraph
instead due to codeblock marker for the following diagram being in the
same line as the section underline. Separate them.

Fixes: daceabf1b494 ("tracing/doc: Fix ascii-art in histogram-design.rst")
Reviewed-by: Tom Zanussi <[email-masked]>
Reviewed-by: Masami Hiramatsu (Google) <[email-masked]>
Signed-off-by: Bagas Sanjaya <[email-masked]>
Acked-by: Steven Rostedt (Google) <[email-masked]>
Signed-off-by: Jonathan Corbet <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 Documentation/trace/histogram-design.rst | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/Documentation/trace/histogram-design.rst b/Documentation/trace/histogram-design.rst
index 088c8cce738ba..6e0d1a48bd505 100644
--- a/Documentation/trace/histogram-design.rst
+++ b/Documentation/trace/histogram-design.rst
@@ -380,7 +380,9 @@ entry, ts0, corresponding to the ts0 variable in the sched_waking
 trigger above.
 
 sched_waking histogram
-----------------------::
+----------------------
+
+.. code-block::
 
   +------------------+
   | hist_data        |<-------------------------------------------------------+
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:14:45 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367221; cv=none; b=qqo7l5Vb40BkOr+m6/otUSUjXFSYSesC8Rx+6PZvRMQfeFk764PIxzNflNkq0i0FLMLN/VnxVgj4Zi82pTmLe3fTcvnl63PQxWAHdgWJqmqAdoMF0dfBUeIRdqGAb9BV4iioYsxAQsJyfsx41HDEXYNL1VKSt5m8S7VkeCdwdRY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367221; c=relaxed/simple;
	bh=5VQNacR3zSi7iWZL87gEPLGQlwIQiRdqu/k6WP/5/iQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=posjDvfmYxVZtXr5nsYgxxMBUuNlbp93MqPLT063vJLcX/U1SR68m7cpsOppj4ht5zuHwiqWDAZ0eFBib0FzRrxrbJntYm25UVWTNFZJgoBxmf5zrNCMzqHH1PGtz+zM8ObSAZm89wvNf5sna+jDdDOQ73Djko5Acz9umufJkZs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Q2jNiCqX; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Vlad Dumitrescu <[email-masked]>,
	Mark Zhang <[email-masked]>,
	Edward Srouji <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 135/196] IB/sa: Fix sa_local_svc_timeout_ms read race
Date: Mon, 13 Oct 2025 16:45:08 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vlad Dumitrescu <[email-masked]>

[ Upstream commit 1428cd764cd708d53a072a2f208d87014bfe05bc ]

When computing the delta, the sa_local_svc_timeout_ms is read without
ib_nl_request_lock held. Though unlikely in practice, this can cause
a race condition if multiple local service threads are managing the
timeout.

Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
Signed-off-by: Vlad Dumitrescu <[email-masked]>
Reviewed-by: Mark Zhang <[email-masked]>
Signed-off-by: Edward Srouji <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Leon Romanovsky <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/core/sa_query.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 8c69bdb5bb754..f56eee73ee4a1 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1021,6 +1021,8 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
 	if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX)
 		timeout = IB_SA_LOCAL_SVC_TIMEOUT_MAX;
 
+	spin_lock_irqsave(&ib_nl_request_lock, flags);
+
 	delta = timeout - sa_local_svc_timeout_ms;
 	if (delta < 0)
 		abs_delta = -delta;
@@ -1028,7 +1030,6 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
 		abs_delta = delta;
 
 	if (delta != 0) {
-		spin_lock_irqsave(&ib_nl_request_lock, flags);
 		sa_local_svc_timeout_ms = timeout;
 		list_for_each_entry(query, &ib_nl_request_list, list) {
 			if (delta < 0 && abs_delta > query->timeout)
@@ -1046,9 +1047,10 @@ int ib_nl_handle_set_timeout(struct sk_buff *skb,
 		if (delay)
 			mod_delayed_work(ib_nl_wq, &ib_nl_timed_work,
 					 (unsigned long)delay);
-		spin_unlock_irqrestore(&ib_nl_request_lock, flags);
 	}
 
+	spin_unlock_irqrestore(&ib_nl_request_lock, flags);
+
 settimeout_out:
 	return 0;
 }
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:04:52 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367219; cv=none; b=sJ5YDHaHLFxZ4bFW84+7lL4oci6STvPopVn/xg5X0lawCP20MPLff+MGKhz43iRPyG577gikWe0bmKZTDy2NfxT94FRR9FvFCmmqIRN/OPusMdYBPMoYD2ZijLqFL0EcpYivd/3Tfl5EuVe+nq6UCuX/p34RshZnvUxnJglJLgM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367219; c=relaxed/simple;
	bh=2n7k2Twaw1LjTN3UDyvhHBa/Yt2Cpsh7sjklLR8FvQQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=JKZANFDXe9gK4Xy5FZD78P4tQ70ByyE0mY9maBhUj2ozs2vvQa00I2COOOSNKqM4SMeQhQmC+GVM//cmU2AlYOQYur8e8m2Jm/6NWkYOAB9yzpUwrWVQMxKYLwSQvq12eMNm+hIy60dnGnPlamI9DWnHEUnS9ySxeeMsieRLNxM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aMHKlKSh; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Parav Pandit <[email-masked]>,
	Vlad Dumitrescu <[email-masked]>,
	Edward Srouji <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 134/196] RDMA/core: Resolve MAC of next-hop device without ARP support
Date: Mon, 13 Oct 2025 16:45:07 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Parav Pandit <[email-masked]>

[ Upstream commit 200651b9b8aadfbbec852f0e5d042d9abe75e2ab ]

Currently, if the next-hop netdevice does not support ARP resolution,
the destination MAC address is silently set to zero without reporting
an error. This leads to incorrect behavior and may result in packet
transmission failures.

Fix this by deferring MAC resolution to the IP stack via neighbour
lookup, allowing proper resolution or error reporting as appropriate.

Fixes: 7025fcd36bd6 ("IB: address translation to map IP toIB addresses (GIDs)")
Signed-off-by: Parav Pandit <[email-masked]>
Reviewed-by: Vlad Dumitrescu <[email-masked]>
Signed-off-by: Edward Srouji <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Leon Romanovsky <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/core/addr.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index f253295795f0a..cdb3b99e057cf 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -460,14 +460,10 @@ static int addr_resolve_neigh(const struct dst_entry *dst,
 {
 	int ret = 0;
 
-	if (ndev_flags & IFF_LOOPBACK) {
+	if (ndev_flags & IFF_LOOPBACK)
 		memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
-	} else {
-		if (!(ndev_flags & IFF_NOARP)) {
-			/* If the device doesn't do ARP internally */
-			ret = fetch_ha(dst, addr, dst_in, seq);
-		}
-	}
+	else
+		ret = fetch_ha(dst, addr, dst_in, seq);
 	return ret;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:23:58 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367216; cv=none; b=dJpcZOVZ3TixwsR9HbyVh8jtdsxuj715UcP2mFDJW0O/WQKHUUg8t3DK8ri7XvPGdzh01ChLrTmfNlXwnE38khM7JcZ4negpcIr6QdQh1d7jdBZsMWn5ov2I4zzwy6Itiu1Ybk76EWabd/pkb2jj5CNo4YHAOiy3PRz9FKPfVi4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367216; c=relaxed/simple;
	bh=8Z+TTPaDnfSvaQKbGERH9iRpRw+SJP0QHBPlgsgwC44=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=OfmbBIENdnupiUDrqL/mgkAQEWQkmoKEzkfS1F7ewv+ZXclDgVhQVshY7IbCHMzocSvL/ZGAT2+0ak+sFsUgP7e/mD7ysPxJcZAexnDuN87iQjjuBTJHRQTcvdryBRmeiXyp2zSSeIM0al0Sq22F7JaErDvjO1WmBMV7UGf+Phw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=myJTPhbQ; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Michal Pecio <[email-masked]>,
	Mathias Nyman <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 133/196] Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"
Date: Mon, 13 Oct 2025 16:45:06 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michal Pecio <[email-masked]>

[ Upstream commit 08fa726e66039dfa80226dfa112931f60ad4c898 ]

This reverts commit 28a76fcc4c85dd39633fb96edb643c91820133e3.

No actual HW bugs are known where Endpoint Context shows Running state
but Stop Endpoint fails repeatedly with Context State Error and leaves
the endpoint state unchanged. Stop Endpoint retries on Running EPs have
been performed since early 2021 with no such issues reported so far.

Trying to handle this hypothetical case brings a more realistic danger:
if Stop Endpoint fails on an endpoint which hasn't yet started after a
doorbell ring and enough latency occurs before this completion event is
handled, the driver may time out and begin removing cancelled TDs from
a running endpoint, even though one more retry would stop it reliably.

Such high latency is rare but not impossible, and removing TDs from a
running endpoint can cause more damage than not giving back a cancelled
URB (which wasn't happening anyway). So err on the side of caution and
revert to the old policy of always retrying if the EP appears running.

[Remove stable tag as we are dealing with theoretical cases -Mathias]

Fixes: 28a76fcc4c85d ("usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running")
Signed-off-by: Michal Pecio <[email-masked]>
Signed-off-by: Mathias Nyman <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/usb/host/xhci-ring.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index c8e1ead0c09e6..cb0bf8b6e0172 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1175,19 +1175,16 @@ static void xhci_handle_cmd_stop_ep(struct xhci_hcd *xhci, int slot_id,
 			 * Stopped state, but it will soon change to Running.
 			 *
 			 * Assume this bug on unexpected Stop Endpoint failures.
-			 * Keep retrying until the EP starts and stops again.
+			 * Keep retrying until the EP starts and stops again, on
+			 * chips where this is known to help. Wait for 100ms.
 			 */
+			if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
+				break;
 			fallthrough;
 		case EP_STATE_RUNNING:
 			/* Race, HW handled stop ep cmd before ep was running */
 			xhci_dbg(xhci, "Stop ep completion ctx error, ctx_state %d\n",
 					GET_EP_CTX_STATE(ep_ctx));
-			/*
-			 * Don't retry forever if we guessed wrong or a defective HC never starts
-			 * the EP or says 'Running' but fails the command. We must give back TDs.
-			 */
-			if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
-				break;
 
 			command = xhci_alloc_command(xhci, false, GFP_ATOMIC);
 			if (!command) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:17:34 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367213; cv=none; b=mh5GYpBTwMHw1BwtcvxzZUO9CZGqExAfnZzNsvgob8z3R/TcafbKDdyzM4bgjwDnM8+eVlZGNCT7P3APIACvunK8v2DrHTE7pGSeODyHowDcKwVO0/YSfDrvsQjCc8ZpxjwKCWD6eG9pDdZsyh0dRK1tVApVOKE3zdVN8+ZOTtU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367213; c=relaxed/simple;
	bh=7J9J9dBX2yNbqGWNjRBDSrmsiRFoS23rWaLhBINHu7M=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Ynq2dFPqebvqUTZ4lDqvtEE/WagDqqJRIa01laTTxPa4qxI2NCNetAPHvzrl4Y4o7Ze6BAA+wlhKNPci7b3MtFOcIvDo4ZJslHWTL0gJvM9IKpgPhkruwxjoa46X/ReSBZ2qZNahILitB9/vUPY/MrzId89Md9GCFk9re6OIqRA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=z7W7LZGh; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	wangzijie <[email-masked]>,
	Chao Yu <[email-masked]>,
	Jaegeuk Kim <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 132/196] f2fs: fix zero-sized extent for precache extents
Date: Mon, 13 Oct 2025 16:45:05 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: wangzijie <[email-masked]>

[ Upstream commit 8175c864391753b210f3dcfae1aeed686a226ebb ]

Script to reproduce:
f2fs_io write 1 0 1881 rand dsync testfile
f2fs_io fallocate 0 7708672 4096 testfile
f2fs_io write 1 1881 1 rand buffered testfile
fsync testfile
umount
mount
f2fs_io precache_extents testfile

When the data layout is something like this:
dnode1:                     dnode2:
[0]      A                  [0]    NEW_ADDR
[1]      A+1                [1]    0x0
...
[1016]   A+1016
[1017]   B (B!=A+1017)      [1017] 0x0

During precache_extents, we map the last block(valid blkaddr) in dnode1:
map->m_flags |= F2FS_MAP_MAPPED;
map->m_pblk = blkaddr(valid blkaddr);
map->m_len = 1;
then we goto next_dnode, meet the first block in dnode2(hole), goto sync_out:
map->m_flags & F2FS_MAP_MAPPED == true, and we make zero-sized extent:

map->m_len = 1
ofs = start_pgofs - map->m_lblk = 1882 - 1881 = 1
ei.fofs = start_pgofs = 1882
ei.len = map->m_len - ofs = 1 - 1 = 0

Rebased on patch[1], this patch can cover these cases to avoid zero-sized extent:
A,B,C is valid blkaddr
case1:
dnode1:                     dnode2:
[0]      A                  [0]    NEW_ADDR
[1]      A+1                [1]    0x0
...                         ....
[1016]   A+1016
[1017]   B (B!=A+1017)      [1017] 0x0

case2:
dnode1:                     dnode2:
[0]      A                  [0]    C (C!=B+1)
[1]      A+1                [1]    C+1
...                         ....
[1016]   A+1016
[1017]   B (B!=A+1017)      [1017] 0x0

case3:
dnode1:                     dnode2:
[0]      A                  [0]    C (C!=B+2)
[1]      A+1                [1]    C+1
...                         ....
[1015]   A+1015
[1016]   B (B!=A+1016)
[1017]   B+1                [1017] 0x0

[1] https://lore.kernel.org/linux-f2fs-devel/[email-masked]/

Fixes: c4020b2da4c9 ("f2fs: support F2FS_IOC_PRECACHE_EXTENTS")
Signed-off-by: wangzijie <[email-masked]>
Reviewed-by: Chao Yu <[email-masked]>
Signed-off-by: Jaegeuk Kim <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/f2fs/data.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 2b018d365b914..ac7d0ed3fb894 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1737,9 +1737,10 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
 		if (map->m_flags & F2FS_MAP_MAPPED) {
 			unsigned int ofs = start_pgofs - map->m_lblk;
 
-			f2fs_update_read_extent_cache_range(&dn,
-				start_pgofs, map->m_pblk + ofs,
-				map->m_len - ofs);
+			if (map->m_len > ofs)
+				f2fs_update_read_extent_cache_range(&dn,
+					start_pgofs, map->m_pblk + ofs,
+					map->m_len - ofs);
 		}
 		if (map->m_next_extent)
 			*map->m_next_extent = pgofs + 1;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:10:16 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367210; cv=none; b=DldV6eOLgz0aOc7P0qKN46zXJzApPhgr5SxQEKof8bOFaj8Eh3vco/i8c42TBB+IY6go3bpLiUUceRwxsl9xgq7oUMXLYqmEhjHTtTDxoGHUMVNe21FQbmwQoAihsL05Ywmp9uRaT2m74fAdb3B7+5+ct9shsoDXuWi3ckwPdh0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367210; c=relaxed/simple;
	bh=g2QRpZj1BD3FaylkdL+TFSigx9cbhCtsnXDR5aBOHIg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=tin1R4tOxCbwVw4UG4VbMCveBwr63DU2994YTfqAsZwnbdwepc3aaLiX+EAaIG9AiNiF5qAkhm5rk3ep7nmWdA3j9i+BXhf/iHKToQ2NYfPGoIaK/h5NdhTb28+ASDpvxhXh2OykWGPJbBdYRRpdsZ7oogtC7gIj8oUlZf6464U=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=tEuJv0Nj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 131/196] scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
Date: Mon, 13 Oct 2025 16:45:04 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 1f037e3acda79639a78f096355f2c308a3d45492 ]

Change the error code EAGAIN to -EAGAIN in START_SP_W_RETRIES() to align
with qla2x00_start_sp() returning negative error codes or QLA_SUCCESS,
preventing logical errors.  Additionally, the '_rval' variable should
store negative error codes to conform to Linux kernel error code
conventions.

Fixes: 9803fb5d2759 ("scsi: qla2xxx: Fix task management cmd failure")
Signed-off-by: Qianfeng Rong <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/qla2xxx/qla_init.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 682e74196f4b0..d2243f809616d 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -2060,11 +2060,11 @@ static void qla_marker_sp_done(srb_t *sp, int res)
 	int cnt = 5; \
 	do { \
 		if (_chip_gen != sp->vha->hw->chip_reset || _login_gen != sp->fcport->login_gen) {\
-			_rval = EINVAL; \
+			_rval = -EINVAL; \
 			break; \
 		} \
 		_rval = qla2x00_start_sp(_sp); \
-		if (_rval == EAGAIN) \
+		if (_rval == -EAGAIN) \
 			msleep(1); \
 		else \
 			break; \
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:25:43 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367307; cv=none; b=JrkMZUc+OO1bN2xYQYN/VPB81dKp1XiPbugrM/IIzU5znUoujZbz3ksY1ZFa8ODRzNH+JoQ1m8hevZwVWCJzW5+n1KJ+k4/RCxgvjEm+9pKpPK041zquu3UQ9UlPD/y5LkXThjNC/mU1FvDjqoIYbqTmfRq5teP+NBOqhJ3+xNA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367307; c=relaxed/simple;
	bh=cg/oa+ODSucqD2UVRkB49b2mda2UrsTYcngLl1e0zKs=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pLTmdR92ofx3a0LhEMgStOlJNzz8RvdyT15yFDGONRHSCeiRFF/9ygTrLh7wnOHT2MN8jM/AJB9nSUhVHMtwk8mWQL4VCPrevwjaZgGDxTS9cTPt7XIoZVSqGj01pJ9N8Y3ecM9fyeuUjUFoiKbou8oQrw4M/m5CkwITXHW5moA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zxRGCtp0; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 130/196] scsi: qla2xxx: edif: Fix incorrect sign of error code
Date: Mon, 13 Oct 2025 16:45:03 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 066b8f3fa85c1be7fb7dbae202231e131d38f7bc ]

Change the error code EAGAIN to -EAGAIN in qla24xx_sadb_update() and
qla_edif_process_els() to align with qla2x00_start_sp() returning
negative error codes or QLA_SUCCESS, preventing logical errors.

Fixes: 0b3f3143d473 ("scsi: qla2xxx: edif: Add retry for ELS passthrough")
Signed-off-by: Qianfeng Rong <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/scsi/qla2xxx/qla_edif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c
index 969008071decd..482c04ac06ba4 100644
--- a/drivers/scsi/qla2xxx/qla_edif.c
+++ b/drivers/scsi/qla2xxx/qla_edif.c
@@ -1755,7 +1755,7 @@ qla24xx_sadb_update(struct bsg_job *bsg_job)
 	switch (rval) {
 	case QLA_SUCCESS:
 		break;
-	case EAGAIN:
+	case -EAGAIN:
 		msleep(EDIF_MSLEEP_INTERVAL);
 		cnt++;
 		if (cnt < EDIF_RETRY_COUNT)
@@ -3621,7 +3621,7 @@ int qla_edif_process_els(scsi_qla_host_t *vha, struct bsg_job *bsg_job)
 		       p->e.extra_rx_xchg_address, p->e.extra_control_flags,
 		       sp->handle, sp->remap.req.len, bsg_job);
 		break;
-	case EAGAIN:
+	case -EAGAIN:
 		msleep(EDIF_MSLEEP_INTERVAL);
 		cnt++;
 		if (cnt < EDIF_RETRY_COUNT)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:24:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367304; cv=none; b=DSnL2UBxiTSGC4GvgCx669BLAnxvTokksLCKjqUkf0tBajyJjDcCPByGj7GMBy6AoPUlGDkW1J0AtJiKubN2G/TnmbajCxgHcUjKSl9BLWhAMapYUBNdaoEkluyk3Qtv2X1c3qwi8YxCQqQJ685lm1K1+y2yTX0GZDsVtnwCz/Q=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367304; c=relaxed/simple;
	bh=+r0YGKvSwzDCAC1nxSyBrOy37f+OLXm1LqeEHYoRdJk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=ln+ZYHSTFygKfUiZKXwR43+nwbDYRqlW9PrFB6nmIl2P26exBTPsEp0QDxyPAL9booC9w/vnIg4Xk5aIaDNioORkbx/MkdAZrVMq90LIrD59dUJ+xuE2gehUF/HaH3axsorKtQ86mmjvD2laotiHleFO1WbtfwXN6Mgf6EwkQzk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dtO+WYNF; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Colin Ian King <[email-masked]>,
	Ira Weiny <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 129/196] ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
Date: Mon, 13 Oct 2025 16:45:02 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Colin Ian King <[email-masked]>

[ Upstream commit d1a599a8136b16522b5afebd122395524496d549 ]

There appears to be a cut-n-paste error with the incorrect field
ndr_desc->numa_node being reported for the target node. Fix this by
using ndr_desc->target_node instead.

Fixes: f060db99374e ("ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect")
Signed-off-by: Colin Ian King <[email-masked]>
Reviewed-by: Ira Weiny <[email-masked]>
Signed-off-by: Ira Weiny <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/acpi/nfit/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 129c503b0951e..78c9f56b4ba34 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -2643,7 +2643,7 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
 	if (ndr_desc->target_node == NUMA_NO_NODE) {
 		ndr_desc->target_node = phys_to_target_node(spa->address);
 		dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
-			NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
+			NUMA_NO_NODE, ndr_desc->target_node, &res.start, &res.end);
 	}
 
 	/*
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:23:17 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367301; cv=none; b=KxfS8h7988/uNhOvasl5ApWXdwSciWDqnkP4Gub18QB9Hr7h/KBs4pGhkq0C1dGHRl97Qo6bszz8WNnl+3XiqkT2A88TDdFETzybt5434q0UeHsZIurI7rbrXni9qLeFQV7lJ+OKxMOr9oDNc0zXiyVFog8zaOFkFIx7jkPHbq8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367301; c=relaxed/simple;
	bh=LvW3JjA0xNgLdVgv/OT+Ymxgv43R9HScYAmEprQ2RSc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=NJuiHChl50iKLIvlSCb5u7x8K07v9Aglx/8QaBQ9GSfpyhwOA7Z2Pi/P/mKtZdpRKq/o+J3szbXgHBP3ry6Vng/T2RFrgvULAdO8CM9fWPVez2eTLPUTrWbNLRoOlvv8pdrGBGdu5VQ8XTbDuxMkPAow9w9xLSScGwZLyqJuNU8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JVMD3oe3; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Abdun Nihaal <[email-masked]>,
	Jiri Slaby <[email-masked]>,
	Felix Fietkau <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 128/196] wifi: mt76: fix potential memory leak in mt76_wmac_probe()
Date: Mon, 13 Oct 2025 16:45:01 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Abdun Nihaal <[email-masked]>

[ Upstream commit 42754b7de2b1a2cf116c5e3f1e8e78392f4ed700 ]

In mt76_wmac_probe(), when the mt76_alloc_device() call succeeds, memory
is allocated for both struct ieee80211_hw and a workqueue. However, on
the error path, the workqueue is not freed. Fix that by calling
mt76_free_device() on the error path.

Fixes: c8846e101502 ("mt76: add driver for MT7603E and MT7628/7688")
Signed-off-by: Abdun Nihaal <[email-masked]>
Reviewed-by: Jiri Slaby <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Felix Fietkau <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/mediatek/mt76/mt7603/soc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
index ba927033bbe8c..1206769cdc7fd 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7603/soc.c
@@ -48,7 +48,7 @@ mt76_wmac_probe(struct platform_device *pdev)
 
 	return 0;
 error:
-	ieee80211_free_hw(mt76_hw(dev));
+	mt76_free_device(mdev);
 	return ret;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:15:59 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367298; cv=none; b=ZXcXp33qsyqBV38zIIlb5sBFUBcR2LbskQu0O6wJepqlWlVjcqdLcnjRgUFT1I9j8G6mquID7u7yQIv57jp4RgovVVKyGT3FyEyL9EGT/UhRZgcvFV2zYcne+6kupT155NGdoy/CP9byNGM0GG48ehDdPeKBdlfo4hDC6OovCdc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367298; c=relaxed/simple;
	bh=O+xP23Pk5f6QBw06ggrnDim4FUVxNmk7pQbi7PFGM8M=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=L3o6cvi5ZIzsXGkCRNQrKPoCIj+xkT2AJsU6Ya7LX+zeXR/4omb/VojD5IyD9MRe9iDtBKhPMAub6WKO9nhW6mBtxV91DsYMU5uxH2/ZcuHPFF1jcrj24uOxoBBkQy1SBR87TIj7wjFC8maHwb9s2vBcbj/ZiyQ8dcOx8qknsOk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=crwABT12; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?H=C3=A5kon=20Bugge?= <[email-masked]>,
	Zhu Yanjun <[email-masked]>,
	Leon Romanovsky <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 127/196] RDMA/cm: Rate limit destroy CM ID timeout error message
Date: Mon, 13 Oct 2025 16:45:00 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Håkon Bugge <[email-masked]>

[ Upstream commit 2bbe1255fcf19c5eb300efb6cb5ad98d66fdae2e ]

When the destroy CM ID timeout kicks in, you typically get a storm of
them which creates a log flooding. Hence, change pr_err() to
pr_err_ratelimited() in cm_destroy_id_wait_timeout().

Fixes: 96d9cbe2f2ff ("RDMA/cm: add timeout to cm_destroy_id wait")
Signed-off-by: Håkon Bugge <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Reviewed-by: Zhu Yanjun <[email-masked]>
Signed-off-by: Leon Romanovsky <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/infiniband/core/cm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 0a113d0d6b08f..5c336ab12ee1d 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -1032,8 +1032,8 @@ static noinline void cm_destroy_id_wait_timeout(struct ib_cm_id *cm_id,
 	struct cm_id_private *cm_id_priv;
 
 	cm_id_priv = container_of(cm_id, struct cm_id_private, id);
-	pr_err("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
-	       cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
+	pr_err_ratelimited("%s: cm_id=%p timed out. state %d -> %d, refcnt=%d\n", __func__,
+			   cm_id, old_state, cm_id->state, refcount_read(&cm_id_priv->refcount));
 }
 
 static void cm_destroy_id(struct ib_cm_id *cm_id, int err)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:15:58 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367295; cv=none; b=XwIgJIcXn4jWWk4VP1kPYUIu9DeFEppdaFKBYzRBvgy9T7wnDC/gGMYn4vctLgaqHAInSaelluEetKwOKkJyd6p3QdMTjZb4GzG9dNXcV+N/mZKy6SkLEnVz3indQjETXZfp8TjrRRnxOcI751bgUUqhKnVJMd/PPaj8ZewBanw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367295; c=relaxed/simple;
	bh=VK4Vc4e3MDAfFf1g0dgbgtxauS2FvHFNhEjRINUB+C8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DqzQ9XBoAz/wcg3SVpAWQTKpojQyCBSKPzCuJlaEArTFd028RgIFSQsawF+OW/w56/YLsgVjTsgJ9fRPwWC+MzlPB+7hYzSYUksW8avEaxnY8r5Im5e7JgsRz927fIDQ1vF8cAC27CTV/Q/HbiOT1tGiwYpplTTt42BeJFZNArk=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=UqwkXmjB; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8EC23C4CEE7;
	Mon, 13 Oct 2025 14:54:54 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760367295;
	bh=VK4Vc4e3MDAfFf1g0dgbgtxauS2FvHFNhEjRINUB+C8=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=UqwkXmjBponOC1cm9Nf6Kx/HelJTBVwnpzXHwQ7hF9A8P5NCdwSxE9VIcI8jrrZUJ
	 wfHTvWnPipqhGdOWhvh8UZaXwcko9fuiIKlxtQysr1/DBXx86Q7Ea/tYdKxxWfEc0e
	 akxQP6V+rrntlILaB8vDcNxFWjKFDMVeDWb0PdcM=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Donet Tom <[email-masked]>,
	David Hildenbrand <[email-masked]>,
	Alison Schofield <[email-masked]>,
	Danilo Krummrich <[email-masked]>,
	Dave Jiang <[email-masked]>,
	Hiroyouki Kamezawa <[email-masked]>,
	Joanthan Cameron <[email-masked]>,
	Oscar Salvador <[email-masked]>,
	"Ritesh Harjani (IBM)" <[email-masked]>,
	"Yury Norov (NVIDIA)" <[email-masked]>,
	Zi Yan <[email-masked]>,
	Andrew Morton <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 126/196] drivers/base/node: handle error properly in register_one_node()
Date: Mon, 13 Oct 2025 16:44:59 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Donet Tom <[email-masked]>

[ Upstream commit 786eb990cfb78aab94eb74fb32a030e14723a620 ]

If register_node() returns an error, it is not handled correctly.
The function will proceed further and try to register CPUs under the
node, which is not correct.

So, in this patch, if register_node() returns an error, we return
immediately from the function.

Link: https://lkml.kernel.org/r/[email-masked]
Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
Signed-off-by: Donet Tom <[email-masked]>
Acked-by: David Hildenbrand <[email-masked]>
Cc: Alison Schofield <[email-masked]>
Cc: Danilo Krummrich <[email-masked]>
Cc: Dave Jiang <[email-masked]>
Cc: Donet Tom <[email-masked]>
Cc: Greg Kroah-Hartman <[email-masked]>
Cc: Hiroyouki Kamezawa <[email-masked]>
Cc: Joanthan Cameron <[email-masked]>
Cc: Oscar Salvador <[email-masked]>
Cc: "Ritesh Harjani (IBM)" <[email-masked]>
Cc: Yury Norov (NVIDIA) <[email-masked]>
Cc: Zi Yan <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/base/node.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/base/node.c b/drivers/base/node.c
index a4141b57b1478..cbaa4e2eddcef 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -869,6 +869,11 @@ int __register_one_node(int nid)
 	node_devices[nid] = node;
 
 	error = register_node(node_devices[nid], nid);
+	if (error) {
+		node_devices[nid] = NULL;
+		kfree(node);
+		return error;
+	}
 
 	/* link cpu under this node */
 	for_each_present_cpu(cpu) {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:27:58 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367292; cv=none; b=T/LHhPnnMRrxRwSvTAOenE8mo8tep0xT4bwIWKEVNU3xcHa9untcRTnEg1U69hijKNndDU9xEAwWcJ4GVjL9E8QxxJRTYHbQg8hJw5AlduzZ9WYKpzh5K/IUWKMi1SLWlJEy92/RiZzXuZS1QmPkzGDoiB/n6acw3hawqv2+gP0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367292; c=relaxed/simple;
	bh=ZDAiOTMtgwG1Gan5z55wb3j+x56HOCPWWSuBc6hqOH4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=aTmPS9/0d/ltBf8h5KcxcsFoVDMzYGJdf+tF3SHTODWpEG4nzWVGrjBAbPPWetv8hrRlZWV3DqAgLq/ZBPe664kpq6pJf1v05FJkW+tMQ5MWeNFJapzZOHo2Zy876fJnNv7ktrwiqDhXvxtxxZlodHgFqh6LGUMSaUnEcY/kp4Q=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=qpHkadyi; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Christophe Leroy <[email-masked]>,
	Guenter Roeck <[email-masked]>,
	Wim Van Sebroeck <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 125/196] watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
Date: Mon, 13 Oct 2025 16:44:58 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christophe Leroy <[email-masked]>

[ Upstream commit 7dfd80f70ef00d871df5af7c391133f7ba61ad9b ]

When the watchdog gets enabled with this driver, it leaves enough time
for the core watchdog subsystem to start pinging it. But when the
watchdog is already started by hardware or by the boot loader, little
time remains before it fires and it happens that the core watchdog
subsystem doesn't have time to start pinging it.

Until commit 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker
function") pinging was managed by the driver itself and the watchdog
was immediately pinged by setting the timer expiry to 0.

So restore similar behaviour by pinging it when enabling it so that
if it was already enabled the watchdog timer counter is reloaded.

Fixes: 19ce9490aa84 ("watchdog: mpc8xxx: use the core worker function")
Signed-off-by: Christophe Leroy <[email-masked]>
Reviewed-by: Guenter Roeck <[email-masked]>
Signed-off-by: Guenter Roeck <[email-masked]>
Signed-off-by: Wim Van Sebroeck <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/watchdog/mpc8xxx_wdt.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c
index 1c569be72ea29..15644ae2387fd 100644
--- a/drivers/watchdog/mpc8xxx_wdt.c
+++ b/drivers/watchdog/mpc8xxx_wdt.c
@@ -100,6 +100,8 @@ static int mpc8xxx_wdt_start(struct watchdog_device *w)
 	ddata->swtc = tmp >> 16;
 	set_bit(WDOG_HW_RUNNING, &ddata->wdd.status);
 
+	mpc8xxx_wdt_keepalive(ddata);
+
 	return 0;
 }
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:20:01 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367272; cv=none; b=J7SXwesJA3i6zKW52MoHmWbrXWI0vK/B+v0bYkqwt+zjl9V4iWXkD36jpH8v0h0Pk19OMEjODB2DKGczmApzSpaDwVeHOZnMHJB8/XcFUrbZ3A+zLnCkQthFFgDK3GIErPlsXji4l4aEc7bbwtXfGeVokA5fVVllkrHDB+ZtLNY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367272; c=relaxed/simple;
	bh=gwgOxX8Mm5y2YLuv5qm30q2s4jFushv14o7oV115BR8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=WASUu4Q167xzXLLlzObBnvNQjNobXbFMnMPJWU71Ldndzshw18QC5Z7HF1c/PqlqU+IdCNYBkoMKNY23GsNDYVYqm6M0lNFPoGfOFESk+cwD/PC8Pv5vTTufHwOtJjse1wOVfQaCgw5uYmJYnSzObNwDtoJk1yQ0VdN+nJPM3IM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Fpa8bPXD; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhen Ni <[email-masked]>,
	Phil Sutter <[email-masked]>,
	Florian Westphal <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 124/196] netfilter: ipset: Remove unused htable_bits in macro ahash_region
Date: Mon, 13 Oct 2025 16:44:57 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhen Ni <[email-masked]>

[ Upstream commit ba941796d7cd1e81f51eed145dad1b47240ff420 ]

Since the ahash_region() macro was redefined to calculate the region
index solely from HTABLE_REGION_BITS, the htable_bits parameter became
unused.

Remove the unused htable_bits argument and its call sites, simplifying
the code without changing semantics.

Fixes: 8478a729c046 ("netfilter: ipset: fix region locking in hash types")
Signed-off-by: Zhen Ni <[email-masked]>
Reviewed-by: Phil Sutter <[email-masked]>
Signed-off-by: Florian Westphal <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 net/netfilter/ipset/ip_set_hash_gen.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 0bd6bf46f05f3..1f9ca5040982d 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -62,7 +62,7 @@ struct hbucket {
 		: jhash_size((htable_bits) - HTABLE_REGION_BITS))
 #define ahash_sizeof_regions(htable_bits)		\
 	(ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region))
-#define ahash_region(n, htable_bits)		\
+#define ahash_region(n)		\
 	((n) / jhash_size(HTABLE_REGION_BITS))
 #define ahash_bucket_start(h,  htable_bits)	\
 	((htable_bits) < HTABLE_REGION_BITS ? 0	\
@@ -689,7 +689,7 @@ mtype_resize(struct ip_set *set, bool retried)
 #endif
 				key = HKEY(data, h->initval, htable_bits);
 				m = __ipset_dereference(hbucket(t, key));
-				nr = ahash_region(key, htable_bits);
+				nr = ahash_region(key);
 				if (!m) {
 					m = kzalloc(sizeof(*m) +
 					    AHASH_INIT_SIZE * dsize,
@@ -839,7 +839,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
 	rcu_read_lock_bh();
 	t = rcu_dereference_bh(h->table);
 	key = HKEY(value, h->initval, t->htable_bits);
-	r = ahash_region(key, t->htable_bits);
+	r = ahash_region(key);
 	atomic_inc(&t->uref);
 	elements = t->hregion[r].elements;
 	maxelem = t->maxelem;
@@ -1037,7 +1037,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
 	rcu_read_lock_bh();
 	t = rcu_dereference_bh(h->table);
 	key = HKEY(value, h->initval, t->htable_bits);
-	r = ahash_region(key, t->htable_bits);
+	r = ahash_region(key);
 	atomic_inc(&t->uref);
 	rcu_read_unlock_bh();
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:16:50 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367240; cv=none; b=mqqd6DnYlx+MTKaW6MNUo9TCBq3Ui/zNwbZ3EURGJj6ZEd7EIVlo2Y3okeyRc1XyAETOd6l3GkKvrBr9HXCUj6LbZOa/w1EWvl2Nnq/H08N/k+a76ll+f9lIMsFYeCuETCfBm5EAjnYuIgZJHzssAuoq+Uy0Yl/GN74t2TT1ITw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367240; c=relaxed/simple;
	bh=Fjf2Bmt9dM6gp/oMA/8XsukfYhDa0RMGrN30jjV2Cnk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=KDjgEIj7Y4KUNPFfFNd6mmvg9NrewTAjdh1qTbvFnxjRGuNUnDMVEXbZie1Zm19UHjQj5nRjvQMvQyTFQfLshdYC+bIcx1RmsUlIGGj2EwdNrFA+zrBpeDI1AepESwHuoI0QBpc0eq1k0+8pFcWto9035+6452RpOorL3yF0NrM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=nNeDqnN2; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Liam Beguin <[email-masked]>,
	Andy Shevchenko <[email-masked]>,
	Hans de Goede <[email-masked]>,
	Jonathan Cameron <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 123/196] iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
Date: Mon, 13 Oct 2025 16:44:56 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hans de Goede <[email-masked]>

[ Upstream commit 33f5c69c4daff39c010b3ea6da8ebab285f4277b ]

Fix iio_convert_raw_to_processed() offset handling for channels without
a scale attribute.

The offset has been applied to the raw64 value not to the original raw
value. Use the raw64 value so that the offset is taken into account.

Fixes: 14b457fdde38 ("iio: inkern: apply consumer scale when no channel scale is available")
Cc: Liam Beguin <[email-masked]>
Reviewed-by: Andy Shevchenko <[email-masked]>
Signed-off-by: Hans de Goede <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jonathan Cameron <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/iio/inkern.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index 5c210f48bd9ce..c7795feb904ed 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -669,7 +669,7 @@ static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan,
 		 * If no channel scaling is available apply consumer scale to
 		 * raw value and return.
 		 */
-		*processed = raw * scale;
+		*processed = raw64 * scale;
 		return 0;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:01:49 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367207; cv=none; b=UJoY+FkRLW/qdCUpi2AEuDBsVmXFfhVRHz8CWQgzEpfIsSBxss3gK6+gaDD33OZlls9jwqcW9aLejLJTD99U64kNyArCyJEJg3HGUfCnqmAeX5GE1cqIRoUbtoOb6r0QKseGhuFDerpg9AYCy4I5Atpv2l1KZa7Zs5NPXXbokl4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367207; c=relaxed/simple;
	bh=74tKqXOWownIlsEOOBwhdSdrfnd4Qe61YRpk9b1KDGc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=OI5RVKDiCbeoUEXjsUFLSjdOl++htL19+HpIBX9/oMDAO31Ls5ORiRsu3JAtwZGorynhe/lqWsaYXkc1Ty/YMZGTsw9Q73PEARohI3H4ICRjDOupJ2u+6FIeJpz761PwE+U0qDHqQiFOysJtDz67VO4KG8B2BqWAtc+qLCd+pHM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=GgsRZlVP; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Vitaly Grigoryev <[email-masked]>,
	Konstantin Komarov <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 122/196] fs: ntfs3: Fix integer overflow in run_unpack()
Date: Mon, 13 Oct 2025 16:44:55 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [147.75.80.249 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vitaly Grigoryev <[email-masked]>

[ Upstream commit 736fc7bf5f68f6b74a0925b7e072c571838657d2 ]

The MFT record relative to the file being opened contains its runlist,
an array containing information about the file's location on the physical
disk. Analysis of all Call Stack paths showed that the values of the
runlist array, from which LCNs are calculated, are not validated before
run_unpack function.

The run_unpack function decodes the compressed runlist data format
from MFT attributes (for example, $DATA), converting them into a runs_tree
structure, which describes the mapping of virtual clusters (VCN) to
logical clusters (LCN). The NTFS3 subsystem also has a shortcut for
deleting files from MFT records - in this case, the RUN_DEALLOCATE
command is sent to the run_unpack input, and the function logic
provides that all data transferred to the runlist about file or
directory is deleted without creating a runs_tree structure.

Substituting the runlist in the $DATA attribute of the MFT record for an
arbitrary file can lead either to access to arbitrary data on the disk
bypassing access checks to them (since the inode access check
occurs above) or to destruction of arbitrary data on the disk.

Add overflow check for addition operation.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
Signed-off-by: Vitaly Grigoryev <[email-masked]>
Signed-off-by: Konstantin Komarov <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/ntfs3/run.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/ntfs3/run.c b/fs/ntfs3/run.c
index 12d8682f33b53..340a4cbe8b5ca 100644
--- a/fs/ntfs3/run.c
+++ b/fs/ntfs3/run.c
@@ -9,6 +9,7 @@
 #include <linux/blkdev.h>
 #include <linux/fs.h>
 #include <linux/log2.h>
+#include <linux/overflow.h>
 
 #include "debug.h"
 #include "ntfs.h"
@@ -982,12 +983,16 @@ int run_unpack(struct runs_tree *run, struct ntfs_sb_info *sbi, CLST ino,
 
 			if (!dlcn)
 				return -EINVAL;
-			lcn = prev_lcn + dlcn;
+
+			if (check_add_overflow(prev_lcn, dlcn, &lcn))
+				return -EINVAL;
 			prev_lcn = lcn;
 		} else
 			return -EINVAL;
 
-		next_vcn = vcn64 + len;
+		if (check_add_overflow(vcn64, len, &next_vcn))
+			return -EINVAL;
+
 		/* Check boundary. */
 		if (next_vcn > evcn + 1)
 			return -EINVAL;
@@ -1148,7 +1153,8 @@ int run_get_highest_vcn(CLST vcn, const u8 *run_buf, u64 *highest_vcn)
 			return -EINVAL;
 
 		run_buf += size_size + offset_size;
-		vcn64 += len;
+		if (check_add_overflow(vcn64, len, &vcn64))
+			return -EINVAL;
 
 #ifndef CONFIG_NTFS3_64BIT_CLUSTER
 		if (vcn64 > 0x100000000ull)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:37:40 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367310; cv=none; b=CQ/tPfFI+F2E1Ufe3vaistO8nsyDZpMuQPXPC8sc25USS+uUdaUagvsdJdVTR5OQeZMyVzpIGvDUdGMQ3rJBHhBA5KFj1KFg713D9f8sK2Bkb3K/Gwag5Gx8zDd8P1R34JIH7J5U2mE/UN7Z25doUEwDJjHmKCt0ODYAHfcAXm4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367310; c=relaxed/simple;
	bh=pGEIrBnRN0oS0R+IaxT95hVDiDLvc4eISxI6UrdTCE4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=u0xDW2NqclDp8u6hp5AkqZxQnUceRp2QykU2LTA+zAMlI+qYZgSSD7YQ/50Sqyt1ZCxDDCIHOkcJI4VTVOltowxaQ23c2QNDUmgpDzMTe4EpQUhPOB9p4HlkOn2ZojiyDZ2+NP0AcOOefUDrLSt/Cx3vxlTok0I+8fQ0qNBWCLs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=h79B19sE; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 121/196] drm/msm/dpu: fix incorrect type for ret
Date: Mon, 13 Oct 2025 16:44:54 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit 88ec0e01a880e3326794e149efae39e3aa4dbbec ]

Change 'ret' from unsigned long to int, as storing negative error codes
in an unsigned long makes it never equal to -ETIMEDOUT, causing logical
errors.

Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback")
Signed-off-by: Qianfeng Rong <[email-masked]>
Reviewed-by: Dmitry Baryshkov <[email-masked]>
Patchwork: https://patchwork.freedesktop.org/patch/671100/
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
index 05a09d86e1838..fd5f9d04f81e6 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c
@@ -452,7 +452,7 @@ static void _dpu_encoder_phys_wb_handle_wbdone_timeout(
 static int dpu_encoder_phys_wb_wait_for_commit_done(
 		struct dpu_encoder_phys *phys_enc)
 {
-	unsigned long ret;
+	int ret;
 	struct dpu_encoder_wait_info wait_info;
 	struct dpu_encoder_phys_wb *wb_enc = to_dpu_encoder_phys_wb(phys_enc);
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:08:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367184; cv=none; b=C2FJKIahNXAZ9V0MxW1TTAfLT/juGXA5jNYmP1oLFAXVk71AF3nhSul0YJoFS7JdRLF11NAV2UUTCABE4pNVh+TImJnZau8ixhMrePXYnUzq5rmV8Eyo+1Rym3oIk7ED5JbCp72tyjNhnZMyb9rqh+6ZbqDj1Ay3rVDjIN56tSY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367184; c=relaxed/simple;
	bh=lRPCop/zmG3oVkLgEFQhtWm5R/Qz8ufJNLDf0fN1yd0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=nQf1SEUQOCb7xVdXukElNmP4PQRyPZl58+/6PqGixC4dB2Omaz6X+UOSbVgf2vs/4vDEG38TprQUfvz7MjZAFZJiI5BKS0NbbAagkTI9UtlE0yEuci1xScpAo00J2hWqzNUKYW03nJtW592pR6aUSnORXZXwChByYsU6/XEn8ng=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ER5pyeN5; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Takashi Iwai <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 120/196] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
Date: Mon, 13 Oct 2025 16:44:53 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email-masked]>

[ Upstream commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b ]

When an invalid value is passed via quirk option, currently
bytcr_rt5640 driver just ignores and leaves as is, which may lead to
unepxected results like OOB access.

This patch adds the sanity check and corrects the input mapping to the
certain default value if an invalid value is passed.

Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks")
Signed-off-by: Takashi Iwai <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
index d74d184e1c7f3..b9990cb1181ff 100644
--- a/sound/soc/intel/boards/bytcr_rt5651.c
+++ b/sound/soc/intel/boards/bytcr_rt5651.c
@@ -58,7 +58,8 @@ enum {
 	BYT_RT5651_OVCD_SF_1P5	= (RT5651_OVCD_SF_1P5 << 13),
 };
 
-#define BYT_RT5651_MAP(quirk)		((quirk) & GENMASK(3, 0))
+#define BYT_RT5651_MAP_MASK		GENMASK(3, 0)
+#define BYT_RT5651_MAP(quirk)		((quirk) & BYT_RT5651_MAP_MASK)
 #define BYT_RT5651_JDSRC(quirk)		(((quirk) & GENMASK(7, 4)) >> 4)
 #define BYT_RT5651_OVCD_TH(quirk)	(((quirk) & GENMASK(12, 8)) >> 8)
 #define BYT_RT5651_OVCD_SF(quirk)	(((quirk) & GENMASK(14, 13)) >> 13)
@@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
 
 static void log_quirks(struct device *dev)
 {
-	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP)
+	int map;
+
+	map = BYT_RT5651_MAP(byt_rt5651_quirk);
+	switch (map) {
+	case BYT_RT5651_DMIC_MAP:
 		dev_info(dev, "quirk DMIC_MAP enabled");
-	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP)
+		break;
+	case BYT_RT5651_IN1_MAP:
 		dev_info(dev, "quirk IN1_MAP enabled");
-	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP)
+		break;
+	case BYT_RT5651_IN2_MAP:
 		dev_info(dev, "quirk IN2_MAP enabled");
-	if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP)
+		break;
+	case BYT_RT5651_IN1_IN2_MAP:
 		dev_info(dev, "quirk IN1_IN2_MAP enabled");
+		break;
+	default:
+		dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map);
+		byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK;
+		byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP;
+		break;
+	}
+
 	if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) {
 		dev_info(dev, "quirk realtek,jack-detect-source %ld\n",
 			 BYT_RT5651_JDSRC(byt_rt5651_quirk));
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:20:35 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367179; cv=none; b=IypZudgUwyaN6oVIc+cYud2sqiFiBlLIn4ogd8gnXiXEehnccgbZ17YlqU12tqnq4/O1ZbtNxkf96L30HIhP2UYrdoGdbq0oRgZlBdmMm0MZHoGVzm6MuJdPupQn1zO2B1hzHmHFDijkM8uUIpjU0YDA1Gq7kxMX1VC83xPPK98=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367179; c=relaxed/simple;
	bh=XVIz9GMYxC545Q3XAjPkClLHIBhBDMmSRXL6+JhbQAQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=kE4bi3TxTWejqkkguzfFKS1r8Dl/4cggIvEfAVrIlrkc4lNDOgpYB5jM+6HHUlN99SA29e8zSn8JqoD5RA+03qAAjCADKJZL5SINtF1rgWu6wMNJrBeqYf6VBm3tCGR+V4e3qCkqRADj1vm1WxIiu+lhhs3F6yXHq3ZOiJIQNLI=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=he9hUClE; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Takashi Iwai <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 118/196] ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
Date: Mon, 13 Oct 2025 16:44:51 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <[email-masked]>

[ Upstream commit b20eb0e8de383116f1e1470d74da2a3c83c4e345 ]

When an invalid value is passed via quirk option, currently
bytcht_es8316 driver just ignores and leaves as is, which may lead to
unepxected results like OOB access.

This patch adds the sanity check and corrects the input mapping to the
certain default value if an invalid value is passed.

Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks")
Signed-off-by: Takashi Iwai <[email-masked]>
Message-ID: <[email-masked]>
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 sound/soc/intel/boards/bytcht_es8316.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
index 4dd37848b30e3..fa2c3981dacac 100644
--- a/sound/soc/intel/boards/bytcht_es8316.c
+++ b/sound/soc/intel/boards/bytcht_es8316.c
@@ -46,7 +46,8 @@ enum {
 	BYT_CHT_ES8316_INTMIC_IN2_MAP,
 };
 
-#define BYT_CHT_ES8316_MAP(quirk)		((quirk) & GENMASK(3, 0))
+#define BYT_CHT_ES8316_MAP_MASK			GENMASK(3, 0)
+#define BYT_CHT_ES8316_MAP(quirk)		((quirk) & BYT_CHT_ES8316_MAP_MASK)
 #define BYT_CHT_ES8316_SSP0			BIT(16)
 #define BYT_CHT_ES8316_MONO_SPEAKER		BIT(17)
 #define BYT_CHT_ES8316_JD_INVERTED		BIT(18)
@@ -59,10 +60,23 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override");
 
 static void log_quirks(struct device *dev)
 {
-	if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN1_MAP)
+	int map;
+
+	map = BYT_CHT_ES8316_MAP(quirk);
+	switch (map) {
+	case BYT_CHT_ES8316_INTMIC_IN1_MAP:
 		dev_info(dev, "quirk IN1_MAP enabled");
-	if (BYT_CHT_ES8316_MAP(quirk) == BYT_CHT_ES8316_INTMIC_IN2_MAP)
+		break;
+	case BYT_CHT_ES8316_INTMIC_IN2_MAP:
 		dev_info(dev, "quirk IN2_MAP enabled");
+		break;
+	default:
+		dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to INTMIC_IN1_MAP\n", map);
+		quirk &= ~BYT_CHT_ES8316_MAP_MASK;
+		quirk |= BYT_CHT_ES8316_INTMIC_IN1_MAP;
+		break;
+	}
+
 	if (quirk & BYT_CHT_ES8316_SSP0)
 		dev_info(dev, "quirk SSP0 enabled");
 	if (quirk & BYT_CHT_ES8316_MONO_SPEAKER)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:10:03 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367164; cv=none; b=tOki1+lRarmLX4dSpydl7Sfrtwp7Jx8vSyVr8qU0MnQGMRF3twJPxT7CzHJ1EBTXR7CzT7kBuMlXrMfKBAwemNo3Rj5qOeT9o+QGF4nRIeWKOsxOODJ9I177Sh+tQzXhLMojrNm6mfPdWUAJKOVf4d9HYjj1je38BZOy87YVRfc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367164; c=relaxed/simple;
	bh=zmMbOMDi8IAkd5NFbdAysXAxLUeFxXczHAMzhcsm69Y=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=OU7Rp1ukYWGqnTbMJrJhKIO8Ecv8Ts1cngBT+FjTvpcjFBoEyiMiEPfZZ9G9bbkU1bTLMIgvnydQe71Mmt2de3qIt1VNl1GD57uYaO+ABgh6EsKF+ftdJrAhZ1127mKV4OIxjNTW8qUCfe7y3w+iBLhWVumIDeH5EZ6jYYCnsBM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=eXZ5B/dk; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Xichao Zhao <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 114/196] usb: phy: twl6030: Fix incorrect type for ret
Date: Mon, 13 Oct 2025 16:44:47 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xichao Zhao <[email-masked]>

[ Upstream commit b570b346ddd727c4b41743a6a2f49e7217c5317f ]

In the twl6030_usb_probe(), the variable ret is declared as
a u32 type. However, since ret may receive -ENODEV when accepting
the return value of omap_usb2_set_comparator().Therefore, its type
should be changed to int.

Fixes: 0e98de67bacba ("usb: otg: make twl6030_usb as a comparator driver to omap_usb2")
Signed-off-by: Xichao Zhao <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/usb/phy/phy-twl6030-usb.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
index ab3c38a7d8ac0..a73604af8960e 100644
--- a/drivers/usb/phy/phy-twl6030-usb.c
+++ b/drivers/usb/phy/phy-twl6030-usb.c
@@ -328,9 +328,8 @@ static int twl6030_set_vbus(struct phy_companion *comparator, bool enabled)
 
 static int twl6030_usb_probe(struct platform_device *pdev)
 {
-	u32 ret;
 	struct twl6030_usb	*twl;
-	int			status, err;
+	int			status, err, ret;
 	struct device_node	*np = pdev->dev.of_node;
 	struct device		*dev = &pdev->dev;
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:20:48 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367153; cv=none; b=AvBBOFD7IYS8D1ipWkmhIBOjSV2U5HNKne4Y4s87Iq72cqFTKMz0R/kCBGnyPzSPdrpTYkNvGhxdxl0p4Phu+OTVwGI3i5PvBRmZF3uHwvLL3YSgyd1HUahAPJd4sjQkv5wCmHNGJn/6vx9du8dMSaHGOBoU2E8GQ6R5j0VAjk4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367153; c=relaxed/simple;
	bh=l5Q1HNxPkcqgZ1lkEGrjSv1asNVw+i33zN9lSSTmQ3o=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=o9azy5S6A0cSGEXsn2Pla7nfZDKftdyNazKSK6aay5OwWmBJirIhY/VdNtVIAmvo+EVrv4G7ajarh51CZKJrogizx5AwJzaTs4RpldWXh848/Y19gp9Xe4qV46VZUPVwX7vLOWLoCGswTDVj2JvMie9xCUp0SrBvDYZQ/7Zv5c8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Hey5XJRj; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Stefan Kerkmann <[email-masked]>,
	Jeff Chen <[email-masked]>,
	Johannes Berg <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 110/196] wifi: mwifiex: send world regulatory domain to driver
Date: Mon, 13 Oct 2025 16:44:43 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: msgid.link]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Kerkmann <[email-masked]>

[ Upstream commit 56819d00bc2ebaa6308913c28680da5d896852b8 ]

The world regulatory domain is a restrictive subset of channel
configurations which allows legal operation of the adapter all over the
world. Changing to this domain should not be prevented.

Fixes: dd4a9ac05c8e1 ("mwifiex: send regulatory domain info to firmware only if alpha2 changed") changed
Signed-off-by: Stefan Kerkmann <[email-masked]>
Reviewed-by: Jeff Chen <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Johannes Berg <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/net/wireless/marvell/mwifiex/cfg80211.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 5e25060647b2d..3b9b75eb4cdb8 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -659,10 +659,9 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
 		return;
 	}
 
-	/* Don't send world or same regdom info to firmware */
-	if (strncmp(request->alpha2, "00", 2) &&
-	    strncmp(request->alpha2, adapter->country_code,
-		    sizeof(request->alpha2))) {
+	/* Don't send same regdom info to firmware */
+	if (strncmp(request->alpha2, adapter->country_code,
+		    sizeof(request->alpha2)) != 0) {
 		memcpy(adapter->country_code, request->alpha2,
 		       sizeof(request->alpha2));
 		mwifiex_send_domain_info_cmd_fw(wiphy);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:16:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367149; cv=none; b=ddKXMkzGMvXoZdl+QZSo4C3257tNWtHsw4WRqDbiMaQ6i0yxU3Q2nwHzOojm9oeqg5qDLQZNyCfJX1o485Jby6vfvMFxLNYkif3Xf0pBQRDFzlRzTQYqsfhYqFHM+EEhaGF9QPzhMoTW7WWRC4cVFHTM+onirWYZAhwNMxtjG7w=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367149; c=relaxed/simple;
	bh=Cq8LXpXX532+otaSRd8DrzKhZ+SC2UnrBqjWcjUx2nU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=DYUG7bzxd64QapU7gKJvuyZUfY6d9knEv/GcSqJT09pDjXRCdJ5s1SEL/bLTs1/BA5GMUY5Tx6ZuzNowN7G+X3YniQeek7uPKSM3aXOg3uLlPfSaXs3YHPbQQKteWDpdO9YFIrzS7t9db9geV9NU+vqu1UtqWZQ9i/67a5L1HLM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2AQZf48s; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 109/196] drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)
Date: Mon, 13 Oct 2025 16:44:42 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit 7009e3af0474aca5f64262b3c72fb6e23b232f9b ]

Port of commit 227545b9a08c ("drm/radeon/dpm: Disable sclk
switching on Oland when two 4K 60Hz monitors are connected")

This is an ad-hoc DPM fix, necessary because we don't have
proper bandwidth calculation for DCE 6.

We define "high pixelclock" for SI as higher than necessary
for 4K 30Hz. For example, 4K 60Hz and 1080p 144Hz fall into
this category.

When two high pixel clock displays are connected to Oland,
additionally disable shader clock switching, which results in
a higher voltage, thereby addressing some visible flickering.

v2:
Add more comments.
v3:
Split into two commits for easier review.

Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 31 ++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index b3c011542daf7..7a85c042a6db9 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -3430,12 +3430,14 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
 {
 	struct  si_ps *ps = si_get_ps(rps);
 	struct amdgpu_clock_and_voltage_limits *max_limits;
+	struct amdgpu_connector *conn;
 	bool disable_mclk_switching = false;
 	bool disable_sclk_switching = false;
 	u32 mclk, sclk;
 	u16 vddc, vddci, min_vce_voltage = 0;
 	u32 max_sclk_vddc, max_mclk_vddci, max_mclk_vddc;
 	u32 max_sclk = 0, max_mclk = 0;
+	u32 high_pixelclock_count = 0;
 	int i;
 
 	if (adev->asic_type == CHIP_HAINAN) {
@@ -3463,6 +3465,35 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
 		}
 	}
 
+	/* We define "high pixelclock" for SI as higher than necessary for 4K 30Hz.
+	 * For example, 4K 60Hz and 1080p 144Hz fall into this category.
+	 * Find number of such displays connected.
+	 */
+	for (i = 0; i < adev->mode_info.num_crtc; i++) {
+		if (!(adev->pm.dpm.new_active_crtcs & (1 << i)) ||
+			!adev->mode_info.crtcs[i]->enabled)
+			continue;
+
+		conn = to_amdgpu_connector(adev->mode_info.crtcs[i]->connector);
+
+		if (conn->pixelclock_for_modeset > 297000)
+			high_pixelclock_count++;
+	}
+
+	/* These are some ad-hoc fixes to some issues observed with SI GPUs.
+	 * They are necessary because we don't have something like dce_calcs
+	 * for these GPUs to calculate bandwidth requirements.
+	 */
+	if (high_pixelclock_count) {
+		/* On Oland, we observe some flickering when two 4K 60Hz
+		 * displays are connected, possibly because voltage is too low.
+		 * Raise the voltage by requiring a higher SCLK.
+		 * (Voltage cannot be adjusted independently without also SCLK.)
+		 */
+		if (high_pixelclock_count > 1 && adev->asic_type == CHIP_OLAND)
+			disable_sclk_switching = true;
+	}
+
 	if (rps->vce_active) {
 		rps->evclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].evclk;
 		rps->ecclk = adev->pm.dpm.vce_states[adev->pm.dpm.vce_level].ecclk;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:13:30 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367144; cv=none; b=iOloCydGOsyz2Otj1DJsFxYklOknF8ib2T2KIzQJTrH2NdC5tJkHIzRmRHxr12kmQ3IMnHRUdv3OsdeNtsTQ67Amk/U1UUrApYgLpW/kMhyOwknd8ToDsj/JG1p+U4NfHNMdxQJZXbuSL2V/Njgu8pCFfTvLgvbzNuRdfr8rK1g=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367144; c=relaxed/simple;
	bh=gqXG975p1Yrkl1hEr5Wzn+OxhsQMMhMPUY/Qh308FN4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=kozCx1SQvXjUoX+yxQc42ZrZweAXLEhTDppBmCvkz0KyPSPXb9sBPANmH/3BMr5bW7k75v7Z/KRkrSCIweQuBZuINQ5fyijWiRbOc9nQijUcxfLJbNMT0pGs5pfZsRI1JK+n2laqFu7KoI07esh6rAWvQNc03Lv976dkWm0Br8I=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Wbfd1Iqq; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 107/196] drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)
Date: Mon, 13 Oct 2025 16:44:40 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit 9003a0746864f39a0ef72bd45f8e1ad85d930d67 ]

Some parts of the code base expect that MCLK switching is turned
off when the vblank time is set to zero.

According to pp_pm_compute_clocks the non-DC code has issues
with MCLK switching with refresh rates over 120 Hz.

v3:
Add code comment to explain this better.
Add an if statement instead of changing the switch_limit.

Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index 267aa96edc890..b3c011542daf7 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -3066,7 +3066,13 @@ static bool si_dpm_vblank_too_short(void *handle)
 	/* we never hit the non-gddr5 limit so disable it */
 	u32 switch_limit = adev->gmc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 0;
 
-	if (vblank_time < switch_limit)
+	/* Consider zero vblank time too short and disable MCLK switching.
+	 * Note that the vblank time is set to maximum when no displays are attached,
+	 * so we'll still enable MCLK switching in that case.
+	 */
+	if (vblank_time == 0)
+		return true;
+	else if (vblank_time < switch_limit)
 		return true;
 	else
 		return false;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:23:36 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367141; cv=none; b=JHNMHbJmKKYugKls9NnNhnUva+6eZ9T2RvSQOOzOx05pFDLAXeC1I+lsEZrJEXsUrc2JRAbN2ABP7q16GzXx1vCghQwbgMqlbbZwHuD3TXgQGCj/zzMVda4i6BOQCQCuuRMMJk+jd0HRdZW1H/9va1bwF8bEMZzMpDGkIB0kVZI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367141; c=relaxed/simple;
	bh=/93KMfoRwWJ9m8YgBl5h/fnC3B+7Cx56A6uQQpjmzfk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=jzTU+aK3p3W6TXrsMxGD1g21+c17fQTPXfsS5sabep/ST6ZGQVPs1dZ/algTysSDy+F/nUz51UUwHBVO3lh2g0Vmep+gAmgP4lTbFyH4gLENxIOjDNM6bGSXz7XD4MrEu0cS/R+9Qx83lAVmaGiWO6XQGS0bEPCpBr3Q9w7LXPo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=jJ/d2fOV; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 106/196] drm/amd/pm: Adjust si_upload_smc_data register programming (v3)
Date: Mon, 13 Oct 2025 16:44:39 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit ce025130127437dc884c84c254170e27b2ce9309 ]

Based on some comments in dm_pp_display_configuration
above the crtc_index and line_time fields, these values
are programmed to the SMC to work around an SMC hang
when it switches MCLK.

According to Alex, the Windows driver programs them to:
mclk_change_block_cp_min = 200 / line_time
mclk_change_block_cp_max = 100 / line_time
Let's use the same for the sake of consistency.

Previously we used the watermark values, but it seemed buggy
as the code was mixing up low/high and A/B watermarks, and
was not saving a low watermark value on DCE 6, so
mclk_change_block_cp_max would be always zero previously.

Split this change off from the previous si_upload_smc_data
to make it easier to bisect, in case it causes any issues.

Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index 85ab0d87eb337..267aa96edc890 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -5813,8 +5813,8 @@ static int si_upload_smc_data(struct amdgpu_device *adev)
 		crtc_index = amdgpu_crtc->crtc_id;
 
 		if (amdgpu_crtc->line_time) {
-			mclk_change_block_cp_min = amdgpu_crtc->wm_high / amdgpu_crtc->line_time;
-			mclk_change_block_cp_max = amdgpu_crtc->wm_low / amdgpu_crtc->line_time;
+			mclk_change_block_cp_min = 200 / amdgpu_crtc->line_time;
+			mclk_change_block_cp_max = 100 / amdgpu_crtc->line_time;
 		}
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:08:04 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367132; cv=none; b=VgB+tdEn2xidW7cNOBg3HfvLXmouf5Ywp95zPJ/2345bs9wFbgBLkNOkbzeya17QDb/BKsWrDff86mgfg0qtHCGqj/wPCICGuY8YELRWRLVHKM9JVfIpyk2fIXMWAZomNPnzGORNyBgyWZxDJJs26OPVweFmaqdkL+L/JHa6zok=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367132; c=relaxed/simple;
	bh=St/Yhxoed6tWbvA7pYyhplY8UwdgC4l+A4Esh2d4yFw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=Kb01sYBUaOva5d09t8RzpX6GdBrJ5zmC6P0NPuhNlioAxvk1PkmLCECST0gaiaY+xcNGXCvAUJwwnkLDwB/l95hdyNcYinf35v1nru3D45CaB3Wao6yRfigzHwYp8sR7TsfqOJINyZjq3ZAS1mwOgG5Xjo6nv62X5OfLAHGr8jE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=f4HJ8FVF; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 104/196] drm/amd/pm: Disable ULV even if unsupported (v3)
Date: Mon, 13 Oct 2025 16:44:37 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit 3a0c3a4035f995e1f993dfaf4d63dc19e9b4bc1c ]

Always send PPSMC_MSG_DisableULV to the SMC, even if ULV mode
is unsupported, to make sure it is properly turned off.

v3:
Simplify si_disable_ulv further.
Always check the return value of amdgpu_si_send_msg_to_smc.

Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
index 52e4397d4a2a9..c17d567cf8bc5 100644
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -5617,14 +5617,10 @@ static int si_populate_smc_t(struct amdgpu_device *adev,
 
 static int si_disable_ulv(struct amdgpu_device *adev)
 {
-	struct si_power_info *si_pi = si_get_pi(adev);
-	struct si_ulv_param *ulv = &si_pi->ulv;
+	PPSMC_Result r;
 
-	if (ulv->supported)
-		return (amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV) == PPSMC_Result_OK) ?
-			0 : -EINVAL;
-
-	return 0;
+	r = amdgpu_si_send_msg_to_smc(adev, PPSMC_MSG_DisableULV);
+	return (r == PPSMC_Result_OK) ? 0 : -EINVAL;
 }
 
 static bool si_is_state_ulv_compatible(struct amdgpu_device *adev,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:09:14 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367129; cv=none; b=mPM1FXU7wVhjXRYcte9ZT8rDeBLyQwn3tALlrY299uoM4Rc2cnw/auuZtaV6xc8XSsWdXl/oPQ6u99G8IRpKoUNn4dFK8cUVSUvHVEVlCULmT7ilG9fFD6pHnbk4TOTrs7dP7GuR3VF3/aQKm0KJ9hZhRDdnekmwG9Sl+DtnIk4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367129; c=relaxed/simple;
	bh=bJtb8IsplqWbrQm6luLOz0AI/P75waZOgjtaFpaWLvw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=epbX5Uem1cx06lvpA2OHiNgG2xkyjm811qxceHcLEa0KDP+d7voEUKkGvtN7s/Hc2qjtb/7tHwuf3Bs3neiKm8y026lvfezjlj02liea5inSq313hurlTU90WQ/BgzneUUxz/8mPcd7HdFgsR5QeKQYd0x147m4fTPM5s2M47LQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uHcVNu0X; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Alex Deucher <[email-masked]>,
	=?UTF-8?q?Timur=20Krist=C3=B3f?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 103/196] drm/amdgpu: Power up UVD 3 for FW validation (v2)
Date: Mon, 13 Oct 2025 16:44:36 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Kristóf <[email-masked]>

[ Upstream commit c661219cd7be75bb5599b525f16a455a058eb516 ]

Unlike later versions, UVD 3 has firmware validation.
For this to work, the UVD should be powered up correctly.

When DPM is enabled and the display clock is off,
the SMU may choose a power state which doesn't power
the UVD, which can result in failure to initialize UVD.

v2:
Add code comments to explain about the UVD power state
and how UVD clock is turned on/off.

Fixes: b38f3e80ecec ("drm amdgpu: SI UVD v3_1 (v2)")
Reviewed-by: Alex Deucher <[email-masked]>
Signed-off-by: Timur Kristóf <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c | 29 +++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
index 0fef925b66024..e458e0d5801b0 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c
@@ -625,7 +625,22 @@ static void uvd_v3_1_enable_mgcg(struct amdgpu_device *adev,
  *
  * @handle: handle used to pass amdgpu_device pointer
  *
- * Initialize the hardware, boot up the VCPU and do some testing
+ * Initialize the hardware, boot up the VCPU and do some testing.
+ *
+ * On SI, the UVD is meant to be used in a specific power state,
+ * or alternatively the driver can manually enable its clock.
+ * In amdgpu we use the dedicated UVD power state when DPM is enabled.
+ * Calling amdgpu_dpm_enable_uvd makes DPM select the UVD power state
+ * for the SMU and afterwards enables the UVD clock.
+ * This is automatically done by amdgpu_uvd_ring_begin_use when work
+ * is submitted to the UVD ring. Here, we have to call it manually
+ * in order to power up UVD before firmware validation.
+ *
+ * Note that we must not disable the UVD clock here, as that would
+ * cause the ring test to fail. However, UVD is powered off
+ * automatically after the ring test: amdgpu_uvd_ring_end_use calls
+ * the UVD idle work handler which will disable the UVD clock when
+ * all fences are signalled.
  */
 static int uvd_v3_1_hw_init(void *handle)
 {
@@ -635,6 +650,15 @@ static int uvd_v3_1_hw_init(void *handle)
 	int r;
 
 	uvd_v3_1_mc_resume(adev);
+	uvd_v3_1_enable_mgcg(adev, true);
+
+	/* Make sure UVD is powered during FW validation.
+	 * It's going to be automatically powered off after the ring test.
+	 */
+	if (adev->pm.dpm_enabled)
+		amdgpu_dpm_enable_uvd(adev, true);
+	else
+		amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
 
 	r = uvd_v3_1_fw_validate(adev);
 	if (r) {
@@ -642,9 +666,6 @@ static int uvd_v3_1_hw_init(void *handle)
 		return r;
 	}
 
-	uvd_v3_1_enable_mgcg(adev, true);
-	amdgpu_asic_set_uvd_clocks(adev, 53300, 40000);
-
 	uvd_v3_1_start(adev);
 
 	r = amdgpu_ring_test_helper(ring);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:07:16 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367126; cv=none; b=kMUx3au+njwIty3FM8DFGLyGCl/IfwB1ageVYhAarlYS/XwNR3ZhJVS5EoCtbsqLIRcBac6aBbnfEmv7DZuTvzI9UgrWQ7+Xa+ZrHINZDOoLT7j5ApsndtErtuXySrJ8xKtzwUA48dhSy1G2L+IwwGwZi6UfmdWUoPOgFFTzLDg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367126; c=relaxed/simple;
	bh=HNQRUuHU3fvRkol4wjIQRmp6axJcz/gX4YzwqYS/8hI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=uakuvwl/70Tjza23MWtptEvF6Tq01ljm9kAIO3cCFXKrW2FfopxLtUIhig85g9KyAzq1ruARiiJ7MnBxZsSb/BeRde98sh06PufTYCILNzNnxCL/dhbFPwB1cKMpHNNgV+pVpv3kcPwb9Jn8fm8pKHD0uDinyuT1BlRy7+50MNc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Bo21+E36; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Chenghai Huang <[email-masked]>,
	Herbert Xu <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 102/196] crypto: hisilicon - re-enable address prefetch after device resuming
Date: Mon, 13 Oct 2025 16:44:35 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chenghai Huang <[email-masked]>

[ Upstream commit 0dcd21443d9308ed88909d35aa0490c3fc680a47 ]

When the device resumes from a suspended state, it will revert to its
initial state and requires re-enabling. Currently, the address prefetch
function is not re-enabled after device resuming. Move the address prefetch
enable to the initialization process. In this way, the address prefetch
can be enabled when the device resumes by calling the initialization
process.

Fixes: 607c191b371d ("crypto: hisilicon - support runtime PM for accelerator device")
Signed-off-by: Chenghai Huang <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/crypto/hisilicon/hpre/hpre_main.c |  3 +-
 drivers/crypto/hisilicon/qm.c             |  3 -
 drivers/crypto/hisilicon/sec2/sec_main.c  | 80 +++++++++++------------
 drivers/crypto/hisilicon/zip/zip_main.c   |  5 +-
 4 files changed, 43 insertions(+), 48 deletions(-)

diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
index b0596564d27d8..c72980dcce52b 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
@@ -690,6 +690,7 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)
 
 	/* Config data buffer pasid needed by Kunpeng 920 */
 	hpre_config_pasid(qm);
+	hpre_open_sva_prefetch(qm);
 
 	hpre_enable_clock_gate(qm);
 
@@ -1367,8 +1368,6 @@ static int hpre_pf_probe_init(struct hpre *hpre)
 	if (ret)
 		return ret;
 
-	hpre_open_sva_prefetch(qm);
-
 	hisi_qm_dev_err_init(qm);
 	ret = hpre_show_last_regs_init(qm);
 	if (ret)
diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
index a9bf65da30a68..42f1e7d0023e1 100644
--- a/drivers/crypto/hisilicon/qm.c
+++ b/drivers/crypto/hisilicon/qm.c
@@ -4268,9 +4268,6 @@ static void qm_restart_prepare(struct hisi_qm *qm)
 {
 	u32 value;
 
-	if (qm->err_ini->open_sva_prefetch)
-		qm->err_ini->open_sva_prefetch(qm);
-
 	if (qm->ver >= QM_HW_V3)
 		return;
 
diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
index 8dd4c0b10a74a..99f3e82e9ebfb 100644
--- a/drivers/crypto/hisilicon/sec2/sec_main.c
+++ b/drivers/crypto/hisilicon/sec2/sec_main.c
@@ -438,6 +438,45 @@ static void sec_set_endian(struct hisi_qm *qm)
 	writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
 }
 
+static void sec_close_sva_prefetch(struct hisi_qm *qm)
+{
+	u32 val;
+	int ret;
+
+	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+		return;
+
+	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+	val |= SEC_PREFETCH_DISABLE;
+	writel(val, qm->io_base + SEC_PREFETCH_CFG);
+
+	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
+					 val, !(val & SEC_SVA_DISABLE_READY),
+					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+	if (ret)
+		pci_err(qm->pdev, "failed to close sva prefetch\n");
+}
+
+static void sec_open_sva_prefetch(struct hisi_qm *qm)
+{
+	u32 val;
+	int ret;
+
+	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
+		return;
+
+	/* Enable prefetch */
+	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
+	val &= SEC_PREFETCH_ENABLE;
+	writel(val, qm->io_base + SEC_PREFETCH_CFG);
+
+	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
+					 val, !(val & SEC_PREFETCH_DISABLE),
+					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
+	if (ret)
+		pci_err(qm->pdev, "failed to open sva prefetch\n");
+}
+
 static void sec_engine_sva_config(struct hisi_qm *qm)
 {
 	u32 reg;
@@ -471,45 +510,7 @@ static void sec_engine_sva_config(struct hisi_qm *qm)
 		writel_relaxed(reg, qm->io_base +
 				SEC_INTERFACE_USER_CTRL1_REG);
 	}
-}
-
-static void sec_open_sva_prefetch(struct hisi_qm *qm)
-{
-	u32 val;
-	int ret;
-
-	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
-		return;
-
-	/* Enable prefetch */
-	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
-	val &= SEC_PREFETCH_ENABLE;
-	writel(val, qm->io_base + SEC_PREFETCH_CFG);
-
-	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_PREFETCH_CFG,
-					 val, !(val & SEC_PREFETCH_DISABLE),
-					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
-	if (ret)
-		pci_err(qm->pdev, "failed to open sva prefetch\n");
-}
-
-static void sec_close_sva_prefetch(struct hisi_qm *qm)
-{
-	u32 val;
-	int ret;
-
-	if (!test_bit(QM_SUPPORT_SVA_PREFETCH, &qm->caps))
-		return;
-
-	val = readl_relaxed(qm->io_base + SEC_PREFETCH_CFG);
-	val |= SEC_PREFETCH_DISABLE;
-	writel(val, qm->io_base + SEC_PREFETCH_CFG);
-
-	ret = readl_relaxed_poll_timeout(qm->io_base + SEC_SVA_TRANS,
-					 val, !(val & SEC_SVA_DISABLE_READY),
-					 SEC_DELAY_10_US, SEC_POLL_TIMEOUT_US);
-	if (ret)
-		pci_err(qm->pdev, "failed to close sva prefetch\n");
+	sec_open_sva_prefetch(qm);
 }
 
 static void sec_enable_clock_gate(struct hisi_qm *qm)
@@ -1092,7 +1093,6 @@ static int sec_pf_probe_init(struct sec_dev *sec)
 	if (ret)
 		return ret;
 
-	sec_open_sva_prefetch(qm);
 	hisi_qm_dev_err_init(qm);
 	sec_debug_regs_clear(qm);
 	ret = sec_show_last_regs_init(qm);
diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
index 4e10090067f18..044e7303cb632 100644
--- a/drivers/crypto/hisilicon/zip/zip_main.c
+++ b/drivers/crypto/hisilicon/zip/zip_main.c
@@ -578,6 +578,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
 		writel(AXUSER_BASE, base + HZIP_DATA_WUSER_32_63);
 		writel(AXUSER_BASE, base + HZIP_SGL_RUSER_32_63);
 	}
+	hisi_zip_open_sva_prefetch(qm);
 
 	/* let's open all compression/decompression cores */
 	dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val;
@@ -589,6 +590,7 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
 	       CQC_CACHE_WB_ENABLE | FIELD_PREP(SQC_CACHE_WB_THRD, 1) |
 	       FIELD_PREP(CQC_CACHE_WB_THRD, 1), base + QM_CACHE_CTL);
 
+	hisi_zip_set_high_perf(qm);
 	hisi_zip_enable_clock_gate(qm);
 
 	return 0;
@@ -1173,9 +1175,6 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
 	if (ret)
 		return ret;
 
-	hisi_zip_set_high_perf(qm);
-
-	hisi_zip_open_sva_prefetch(qm);
 	hisi_qm_dev_err_init(qm);
 	hisi_zip_debug_regs_clear(qm);
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:08:38 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367115; cv=none; b=Kwrwny9YnlsucJA+7CNUfE/DMJRdkuN6pjIz7c/fTNRDTmqPtq6BgnPKkD1LJWlTFNEJC8dp5NjM6wHylcIGyO4qEUHiIIX12OkAu6pdEC2TySAytMSjKKZ06UKOWOSiOU3w0ApTrbzzbxkO6+LhXhpGLBiA1TwoZW0OCMzOelY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367115; c=relaxed/simple;
	bh=/lyBYK2cTBV9j7kzzmHHkIG7qJ9+7vBaFkJRjQ0ezOo=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=nLEMkeC53iTOfj1Tx28Vtz6X/9CL7XG759EkoeDF86zs8HDcIe2Mqgt7wckoHKbm0raulxLzynKrGedgRnHU92INDAV+RoK3xtMu534WdI0yAC34Yq9MY8poxScvHwSNc/yBJDQwXV7XfSaKO1QQrU22gMqi4qTgDdtHRhJAYqE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XN/l4i/V; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhang Shurong <[email-masked]>,
	Jacopo Mondi <[email-masked]>,
	Sakari Ailus <[email-masked]>,
	Hans Verkuil <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 098/196] media: rj54n1cb0c: Fix memleak in rj54n1_probe()
Date: Mon, 13 Oct 2025 16:44:31 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  2.0 PDS_OTHER_BAD_TLD      Untrustworthy TLDs
                             [URI: rect.top (top)]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 24

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhang Shurong <[email-masked]>

[ Upstream commit fda55673ecdabf25f5ecc61b5ab17239257ac252 ]

rj54n1_probe() won't clean all the allocated resources in fail
path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to
prevent memleak.

Fixes: f187352dcd45 ("media: i2c: Copy rj54n1cb0c soc_camera sensor driver")
Signed-off-by: Zhang Shurong <[email-masked]>
Reviewed-by: Jacopo Mondi <[email-masked]>
Signed-off-by: Sakari Ailus <[email-masked]>
Signed-off-by: Hans Verkuil <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/media/i2c/rj54n1cb0c.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/media/i2c/rj54n1cb0c.c b/drivers/media/i2c/rj54n1cb0c.c
index 1c3502f34cd37..86f4971222ba7 100644
--- a/drivers/media/i2c/rj54n1cb0c.c
+++ b/drivers/media/i2c/rj54n1cb0c.c
@@ -1332,10 +1332,13 @@ static int rj54n1_probe(struct i2c_client *client,
 			V4L2_CID_GAIN, 0, 127, 1, 66);
 	v4l2_ctrl_new_std(&rj54n1->hdl, &rj54n1_ctrl_ops,
 			V4L2_CID_AUTO_WHITE_BALANCE, 0, 1, 1, 1);
-	rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
-	if (rj54n1->hdl.error)
-		return rj54n1->hdl.error;
 
+	if (rj54n1->hdl.error) {
+		ret = rj54n1->hdl.error;
+		goto err_free_ctrl;
+	}
+
+	rj54n1->subdev.ctrl_handler = &rj54n1->hdl;
 	rj54n1->clk_div		= clk_div;
 	rj54n1->rect.left	= RJ54N1_COLUMN_SKIP;
 	rj54n1->rect.top	= RJ54N1_ROW_SKIP;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:22:20 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367195; cv=none; b=MZ3bP+xKedJICLlh3l7gf3OaKKHvuLboJS46/qmTywEMSQpUxTsTeMHaCk/+GX2cuLF8e/KWpBAV1t39Edt8R96rpUq0TN4iMBjyxZjMmFGLnHR1WklNpYj0/yGDlGeKeCvzpr98HSfARGY2kskqMO2zvOpMlVLHR7VU+Ez0bEs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367195; c=relaxed/simple;
	bh=0Kr8/VEq7Ts61TeSjkqzdNMncoIhNA0IXS7Xx4BDsMk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=UvxLVlmFw5s5EvgleF2+26kkHNsY7OzWob0Lx+HUegsfX6iEYZQGpWkDlSPHYANkA7hhsWcV1ZWNyklUHNdnjOQt7V2XGw4iF/pjxNDC1jPZnmJqOfwxOuRqcpk0UDQqWR1BcGFNMR7fiIBukTR/ZhM8s9rcWJ1oEobXjezJenQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Rjwafhl3; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 092/196] usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
Date: Mon, 13 Oct 2025 16:44:25 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email-masked]>

[ Upstream commit 186e8f2bdba551f3ae23396caccd452d985c23e3 ]

The kthread_run() function returns error pointers so the
max3421_hcd->spi_thread pointer can be either error pointers or NULL.
Check for both before dereferencing it.

Fixes: 05dfa5c9bc37 ("usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning")
Signed-off-by: Dan Carpenter <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/usb/host/max3421-hcd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index 8aaafba058aa9..f170741206e1d 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1925,7 +1925,7 @@ max3421_probe(struct spi_device *spi)
 	if (hcd) {
 		kfree(max3421_hcd->tx);
 		kfree(max3421_hcd->rx);
-		if (max3421_hcd->spi_thread)
+		if (!IS_ERR_OR_NULL(max3421_hcd->spi_thread))
 			kthread_stop(max3421_hcd->spi_thread);
 		usb_put_hcd(hcd);
 	}
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:23:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367192; cv=none; b=okDRVIFNmCWxEWIoJA3x3IohO7IrcLnJH/2dUcVKvK5PtaN8nR0hbWkPAIR+zUklcyAZhgwIn55nxJvVTrj+NcQQIShnjHfGnLbW4zS5D6S1GKj/wSlFwJfqlbt3KBtEiLi152XSNpSkHFLFsbzg48FHvf3h2hk0W0OOLMirG7k=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367192; c=relaxed/simple;
	bh=K67+G9JejPvHyxsqNKTmvxotVNZDzAAfFKlIp6/CB3Y=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=fi58LGnIc/NGbRgwIPHYy+yf7wb/7MHz8I/s+cM0Nehgk6GPY9ETgpekVKZDejmOhYEUKJN1NI8+M8nM0WJafUqKOnBmBgQWEF9WoxFwL5JfciJtBEcGv7F+8Ng/dGaiofHdRXGK3h/rwpbUhKBAhXl95sVexwlfpBm6clMb09I=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=iKFuxSp4; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	=?UTF-8?q?Christian=20K=C3=B6nig?= <[email-masked]>,
	Brahmajit Das <[email-masked]>,
	Alex Deucher <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 091/196] drm/radeon/r600_cs: clean up of dead code in r600_cs
Date: Mon, 13 Oct 2025 16:44:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brahmajit Das <[email-masked]>

[ Upstream commit 260dcf5b06d519bcf27a5dfdb5c626821a55c170 ]

GCC 16 enables -Werror=unused-but-set-variable= which results in build
error with the following message.

drivers/gpu/drm/radeon/r600_cs.c: In function ‘r600_texture_size’:
drivers/gpu/drm/radeon/r600_cs.c:1411:29: error: variable ‘level’ set but not used [-Werror=unused-but-set-variable=]
 1411 |         unsigned offset, i, level;
      |                             ^~~~~
cc1: all warnings being treated as errors
make[6]: *** [scripts/Makefile.build:287: drivers/gpu/drm/radeon/r600_cs.o] Error 1

level although is set, but in never used in the function
r600_texture_size. Thus resulting in dead code and this error getting
triggered.

Fixes: 60b212f8ddcd ("drm/radeon: overhaul texture checking. (v3)")
Acked-by: Christian König <[email-masked]>
Signed-off-by: Brahmajit Das <[email-masked]>
Signed-off-by: Alex Deucher <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 780352f794e91..b63d935391dcd 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -1408,7 +1408,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
 			      unsigned block_align, unsigned height_align, unsigned base_align,
 			      unsigned *l0_size, unsigned *mipmap_size)
 {
-	unsigned offset, i, level;
+	unsigned offset, i;
 	unsigned width, height, depth, size;
 	unsigned blocksize;
 	unsigned nbx, nby;
@@ -1420,7 +1420,7 @@ static void r600_texture_size(unsigned nfaces, unsigned blevel, unsigned llevel,
 	w0 = r600_mip_minify(w0, 0);
 	h0 = r600_mip_minify(h0, 0);
 	d0 = r600_mip_minify(d0, 0);
-	for(i = 0, offset = 0, level = blevel; i < nlevels; i++, level++) {
+	for (i = 0, offset = 0; i < nlevels; i++) {
 		width = r600_mip_minify(w0, i);
 		nbx = r600_fmt_get_nblocksx(format, width);
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:09:49 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367190; cv=none; b=IrFEvl5SofSG2yViMDMk/nOOLeEwC5xKjZ52dyCzf9Nrplt1T8JgAN5ENZWW24LV7H5F+QR/uojl1eGCDOI/2PlLlbAAPWrnWbe7vsKfvR1C4KbLwDkwhvPpeKk/1uFuCjxaA2bhfuXpXqx+xICjouhEOOhlVrOudqMcCfMrYgc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367190; c=relaxed/simple;
	bh=T0YKKcwbdluc1qleqSsIRso61JsupwuAdqdNyP30E+k=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DDeY/WDR5mgpbJYwzk3qtsduLiGZTOB65/x5HEvgDC1ThzUKk7tDmMwRza8K+5XpQlq3E7X5ERreQ9mGsNn6aNFdDHrsjZoPfIzz6LmpwHdEcJ1r91ak2SCGVHkBplvmDcp4TRM1v7cuzxuBnYzS3h0u3wZBNrbVfvsAq1Uyo0Q=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uhQbZKvO; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Douglas Anderson <[email-masked]>,
	Neil Armstrong <[email-masked]>,
	Brigham Campbell <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 090/196] drm/panel: novatek-nt35560: Fix invalid return value
Date: Mon, 13 Oct 2025 16:44:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brigham Campbell <[email-masked]>

[ Upstream commit 125459e19ec654924e472f3ff5aeea40358dbebf ]

Fix bug in nt35560_set_brightness() which causes the function to
erroneously report an error. mipi_dsi_dcs_write() returns either a
negative value when an error occurred or a positive number of bytes
written when no error occurred. The buggy code reports an error under
either condition.

Fixes: 8152c2bfd780 ("drm/panel: Add driver for Sony ACX424AKP panel")
Reviewed-by: Douglas Anderson <[email-masked]>
Reviewed-by: Neil Armstrong <[email-masked]>
Signed-off-by: Brigham Campbell <[email-masked]>
Signed-off-by: Neil Armstrong <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/gpu/drm/panel/panel-novatek-nt35560.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panel/panel-novatek-nt35560.c b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
index cc7f96d708263..52df7e776fae0 100644
--- a/drivers/gpu/drm/panel/panel-novatek-nt35560.c
+++ b/drivers/gpu/drm/panel/panel-novatek-nt35560.c
@@ -162,7 +162,7 @@ static int nt35560_set_brightness(struct backlight_device *bl)
 		par = 0x00;
 		ret = mipi_dsi_dcs_write(dsi, MIPI_DCS_WRITE_CONTROL_DISPLAY,
 					 &par, 1);
-		if (ret) {
+		if (ret < 0) {
 			dev_err(nt->dev, "failed to disable display backlight (%d)\n", ret);
 			return ret;
 		}
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:10:09 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367167; cv=none; b=NCoiGM2ACGj98AsDIk5UYEFRi/Bbz6Xn10QEU9MZZlNTDF87QizCGEDnFzcZsh/uMMNgxl3V/eGcsaNSWXI1CVFmifjao4wn45Y2JfaqcovXDTS9uadfdUDfmsii/9IVbI55GphgryO7Ks39Q4eaArgytFeioNCQinhvOarpR3k=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367167; c=relaxed/simple;
	bh=9ZPHbAOd+CawNmXw6hwMk3I0l4hl9dbuGmZ/xGdlOI0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=mwoomjTk2Ym+J2o66XKImyHqlsZQ+qo9jCnvbrO5OXDfuMDQQNLFjkrjwqDk56CJ0FgRspyFQtk0mU9Mm1waORAcL44eTpgGMiaIgQwcCKZdp/1rA7U4VCCzAFha4kEGQCoaCDr6ApvBCNRj/wjGa3Lqp8OOiHhPyRzL0gUWY+g=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=h+Z/rKoI; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Kohei Ito <[email-masked]>,
	Kunihiko Hayashi <[email-masked]>,
	Jarkko Nikula <[email-masked]>,
	Wolfram Sang <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 088/196] i2c: designware: Add disabling clocks when probe fails
Date: Mon, 13 Oct 2025 16:44:21 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kunihiko Hayashi <[email-masked]>

[ Upstream commit c149841b069ccc6e480b00e11f35a57b5d88c7bb ]

After an error occurs during probing state, dw_i2c_plat_pm_cleanup() is
called. However, this function doesn't disable clocks and the clock-enable
count keeps increasing. Should disable these clocks explicitly.

Fixes: 7272194ed391f ("i2c-designware: add minimal support for runtime PM")
Co-developed-by: Kohei Ito <[email-masked]>
Signed-off-by: Kohei Ito <[email-masked]>
Signed-off-by: Kunihiko Hayashi <[email-masked]>
Acked-by: Jarkko Nikula <[email-masked]>
Signed-off-by: Wolfram Sang <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i2c/busses/i2c-designware-platdrv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 74182db03a88b..a29f4ef793cf3 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -380,6 +380,7 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
 
 exit_probe:
 	dw_i2c_plat_pm_cleanup(dev);
+	i2c_dw_prepare_clk(dev, false);
 exit_reset:
 	reset_control_assert(dev->rst);
 	return ret;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:07:34 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367135; cv=none; b=IhaHlrqbsU6k8jIbS63AuexHKkpgv9QPfhZcYdW2DRhJMQF3GGSU1TI0LciWAKbnSdD8Q+HF+N7qKGc63GsEXxV61zuvug6C2D33SenzvRIwg12CatoRIKv+M6ftqvkhMJI3G2r8e8dy3a/qMYD/1inQDjANusbVI1KPPtg5WfI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367135; c=relaxed/simple;
	bh=Mw9eMDO5h2Vp73by5rD1idxLm45V3FlfKqeQhsrk1go=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=EdopEVv5Zz7Al35iOCn1TKM/i5Y7c7tFfpWyJgdY6Hl+v/M30q8cBFpG3IXXE0la1R9FvKL76i3PI6cs77QJD1Pn2XiDVu3nEhhvd6xe80PW+XW47GlNEy1e6pA1K9w1+G+qHk1XWMR5+FnQid265O9rlYnVnTsXgETn5+jYVmo=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=FVkx5Rg7; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	"Leilk.Liu" <[email-masked]>,
	Chen-Yu Tsai <[email-masked]>,
	Wolfram Sang <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 087/196] i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
Date: Mon, 13 Oct 2025 16:44:20 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leilk.Liu <[email-masked]>

[ Upstream commit b492183652808e0f389272bf63dc836241b287ff ]

The old IC does not support the I2C_MASTER_WRRD (write-then-read)
function, but the current code’s handling of i2c->auto_restart may
potentially lead to entering the I2C_MASTER_WRRD software flow,
resulting in unexpected bugs.

Instead of repurposing the auto_restart flag, add a separate flag
to signal I2C_MASTER_WRRD operations.

Also fix handling of msgs. If the operation (i2c->op) is
I2C_MASTER_WRRD, then the msgs pointer is incremented by 2.
For all other operations, msgs is simply incremented by 1.

Fixes: b2ed11e224a2 ("I2C: mediatek: Add driver for MediaTek MT8173 I2C controller")
Signed-off-by: Leilk.Liu <[email-masked]>
Suggested-by: Chen-Yu Tsai <[email-masked]>
Reviewed-by: Chen-Yu Tsai <[email-masked]>
Signed-off-by: Wolfram Sang <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i2c/busses/i2c-mt65xx.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
index fc7bfd98156ba..38d3dff7a2614 100644
--- a/drivers/i2c/busses/i2c-mt65xx.c
+++ b/drivers/i2c/busses/i2c-mt65xx.c
@@ -1218,6 +1218,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
 {
 	int ret;
 	int left_num = num;
+	bool write_then_read_en = false;
 	struct mtk_i2c *i2c = i2c_get_adapdata(adap);
 
 	ret = clk_bulk_enable(I2C_MT65XX_CLK_MAX, i2c->clocks);
@@ -1231,6 +1232,7 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
 		if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
 		    msgs[0].addr == msgs[1].addr) {
 			i2c->auto_restart = 0;
+			write_then_read_en = true;
 		}
 	}
 
@@ -1255,12 +1257,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
 		else
 			i2c->op = I2C_MASTER_WR;
 
-		if (!i2c->auto_restart) {
-			if (num > 1) {
-				/* combined two messages into one transaction */
-				i2c->op = I2C_MASTER_WRRD;
-				left_num--;
-			}
+		if (write_then_read_en) {
+			/* combined two messages into one transaction */
+			i2c->op = I2C_MASTER_WRRD;
+			left_num--;
 		}
 
 		/* always use DMA mode. */
@@ -1268,7 +1268,10 @@ static int mtk_i2c_transfer(struct i2c_adapter *adap,
 		if (ret < 0)
 			goto err_exit;
 
-		msgs++;
+		if (i2c->op == I2C_MASTER_WRRD)
+			msgs += 2;
+		else
+			msgs++;
 	}
 	/* the return value is number of executed messages */
 	ret = num;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:08:13 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367104; cv=none; b=VaW874V+JtXpniEw4tGOeyWhbvJ7Lkk4G2wnd1G9UtBMWiw/23dEnl20GanNEvyO7mJtPXgK+fu126jq9PUN6WKg4u2TP3mRLU6mmyL5Tt8+IbcoRP4TyOWJ5uUUjtxBO3FGspIZ8ATgbb3RKgMgjV7toqKeq7q8kH0gpO871zY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367104; c=relaxed/simple;
	bh=SqntwH/2wLjAtpv/fXlGlDW0A/SVxTwm2OBwio9wIcA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=B8Vg1xYq82fGGMUyzXqvj9D7ytjD0mUW//r3RBrw59E4mp81/pYyEfC6azpjxzlH2TlLV9nZELEpgfKzc2C8y2lSbRIbBiyxnPqmGDYUwZHRrQgLr91kNs2cNcxVHhD93IHty7FrIOyurUtm6gFEEhhNFhO1cbA580XRo1BuQbQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IPXpTELl; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	kernel test robot <[email-masked]>,
	Dmitry Baryshkov <[email-masked]>,
	Daniel Lezcano <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 086/196] thermal/drivers/qcom/lmh: Add missing IRQ includes
Date: Mon, 13 Oct 2025 16:44:19 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Baryshkov <[email-masked]>

[ Upstream commit b50b2c53f98fcdb6957e184eb488c16502db9575 ]

As reported by LKP, the Qualcomm LMH driver needs to include several
IRQ-related headers, which decrlare necessary IRQ functionality.
Currently driver builds on ARM64 platforms, where the headers are pulled
in implicitly by other headers, but fails to build on other platforms.

Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver")
Reported-by: kernel test robot <[email-masked]>
Closes: https://lore.kernel.org/oe-kbuild-all/[email-masked]/
Signed-off-by: Dmitry Baryshkov <[email-masked]>
Signed-off-by: Daniel Lezcano <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/thermal/qcom/lmh.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c
index 1434ab8f6988c..c7deb7c19d7a9 100644
--- a/drivers/thermal/qcom/lmh.c
+++ b/drivers/thermal/qcom/lmh.c
@@ -5,6 +5,8 @@
  */
 #include <linux/module.h>
 #include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/irqdesc.h>
 #include <linux/irqdomain.h>
 #include <linux/err.h>
 #include <linux/platform_device.h>
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:08:28 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367078; cv=none; b=HAYS3FJk6YoWY4WAufGmGwpTokbNu7nd8ZR5t8W6xadte71E11sN0B3dLP95IxWBeHxgK8YOqkBHjnBoApwG9QLrowPgL9Qv7D2wJl/hj+/Sjl+HUd1ROjSaW9p2cRD1V+O9YTjNOY7CA3ZkFK93O51o2tjDoZy6mP6AnWhFOI4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367078; c=relaxed/simple;
	bh=Az8wpxHLzrMS6fgQL4VdkRTcrr3XMZeWdqdM2whCdqc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=QVyRLammREEsqVop1AVD1p3rAGBNd5lJyaDownT/t1y7b4+D+VSYAKSczE4+F5Pa9Q4bz+ew1n+D9T6THZxooZdFvwp8uXrjAAHC/q1BsGWxa95hP0MukvktzPSCqqZuowuSZQv5t2I4Cff/6GI3y2gDdjKO1dd8tHSmEv2aJzQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mt9hYIXW; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Zhouyi Zhou <[email-masked]>,
	=?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 083/196] tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
Date: Mon, 13 Oct 2025 16:44:16 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Zhouyi Zhou <[email-masked]>

[ Upstream commit 0ff52df6b32a6b04a7c9dfe3d7a387aff215b482 ]

Commit d5094bcb5bfd ("tools/nolibc: define time_t in terms of
__kernel_old_time_t") made nolibc use the kernel's time type so that
`time_t` matches `timespec::tv_sec` on all ABIs (notably x32).

But since __kernel_old_time_t is fairly new, notably from 2020 in commit
94c467ddb273 ("y2038: add __kernel_old_timespec and __kernel_old_time_t"),
nolibc builds that rely on host headers may fail.

Switch to __kernel_time_t, which is the same as __kernel_old_time_t and
has existed for longer.

Tested in PPC VM of Open Source Lab of Oregon State University
(./tools/testing/selftests/rcutorture/bin/mkinitrd.sh)

Fixes: d5094bcb5bfd ("tools/nolibc: define time_t in terms of __kernel_old_time_t")
Signed-off-by: Zhouyi Zhou <[email-masked]>
[Thomas: Reformat commit and its message a bit]
Signed-off-by: Thomas Weißschuh <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/include/nolibc/std.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/include/nolibc/std.h b/tools/include/nolibc/std.h
index a0ea830e1ba17..f9eccd40c221f 100644
--- a/tools/include/nolibc/std.h
+++ b/tools/include/nolibc/std.h
@@ -46,6 +46,6 @@ typedef unsigned long       nlink_t;
 typedef   signed long         off_t;
 typedef   signed long     blksize_t;
 typedef   signed long      blkcnt_t;
-typedef __kernel_old_time_t  time_t;
+typedef __kernel_time_t      time_t;
 
 #endif /* _NOLIBC_STD_H */
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:06:59 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367070; cv=none; b=czFA/M6Xdpt9D1TQeI2gx9IPEoAASWTFtnGmQh20/1rgGEjpNtK17nhCz9ogLCRZLfU+TJxc7QfYV1xA3pu/IKUI8OqVEaXc349FY5mLuFX7j1ChBWxxageOPVMRSOocpeRTN4Uy09X/ztvURO/3xm2LvYVyyiZU+y4IyVKREao=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367070; c=relaxed/simple;
	bh=2DonojuFFLQbJo9qmAXhS5f4D8wlIqpTwlaQPctx6uY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=d5C5VVSDjcksQyD1lQt5vpzi/rBqR58Hl9b5TOmYse1M1+C87peolEHOEw4ytLnV8B2LdRNj1MwO5m0oLeOSbnWdTsrK+Bb4v7u04Osh+heYsI8SQmCnJz02p+1tXkvjz4wo14f5wrg5fG6INBuHUDnA0o9Yrgg/FXBNFUWnC9M=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=iRhX+VpA; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Akhilesh Patil <[email-masked]>,
	Shuah Khan <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 080/196] selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
Date: Mon, 13 Oct 2025 16:44:13 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Akhilesh Patil <[email-masked]>

[ Upstream commit e8cfc524eaf3c0ed88106177edb6961e202e6716 ]

Check if watchdog device supports WDIOF_KEEPALIVEPING option before
entering keep_alive() ping test loop. Fix watchdog-test silently looping
if ioctl based ping is not supported by the device. Exit from test in
such case instead of getting stuck in loop executing failing keep_alive()

watchdog_info:
 identity:              m41t93 rtc Watchdog
 firmware_version:      0
Support/Status: Set timeout (in seconds)
Support/Status: Watchdog triggers a management or other external alarm not a reboot

Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.
WDIOC_KEEPALIVE not supported by this device

without this change
Watchdog card disabled.
Watchdog timeout set to 5 seconds.
Watchdog ping rate set to 2 seconds.
Watchdog card enabled.
Watchdog Ticking Away!
(Where test stuck here forver silently)

Updated change log at commit time:
Shuah Khan <[email-masked]>

Link: https://lore.kernel.org/r/[email-masked]
Fixes: d89d08ffd2c5 ("selftests: watchdog: Fix ioctl SET* error paths to take oneshot exit path")
Signed-off-by: Akhilesh Patil <[email-masked]>
Signed-off-by: Shuah Khan <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/watchdog/watchdog-test.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
index 09773695d219f..4056706d63f7e 100644
--- a/tools/testing/selftests/watchdog/watchdog-test.c
+++ b/tools/testing/selftests/watchdog/watchdog-test.c
@@ -240,6 +240,12 @@ int main(int argc, char *argv[])
 	if (oneshot)
 		goto end;
 
+	/* Check if WDIOF_KEEPALIVEPING is supported */
+	if (!(info.options & WDIOF_KEEPALIVEPING)) {
+		printf("WDIOC_KEEPALIVE not supported by this device\n");
+		goto end;
+	}
+
 	printf("Watchdog Ticking Away!\n");
 
 	/*
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:09:20 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367067; cv=none; b=Xs2VIqHoyFTSRuSEN0SCNqiiRb1ZpQUtEnmGpOBAbpgcJoEvyg7TyRnojOlZNYRCdaUQ4XGYlX/qVkGfCvTmb8dAl/IC3sJdctDPB20spPp9Fi/Znob6mmZqPczrKHA5Poo+Q9GjhK4s37AgEAhCrMDK1NT99SkUxKLynQGcPeM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367067; c=relaxed/simple;
	bh=dhbUzt4y4GTQ1mTJXEM01gV/wFnlgpgk5BbbTGr63AU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=b+gU4qlG0DXYwUf677tDWyMSmlO5hlHuadKIApmf/YYAhKVs35rPfmAu0BKMf/6SsUQOpYVfG31Azd+pfAJu+hl3RtRm7JQyt0uKSrbrdbWcV97jpuYrIs4ysQ4wbbL6Z9o4sFDqrjx1OVUaLdtwHC+bZyZgr/qNiytugXJdyrQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=c1zUTikP; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Stanley Chu <[email-masked]>,
	Frank Li <[email-masked]>,
	Alexandre Belloni <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 079/196] i3c: master: svc: Recycle unused IBI slot
Date: Mon, 13 Oct 2025 16:44:12 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stanley Chu <[email-masked]>

[ Upstream commit 3448a934ba6f803911ac084d05a2ffce507ea6c6 ]

In svc_i3c_master_handle_ibi(), an IBI slot is fetched from the pool
to store the IBI payload. However, when an error condition is encountered,
the function returns without recycling the IBI slot, resulting in an IBI
slot leak.

Fixes: c85e209b799f ("i3c: master: svc: fix ibi may not return mandatory data byte")
Signed-off-by: Stanley Chu <[email-masked]>
Reviewed-by: Frank Li <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexandre Belloni <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i3c/master/svc-i3c-master.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index a18d5876678c1..fda472d84549b 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -361,6 +361,7 @@ static int svc_i3c_master_handle_ibi(struct svc_i3c_master *master,
 						SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000);
 	if (ret) {
 		dev_err(master->dev, "Timeout when polling for COMPLETE\n");
+		i3c_generic_ibi_recycle_slot(data->ibi_pool, slot);
 		return ret;
 	}
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:06:56 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367061; cv=none; b=ZTVExS4aa9ebzBlsFdUKUEwSMeRDQCCgdFeI4o4gd3Gx9ajHgdy1GEZFOU0dNjQUwxW5AwJ0aNG9dGfOUPX+9VyhvsOL6YfKx117XrIcfnRDDpm4q3zu7CxmULqtByMsjSwZgAJQR7g6MFrFCyesqgSK6oLKore9KC/b3tVLFSc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367061; c=relaxed/simple;
	bh=EpBND5AvBcn8GQP09s/SiwPC8NC6LhAfPKkQ7i8oWnU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=j8ue21nUH9eaIZoQx+NMPkphdhcGlL5/FHA43k/gFukcjueQ/939GZqLhB9YOQTEfVbwioUPN3tHAKAkod3LaVJPTnAqNnSPXVo93McFn7WxDnPv+U+p3Lm73ElU/bSv1HZADxBPBzAqqhJXNOqnRcB3f64cxsdAj4Ermzz3g2A=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bz/dH5mL; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Stanley Chu <[email-masked]>,
	Frank Li <[email-masked]>,
	Alexandre Belloni <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 078/196] i3c: master: svc: Use manual response for IBI events
Date: Mon, 13 Oct 2025 16:44:11 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stanley Chu <[email-masked]>

[ Upstream commit a7869b0a2540fd122eccec00ae7d4243166b0a60 ]

Driver wants to nack the IBI request when the target is not in the
known address list. In below code, svc_i3c_master_nack_ibi() will
cause undefined behavior when using AUTOIBI with auto response rule,
because hw always auto ack the IBI request.

    switch (ibitype) {
    case SVC_I3C_MSTATUS_IBITYPE_IBI:
            dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
            if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
                    svc_i3c_master_nack_ibi(master);
            ...
            break;

AutoIBI has another issue that the controller doesn't quit AutoIBI state
after IBIWON polling timeout when there is a SDA glitch(high->low->high).
1. SDA high->low: raising an interrupt to execute IBI ISR
2. SDA low->high
3. Driver writes an AutoIBI request
4. AutoIBI process does not start because SDA is not low
5. IBIWON polling times out
6. Controller reamins in AutoIBI state and doesn't accept EmitStop request

Emitting broadcast address with IBIRESP_MANUAL avoids both issues.

Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver")
Signed-off-by: Stanley Chu <[email-masked]>
Reviewed-by: Frank Li <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Alexandre Belloni <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/i3c/master/svc-i3c-master.c | 30 ++++++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
index 9b287f92d078d..a18d5876678c1 100644
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -422,9 +422,24 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
 	 */
 	writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS);
 
-	/* Acknowledge the incoming interrupt with the AUTOIBI mechanism */
-	writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI |
-	       SVC_I3C_MCTRL_IBIRESP_AUTO,
+	/*
+	 * Write REQUEST_START_ADDR request to emit broadcast address for arbitration,
+	 * instend of using AUTO_IBI.
+	 *
+	 * Using AutoIBI request may cause controller to remain in AutoIBI state when
+	 * there is a glitch on SDA line (high->low->high).
+	 * 1. SDA high->low, raising an interrupt to execute IBI isr.
+	 * 2. SDA low->high.
+	 * 3. IBI isr writes an AutoIBI request.
+	 * 4. The controller will not start AutoIBI process because SDA is not low.
+	 * 5. IBIWON polling times out.
+	 * 6. Controller reamins in AutoIBI state and doesn't accept EmitStop request.
+	 */
+	writel(SVC_I3C_MCTRL_REQUEST_START_ADDR |
+	       SVC_I3C_MCTRL_TYPE_I3C |
+	       SVC_I3C_MCTRL_IBIRESP_MANUAL |
+	       SVC_I3C_MCTRL_DIR(SVC_I3C_MCTRL_DIR_WRITE) |
+	       SVC_I3C_MCTRL_ADDR(I3C_BROADCAST_ADDR),
 	       master->regs + SVC_I3C_MCTRL);
 
 	/* Wait for IBIWON, should take approximately 100us */
@@ -444,10 +459,15 @@ static void svc_i3c_master_ibi_work(struct work_struct *work)
 	switch (ibitype) {
 	case SVC_I3C_MSTATUS_IBITYPE_IBI:
 		dev = svc_i3c_master_dev_from_addr(master, ibiaddr);
-		if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI))
+		if (!dev || !is_events_enabled(master, SVC_I3C_EVENT_IBI)) {
 			svc_i3c_master_nack_ibi(master);
-		else
+		} else {
+			if (dev->info.bcr & I3C_BCR_IBI_PAYLOAD)
+				svc_i3c_master_ack_ibi(master, true);
+			else
+				svc_i3c_master_ack_ibi(master, false);
 			svc_i3c_master_handle_ibi(master, dev);
+		}
 		break;
 	case SVC_I3C_MSTATUS_IBITYPE_HOT_JOIN:
 		if (is_events_enabled(master, SVC_I3C_EVENT_HOTJOIN))
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:07:30 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367052; cv=none; b=V3T7JKp4JejHcjrl+VQh1+w+dMVEjpVgsU58IQLXJMuAh2DLGOcs8j8HG9q32Fn9sGTcW9KH2KNKK54Zrxv8JljgevDB2xxafrbgINyT2/f0R0EJVt8c3PNg55tWnB0olq9SP3CLisktMqbEDZ/gojTYNPvTfWsF39lVLCezpKk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367052; c=relaxed/simple;
	bh=VN2JkLohh+8h937wy8zKJ+1DjVMsRkQCVVeJDHwfrKM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=SBpNd/H2SB2jzmap5oJhcNlN0hz+9QBq3AVVus22eBiPJkai7f3SMS5lW3MxCcx/DdCg9hetDINEpalR68OIh1LGoZ0afFjFEDi02wnLU2lh/YbEJD00UdlG8NuCQeYr02xxLWhf1//lXwTkIn9YGHoj1ZMoC1szwnTZBKEpgVM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=GWQAmg9s; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	AngeloGioacchino Del Regno <[email-masked]>,
	Fei Shao <[email-masked]>,
	Matthias Brugger <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 075/196] arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
Date: Mon, 13 Oct 2025 16:44:08 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: AngeloGioacchino Del Regno <[email-masked]>

[ Upstream commit ffe6a5d1dd4d4d8af0779526cf4e40522647b25f ]

This devicetree contained only the SoC compatible but lacked the
machine specific one: add a "mediatek,mt8516-pumpkin" compatible
to the list to fix dtbs_check warnings.

Fixes: 9983822c8cf9 ("arm64: dts: mediatek: add pumpkin board dts")
Signed-off-by: AngeloGioacchino Del Regno <[email-masked]>
Reviewed-by: Fei Shao <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Matthias Brugger <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
index cce642c538128..3d3db33a64dc6 100644
--- a/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts
@@ -11,7 +11,7 @@
 
 / {
 	model = "Pumpkin MT8516";
-	compatible = "mediatek,mt8516";
+	compatible = "mediatek,mt8516-pumpkin", "mediatek,mt8516";
 
 	memory@40000000 {
 		device_type = "memory";
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:06:24 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367046; cv=none; b=LjD8B/f/YoWbcYfoBtdyZTO1j+hmWR5ettlZQx51c6tFGzzPumVAIZcSWj6+oYFawOpeCmLLf3JsYQ/pkuvgHx6alErOutRdFA2KFHtQgwMmxFbQBFXJjt8mAaRyliviCcBfLnxNiU9AxOVaztNAi3neU2u23EILVjk5hxTNoHg=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367046; c=relaxed/simple;
	bh=Nx01DCgUKZCK4JIuudxbrRHQotOegdsllWKtX3xHTgg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Pbf7LbdjLt45u8Bk4jY45iGfHTAFvVC4NI+qoLGIr5JXW1sx53jbZFXBqx70fpnEYv2oHetbMNlAj6bqq2sw5TYSmapB2IU9rAgi3KXVKO2ooywG7k7WjBm7Hwpi25j4VZ1IcC899A9CiyeYedVQGutLnwjZhYQJBZDOoX/pVVQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=B3clDanA; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Johan Hovold <[email-masked]>,
	Neil Armstrong <[email-masked]>,
	Martin Blumenstingl <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 073/196] firmware: firmware: meson-sm: fix compile-test default
Date: Mon, 13 Oct 2025 16:44:06 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email-masked]>

[ Upstream commit 0454346d1c5f7fccb3ef6e3103985de8ab3469f3 ]

Enabling compile testing should not enable every individual driver (we
have "allyesconfig" for that).

Fixes: 4a434abc40d2 ("firmware: meson-sm: enable build as module")
Signed-off-by: Johan Hovold <[email-masked]>
Reviewed-by: Neil Armstrong <[email-masked]>
Reviewed-by: Martin Blumenstingl <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Neil Armstrong <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/firmware/meson/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/meson/Kconfig b/drivers/firmware/meson/Kconfig
index f2fdd37566482..179f5d46d8ddf 100644
--- a/drivers/firmware/meson/Kconfig
+++ b/drivers/firmware/meson/Kconfig
@@ -5,7 +5,7 @@
 config MESON_SM
 	tristate "Amlogic Secure Monitor driver"
 	depends on ARCH_MESON || COMPILE_TEST
-	default y
+	default ARCH_MESON
 	depends on ARM64_4K_PAGES
 	help
 	  Say y here to enable the Amlogic secure monitor driver
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:08:29 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367023; cv=none; b=idOETnFrBurUEPtv7imjSISMSWjdQbBNVx0zI0qKPkQmnR0PyRqzAIVzwPWM48nnVVY/FFDHIT8EoHTSPiYbFhyic3O6ATFT1QZawE0Vfisqckp5ZE2XY4DQsS5s5QtIFSR5gRe4WcbKdQWOjDtKE4YNKx0sQ8UTOmsuHEOM5/g=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367023; c=relaxed/simple;
	bh=ptiI6Jf/lz0GSq1fahyUByaNsiW54kdApN4r/PZZhQE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=NBtiUpTq3PXUlpO+bqRmg7t9VkiYJQEY1MLDCzuAU5kPT0SpWs2y0y8AVvBerRDkXy15MqxCCvKJD/ktfGnZKv83HQC91LRtyukb3omEwIJeK2ezwBJDWnzMMinHxUq078pyzAwXD8o0y2DDjFxNHoaw1kCLzvJNgWEcknSsIkY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rOJxSWVC; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Qianfeng Rong <[email-masked]>,
	John Garry <[email-masked]>,
	Bart Van Assche <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 066/196] block: use int to store blk_stack_limits() return value
Date: Mon, 13 Oct 2025 16:43:59 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qianfeng Rong <[email-masked]>

[ Upstream commit b0b4518c992eb5f316c6e40ff186cbb7a5009518 ]

Change the 'ret' variable in blk_stack_limits() from unsigned int to int,
as it needs to store negative value -1.

Storing the negative error codes in unsigned type, or performing equality
comparisons (e.g., ret == -1), doesn't cause an issue at runtime [1] but
can be confusing.  Additionally, assigning negative error codes to unsigned
type may trigger a GCC warning when the -Wsign-conversion flag is enabled.

No effect on runtime.

Link: https://lore.kernel.org/all/x3wogjf6vgpkisdhg3abzrx7v7zktmdnfmqeih5kosszmagqfs@oh3qxrgzkikf/ #1
Signed-off-by: Qianfeng Rong <[email-masked]>
Reviewed-by: John Garry <[email-masked]>
Fixes: fe0b393f2c0a ("block: Correct handling of bottom device misaligment")
Reviewed-by: Bart Van Assche <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/blk-settings.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/block/blk-settings.c b/block/blk-settings.c
index 305b47a38429e..741c4085b9e45 100644
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -547,7 +547,8 @@ static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lb
 int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
 		     sector_t start)
 {
-	unsigned int top, bottom, alignment, ret = 0;
+	unsigned int top, bottom, alignment;
+	int ret = 0;
 
 	t->max_sectors = min_not_zero(t->max_sectors, b->max_sectors);
 	t->max_hw_sectors = min_not_zero(t->max_hw_sectors, b->max_hw_sectors);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:11:22 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367017; cv=none; b=C4OjvZ6qbP1AMtIkz1+dtf8lPe9UGa3WEDiCCrSjI9HrTmrvfaansVMA/rz/9+PLaavVwcBSQGKHUVKEa595pvsrKg51H99daV5FHFTo/oSfC51lnvMCs9nE7i6rwdaPHpvQU/ZkgfU/0UD9clkaJByZBVckfFnvTH0ruSzrMUs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367017; c=relaxed/simple;
	bh=YNMBOUQhVgwhmOd+Ob/ZqVK1bB/mFVsDPNdASWH7fGM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=cpoZsnc/6fpa7S2g/Qdc1t1hTU0LoQ8sGZKmRu9osKoVFc6HZhs5WNoOK4spAgAhqbpD7wn3084Po0c5k2f3zwGhMz+lgd1DnNhqvcHOejrR5KQxF1cAWDaqWi0tjMIkKUpB1c04qD0q8aAaWH6TP6VewoFjDjmKRirVou+G6kA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0u31t9Gu; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Nicolas Ferre <[email-masked]>,
	Alexandre Belloni <[email-masked]>,
	Claudiu Beznea <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 064/196] ARM: at91: pm: fix MCKx restore routine
Date: Mon, 13 Oct 2025 16:43:57 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolas Ferre <[email-masked]>

[ Upstream commit 296302d3d81360e09fa956e9be9edc8223b69a12 ]

The at91_mckx_ps_restore() assembly function is responsible for setting
back MCKx system bus clocks after exiting low power modes.

Fix a typo and use tmp3 variable instead of tmp2 to correctly set MCKx
to previously saved state.
Tmp2 was used without the needed changes in CSS and DIV. Moreover the
required bit 7, telling that MCR register's content is to be changed
(CMD/write), was not set.

Fix function comment to match tmp variables actually used.

Signed-off-by: Nicolas Ferre <[email-masked]>
Fixes: 28eb1d40fe57 ("ARM: at91: pm: add support for MCK1..4 save/restore for ulp modes")
Link: https://lore.kernel.org/r/[email-masked]
Reviewed-by: Alexandre Belloni <[email-masked]>
[claudiu.beznea: s/sate/state in commit description]
Signed-off-by: Claudiu Beznea <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm/mach-at91/pm_suspend.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
index e4904faf17532..0af2598899fc5 100644
--- a/arch/arm/mach-at91/pm_suspend.S
+++ b/arch/arm/mach-at91/pm_suspend.S
@@ -868,7 +868,7 @@ e_done:
 /**
  * at91_mckx_ps_restore: restore MCK1..4 settings
  *
- * Side effects: overwrites tmp1, tmp2
+ * Side effects: overwrites tmp1, tmp2 and tmp3
  */
 .macro at91_mckx_ps_restore
 #ifdef CONFIG_SOC_SAMA7
@@ -912,7 +912,7 @@ r_ps:
 	bic	tmp3, tmp3, #AT91_PMC_MCR_V2_ID_MSK
 	orr	tmp3, tmp3, tmp1
 	orr	tmp3, tmp3, #AT91_PMC_MCR_V2_CMD
-	str	tmp2, [pmc, #AT91_PMC_MCR_V2]
+	str	tmp3, [pmc, #AT91_PMC_MCR_V2]
 
 	wait_mckrdy tmp1
 
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:05:42 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367015; cv=none; b=j9WseFlbN6SLqwmpamCRwGJu0aSxh8T0Bjm3oAWjH570q+ruacQKCg2YhSgmgnRlXwfy9ylZBWvo0/4OylkgxXSUh1ci1LGF4R4qWynnTjzTCK9TwQR4n+16UrwVaiojxHcAwqYE4be1xqnGr3QB/CZxkryfI4gt1aKZv3V9dBw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367015; c=relaxed/simple;
	bh=5GhKVKCLfkK2hlAqxTKivjV6NkNkD6xKjvS50suBoUA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=TxXDTsemQS2f12B+2MAaXkkYyKjU6FzhtAb2BnvSbAyYQmG6qxgqqvx/VVEJ2DHbQy17uFEQaEdFc2+CNDYrFUvXxqMQTJeSz3ypUkFno5d5lDJmp+4jhuBNCVnpi+WERGY8Prmt6I8eJXhchdDd7GsBsse+mgvrjetDIf/mWOM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dHPZwnPD; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Li Nan <[email-masked]>,
	Yu Kuai <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 063/196] blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
Date: Mon, 13 Oct 2025 16:43:56 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Li Nan <[email-masked]>

[ Upstream commit 4c7ef92f6d4d08a27d676e4c348f4e2922cab3ed ]

In __blk_mq_update_nr_hw_queues() the return value of
blk_mq_sysfs_register_hctxs() is not checked. If sysfs creation for hctx
fails, later changing the number of hw_queues or removing disk will
trigger the following warning:

  kernfs: can not remove 'nr_tags', no directory
  WARNING: CPU: 2 PID: 637 at fs/kernfs/dir.c:1707 kernfs_remove_by_name_ns+0x13f/0x160
  Call Trace:
   remove_files.isra.1+0x38/0xb0
   sysfs_remove_group+0x4d/0x100
   sysfs_remove_groups+0x31/0x60
   __kobject_del+0x23/0xf0
   kobject_del+0x17/0x40
   blk_mq_unregister_hctx+0x5d/0x80
   blk_mq_sysfs_unregister_hctxs+0x94/0xd0
   blk_mq_update_nr_hw_queues+0x124/0x760
   nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
   nullb_device_submit_queues_store+0x92/0x120 [null_blk]

kobjct_del() was called unconditionally even if sysfs creation failed.
Fix it by checkig the kobject creation statusbefore deleting it.

Fixes: 477e19dedc9d ("blk-mq: adjust debugfs and sysfs register when updating nr_hw_queues")
Signed-off-by: Li Nan <[email-masked]>
Reviewed-by: Yu Kuai <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Jens Axboe <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 block/blk-mq-sysfs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
index 4515288fbe351..f5870efec33e9 100644
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -176,9 +176,11 @@ static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
 		return;
 
 	hctx_for_each_ctx(hctx, ctx, i)
-		kobject_del(&ctx->kobj);
+		if (ctx->kobj.state_in_sysfs)
+			kobject_del(&ctx->kobj);
 
-	kobject_del(&hctx->kobj);
+	if (hctx->kobj.state_in_sysfs)
+		kobject_del(&hctx->kobj);
 }
 
 static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:17:31 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367012; cv=none; b=R8WZuI6Ltuet/3tOaVaPQ8d7EOn3iyV5nBTpw4JcC494W8mq+yYNGxWb9zUbSb/7gZ8mmgbn7FfJkmA2D4wkuH+DuwS7W+3rPh3l8go8C3A+CMRjrmwu5SxU1y2jxmxUeiUNblu57pP3CtF0KHUz9+Jm1Tcas2Mt3pfGcovpXNQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367012; c=relaxed/simple;
	bh=zzIu59kSMjBqH5sOL4eqg1iSnIRIOK5MC0bNXdIji+g=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=YPgYfHic0FmOpvtzn1/jO3qIHU0VXa++jorfTa8r7wXmYq+0lroBeSfkJAKxdtx6RZq4T0/j1GPxomIoQRIodGiqTvbodOMCkXcBs8KQ/j6Nr+STEA3eRvd2FO+13IxD4+OJNlx7xSsg7NBEJNOM9fT5HecjEf9T9QVxlIs0LtQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Ngjbr1W6; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Da Xue <[email-masked]>,
	Linus Walleij <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 062/196] pinctrl: meson-gxl: add missing i2c_d pinmux
Date: Mon, 13 Oct 2025 16:43:55 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Da Xue <[email-masked]>

[ Upstream commit d8c2a9edd181f0cc4a66eec954b3d8f6a1d954a7 ]

Amlogic GXL has 4 I2C attached to gpio-periphs. I2C_D is on GPIOX_10/11.

Add the relevant func 3 pinmux per the datasheet for S805X/S905X/S905D.

Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
Signed-off-by: Da Xue <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Linus Walleij <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/pinctrl/meson/pinctrl-meson-gxl.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
index 51408996255bd..e2601e45935e6 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
@@ -187,6 +187,9 @@ static const unsigned int i2c_sda_c_pins[]	= { GPIODV_28 };
 static const unsigned int i2c_sck_c_dv19_pins[] = { GPIODV_19 };
 static const unsigned int i2c_sda_c_dv18_pins[] = { GPIODV_18 };
 
+static const unsigned int i2c_sck_d_pins[]	= { GPIOX_11 };
+static const unsigned int i2c_sda_d_pins[]	= { GPIOX_10 };
+
 static const unsigned int eth_mdio_pins[]	= { GPIOZ_0 };
 static const unsigned int eth_mdc_pins[]	= { GPIOZ_1 };
 static const unsigned int eth_clk_rx_clk_pins[] = { GPIOZ_2 };
@@ -411,6 +414,8 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = {
 	GPIO_GROUP(GPIO_TEST_N),
 
 	/* Bank X */
+	GROUP(i2c_sda_d,	5,	5),
+	GROUP(i2c_sck_d,	5,	4),
 	GROUP(sdio_d0,		5,	31),
 	GROUP(sdio_d1,		5,	30),
 	GROUP(sdio_d2,		5,	29),
@@ -651,6 +656,10 @@ static const char * const i2c_c_groups[] = {
 	"i2c_sck_c", "i2c_sda_c", "i2c_sda_c_dv18", "i2c_sck_c_dv19",
 };
 
+static const char * const i2c_d_groups[] = {
+	"i2c_sck_d", "i2c_sda_d",
+};
+
 static const char * const eth_groups[] = {
 	"eth_mdio", "eth_mdc", "eth_clk_rx_clk", "eth_rx_dv",
 	"eth_rxd0", "eth_rxd1", "eth_rxd2", "eth_rxd3",
@@ -777,6 +786,7 @@ static struct meson_pmx_func meson_gxl_periphs_functions[] = {
 	FUNCTION(i2c_a),
 	FUNCTION(i2c_b),
 	FUNCTION(i2c_c),
+	FUNCTION(i2c_d),
 	FUNCTION(eth),
 	FUNCTION(pwm_a),
 	FUNCTION(pwm_b),
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:20:54 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367006; cv=none; b=SBtfY+9OBFcsEyBn1T6rx0n/FyUJiov+NdxbOZ43Mh/4/E3t0gNji25+xImDjhgd2+eDvxTw+MpcAP+JGMbAm2zWz6b5/waz9s9HFnvyZydX8KD4dlagagDgsrbBEjmQ6lHpDx/P2zusAXCIznxoY3VOfjN6toKm8+1sz2cwixU=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367006; c=relaxed/simple;
	bh=HuEudgYtkX6qYDy1c41amkHXMCr2g9QC71xVhsYbKpM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=cuG+jc51hCQ6qmehPbuBU5Bu6PtcUUpJt4ugVFC4ilfGjvphU2Q/ERU8v2J9ptL6ZtSwUqK7JS+0gxJsjKRensy7TfwKcBtk/BJ8PLJM53eLY7E8j4qG4bx+UXE0s4iVw7nX3V8qDqbp73XR+DaV+Rsa9Yfn7u4e5U4kUwVGlk0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Ag4AUwno; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Huisong Li <[email-masked]>,
	"Rafael J. Wysocki" <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 060/196] ACPI: processor: idle: Fix memory leak when register cpuidle device failed
Date: Mon, 13 Oct 2025 16:43:53 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Huisong Li <[email-masked]>

[ Upstream commit 11b3de1c03fa9f3b5d17e6d48050bc98b3704420 ]

The cpuidle device's memory is leaked when cpuidle device registration
fails in acpi_processor_power_init().  Free it as appropriate.

Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
Signed-off-by: Huisong Li <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
[ rjw: Changed the order of the new statements, added empty line after if () ]
[ rjw: Changelog edits ]
Signed-off-by: Rafael J. Wysocki <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/acpi/processor_idle.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 3386d01c1f157..afa3b4ac367a3 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -1411,6 +1411,9 @@ int acpi_processor_power_init(struct acpi_processor *pr)
 		if (retval) {
 			if (acpi_processor_registered == 0)
 				cpuidle_unregister_driver(&acpi_idle_driver);
+
+			per_cpu(acpi_cpuidle_device, pr->id) = NULL;
+			kfree(dev);
 			return retval;
 		}
 		acpi_processor_registered++;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:21:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367092; cv=none; b=la80Lngvh+BAZd/gDW7wsgaiU7NxcruYSbjJxk4/EgLmP1o6ezAwxYaVt8P1D98J83Eed+Z+vLFl7NYjrYmKZBle3jEsrEqtqIQF8KNAU5nDhdZfZ+FC3ejbzDiwug9iQ7bxOhu8yq0iMchgsWoJTNi0jjjtbdjW2/jcLwFu+pc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367092; c=relaxed/simple;
	bh=yyGVQFbPyqgF939vUDqu+kJTknj8zD6zab8Gz5WMezU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=OgH96iLxZEM0Ekdr8oJL+aclJn5eAtVELa0ekr+3WtQVTNy4ThdsPt04fGe7Ue0R9yfqtp5PmkE2oC+gkDqAfvidpWObqrvLUPaYRsLO1fmM9/PAwT408Hfr1q4gQ+p4zv2hNTcoclWDPEA6E2M0JrUk9J1DmCPzVr8uS3iyUrw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rQdOo8Yn; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Matt Bobrowski <[email-masked]>,
	Martin KaFai Lau <[email-masked]>,
	Stanislav Fomichev <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 056/196] bpf/selftests: Fix test_tcpnotify_user
Date: Mon, 13 Oct 2025 16:43:49 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Matt Bobrowski <[email-masked]>

[ Upstream commit c80d79720647ed77ebc0198abd5a0807efdaff0b ]

Based on a bisect, it appears that commit 7ee988770326 ("timers:
Implement the hierarchical pull model") has somehow inadvertently
broken BPF selftest test_tcpnotify_user. The error that is being
generated by this test is as follows:

	FAILED: Wrong stats Expected 10 calls, got 8

It looks like the change allows timer functions to be run on CPUs
different from the one they are armed on. The test had pinned itself
to CPU 0, and in the past the retransmit attempts also occurred on CPU
0. The test had set the max_entries attribute for
BPF_MAP_TYPE_PERF_EVENT_ARRAY to 2 and was calling
bpf_perf_event_output() with BPF_F_CURRENT_CPU, so the entry was
likely to be in range. With the change to allow timers to run on other
CPUs, the current CPU tasked with performing the retransmit might be
bumped and in turn fall out of range, as the event will be filtered
out via __bpf_perf_event_output() using:

    if (unlikely(index >= array->map.max_entries))
            return -E2BIG;

A possible change would be to explicitly set the max_entries attribute
for perf_event_map in test_tcpnotify_kern.c to a value that's at least
as large as the number of CPUs. As it turns out however, if the field
is left unset, then the libbpf will determine the number of CPUs available
on the underlying system and update the max_entries attribute accordingly
in map_set_def_max_entries().

A further problem with the test is that it has a thread that continues
running up until the program exits. The main thread cleans up some
LIBBPF data structures, while the other thread continues to use them,
which inevitably will trigger a SIGSEGV. This can be dealt with by
telling the thread to run for as long as necessary and doing a
pthread_join on it before exiting the program.

Finally, I don't think binding the process to CPU 0 is meaningful for
this test any more, so get rid of that.

Fixes: 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification")
Signed-off-by: Matt Bobrowski <[email-masked]>
Signed-off-by: Martin KaFai Lau <[email-masked]>
Acked-by: Stanislav Fomichev <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Sasha Levin <[email-masked]>
---
 .../selftests/bpf/progs/test_tcpnotify_kern.c |  1 -
 .../selftests/bpf/test_tcpnotify_user.c       | 20 +++++++++----------
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
index 540181c115a85..ef00d38b0a8d2 100644
--- a/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
+++ b/tools/testing/selftests/bpf/progs/test_tcpnotify_kern.c
@@ -23,7 +23,6 @@ struct {
 
 struct {
 	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
-	__uint(max_entries, 2);
 	__type(key, int);
 	__type(value, __u32);
 } perf_event_map SEC(".maps");
diff --git a/tools/testing/selftests/bpf/test_tcpnotify_user.c b/tools/testing/selftests/bpf/test_tcpnotify_user.c
index 595194453ff8f..35b4893ccdf8a 100644
--- a/tools/testing/selftests/bpf/test_tcpnotify_user.c
+++ b/tools/testing/selftests/bpf/test_tcpnotify_user.c
@@ -15,20 +15,18 @@
 #include <bpf/libbpf.h>
 #include <sys/ioctl.h>
 #include <linux/rtnetlink.h>
-#include <signal.h>
 #include <linux/perf_event.h>
-#include <linux/err.h>
 
-#include "bpf_util.h"
 #include "cgroup_helpers.h"
 
 #include "test_tcpnotify.h"
-#include "trace_helpers.h"
 #include "testing_helpers.h"
 
 #define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L)
 
 pthread_t tid;
+static bool exit_thread;
+
 int rx_callbacks;
 
 static void dummyfn(void *ctx, int cpu, void *data, __u32 size)
@@ -45,7 +43,7 @@ void tcp_notifier_poller(struct perf_buffer *pb)
 {
 	int err;
 
-	while (1) {
+	while (!exit_thread) {
 		err = perf_buffer__poll(pb, 100);
 		if (err < 0 && err != -EINTR) {
 			printf("failed perf_buffer__poll: %d\n", err);
@@ -78,15 +76,10 @@ int main(int argc, char **argv)
 	int error = EXIT_FAILURE;
 	struct bpf_object *obj;
 	char test_script[80];
-	cpu_set_t cpuset;
 	__u32 key = 0;
 
 	libbpf_set_strict_mode(LIBBPF_STRICT_ALL);
 
-	CPU_ZERO(&cpuset);
-	CPU_SET(0, &cpuset);
-	pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset);
-
 	cg_fd = cgroup_setup_and_join(cg_path);
 	if (cg_fd < 0)
 		goto err;
@@ -151,6 +144,13 @@ int main(int argc, char **argv)
 
 	sleep(10);
 
+	exit_thread = true;
+	int ret = pthread_join(tid, NULL);
+	if (ret) {
+		printf("FAILED: pthread_join\n");
+		goto err;
+	}
+
 	if (verify_result(&g)) {
 		printf("FAILED: Wrong stats Expected %d calls, got %d\n",
 			g.ncalls, rx_callbacks);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:09:09 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367089; cv=none; b=jXnlKogrVbxpmWNEW19oazutMHawDoQr15AB7mWTcDnVtwH4CP1RsqyDHcMX521t8lfoIk3l1omt3wsJSo4+N1hU69SzcFJdzwM7Jk5PMKa82FARrzB89my+aqBkwu7AbntF42AdIx515cI7vwJLkHlmFpazYqRwbXL15MrU0lw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367089; c=relaxed/simple;
	bh=ovEkVSo0gb775omDXJUthTJwizrJsvIcwe25JGMekJM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=PtaRlJ0tXJIT0VdGlv2/7eNgoWzPxon/9hAAgD83vxBAlw3nZLHvmXVqnNfyu5WvAXR+oIoBgTr8zbpOBWyES+OlNqyFA6iE0zD7nYBsvLlr+ESlrjvyjApyKx71J/pwgM313TmM0wDdSQY/NR60VU+ETNXhCMBGRwc8yw55934=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=pvfcfCxf; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Geert Uytterhoeven <[email-masked]>,
	Mark Brown <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 055/196] regmap: Remove superfluous check for !config in __regmap_init()
Date: Mon, 13 Oct 2025 16:43:48 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email-masked]>

[ Upstream commit 5c36b86d2bf68fbcad16169983ef7ee8c537db59 ]

The first thing __regmap_init() do is check if config is non-NULL,
so there is no need to check for this again later.

Fixes: d77e745613680c54 ("regmap: Add bulk read/write callbacks into regmap_config")
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Link: https://patch.msgid.link/a154d[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/base/regmap/regmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 168532931c86d..bdbde64e4b21d 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -880,7 +880,7 @@ struct regmap *__regmap_init(struct device *dev,
 		map->read_flag_mask = bus->read_flag_mask;
 	}
 
-	if (config && config->read && config->write) {
+	if (config->read && config->write) {
 		map->reg_read  = _regmap_bus_read;
 		if (config->reg_update_bits)
 			map->reg_update_bits = config->reg_update_bits;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:06:39 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367087; cv=none; b=Ack3dIIG2ZmlVCgydslgRthriE2eIL+fvICQhLZk84mv2nJ7Kt1A3mmr11SIWFOf/xji6/gonHqV2kcxOYF+TIRpjr24UASne8hQ6GjzE5aHowO66SlUeTY14K21kmB1MB/AjvZCe7SR0gHSxjZLWiGIpqxbdYpPXDWqWM3SS50=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367087; c=relaxed/simple;
	bh=rznG/JWZU0cCSXpoA7wsuyk0O6o5BhIzwKTLMX8hFqY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=GujqxMWdYlbGe2eiixYkYJJwDOeemLZzrXQF49x2Z9mXRpqYWErmENQu0y+4GMgu0NVUwFbtzJstRV6VLrEJqs6mjEGQt0chFaRKpjo5epGEfE5IdnczCdoI1YWSWo9T76G6VdGbuLC2Pze0utln9GXgnLuOSVsuLRDWxu6N64Y=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=j4p2R6Nq; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Biju Das <[email-masked]>,
	Geert Uytterhoeven <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 054/196] arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0
Date: Mon, 13 Oct 2025 16:43:47 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Biju Das <[email-masked]>

[ Upstream commit ae014fbc99c7f986ee785233e7a5336834e39af4 ]

On RZ/G2LC SMARC EVK, CAN-FD channel0 is not populated, and currently we
are deleting a wrong and nonexistent node.  Fixing the wrong node would
invoke a dtb warning message, as channel0 is a required property.
Disable CAN-FD channel0 instead of deleting the node.

Fixes: 46da632734a5 ("arm64: dts: renesas: rzg2lc-smarc: Enable CANFD channel 1")
Signed-off-by: Biju Das <[email-masked]>
Reviewed-by: Geert Uytterhoeven <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
index 6be25a8a28db7..866f1358d57a4 100644
--- a/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
+++ b/arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi
@@ -50,7 +50,10 @@ aliases {
 #if (SW_SCIF_CAN || SW_RSPI_CAN)
 &canfd {
 	pinctrl-0 = <&can1_pins>;
-	/delete-node/ channel@0;
+
+	channel0 {
+		status = "disabled";
+	};
 };
 #else
 &canfd {
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:06:48 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367064; cv=none; b=pE6x29KL+92nlXJ0Uy6V0o0T+KdJrjU2JNQPRiJ0Vm159/dND8dLo5Tv2XS7s9r98rHfoAbg0wSTx7LafuFEBTla24qcRWoaEo6uZtP/4sr2esvhKPVvk4OXDsMnrT/qwJ1pw2wfwQQg+qhQ+heq5jW6+q03U+K8VtN03bU+o0U=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367064; c=relaxed/simple;
	bh=V+EA/HAYN4xAQmv1tLAZQoGTMRNG5Dw7RZ7cdv7LCAw=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=P+op4GlTrgJzHpbOp6EISfNXqqMZm+GBWoj8omjWpWG4dXHroeLTHTddw71RKMiqnb664kEcWYnnt8yNMgOIBLd4OekLmIyv16ddlpzl9DusuqCZwbFWogYsfrYHLwxdm3S8rHFhkxbt8QRNlaJOtmjK0vtsN14U3tcbseXcSLA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Zezx/nrb; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id D696AC4CEE7;
	Mon, 13 Oct 2025 14:51:03 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760367064;
	bh=V+EA/HAYN4xAQmv1tLAZQoGTMRNG5Dw7RZ7cdv7LCAw=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=Zezx/nrbo6xTPhoAliQwjBgbLOyLsLRPTkR1YzSML3d3g/O8ke7rv1gScPCwgbYv4
	 MsvAvv0YyGb55tzaV3nemzUD2XSt9EELiIHONr1UUXgdQQJ7iGRFk4Xib8uW6U/3Ya
	 2EAIsuDqoJwIk2C4ZO7Q1MY7Sw3RSrrfPOGIiaNU=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Namjae Jeon <[email-masked]>,
	Steve French <[email-masked]>,
	Tom Talpey <[email-masked]>,
	[email-masked],
	[email-masked],
	[email-masked],
	Stefan Metzmacher <[email-masked]>,
	Steve French <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 052/196] smb: server: fix IRD/ORD negotiation with the client
Date: Mon, 13 Oct 2025 16:43:45 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Metzmacher <[email-masked]>

[ Upstream commit fad988a2158d743da7971884b93482a73735b25e ]

Already do real negotiation in smb_direct_handle_connect_request()
where we see the requested initiator_depth and responder_resources
from the client.

We should detect legacy iwarp clients using MPA v1
with the custom IRD/ORD negotiation.

We need to send the custom IRD/ORD in big endian,
but we need to try to let clients with broken requests
using little endian (older cifs.ko) to work.

Note the reason why this uses u8 for
initiator_depth and responder_resources is
that the rdma layer also uses it.

Acked-by: Namjae Jeon <[email-masked]>
Cc: Steve French <[email-masked]>
Cc: Tom Talpey <[email-masked]>
Cc: [email-masked]
Cc: [email-masked]
Cc: [email-masked]
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Signed-off-by: Stefan Metzmacher <[email-masked]>
Signed-off-by: Steve French <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/smb/server/transport_rdma.c | 99 +++++++++++++++++++++++++++++-----
 1 file changed, 85 insertions(+), 14 deletions(-)

diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index 84b5b2f5df998..af1c41f922bb3 100644
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -152,6 +152,10 @@ struct smb_direct_transport {
 	struct work_struct	disconnect_work;
 
 	bool			negotiation_requested;
+
+	bool			legacy_iwarp;
+	u8			initiator_depth;
+	u8			responder_resources;
 };
 
 #define KSMBD_TRANS(t) ((struct ksmbd_transport *)&((t)->transport))
@@ -345,6 +349,9 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
 	t->cm_id = cm_id;
 	cm_id->context = t;
 
+	t->initiator_depth = SMB_DIRECT_CM_INITIATOR_DEPTH;
+	t->responder_resources = 1;
+
 	t->status = SMB_DIRECT_CS_NEW;
 	init_waitqueue_head(&t->wait_status);
 
@@ -1618,21 +1625,21 @@ static int smb_direct_send_negotiate_response(struct smb_direct_transport *t,
 static int smb_direct_accept_client(struct smb_direct_transport *t)
 {
 	struct rdma_conn_param conn_param;
-	struct ib_port_immutable port_immutable;
-	u32 ird_ord_hdr[2];
+	__be32 ird_ord_hdr[2];
 	int ret;
 
+	/*
+	 * smb_direct_handle_connect_request()
+	 * already negotiated t->initiator_depth
+	 * and t->responder_resources
+	 */
 	memset(&conn_param, 0, sizeof(conn_param));
-	conn_param.initiator_depth = min_t(u8, t->cm_id->device->attrs.max_qp_rd_atom,
-					   SMB_DIRECT_CM_INITIATOR_DEPTH);
-	conn_param.responder_resources = 0;
-
-	t->cm_id->device->ops.get_port_immutable(t->cm_id->device,
-						 t->cm_id->port_num,
-						 &port_immutable);
-	if (port_immutable.core_cap_flags & RDMA_CORE_PORT_IWARP) {
-		ird_ord_hdr[0] = conn_param.responder_resources;
-		ird_ord_hdr[1] = 1;
+	conn_param.initiator_depth = t->initiator_depth;
+	conn_param.responder_resources = t->responder_resources;
+
+	if (t->legacy_iwarp) {
+		ird_ord_hdr[0] = cpu_to_be32(conn_param.responder_resources);
+		ird_ord_hdr[1] = cpu_to_be32(conn_param.initiator_depth);
 		conn_param.private_data = ird_ord_hdr;
 		conn_param.private_data_len = sizeof(ird_ord_hdr);
 	} else {
@@ -2018,10 +2025,13 @@ static bool rdma_frwr_is_supported(struct ib_device_attr *attrs)
 	return true;
 }
 
-static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
+static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id,
+					     struct rdma_cm_event *event)
 {
 	struct smb_direct_transport *t;
 	struct task_struct *handler;
+	u8 peer_initiator_depth;
+	u8 peer_responder_resources;
 	int ret;
 
 	if (!rdma_frwr_is_supported(&new_cm_id->device->attrs)) {
@@ -2035,6 +2045,67 @@ static int smb_direct_handle_connect_request(struct rdma_cm_id *new_cm_id)
 	if (!t)
 		return -ENOMEM;
 
+	peer_initiator_depth = event->param.conn.initiator_depth;
+	peer_responder_resources = event->param.conn.responder_resources;
+	if (rdma_protocol_iwarp(new_cm_id->device, new_cm_id->port_num) &&
+	    event->param.conn.private_data_len == 8) {
+		/*
+		 * Legacy clients with only iWarp MPA v1 support
+		 * need a private blob in order to negotiate
+		 * the IRD/ORD values.
+		 */
+		const __be32 *ird_ord_hdr = event->param.conn.private_data;
+		u32 ird32 = be32_to_cpu(ird_ord_hdr[0]);
+		u32 ord32 = be32_to_cpu(ird_ord_hdr[1]);
+
+		/*
+		 * cifs.ko sends the legacy IRD/ORD negotiation
+		 * event if iWarp MPA v2 was used.
+		 *
+		 * Here we check that the values match and only
+		 * mark the client as legacy if they don't match.
+		 */
+		if ((u32)event->param.conn.initiator_depth != ird32 ||
+		    (u32)event->param.conn.responder_resources != ord32) {
+			/*
+			 * There are broken clients (old cifs.ko)
+			 * using little endian and also
+			 * struct rdma_conn_param only uses u8
+			 * for initiator_depth and responder_resources,
+			 * so we truncate the value to U8_MAX.
+			 *
+			 * smb_direct_accept_client() will then
+			 * do the real negotiation in order to
+			 * select the minimum between client and
+			 * server.
+			 */
+			ird32 = min_t(u32, ird32, U8_MAX);
+			ord32 = min_t(u32, ord32, U8_MAX);
+
+			t->legacy_iwarp = true;
+			peer_initiator_depth = (u8)ird32;
+			peer_responder_resources = (u8)ord32;
+		}
+	}
+
+	/*
+	 * First set what the we as server are able to support
+	 */
+	t->initiator_depth = min_t(u8, t->initiator_depth,
+				   new_cm_id->device->attrs.max_qp_rd_atom);
+
+	/*
+	 * negotiate the value by using the minimum
+	 * between client and server if the client provided
+	 * non 0 values.
+	 */
+	if (peer_initiator_depth != 0)
+		t->initiator_depth = min_t(u8, t->initiator_depth,
+					   peer_initiator_depth);
+	if (peer_responder_resources != 0)
+		t->responder_resources = min_t(u8, t->responder_resources,
+					       peer_responder_resources);
+
 	ret = smb_direct_connect(t);
 	if (ret)
 		goto out_err;
@@ -2059,7 +2130,7 @@ static int smb_direct_listen_handler(struct rdma_cm_id *cm_id,
 {
 	switch (event->event) {
 	case RDMA_CM_EVENT_CONNECT_REQUEST: {
-		int ret = smb_direct_handle_connect_request(cm_id);
+		int ret = smb_direct_handle_connect_request(cm_id, event);
 
 		if (ret) {
 			pr_err("Can't create transport: %d\n", ret);
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:07:46 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367001; cv=none; b=eUsosa9UPe2o9E6SdzEUVouHqpczaqEBuMPkMF4dsicABjf78b9NLDaJp/OXvWnHeyLomNViV+Ybl/e/4T6R6konWqoE7RcsVTZOEh9tVTGvjOi0dAsaAzyeMBRsz7J4A1GjvtjOaZ8nmhIExEqti81fLEI5yVjdow9V+5DO6B8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367001; c=relaxed/simple;
	bh=NovrTsFIN0u24jhXaH3iWAl7+xDAlFdRiB6/qQqTcQg=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=sc4qCceFOzXGgHw9WuUjErys2WtB45kFBHoos0aL2qr2IXfbL1z5uo3k9h46oiy0hfN8/bFs+WzhvTUYdqDB6N6ranTOxy/jgs9zd/WyaUXCmMq1YivokNj7+I8Wi7HZYOYtSS/HaEXGBIRg2VrTCub+kf9Ky6Mi8PJkYGbA/Tw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=A2MCL8wb; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Leo Yan <[email-masked]>,
	Will Deacon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 050/196] coresight: trbe: Prevent overflow in PERF_IDX2OFF()
Date: Mon, 13 Oct 2025 16:43:43 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leo Yan <[email-masked]>

[ Upstream commit 105f56877f2d5f82d71e20b45eb7be7c24c3d908 ]

Cast nr_pages to unsigned long to avoid overflow when handling large
AUX buffer sizes (>= 2 GiB).

Fixes: 3fbf7f011f24 ("coresight: sink: Add TRBE driver")
Signed-off-by: Leo Yan <[email-masked]>
Signed-off-by: Will Deacon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 drivers/hwtracing/coresight/coresight-trbe.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
index 925f6c9cecff4..bc6e247443e80 100644
--- a/drivers/hwtracing/coresight/coresight-trbe.c
+++ b/drivers/hwtracing/coresight/coresight-trbe.c
@@ -21,7 +21,8 @@
 #include "coresight-self-hosted-trace.h"
 #include "coresight-trbe.h"
 
-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
+#define PERF_IDX2OFF(idx, buf) \
+	((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
 
 /*
  * A padding packet that will help the user space tools
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:09:59 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760367101; cv=none; b=skuZkmDYqYgGFffLUn9DKww59LcaU/rJ6JlVsQdTtejf4t41MHVAHczE9smjGZVz7FV3XsesxvEtYBO/htC7rXnL9rRWacctXviuwXty1kcABxpmWBaz4Cq5QFm2VnlYSP1gEGZP8dipVnJL0FtK79nTAzIhZ8WQInSNcODZocc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760367101; c=relaxed/simple;
	bh=/gELB85Facq97UNnhWZ1U74WY119jXukpobHojdx8AQ=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=fFwgb4AJsjoMnTzUbtBpF2PuUK39sSuxCjoh7c3u7nh/cHy+ttpsQI514rOfgxcDdQYFGEsdhu+AOx6ubfjtRzWmMLqadUFsiJs2E5DNmVQ1QfBWhGt9YTXOROhrc/uqEiC5K857503NNSsYO0HryqBNjrAiLX+dz4SgaZtoP9Q=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mlpitBJK; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Bala-Vignesh-Reddy <[email-masked]>,
	Mark Brown <[email-masked]>,
	Will Deacon <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 049/196] selftests: arm64: Check fread return value in exec_target
Date: Mon, 13 Oct 2025 16:43:42 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bala-Vignesh-Reddy <[email-masked]>

[ Upstream commit a679e5683d3eef22ca12514ff8784b2b914ebedc ]

Fix -Wunused-result warning generated when compiled with gcc 13.3.0,
by checking fread's return value and handling errors, preventing
potential failures when reading from stdin.

Fixes compiler warning:
warning: ignoring return value of 'fread' declared with attribute
'warn_unused_result' [-Wunused-result]

Fixes: 806a15b2545e ("kselftests/arm64: add PAuth test for whether exec() changes keys")

Signed-off-by: Bala-Vignesh-Reddy <[email-masked]>
Reviewed-by: Mark Brown <[email-masked]>
Signed-off-by: Will Deacon <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 tools/testing/selftests/arm64/pauth/exec_target.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/arm64/pauth/exec_target.c b/tools/testing/selftests/arm64/pauth/exec_target.c
index 4435600ca400d..e597861b26d6b 100644
--- a/tools/testing/selftests/arm64/pauth/exec_target.c
+++ b/tools/testing/selftests/arm64/pauth/exec_target.c
@@ -13,7 +13,12 @@ int main(void)
 	unsigned long hwcaps;
 	size_t val;
 
-	fread(&val, sizeof(size_t), 1, stdin);
+	size_t size = fread(&val, sizeof(size_t), 1, stdin);
+
+	if (size != 1) {
+		fprintf(stderr, "Could not read input from stdin\n");
+		return EXIT_FAILURE;
+	}
 
 	/* don't try to execute illegal (unimplemented) instructions) caller
 	 * should have checked this and keep worker simple
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:10:40 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366978; cv=none; b=LgkUkrJYVdG/Gv/UGZ0Zvg7Xf86TlwsTIyuc004X9c5HbzPw5p4Qc7mSAHBP6MWkzm9qYwIus/G3avDpiZe73hvwEndxa3lhOuy3NBIapIVYOhSW141DPxnYkMSL4rJL4FvFZetRnQEpoJUSbnQLtI0BiUCn2Xxyiyox1sqfPSc=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366978; c=relaxed/simple;
	bh=UCHit4OlGhvvUTJWV6vPgkFrdsqNol+4AY0qYW68s20=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=nO1eIpDojs3ZBR2MecPmhdg032AaEU6jjv4Aq3F4AV8r6snqVHlYB5XDCohO0/6PutGxBIeaIPT4/NJMHCuKyFOuvP9A47CAASb2GS2bTCFLvwbcyI2tPqX3rzdCchj/hKoWxg9v7jd8OwP+HKmrqumtZfDB/gL9RRwwT5IPLnU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xdA6JJWV; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ali Polatel <[email-masked]>,
	Johannes Nixdorf <[email-masked]>,
	Kees Cook <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 048/196] seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast
Date: Mon, 13 Oct 2025 16:43:41 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johannes Nixdorf <[email-masked]>

[ Upstream commit cce436aafc2abad691fdd37de63ec8a4490b42ce ]

Normally the tracee starts in SECCOMP_NOTIFY_INIT, sends an
event to the tracer, and starts to wait interruptibly. With
SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV, if the tracer receives the
message (SECCOMP_NOTIFY_SENT is reached) while the tracee was waiting
and is subsequently interrupted, the tracee begins to wait again
uninterruptibly (but killable).

This fails if SECCOMP_NOTIFY_REPLIED is reached before the tracee
is interrupted, as the check only considered SECCOMP_NOTIFY_SENT as a
condition to begin waiting again. In this case the tracee is interrupted
even though the tracer already acted on its behalf. This breaks the
assumption SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV wanted to ensure,
namely that the tracer can be sure the syscall is not interrupted or
restarted on the tracee after it is received on the tracer. Fix this
by also considering SECCOMP_NOTIFY_REPLIED when evaluating whether to
switch to uninterruptible waiting.

With the condition changed the loop in seccomp_do_user_notification()
would exit immediately after deciding that noninterruptible waiting
is required if the operation already reached SECCOMP_NOTIFY_REPLIED,
skipping the code that processes pending addfd commands first. Prevent
this by executing the remaining loop body one last time in this case.

Fixes: c2aa2dfef243 ("seccomp: Add wait_killable semantic to seccomp user notifier")
Reported-by: Ali Polatel <[email-masked]>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220291
Signed-off-by: Johannes Nixdorf <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Kees Cook <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 kernel/seccomp.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index e9852d1b4a5ec..8dcb585ae78c1 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -1090,7 +1090,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn
 static bool should_sleep_killable(struct seccomp_filter *match,
 				  struct seccomp_knotif *n)
 {
-	return match->wait_killable_recv && n->state == SECCOMP_NOTIFY_SENT;
+	return match->wait_killable_recv && n->state >= SECCOMP_NOTIFY_SENT;
 }
 
 static int seccomp_do_user_notification(int this_syscall,
@@ -1134,13 +1134,11 @@ static int seccomp_do_user_notification(int this_syscall,
 
 		if (err != 0) {
 			/*
-			 * Check to see if the notifcation got picked up and
-			 * whether we should switch to wait killable.
+			 * Check to see whether we should switch to wait
+			 * killable. Only return the interrupted error if not.
 			 */
-			if (!wait_killable && should_sleep_killable(match, &n))
-				continue;
-
-			goto interrupted;
+			if (!(!wait_killable && should_sleep_killable(match, &n)))
+				goto interrupted;
 		}
 
 		addfd = list_first_entry_or_null(&n.addfd,
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:06:33 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366975; cv=none; b=tve0CY4vC8ac7SQxmS6OWt7UCp9yTvfNznc7Mq/38EvkpjQ38nr9AJx1slhFtaUA8PUJnUpHmlSz72s4LvKLqI5+SsWflmZCOE3VKx0WzOhq0p8TFCxUOj5gQr3Kf/3TeuvTo90fQm2rwltvOp9vsHVtInEGxusxjAfaJlRgUOM=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366975; c=relaxed/simple;
	bh=LTINxT0qULXGB909hgq00VgsRihINk2ylhBK6DMwChA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=DfssAXxlPR1U+w5a9Nf4fhi9/3eJwxDHOQIFIo1R/0O1W3hmW187u4GmlFvJXT0j0x85vZMERklULDsMGMkKjiLaQYrDggkjdtpGP1G0ZFdG039lNahlebtbZPoGwB+IWUbBvNLKZRp9qWGZfJ4aRZNLVlBRBDGZ4m58C2eHLcA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=srkClh/e; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Geert Uytterhoeven <[email-masked]>,
	Martin Wilck <[email-masked]>,
	David Disseldorp <[email-masked]>,
	Christian Brauner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 047/196] init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD
Date: Mon, 13 Oct 2025 16:43:40 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <[email-masked]>

[ Upstream commit 74792608606a525a0e0df7e8d48acd8000561389 ]

INITRAMFS_PRESERVE_MTIME is only used in init/initramfs.c and
init/initramfs_test.c.  Hence add a dependency on BLK_DEV_INITRD, to
prevent asking the user about this feature when configuring a kernel
without initramfs support.

Fixes: 1274aea127b2e8c9 ("initramfs: add INITRAMFS_PRESERVE_MTIME Kconfig option")
Signed-off-by: Geert Uytterhoeven <[email-masked]>
Reviewed-by: Martin Wilck <[email-masked]>
Reviewed-by: David Disseldorp <[email-masked]>
Signed-off-by: Christian Brauner <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 init/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/init/Kconfig b/init/Kconfig
index 8b6a2848da4a5..b70e0e05a1856 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1405,6 +1405,7 @@ config BOOT_CONFIG_EMBED_FILE
 
 config INITRAMFS_PRESERVE_MTIME
 	bool "Preserve cpio archive mtimes in initramfs"
+	depends on BLK_DEV_INITRD
 	default y
 	help
 	  Each entry in an initramfs cpio archive carries an mtime value. When
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:06:40 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366972; cv=none; b=rozXFlmTAcsXkXHA4OS9sRboWdBsVzQ0NuG6blYngLuWTTHbPW2ub4rFf/S+7fx4nYklpBMzqEIug5S2N4FGjOdqhwKKFKRUkSLnkWVXhQuSlurR0cRkcpqTgZRJTuBVQMkLSWkdaE9CmZtfdGeGXFUl+l7H3NtM146/rA30cRo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366972; c=relaxed/simple;
	bh=V4RaUqE685dvJb9fVIa7k082pE4VbJZtVYnG0eq3lf8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=lRQSePUId/L4cyS9N2cxpIplpG1S1nGdqA/tnxRZiBnb82IflVWXbPqwxyHZdOJlL3Tpgl23/5jaTfpZAB2a88CBnp8oWWjMuFviwvscWFfYmnx/9hIbI+c94QtCXjQbWAMkUiwt/4RC49Iwq1dnp+/+bl2p10oxf/Vrs2/H1ck=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=I+CsiAt+; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Jeff Layton <[email-masked]>,
	Christian Brauner <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 046/196] filelock: add FL_RECLAIM to show_fl_flags() macro
Date: Mon, 13 Oct 2025 16:43:39 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jeff Layton <[email-masked]>

[ Upstream commit c593b9d6c446510684da400833f9d632651942f0 ]

Show the FL_RECLAIM flag symbolically in tracepoints.

Fixes: bb0a55bb7148 ("nfs: don't allow reexport reclaims")
Signed-off-by: Jeff Layton <[email-masked]>
Link: https://lore.kernel.org/[email-masked]
Signed-off-by: Christian Brauner <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 include/trace/events/filelock.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h
index 1646dadd7f37c..3b1c8d93b2654 100644
--- a/include/trace/events/filelock.h
+++ b/include/trace/events/filelock.h
@@ -27,7 +27,8 @@
 		{ FL_SLEEP,		"FL_SLEEP" },			\
 		{ FL_DOWNGRADE_PENDING,	"FL_DOWNGRADE_PENDING" },	\
 		{ FL_UNLOCK_PENDING,	"FL_UNLOCK_PENDING" },		\
-		{ FL_OFDLCK,		"FL_OFDLCK" })
+		{ FL_OFDLCK,		"FL_OFDLCK" },			\
+		{ FL_RECLAIM,		"FL_RECLAIM"})
 
 #define show_fl_type(val)				\
 	__print_symbolic(val,				\
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:08:59 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366969; cv=none; b=OOINE4F9ZKHYwkYB7NSJaU/B6IKiXqNlYjKpQ5Tg9ONGD/R5JgnOT+Yig9gdLVQNtZlh+qvGrDnGpZZuTLzFZTT9eMK/A2Z0oyOhNNsM3qtsJ2lpXa9wQXoM4vJHZ/tw6cxCJ7xChTqNqPqQENruBb0WA8KRWIhczU0WJY8hZ8E=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366969; c=relaxed/simple;
	bh=GgDuRA229uhM/hJ43DYrSu2rdZVzTJSUTsgQsyu1+8E=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=moumzdWomfVZCX9gEFYD4+CjT6V0NOM4ImMm04tPhwMJOwhxdlKsJcOpyMClpKYESmXQmb5+l+Jz1ITWKSszrCU0/Zi05uOpQnqlQsj/YjnJtzIToHyLN8L89xOLNnVbNuP9cbohKN1sdqjGbADWMpddn1Wt0JsdrL1mAIc+ZCQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=RFstuw/x; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Nalivayko Sergey <[email-masked]>,
	Dominique Martinet <[email-masked]>
Subject: [PATCH 6.1 045/196] net/9p: fix double req put in p9_fd_cancelled
Date: Mon, 13 Oct 2025 16:43:38 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nalivayko Sergey <[email-masked]>

commit 674b56aa57f9379854cb6798c3bbcef7e7b51ab7 upstream.

Syzkaller reports a KASAN issue as below:

general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0xdead000000000108-0xdead00000000010f]
CPU: 0 PID: 5083 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00037-g855bd1d7d838 #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__list_del include/linux/list.h:114 [inline]
RIP: 0010:__list_del_entry include/linux/list.h:137 [inline]
RIP: 0010:list_del include/linux/list.h:148 [inline]
RIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734

Call Trace:
 <TASK>
 p9_client_flush+0x351/0x440 net/9p/client.c:614
 p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734
 p9_client_version net/9p/client.c:920 [inline]
 p9_client_create+0xb51/0x1240 net/9p/client.c:1027
 v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408
 v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126
 legacy_get_tree+0x108/0x220 fs/fs_context.c:632
 vfs_get_tree+0x8e/0x300 fs/super.c:1573
 do_new_mount fs/namespace.c:3056 [inline]
 path_mount+0x6a6/0x1e90 fs/namespace.c:3386
 do_mount fs/namespace.c:3399 [inline]
 __do_sys_mount fs/namespace.c:3607 [inline]
 __se_sys_mount fs/namespace.c:3584 [inline]
 __x64_sys_mount+0x283/0x300 fs/namespace.c:3584
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

This happens because of a race condition between:

- The 9p client sending an invalid flush request and later cleaning it up;
- The 9p client in p9_read_work() canceled all pending requests.

      Thread 1                              Thread 2
    ...
    p9_client_create()
    ...
    p9_fd_create()
    ...
    p9_conn_create()
    ...
    // start Thread 2
    INIT_WORK(&m->rq, p9_read_work);
                                        p9_read_work()
    ...
    p9_client_rpc()
    ...
                                        ...
                                        p9_conn_cancel()
                                        ...
                                        spin_lock(&m->req_lock);
    ...
    p9_fd_cancelled()
    ...
                                        ...
                                        spin_unlock(&m->req_lock);
                                        // status rewrite
                                        p9_client_cb(m->client, req, REQ_STATUS_ERROR)
                                        // first remove
                                        list_del(&req->req_list);
                                        ...

    spin_lock(&m->req_lock)
    ...
    // second remove
    list_del(&req->req_list);
    spin_unlock(&m->req_lock)
  ...

Commit 74d6a5d56629 ("9p/trans_fd: Fix concurrency del of req_list in
p9_fd_cancelled/p9_read_work") fixes a concurrency issue in the 9p filesystem
client where the req_list could be deleted simultaneously by both
p9_read_work and p9_fd_cancelled functions, but for the case where req->status
equals REQ_STATUS_RCVD.

Update the check for req->status in p9_fd_cancelled to skip processing not
just received requests, but anything that is not SENT, as whatever
changed the state from SENT also removed the request from its list.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Fixes: afd8d6541155 ("9P: Add cancelled() to the transport functions.")
Cc: [email-masked]
Signed-off-by: Nalivayko Sergey <[email-masked]>
Message-ID: <[email-masked]>
[updated the check from status == RECV || status == ERROR to status != SENT]
Signed-off-by: Dominique Martinet <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 net/9p/trans_fd.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -720,10 +720,10 @@ static int p9_fd_cancelled(struct p9_cli
 	p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
 
 	spin_lock(&m->req_lock);
-	/* Ignore cancelled request if message has been received
-	 * before lock.
-	 */
-	if (req->status == REQ_STATUS_RCVD) {
+	/* Ignore cancelled request if status changed since the request was
+	 * processed in p9_client_flush()
+	*/
+	if (req->status != REQ_STATUS_SENT) {
 		spin_unlock(&m->req_lock);
 		return 0;
 	}

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:06:16 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366966; cv=none; b=N0Biuxnrm2B/PPf8/xfvnfd6FXnzvkIYJCWYAZBJkyp74HXp20QzzdvqPzmUOxnQYuyqbJBDiuSrGKYap1gi3JwarNVjlJEJYkd8C1nzM211EtmqCGXwTE369h1MnKLtSEzW3qRRxok3sSfOxZwcnN5PDa4qRsx/UTgSMgWGJS0=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366966; c=relaxed/simple;
	bh=9MP2UFQDCXthLq61ZVuyFXuFPspEypPPm8Z0SciwPpk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=hV90k0k8wpAlv7tH6Z5cxGot3otALrwuzwLPYkIJErgnXF1jBfiyCcQ4q9Oy38biKtSPwMdo5FC0mUC8tshkWRH+yIdGlhV3+cputuiGAuoucqYyAEgsHcDxj1NQGJ/aX6axHKwDVCnhONoG954PB1bJ/nWTf5x13rtE0nu1/rs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Y5UY/N1b; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Yiqi Sun <[email-masked]>,
	Herbert Xu <[email-masked]>
Subject: [PATCH 6.1 044/196] crypto: rng - Ensure set_ent is always present
Date: Mon, 13 Oct 2025 16:43:37 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Herbert Xu <[email-masked]>

commit c0d36727bf39bb16ef0a67ed608e279535ebf0da upstream.

Ensure that set_ent is always set since only drbg provides it.

Fixes: 77ebdabe8de7 ("crypto: af_alg - add extra parameters for DRBG interface")
Reported-by: Yiqi Sun <[email-masked]>
Signed-off-by: Herbert Xu <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 crypto/rng.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/crypto/rng.c
+++ b/crypto/rng.c
@@ -174,6 +174,11 @@ out:
 EXPORT_SYMBOL_GPL(crypto_del_default_rng);
 #endif
 
+static void rng_default_set_ent(struct crypto_rng *tfm, const u8 *data,
+				unsigned int len)
+{
+}
+
 int crypto_register_rng(struct rng_alg *alg)
 {
 	struct crypto_alg *base = &alg->base;
@@ -185,6 +190,9 @@ int crypto_register_rng(struct rng_alg *
 	base->cra_flags &= ~CRYPTO_ALG_TYPE_MASK;
 	base->cra_flags |= CRYPTO_ALG_TYPE_RNG;
 
+	if (!alg->set_ent)
+		alg->set_ent = rng_default_set_ent;
+
 	return crypto_register_alg(base);
 }
 EXPORT_SYMBOL_GPL(crypto_register_rng);

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:14:48 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366958; cv=none; b=Jhkfv3csJFojdclwQ93c4wBsXzU/RFYM3ep7fVUX2U4oFetZbPaE93aA5NYMBjJStFHWluNBHBh2T0fcS60OF5G+OS+7rCTfzLnDJvrWvjxR7alPW/NH/H7mxJ0WDUCQw/IDkW4i0et18JNwQ0kQuQRArFt06vXlpBaLNd8ozxk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366958; c=relaxed/simple;
	bh=NiCz/rd604dIwOfXRSUQbVooTd/Ni7IIFHdl6XWrY0c=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=fZDpexFzN+SVjbvdPCB2Y7+c88RuWMk6Elkqp60nc3sKx3zfCzqQs8UvF6JFMIgvo3XSP1TDLO2EF+QbWV6hA/NFxqlge6nIbhinqQX4g8osNoi+oiKaY8Z+cXv5ceyAij3p575fxbIebiZ+cLRM0z/msh4NgtykAw25YLvdCQU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OCOyy9jO; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Ovidiu Panait <[email-masked]>
Subject: [PATCH 6.1 042/196] staging: axis-fifo: flush RX FIFO on read errors
Date: Mon, 13 Oct 2025 16:43:35 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ovidiu Panait <[email-masked]>

commit 82a051e2553b9e297cba82a975d9c538b882c79e upstream.

Flush stale data from the RX FIFO in case of errors, to avoid reading
old data when new packets arrive.

Commit c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for
user errors") removed full FIFO resets from the read error paths, which
fixed potential TX data losses, but introduced this RX issue.

Fixes: c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors")
Cc: [email-masked]
Signed-off-by: Ovidiu Panait <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/staging/axis-fifo/axis-fifo.c |   18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

--- a/drivers/staging/axis-fifo/axis-fifo.c
+++ b/drivers/staging/axis-fifo/axis-fifo.c
@@ -398,6 +398,7 @@ static ssize_t axis_fifo_read(struct fil
 	}
 
 	bytes_available = ioread32(fifo->base_addr + XLLF_RLR_OFFSET);
+	words_available = bytes_available / sizeof(u32);
 	if (!bytes_available) {
 		dev_err(fifo->dt_device, "received a packet of length 0\n");
 		ret = -EIO;
@@ -408,7 +409,7 @@ static ssize_t axis_fifo_read(struct fil
 		dev_err(fifo->dt_device, "user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n",
 			bytes_available, len);
 		ret = -EINVAL;
-		goto end_unlock;
+		goto err_flush_rx;
 	}
 
 	if (bytes_available % sizeof(u32)) {
@@ -417,11 +418,9 @@ static ssize_t axis_fifo_read(struct fil
 		 */
 		dev_err(fifo->dt_device, "received a packet that isn't word-aligned\n");
 		ret = -EIO;
-		goto end_unlock;
+		goto err_flush_rx;
 	}
 
-	words_available = bytes_available / sizeof(u32);
-
 	/* read data into an intermediate buffer, copying the contents
 	 * to userspace when the buffer is full
 	 */
@@ -433,18 +432,23 @@ static ssize_t axis_fifo_read(struct fil
 			tmp_buf[i] = ioread32(fifo->base_addr +
 					      XLLF_RDFD_OFFSET);
 		}
+		words_available -= copy;
 
 		if (copy_to_user(buf + copied * sizeof(u32), tmp_buf,
 				 copy * sizeof(u32))) {
 			ret = -EFAULT;
-			goto end_unlock;
+			goto err_flush_rx;
 		}
 
 		copied += copy;
-		words_available -= copy;
 	}
+	mutex_unlock(&fifo->read_lock);
+
+	return bytes_available;
 
-	ret = bytes_available;
+err_flush_rx:
+	while (words_available--)
+		ioread32(fifo->base_addr + XLLF_RDFD_OFFSET);
 
 end_unlock:
 	mutex_unlock(&fifo->read_lock);

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:06:30 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366950; cv=none; b=SZbgRDSgC7miq4cUgk2wotIxzq7uDi2PCaaA+Mz+poSHwd1uUpGlzlI+lBZKi7OcLCjBNvJgL0ubejkE7FJrwXjBqF6A7KHU45jtDMIg5J11LhkjYjI6HRq0bk1LtpEw6As8hOsafLOH7p/XQ/zwWma1bs/oc0VR/57jLJ5UBjA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366950; c=relaxed/simple;
	bh=HO/PkBfnVrkA3t+1ZDXiUMcgnCHovUGkFRXjrjeJas8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=OLxwRl1he2j6EVs7sA0z7qIdwb/Hk5B73WwU4B0Xho+lcvy1DonMEcJBlmqKVcvygwMZh804XMGGxGY0gT11mhsifc/jEyxx+iY9RVMuz9Jzd2l8x6E29WSAE4CLpSqtuV9ps0mEzmsFnkdFttKO/EEop+8DkkQJ+i4Q9w1+pXQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IVbIr2N+; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Raphael Gallais-Pou <[email-masked]>
Subject: [PATCH 6.1 039/196] serial: stm32: allow selecting console when the driver is module
Date: Mon, 13 Oct 2025 16:43:32 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Raphael Gallais-Pou <[email-masked]>

commit cc4d900d0d6d8dd5c41832a93ff3cfa629a78f9a upstream.

Console can be enabled on the UART compile as module.
Change dependency to allow console mode when the driver is built as module.

Fixes: 48a6092fb41fa ("serial: stm32-usart: Add STM32 USART Driver")
Cc: [email-masked]
Signed-off-by: Raphael Gallais-Pou <[email-masked]>
Link: https://lore.kernel.org/r/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/tty/serial/Kconfig |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -1410,7 +1410,7 @@ config SERIAL_STM32
 
 config SERIAL_STM32_CONSOLE
 	bool "Support for console on STM32"
-	depends on SERIAL_STM32=y
+	depends on SERIAL_STM32
 	select SERIAL_CORE_CONSOLE
 	select SERIAL_EARLYCON

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:04:51 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366946; cv=none; b=GgnG14pGBxq8L8esMSp7wE+2Ovc7s/MPWE7urHNMfth+Dz1BLAsS/DdpVPwD/dSQZxjY2ke2b8VHS6fRtR4m8eTdtaD3kaVj6IpBdM5eVdSsFVnLjL6UBRPS8JIN7UAzvg4prayC80ehPGP9GGibj3n5H/qAxq7R0RChan/BuKI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366946; c=relaxed/simple;
	bh=zM22GH8U7MSWnzq1SCVQxW9B0nAeBbIV1lwMVb9t3I4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=BE7lUWNbqhISaoDje7claCv9vvPrPPlr1ECkWhAQ/Pn/SwJAoSRLIHoctFePKxDagT3EYmo8gLzZl7beRdhkbCBo2aghn7S4JFBLXjlUW1zbBFcwwLh2CGNj/cp9Kpp+WfW/xkNjKpgmzss6UuHeOI1XXOAqA35QVmv1J9r9Qjc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KUYB9lBe; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Arnaud Lecomte <[email-masked]>,
	Benjamin Tissoires <[email-masked]>,
	Romain Sioen <[email-masked]>
Subject: [PATCH 6.1 038/196] hid: fix I2C read buffer overflow in raw_event() for mcp2221
Date: Mon, 13 Oct 2025 16:43:31 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnaud Lecomte <[email-masked]>

commit b56cc41a3ae7323aa3c6165f93c32e020538b6d2 upstream.

As reported by syzbot, mcp2221_raw_event lacked
validation of incoming I2C read data sizes, risking buffer
overflows in mcp->rxbuf during multi-part transfers.
As highlighted in the DS20005565B spec, p44, we have:
"The number of read-back data bytes to follow in this packet:
from 0 to a maximum of 60 bytes of read-back bytes."
This patch enforces we don't exceed this limit.

Reported-by: [email-masked]
Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346
Tested-by: [email-masked]
Signed-off-by: Arnaud Lecomte <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Benjamin Tissoires <[email-masked]>
Signed-off-by: Romain Sioen <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/hid/hid-mcp2221.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/hid/hid-mcp2221.c
+++ b/drivers/hid/hid-mcp2221.c
@@ -791,6 +791,10 @@ static int mcp2221_raw_event(struct hid_
 			}
 			if (data[2] == MCP2221_I2C_READ_COMPL ||
 			    data[2] == MCP2221_I2C_READ_PARTIAL) {
+				if (!mcp->rxbuf || mcp->rxbuf_idx < 0 || data[3] > 60) {
+					mcp->status = -EINVAL;
+					break;
+				}
 				buf = mcp->rxbuf;
 				memcpy(&buf[mcp->rxbuf_idx], &data[4], data[3]);
 				mcp->rxbuf_idx = mcp->rxbuf_idx + data[3];

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:04:18 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366936; cv=none; b=UdyQMtqHK4YVLmMP3NIc+z1HN0Su6rDG3EHN6bqajuQWFQZdwX+emTlgSPopi4LMqEwN2cy13W4SF/QO13KpyENhQJyCXD21P6HE3GQyVCHNyyldPuOIZ16e+NsCiK13LYeyodvkS2POSf6c2pXd/R2LzlcQ0x4ZPpdViL2qUQs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366936; c=relaxed/simple;
	bh=hf0MeK9gtfLPbD0IftvB1VOcBKcDO47JzrbiJxpJ8kE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=baMwR6w6v5OMnJZavg5XIBiXCitNkBycAAJ73beHUE+qYgw7uY/v4HTtFz2SZ5+fU7nlxwqt1I91jvbI9BME4oWOR3EGZ/syp95mGs0sOr0GayHDdhXbZwn3d646L8TXW4lKFTJ89OhMTNf+XBxKU9loQME3oc3XybZhiSMXEy0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aGHm4+ga; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	Qu Wenruo <[email-masked]>,
	David Sterba <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 035/196] btrfs: ref-verify: handle damaged extent root tree
Date: Mon, 13 Oct 2025 16:43:28 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Sterba <[email-masked]>

[ Upstream commit ed4e6b5d644c4dd2bc2872ffec036b7da0ec2e27 ]

Syzbot hits a problem with enabled ref-verify, ignorebadroots and a
fuzzed/damaged extent tree. There's no fallback option like in other
places that can deal with it so disable the whole ref-verify as it is
just a debugging feature.

Reported-by: [email-masked]
Link: https://lore.kernel.org/all/[email-masked]/
Reviewed-by: Qu Wenruo <[email-masked]>
Signed-off-by: David Sterba <[email-masked]>
Signed-off-by: Sasha Levin <[email-masked]>
---
 fs/btrfs/ref-verify.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
index 56ceb23bd7409..195fce42b982d 100644
--- a/fs/btrfs/ref-verify.c
+++ b/fs/btrfs/ref-verify.c
@@ -987,11 +987,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info)
 	if (!btrfs_test_opt(fs_info, REF_VERIFY))
 		return 0;
 
+	extent_root = btrfs_extent_root(fs_info, 0);
+	/* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */
+	if (IS_ERR(extent_root)) {
+		btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling");
+		btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY);
+		return 0;
+	}
+
 	path = btrfs_alloc_path();
 	if (!path)
 		return -ENOMEM;
 
-	extent_root = btrfs_extent_root(fs_info, 0);
 	eb = btrfs_read_lock_root_node(extent_root);
 	level = btrfs_header_level(eb);
 	path->nodes[level] = eb;
-- 
2.51.0

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:13:34 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366922; cv=none; b=pSHkSVLPm0+sapM0QOVN8Xxg+H6L8WbWaLdBmYdu77BvGp7XFoL50cAE7AfOQZK1R3+P9qTKbqvUyayhhXvXLATrW0VDmMVCL1xLhXA87I+OvVFBZEYMNUR0icaa/Dmq6MG0vEXkMlbKL3AewLF9KsyW5uGsp3NroU+BDHf+YVo=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366922; c=relaxed/simple;
	bh=rzHvq2YPDfR4OftOqn97AAdPXkbXf0wHd7k41brn4H8=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=eflvSBwm+4Hz0PBxQDGpZnVMAjwCXUtyBm4QZzNV1in6o1ZMewXCKtvv9BIbeEn6ap+Q7JIh7qoU3DnihF2ydpvoypw9qtXmmhU2tHaE7FEpwxodlB1ERxp0rW1ri1hJrPcmEJf1f2QYWflfx/juqASCxrnm6I9F/1z0u2tXYxY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=J7eUMHCI; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Bitterblue Smith <[email-masked]>,
	Ping-Ke Shih <[email-masked]>
Subject: [PATCH 6.1 031/196] wifi: rtlwifi: rtl8192cu: Dont claim USB ID 07b8:8188
Date: Mon, 13 Oct 2025 16:43:24 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  2.0 SUSPICIOUS_REWARD      BODY: Contains suspicious reward/winning
                             language
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 24

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bitterblue Smith <[email-masked]>

commit e798f2ac6040f46a04795d7de977341fa9aeabae upstream.

This ID appears to be RTL8188SU, not RTL8188CU. This is the wrong driver
for RTL8188SU. The r8712u driver from staging used to handle this ID.

Closes: https://lore.kernel.org/linux-wireless/[email-masked]/
Cc: [email-masked]
Signed-off-by: Bitterblue Smith <[email-masked]>
Acked-by: Ping-Ke Shih <[email-masked]>
Signed-off-by: Ping-Ke Shih <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c |    1 -
 1 file changed, 1 deletion(-)

--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c
@@ -296,7 +296,6 @@ static const struct usb_device_id rtl819
 	{RTL_USB_DEVICE(0x050d, 0x1102, rtl92cu_hal_cfg)}, /*Belkin - Edimax*/
 	{RTL_USB_DEVICE(0x050d, 0x11f2, rtl92cu_hal_cfg)}, /*Belkin - ISY*/
 	{RTL_USB_DEVICE(0x06f8, 0xe033, rtl92cu_hal_cfg)}, /*Hercules - Edimax*/
-	{RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
 	{RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
 	{RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
 	{RTL_USB_DEVICE(0x0846, 0x9043, rtl92cu_hal_cfg)}, /*NG WNA1000Mv2*/

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:02:23 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366919; cv=none; b=epoVbJdugGtw5QYAYWSZ25eLLItTGezvmRi4Yk2SxIfMcbpsTZxgTCqZ5DL2g5MMgP5FhAXCt+fmqqjMemKy1A8vNLWfPh6Pm9P7J+dfM8N9pAw3XZBJZtrlj5NoY/hfAvCFv1ovTafUR9lA+mNX2wdQ6grCjBrd8x6mnAdLy44=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366919; c=relaxed/simple;
	bh=Ko6ap5/zF0qhTKAOqLSTgCRqCE6by+ZlG2ur6K4WVZY=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=gii3Lf/upY1yQ3FXrf2F8D7R6umFjmIwdzzs9KLe8MQgAZ+0sx96NjNvsEXDPSU+HTs54PgEeAdfvSZHKKlHlCBMjSXk5ODdxio1s/xncJz2PGqNhXwPJIkdlHhP2J9sKYaAPEOoGeABhBH2pC9KMlisoBVBgOdm30YbOyVE+DY=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OfbSHjwp; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Xiaowei Li <[email-masked]>,
	Johan Hovold <[email-masked]>
Subject: [PATCH 6.1 030/196] USB: serial: option: add SIMCom 8230C compositions
Date: Mon, 13 Oct 2025 16:43:23 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xiaowei Li <[email-masked]>

commit 0e0ba0ecec3d6e819e0c2348331ff99afe2eb5d5 upstream.

Add support for SIMCom 8230C which is based on Qualcomm SDX35 chip.

USB Device Listings:

0x9071: tty (DM) + tty (NMEA) + tty (AT) + rmnet (QMI mode) + adb
T:  Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 10 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1e0e ProdID=9071 Rev= 5.15
S:  Manufacturer=SIMCOM
S:  Product=SDXBAAGHA-IDP _SN:D744C4C5
S:  SerialNumber=0123456789ABCDEF
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
E:  Ad=86(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

0x9078: tty (DM) + tty (NMEA) + tty (AT) + ECM + adb
T:  Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#=  9 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=1e0e ProdID=9078 Rev= 5.15
S:  Manufacturer=SIMCOM
S:  Product=SDXBAAGHA-IDP _SN:D744C4C5
S:  SerialNumber=0123456789ABCDEF
C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether
E:  Ad=86(I) Atr=03(Int.) MxPS=  16 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

0x907b: RNDIS + tty (DM) + tty (NMEA) + tty (AT) + adb
T:  Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#=  8 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1e0e ProdID=907b Rev= 5.15
S:  Manufacturer=SIMCOM
S:  Product=SDXBAAGHA-IDP _SN:D744C4C5
S:  SerialNumber=0123456789ABCDEF
C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
A:  FirstIf#= 0 IfCount= 2 Cls=ef(misc ) Sub=04 Prot=01
I:* If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E:  Ad=82(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

Signed-off-by: Xiaowei Li <[email-masked]>
Cc: [email-masked]
Signed-off-by: Johan Hovold <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/usb/serial/option.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2114,6 +2114,12 @@ static const struct usb_device_id option
 	{ USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) },	/* Simcom SIM7500/SIM7600 MBIM mode */
 	{ USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff),	/* Simcom SIM7500/SIM7600 RNDIS mode */
 	  .driver_info = RSVD(7) },
+	{ USB_DEVICE(0x1e0e, 0x9071),				/* Simcom SIM8230 RMNET mode */
+	  .driver_info = RSVD(3) | RSVD(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9078, 0xff),	/* Simcom SIM8230 ECM mode */
+	  .driver_info = RSVD(5) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x907b, 0xff),	/* Simcom SIM8230 RNDIS mode */
+	  .driver_info = RSVD(5) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9205, 0xff) },	/* Simcom SIM7070/SIM7080/SIM7090 AT+ECM mode */
 	{ USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9206, 0xff) },	/* Simcom SIM7070/SIM7080/SIM7090 AT-only mode */
 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:07:53 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366911; cv=none; b=KvCtEW/io3zpKfZFGMqLzlv20erwFjzDG8kD5WHi+0n6EzOczbyWPpzp52e7BctR2BOk/s3FB6QguZO5KDdVSwSnq0ThLqd6qgyXB1P4nCo6DcIuG5zgfdRj3hMi1YS7jqymMXmLfHlxRjKDF2PTJ/4J/17KNfFtDKshJTXqK/Q=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366911; c=relaxed/simple;
	bh=ZlpRjf8VuDKRmJBjD5phRMdIOjBnmHdCMqlmBmzv85U=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=WzWi9KHqybNwL9Y5gtAqdvYlRL2idTM9ruTYM8oLlVZDm/kk3odNI90lV/VDjRwOBj04+BV3+CYzed9MUzMrir6H/UkkR6iqk3c3IQ9G5TYWzi/E6LQV4VCIRwviDwrp3pGllfHaYmI88HMFcoQDRoT4jvsn0k7YpNu5w6/QhqQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=f9uLMakY; arc=none smtp.client-ip=10.30.226.201
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3DD0EC4CEE7;
	Mon, 13 Oct 2025 14:48:30 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1760366910;
	bh=ZlpRjf8VuDKRmJBjD5phRMdIOjBnmHdCMqlmBmzv85U=;
	h=From:To:Cc:Subject:Date:In-Reply-To:References:From;
	b=f9uLMakY0ZClqFKyvXPhTHtTFmLezsuRgXZEnSQSmvXUA9cPHaRpVaRS9F7yTnpkC
	 +N28Gv3XlFyuMKrrLlnIvD3PPtD2s9WHeveX6I2KjPTTbP6WlbCrYeLJlSZ3y/dh5F
	 NQL7TNTMs5ut+vtkQANo2uzPa9KG+3AdK43yMBaQ=
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	David Laight <[email-masked]>,
	Andy Shevchenko <[email-masked]>,
	Arnd Bergmann <[email-masked]>,
	Christoph Hellwig <[email-masked]>,
	Dan Carpenter <[email-masked]>,
	"Jason A. Donenfeld" <[email-masked]>,
	Jens Axboe <[email-masked]>,
	Lorenzo Stoakes <[email-masked]>,
	Mateusz Guzik <[email-masked]>,
	Matthew Wilcox <[email-masked]>,
	Pedro Falcato <[email-masked]>,
	Andrew Morton <[email-masked]>,
	Eliav Farber <[email-masked]>
Subject: [PATCH 6.1 027/196] minmax.h: move all the clamp() definitions after the min/max() ones
Date: Mon, 13 Oct 2025 16:43:20 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
 -2.3 RCVD_IN_DNSWL_MED      RBL: Sender listed at https://www.dnswl.org/,
                             medium trust
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: -18

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Laight <[email-masked]>

[ Upstream commit c3939872ee4a6b8bdcd0e813c66823b31e6e26f7 ]

At some point the definitions for clamp() got added in the middle of the
ones for min() and max().  Re-order the definitions so they are more
sensibly grouped.

Link: https://lkml.kernel.org/r/[email-masked]
Signed-off-by: David Laight <[email-masked]>
Cc: Andy Shevchenko <[email-masked]>
Cc: Arnd Bergmann <[email-masked]>
Cc: Christoph Hellwig <[email-masked]>
Cc: Dan Carpenter <[email-masked]>
Cc: Jason A. Donenfeld <[email-masked]>
Cc: Jens Axboe <[email-masked]>
Cc: Lorenzo Stoakes <[email-masked]>
Cc: Mateusz Guzik <[email-masked]>
Cc: Matthew Wilcox <[email-masked]>
Cc: Pedro Falcato <[email-masked]>
Signed-off-by: Andrew Morton <[email-masked]>
Signed-off-by: Eliav Farber <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 include/linux/minmax.h |  109 ++++++++++++++++++++++---------------------------
 1 file changed, 51 insertions(+), 58 deletions(-)

--- a/include/linux/minmax.h
+++ b/include/linux/minmax.h
@@ -99,22 +99,6 @@
 #define __careful_cmp(op, x, y) \
 	__careful_cmp_once(op, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
 
-#define __clamp(val, lo, hi)	\
-	((val) >= (hi) ? (hi) : ((val) <= (lo) ? (lo) : (val)))
-
-#define __clamp_once(val, lo, hi, uval, ulo, uhi) ({				\
-	__auto_type uval = (val);						\
-	__auto_type ulo = (lo);							\
-	__auto_type uhi = (hi);							\
-	BUILD_BUG_ON_MSG(statically_true(ulo > uhi),				\
-		"clamp() low limit " #lo " greater than high limit " #hi);	\
-	BUILD_BUG_ON_MSG(!__types_ok3(uval, ulo, uhi),				\
-		"clamp("#val", "#lo", "#hi") signedness error");		\
-	__clamp(uval, ulo, uhi); })
-
-#define __careful_clamp(val, lo, hi) \
-	__clamp_once(val, lo, hi, __UNIQUE_ID(v_), __UNIQUE_ID(l_), __UNIQUE_ID(h_))
-
 /**
  * min - return minimum of two values of the same or compatible types
  * @x: first value
@@ -171,6 +155,22 @@
 	__careful_op3(max, x, y, z, __UNIQUE_ID(x_), __UNIQUE_ID(y_), __UNIQUE_ID(z_))
 
 /**
+ * min_t - return minimum of two values, using the specified type
+ * @type: data type to use
+ * @x: first value
+ * @y: second value
+ */
+#define min_t(type, x, y) __cmp_once(min, type, x, y)
+
+/**
+ * max_t - return maximum of two values, using the specified type
+ * @type: data type to use
+ * @x: first value
+ * @y: second value
+ */
+#define max_t(type, x, y) __cmp_once(max, type, x, y)
+
+/**
  * min_not_zero - return the minimum that is _not_ zero, unless both are zero
  * @x: value1
  * @y: value2
@@ -180,6 +180,22 @@
 	typeof(y) __y = (y);			\
 	__x == 0 ? __y : ((__y == 0) ? __x : min(__x, __y)); })
 
+#define __clamp(val, lo, hi)	\
+	((val) >= (hi) ? (hi) : ((val) <= (lo) ? (lo) : (val)))
+
+#define __clamp_once(val, lo, hi, uval, ulo, uhi) ({				\
+	__auto_type uval = (val);						\
+	__auto_type ulo = (lo);							\
+	__auto_type uhi = (hi);							\
+	BUILD_BUG_ON_MSG(statically_true(ulo > uhi),				\
+		"clamp() low limit " #lo " greater than high limit " #hi);	\
+	BUILD_BUG_ON_MSG(!__types_ok3(uval, ulo, uhi),				\
+		"clamp("#val", "#lo", "#hi") signedness error");		\
+	__clamp(uval, ulo, uhi); })
+
+#define __careful_clamp(val, lo, hi) \
+	__clamp_once(val, lo, hi, __UNIQUE_ID(v_), __UNIQUE_ID(l_), __UNIQUE_ID(h_))
+
 /**
  * clamp - return a value clamped to a given range with strict typechecking
  * @val: current value
@@ -191,28 +207,30 @@
  */
 #define clamp(val, lo, hi) __careful_clamp(val, lo, hi)
 
-/*
- * ..and if you can't take the strict
- * types, you can specify one yourself.
- *
- * Or not use min/max/clamp at all, of course.
- */
-
 /**
- * min_t - return minimum of two values, using the specified type
- * @type: data type to use
- * @x: first value
- * @y: second value
+ * clamp_t - return a value clamped to a given range using a given type
+ * @type: the type of variable to use
+ * @val: current value
+ * @lo: minimum allowable value
+ * @hi: maximum allowable value
+ *
+ * This macro does no typechecking and uses temporary variables of type
+ * @type to make all the comparisons.
  */
-#define min_t(type, x, y) __cmp_once(min, type, x, y)
+#define clamp_t(type, val, lo, hi) __careful_clamp((type)(val), (type)(lo), (type)(hi))
 
 /**
- * max_t - return maximum of two values, using the specified type
- * @type: data type to use
- * @x: first value
- * @y: second value
+ * clamp_val - return a value clamped to a given range using val's type
+ * @val: current value
+ * @lo: minimum allowable value
+ * @hi: maximum allowable value
+ *
+ * This macro does no typechecking and uses temporary variables of whatever
+ * type the input argument @val is.  This is useful when @val is an unsigned
+ * type and @lo and @hi are literals that will otherwise be assigned a signed
+ * integer type.
  */
-#define max_t(type, x, y) __cmp_once(max, type, x, y)
+#define clamp_val(val, lo, hi) clamp_t(typeof(val), val, lo, hi)
 
 /*
  * Do not check the array parameter using __must_be_array().
@@ -257,31 +275,6 @@
  */
 #define max_array(array, len) __minmax_array(max, array, len)
 
-/**
- * clamp_t - return a value clamped to a given range using a given type
- * @type: the type of variable to use
- * @val: current value
- * @lo: minimum allowable value
- * @hi: maximum allowable value
- *
- * This macro does no typechecking and uses temporary variables of type
- * @type to make all the comparisons.
- */
-#define clamp_t(type, val, lo, hi) __careful_clamp((type)(val), (type)(lo), (type)(hi))
-
-/**
- * clamp_val - return a value clamped to a given range using val's type
- * @val: current value
- * @lo: minimum allowable value
- * @hi: maximum allowable value
- *
- * This macro does no typechecking and uses temporary variables of whatever
- * type the input argument @val is.  This is useful when @val is an unsigned
- * type and @lo and @hi are literals that will otherwise be assigned a signed
- * integer type.
- */
-#define clamp_val(val, lo, hi) clamp_t(typeof(val), val, lo, hi)
-
 static inline bool in_range64(u64 val, u64 start, u64 len)
 {
 	return (val - start) < len;

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:05:09 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366992; cv=none; b=siy25mJGaSL+ZHiE9VU10eWZzh3jqAPnG9m2AA7N+zyJ3Gy17d9o/OCSugoCxvV3WP9coqjQpCLElzkIbm+fT37n7ZSrrmhjPzD9CQVVCm2lN/uz4EoEWuFHB5tUc78F+oM5uLjcAdbPVPOz6trPfB+XuFB1q9K857GHzMGx+Tw=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366992; c=relaxed/simple;
	bh=JuRio9Zu17Pm99mBzIJ8d9ANe4X+hHXY0WB6Fkaf+FM=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=swBE6db4gnYEfIvuM59jVjDyGd5rL66UXqOSagz3hbr1nBLRryGKzJDFerg4X8ZxI1nIgB+NZq2fxm+myQoI54bbmup1RrDokTEcozkxF9VqeKQ4VJJYvG3ByVlJxKJB/TzqPjaqaa1zko+LbkvefCZraK2fX4AtwszR19RGeiA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rHa7pNw1; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	David Laight <[email-masked]>,
	Arnd Bergmann <[email-masked]>,
	Linus Torvalds <[email-masked]>,
	Eliav Farber <[email-masked]>
Subject: [PATCH 6.1 022/196] minmax: fix up min3() and max3() too
Date: Mon, 13 Oct 2025 16:43:15 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Linus Torvalds <[email-masked]>

[ Upstream commit 21b136cc63d2a9ddd60d4699552b69c214b32964 ]

David Laight pointed out that we should deal with the min3() and max3()
mess too, which still does excessive expansion.

And our current macros are actually rather broken.

In particular, the macros did this:

  #define min3(x, y, z) min((typeof(x))min(x, y), z)
  #define max3(x, y, z) max((typeof(x))max(x, y), z)

and that not only is a nested expansion of possibly very complex
arguments with all that involves, the typing with that "typeof()" cast
is completely wrong.

For example, imagine what happens in max3() if 'x' happens to be a
'unsigned char', but 'y' and 'z' are 'unsigned long'.  The types are
compatible, and there's no warning - but the result is just random
garbage.

No, I don't think we've ever hit that issue in practice, but since we
now have sane infrastructure for doing this right, let's just use it.
It fixes any excessive expansion, and also avoids these kinds of broken
type issues.

Requested-by: David Laight <[email-masked]>
Acked-by: Arnd Bergmann <[email-masked]>
Signed-off-by: Linus Torvalds <[email-masked]>
Signed-off-by: Eliav Farber <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 include/linux/minmax.h |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/include/linux/minmax.h
+++ b/include/linux/minmax.h
@@ -152,13 +152,20 @@
 #define umax(x, y)	\
 	__careful_cmp(max, (x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull)
 
+#define __careful_op3(op, x, y, z, ux, uy, uz) ({			\
+	__auto_type ux = (x); __auto_type uy = (y);__auto_type uz = (z);\
+	BUILD_BUG_ON_MSG(!__types_ok3(x,y,z,ux,uy,uz),			\
+		#op"3("#x", "#y", "#z") signedness error");		\
+	__cmp(op, ux, __cmp(op, uy, uz)); })
+
 /**
  * min3 - return minimum of three values
  * @x: first value
  * @y: second value
  * @z: third value
  */
-#define min3(x, y, z) min((typeof(x))min(x, y), z)
+#define min3(x, y, z) \
+	__careful_op3(min, x, y, z, __UNIQUE_ID(x_), __UNIQUE_ID(y_), __UNIQUE_ID(z_))
 
 /**
  * max3 - return maximum of three values
@@ -166,7 +173,8 @@
  * @y: second value
  * @z: third value
  */
-#define max3(x, y, z) max((typeof(x))max(x, y), z)
+#define max3(x, y, z) \
+	__careful_op3(max, x, y, z, __UNIQUE_ID(x_), __UNIQUE_ID(y_), __UNIQUE_ID(z_))
 
 /**
  * min_not_zero - return the minimum that is _not_ zero, unless both are zero

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:19:29 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366989; cv=none; b=djEU6ZRvsXRviwI4BwVBL3fNVwpkNHZ7RoDM1bu/72zcehJ2v0EOYFKRTWNi8PDkfRK1AMy07Noki13w1CJ2C+EpqiyQ2jmFG2/XcBKxGqDRCugA79JUrftTg4TV2Y6nUx7YnIOjwXxz3C4aoseWMyjtVhKD+zWOB9AqUmCAEaA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366989; c=relaxed/simple;
	bh=stpHsb73cutQJfloQAQOkE/teljR2TqIz/0+TNieTwI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=qfUcE6EpbELg4kyG477+75dSfExTgWNuaap1vqJYjUmt06xlcvBZS5GFhshmcWn+RVbdkllrE13975xvX5MWWKnVP+ke9MhhyPBbUhvqC5IA1Iiq0BxWa4d8/HRmBCxmE4Eekawk9AV0Rb+SewcU74qZDn9bhTWVI5f2xty4uDE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=I1TDv+Dl; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Arnd Bergmann <[email-masked]>,
	David Laight <[email-masked]>,
	Lorenzo Stoakes <[email-masked]>,
	Linus Torvalds <[email-masked]>,
	Eliav Farber <[email-masked]>
Subject: [PATCH 6.1 021/196] minmax: improve macro expansion and type checking
Date: Mon, 13 Oct 2025 16:43:14 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Linus Torvalds <[email-masked]>

[ Upstream commit 22f5468731491e53356ba7c028f0fdea20b18e2c ]

This clarifies the rules for min()/max()/clamp() type checking and makes
them a much more efficient macro expansion.

In particular, we now look at the type and range of the inputs to see
whether they work together, generating a mask of acceptable comparisons,
and then just verifying that the inputs have a shared case:

 - an expression with a signed type can be used for
    (1) signed comparisons
    (2) unsigned comparisons if it is statically known to have a
        non-negative value

 - an expression with an unsigned type can be used for
    (3) unsigned comparison
    (4) signed comparisons if the type is smaller than 'int' and thus
        the C integer promotion rules will make it signed anyway

Here rule (1) and (3) are obvious, and rule (2) is important in order to
allow obvious trivial constants to be used together with unsigned
values.

Rule (4) is not necessarily a good idea, but matches what we used to do,
and we have extant cases of this situation in the kernel.  Notably with
bcachefs having an expression like

	min(bch2_bucket_sectors_dirty(a), ca->mi.bucket_size)

where bch2_bucket_sectors_dirty() returns an 's64', and
'ca->mi.bucket_size' is of type 'u16'.

Technically that bcachefs comparison is clearly sensible on a C type
level, because the 'u16' will go through the normal C integer promotion,
and become 'int', and then we're comparing two signed values and
everything looks sane.

However, it's not entirely clear that a 'min(s64,u16)' operation makes a
lot of conceptual sense, and it's possible that we will remove rule (4).
After all, the _reason_ we have these complicated type checks is exactly
that the C type promotion rules are not very intuitive.

But at least for now the rule is in place for backwards compatibility.

Also note that rule (2) existed before, but is hugely relaxed by this
commit.  It used to be true only for the simplest compile-time
non-negative integer constants.  The new macro model will allow cases
where the compiler can trivially see that an expression is non-negative
even if it isn't necessarily a constant.

For example, the amdgpu driver does

	min_t(size_t, sizeof(fru_info->serial), pia[addr] & 0x3F));

because our old 'min()' macro would see that 'pia[addr] & 0x3F' is of
type 'int' and clearly not a C constant expression, so doing a 'min()'
with a 'size_t' is a signedness violation.

Our new 'min()' macro still sees that 'pia[addr] & 0x3F' is of type
'int', but is smart enough to also see that it is clearly non-negative,
and thus would allow that case without any complaints.

Cc: Arnd Bergmann <[email-masked]>
Cc: David Laight <[email-masked]>
Cc: Lorenzo Stoakes <[email-masked]>
Signed-off-by: Linus Torvalds <[email-masked]>
Signed-off-by: Eliav Farber <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 include/linux/compiler.h |    9 +++++
 include/linux/minmax.h   |   78 ++++++++++++++++++++++++++++++++++++-----------
 2 files changed, 70 insertions(+), 17 deletions(-)

--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -245,6 +245,15 @@ static inline void *offset_to_ptr(const
 #define is_signed_type(type) (((type)(-1)) < (__force type)1)
 
 /*
+ * Useful shorthand for "is this condition known at compile-time?"
+ *
+ * Note that the condition may involve non-constant values,
+ * but the compiler may know enough about the details of the
+ * values to determine that the condition is statically true.
+ */
+#define statically_true(x) (__builtin_constant_p(x) && (x))
+
+/*
  * This is needed in functions which generate the stack canary, see
  * arch/x86/kernel/smpboot.c::start_secondary() for an example.
  */
--- a/include/linux/minmax.h
+++ b/include/linux/minmax.h
@@ -26,19 +26,63 @@
 #define __typecheck(x, y) \
 	(!!(sizeof((typeof(x) *)1 == (typeof(y) *)1)))
 
-/* is_signed_type() isn't a constexpr for pointer types */
-#define __is_signed(x) 								\
-	__builtin_choose_expr(__is_constexpr(is_signed_type(typeof(x))),	\
-		is_signed_type(typeof(x)), 0)
-
-/* True for a non-negative signed int constant */
-#define __is_noneg_int(x)	\
-	(__builtin_choose_expr(__is_constexpr(x) && __is_signed(x), x, -1) >= 0)
-
-#define __types_ok(x, y, ux, uy) 				\
-	(__is_signed(ux) == __is_signed(uy) ||			\
-	 __is_signed((ux) + 0) == __is_signed((uy) + 0) ||	\
-	 __is_noneg_int(x) || __is_noneg_int(y))
+/*
+ * __sign_use for integer expressions:
+ *   bit #0 set if ok for unsigned comparisons
+ *   bit #1 set if ok for signed comparisons
+ *
+ * In particular, statically non-negative signed integer
+ * expressions are ok for both.
+ *
+ * NOTE! Unsigned types smaller than 'int' are implicitly
+ * converted to 'int' in expressions, and are accepted for
+ * signed conversions for now. This is debatable.
+ *
+ * Note that 'x' is the original expression, and 'ux' is
+ * the unique variable that contains the value.
+ *
+ * We use 'ux' for pure type checking, and 'x' for when
+ * we need to look at the value (but without evaluating
+ * it for side effects! Careful to only ever evaluate it
+ * with sizeof() or __builtin_constant_p() etc).
+ *
+ * Pointers end up being checked by the normal C type
+ * rules at the actual comparison, and these expressions
+ * only need to be careful to not cause warnings for
+ * pointer use.
+ */
+#define __signed_type_use(x,ux) (2+__is_nonneg(x,ux))
+#define __unsigned_type_use(x,ux) (1+2*(sizeof(ux)<4))
+#define __sign_use(x,ux) (is_signed_type(typeof(ux))? \
+	__signed_type_use(x,ux):__unsigned_type_use(x,ux))
+
+/*
+ * To avoid warnings about casting pointers to integers
+ * of different sizes, we need that special sign type.
+ *
+ * On 64-bit we can just always use 'long', since any
+ * integer or pointer type can just be cast to that.
+ *
+ * This does not work for 128-bit signed integers since
+ * the cast would truncate them, but we do not use s128
+ * types in the kernel (we do use 'u128', but they will
+ * be handled by the !is_signed_type() case).
+ *
+ * NOTE! The cast is there only to avoid any warnings
+ * from when values that aren't signed integer types.
+ */
+#ifdef CONFIG_64BIT
+  #define __signed_type(ux) long
+#else
+  #define __signed_type(ux) typeof(__builtin_choose_expr(sizeof(ux)>4,1LL,1L))
+#endif
+#define __is_nonneg(x,ux) statically_true((__signed_type(ux))(x)>=0)
+
+#define __types_ok(x,y,ux,uy) \
+	(__sign_use(x,ux) & __sign_use(y,uy))
+
+#define __types_ok3(x,y,z,ux,uy,uz) \
+	(__sign_use(x,ux) & __sign_use(y,uy) & __sign_use(z,uz))
 
 #define __cmp_op_min <
 #define __cmp_op_max >
@@ -53,8 +97,8 @@
 
 #define __careful_cmp_once(op, x, y, ux, uy) ({		\
 	__auto_type ux = (x); __auto_type uy = (y);	\
-	static_assert(__types_ok(x, y, ux, uy),		\
-		#op "(" #x ", " #y ") signedness error, fix types or consider u" #op "() before " #op "_t()"); \
+	BUILD_BUG_ON_MSG(!__types_ok(x,y,ux,uy),	\
+		#op"("#x", "#y") signedness error");	\
 	__cmp(op, ux, uy); })
 
 #define __careful_cmp(op, x, y) \
@@ -70,8 +114,8 @@
 	static_assert(__builtin_choose_expr(__is_constexpr((lo) > (hi)), 	\
 			(lo) <= (hi), true),					\
 		"clamp() low limit " #lo " greater than high limit " #hi);	\
-	static_assert(__types_ok(uval, lo, uval, ulo), "clamp() 'lo' signedness error");	\
-	static_assert(__types_ok(uval, hi, uval, uhi), "clamp() 'hi' signedness error");	\
+	BUILD_BUG_ON_MSG(!__types_ok3(val,lo,hi,uval,ulo,uhi),			\
+		"clamp("#val", "#lo", "#hi") signedness error");		\
 	__clamp(uval, ulo, uhi); })
 
 #define __careful_clamp(val, lo, hi) \

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:07:22 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366983; cv=none; b=FX/gm5zh8Mh5a/5Y1JzswrlzXbu/O//w2KQ6b6rqxQZbYuWX4ZgO3BMVekyqVz5LPZzhk/h+n9CcEwg/pm6d41jSu7Z3Yy2ni3Jm7SS4Z9XUamTKUOGGKGmY7JnZtxH5ZmoiZ+DspfWBn3Sn6ZICGzJDPjF40PJ7a+aUs2kOoO4=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366983; c=relaxed/simple;
	bh=SW0RIf3QfCnvJf+IXoEe2TMBeWENK+/0Jo5/usmKEl0=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=eO/l/7UE0N7mBlKOGFcCrsA3Uud2WWXgEnVMmFyoyEUMJX36pJZL4ZVoI+uhK/74pODj57nhnfvnSTYG8vsYKhdViRpbSETL5TtX7wfe7cufUhgJTmkxJ0FqDQ2jhGvdady3aYy/P6jayrfaecx4zwfHlJXslOe47bz/g5UzIc4=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=tL9vgC86; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	David Laight <[email-masked]>,
	Lorenzo Stoakes <[email-masked]>,
	Linus Torvalds <[email-masked]>,
	Eliav Farber <[email-masked]>
Subject: [PATCH 6.1 019/196] minmax: dont use max() in situations that want a C constant expression
Date: Mon, 13 Oct 2025 16:43:12 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Linus Torvalds <[email-masked]>

[ Upstream commit cb04e8b1d2f24c4c2c92f7b7529031fc35a16fed ]

We only had a couple of array[] declarations, and changing them to just
use 'MAX()' instead of 'max()' fixes the issue.

This will allow us to simplify our min/max macros enormously, since they
can now unconditionally use temporary variables to avoid using the
argument values multiple times.

Cc: David Laight <[email-masked]>
Cc: Lorenzo Stoakes <[email-masked]>
Signed-off-by: Linus Torvalds <[email-masked]>
Signed-off-by: Eliav Farber <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c   |    2 +-
 drivers/input/touchscreen/cyttsp4_core.c |    2 +-
 drivers/irqchip/irq-sun6i-r.c            |    2 +-
 drivers/md/dm-integrity.c                |    2 +-
 fs/btrfs/tree-checker.c                  |    2 +-
 lib/vsprintf.c                           |    2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

--- a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
@@ -700,7 +700,7 @@ static const char *smu_get_feature_name(
 size_t smu_cmn_get_pp_feature_mask(struct smu_context *smu,
 				   char *buf)
 {
-	int8_t sort_feature[max(SMU_FEATURE_COUNT, SMU_FEATURE_MAX)];
+	int8_t sort_feature[MAX(SMU_FEATURE_COUNT, SMU_FEATURE_MAX)];
 	uint64_t feature_mask;
 	int i, feature_index;
 	uint32_t count = 0;
--- a/drivers/input/touchscreen/cyttsp4_core.c
+++ b/drivers/input/touchscreen/cyttsp4_core.c
@@ -871,7 +871,7 @@ static void cyttsp4_get_mt_touches(struc
 	struct cyttsp4_touch tch;
 	int sig;
 	int i, j, t = 0;
-	int ids[max(CY_TMA1036_MAX_TCH, CY_TMA4XX_MAX_TCH)];
+	int ids[MAX(CY_TMA1036_MAX_TCH, CY_TMA4XX_MAX_TCH)];
 
 	memset(ids, 0, si->si_ofs.tch_abs[CY_TCH_T].max * sizeof(int));
 	for (i = 0; i < num_cur_tch; i++) {
--- a/drivers/irqchip/irq-sun6i-r.c
+++ b/drivers/irqchip/irq-sun6i-r.c
@@ -270,7 +270,7 @@ static const struct irq_domain_ops sun6i
 
 static int sun6i_r_intc_suspend(void)
 {
-	u32 buf[BITS_TO_U32(max(SUN6I_NR_TOP_LEVEL_IRQS, SUN6I_NR_MUX_BITS))];
+	u32 buf[BITS_TO_U32(MAX(SUN6I_NR_TOP_LEVEL_IRQS, SUN6I_NR_MUX_BITS))];
 	int i;
 
 	/* Wake IRQs are enabled during system sleep and shutdown. */
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -1794,7 +1794,7 @@ static void integrity_metadata(struct wo
 		struct bio *bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io));
 		char *checksums;
 		unsigned int extra_space = unlikely(digest_size > ic->tag_size) ? digest_size - ic->tag_size : 0;
-		char checksums_onstack[max((size_t)HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)];
+		char checksums_onstack[MAX(HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)];
 		sector_t sector;
 		unsigned int sectors_to_process;
 
--- a/fs/btrfs/tree-checker.c
+++ b/fs/btrfs/tree-checker.c
@@ -608,7 +608,7 @@ static int check_dir_item(struct extent_
 		 */
 		if (key->type == BTRFS_DIR_ITEM_KEY ||
 		    key->type == BTRFS_XATTR_ITEM_KEY) {
-			char namebuf[max(BTRFS_NAME_LEN, XATTR_NAME_MAX)];
+			char namebuf[MAX(BTRFS_NAME_LEN, XATTR_NAME_MAX)];
 
 			read_extent_buffer(leaf, namebuf,
 					(unsigned long)(di + 1), name_len);
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -1082,7 +1082,7 @@ char *resource_string(char *buf, char *e
 #define FLAG_BUF_SIZE		(2 * sizeof(res->flags))
 #define DECODED_BUF_SIZE	sizeof("[mem - 64bit pref window disabled]")
 #define RAW_BUF_SIZE		sizeof("[mem - flags 0x]")
-	char sym[max(2*RSRC_BUF_SIZE + DECODED_BUF_SIZE,
+	char sym[MAX(2*RSRC_BUF_SIZE + DECODED_BUF_SIZE,
 		     2*RSRC_BUF_SIZE + FLAG_BUF_SIZE + RAW_BUF_SIZE)];
 
 	char *p = sym, *pend = sym + sizeof(sym);

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:05:24 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366980; cv=none; b=fJzEzwaQ02RSfZ1zB8R2LgiuZo/F4nQV38iRK+hXcBKgZ0eiyOcLPczm5p6SUWA4dWM8hRSJKD6rd1tUXTSfGOZvYU4CNgvfhtvLdLsVK93MZc02vcAU6DR1PD9Pi6sy2d4w9nCE1+k9T+/2KYMGytyD0fGSAzNEhwznxxSaFHs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366980; c=relaxed/simple;
	bh=bXJACKZLnuZnzjRG72HOlc6mBRmKv0Nbwdb0167p/aI=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Mi6Tgw3zQyEdMzbsSr1D97JlXTNjTo/jcQ7VcAfOKRrguOBDxzRYyWekJdKK8yCoh2QYff8lHkggheox6pYgPINnoOzX8exYgAsFaBwPLIkrNS4Vym0a/r9yxJCwwX627dJQib9K1BzLUFzTDwL/CuEK4U5ViguY9mVayxWPq58=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=kxS6LDTi; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Duoming Zhou <[email-masked]>,
	Hans Verkuil <[email-masked]>,
	Sasha Levin <[email-masked]>
Subject: [PATCH 6.1 018/196] media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
Date: Mon, 13 Oct 2025 16:43:11 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Duoming Zhou <[email-masked]>

[ Upstream commit 79d10f4f21a92e459b2276a77be62c59c1502c9d ]

The state->timer is a cyclic timer that schedules work_i2c_poll and
delayed_work_enable_hotplug, while rearming itself. Using timer_delete()
fails to guarantee the timer isn't still running when destroyed, similarly
cancel_delayed_work() cannot ensure delayed_work_enable_hotplug has
terminated if already executing. During probe failure after timer
initialization, these may continue running as orphans and reference the
already-freed tc358743_state object through tc358743_irq_poll_timer.

The following is the trace captured by KASAN.

BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0
Write of size 8 at addr ffff88800ded83c8 by task swapper/1/0
...
Call Trace:
 <IRQ>
 dump_stack_lvl+0x55/0x70
 print_report+0xcf/0x610
 ? __pfx_sched_balance_find_src_group+0x10/0x10
 ? __run_timer_base.part.0+0x7d7/0x8c0
 kasan_report+0xb8/0xf0
 ? __run_timer_base.part.0+0x7d7/0x8c0
 __run_timer_base.part.0+0x7d7/0x8c0
 ? rcu_sched_clock_irq+0xb06/0x27d0
 ? __pfx___run_timer_base.part.0+0x10/0x10
 ? try_to_wake_up+0xb15/0x1960
 ? tmigr_update_events+0x280/0x740
 ? _raw_spin_lock_irq+0x80/0xe0
 ? __pfx__raw_spin_lock_irq+0x10/0x10
 tmigr_handle_remote_up+0x603/0x7e0
 ? __pfx_tmigr_handle_remote_up+0x10/0x10
 ? sched_balance_trigger+0x98/0x9f0
 ? sched_tick+0x221/0x5a0
 ? _raw_spin_lock_irq+0x80/0xe0
 ? __pfx__raw_spin_lock_irq+0x10/0x10
 ? tick_nohz_handler+0x339/0x440
 ? __pfx_tmigr_handle_remote_up+0x10/0x10
 __walk_groups.isra.0+0x42/0x150
 tmigr_handle_remote+0x1f4/0x2e0
 ? __pfx_tmigr_handle_remote+0x10/0x10
 ? ktime_get+0x60/0x140
 ? lapic_next_event+0x11/0x20
 ? clockevents_program_event+0x1d4/0x2a0
 ? hrtimer_interrupt+0x322/0x780
 handle_softirqs+0x16a/0x550
 irq_exit_rcu+0xaf/0xe0
 sysvec_apic_timer_interrupt+0x70/0x80
 </IRQ>
...

Allocated by task 141:
 kasan_save_stack+0x24/0x50
 kasan_save_track+0x14/0x30
 __kasan_kmalloc+0x7f/0x90
 __kmalloc_node_track_caller_noprof+0x198/0x430
 devm_kmalloc+0x7b/0x1e0
 tc358743_probe+0xb7/0x610  i2c_device_probe+0x51d/0x880
 really_probe+0x1ca/0x5c0
 __driver_probe_device+0x248/0x310
 driver_probe_device+0x44/0x120
 __device_attach_driver+0x174/0x220
 bus_for_each_drv+0x100/0x190
 __device_attach+0x206/0x370
 bus_probe_device+0x123/0x170
 device_add+0xd25/0x1470
 i2c_new_client_device+0x7a0/0xcd0
 do_one_initcall+0x89/0x300
 do_init_module+0x29d/0x7f0
 load_module+0x4f48/0x69e0
 init_module_from_file+0xe4/0x150
 idempotent_init_module+0x320/0x670
 __x64_sys_finit_module+0xbd/0x120
 do_syscall_64+0xac/0x280
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 141:
 kasan_save_stack+0x24/0x50
 kasan_save_track+0x14/0x30
 kasan_save_free_info+0x3a/0x60
 __kasan_slab_free+0x3f/0x50
 kfree+0x137/0x370
 release_nodes+0xa4/0x100
 devres_release_group+0x1b2/0x380
 i2c_device_probe+0x694/0x880
 really_probe+0x1ca/0x5c0
 __driver_probe_device+0x248/0x310
 driver_probe_device+0x44/0x120
 __device_attach_driver+0x174/0x220
 bus_for_each_drv+0x100/0x190
 __device_attach+0x206/0x370
 bus_probe_device+0x123/0x170
 device_add+0xd25/0x1470
 i2c_new_client_device+0x7a0/0xcd0
 do_one_initcall+0x89/0x300
 do_init_module+0x29d/0x7f0
 load_module+0x4f48/0x69e0
 init_module_from_file+0xe4/0x150
 idempotent_init_module+0x320/0x670
 __x64_sys_finit_module+0xbd/0x120
 do_syscall_64+0xac/0x280
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
...

Replace timer_delete() with timer_delete_sync() and cancel_delayed_work()
with cancel_delayed_work_sync() to ensure proper termination of timer and
work items before resource cleanup.

This bug was initially identified through static analysis. For reproduction
and testing, I created a functional emulation of the tc358743 device via a
kernel module and introduced faults through the debugfs interface.

Fixes: 869f38ae07f7 ("media: i2c: tc358743: Fix crash in the probe error path when using polling")
Fixes: d32d98642de6 ("[media] Driver for Toshiba TC358743 HDMI to CSI-2 bridge")
Cc: [email-masked]
Signed-off-by: Duoming Zhou <[email-masked]>
Signed-off-by: Hans Verkuil <[email-masked]>
[ replaced del_timer() instead of timer_delete() ]
Signed-off-by: Sasha Levin <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/media/i2c/tc358743.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -2180,10 +2180,10 @@ static int tc358743_probe(struct i2c_cli
 err_work_queues:
 	cec_unregister_adapter(state->cec_adap);
 	if (!state->i2c_client->irq) {
-		del_timer(&state->timer);
+		timer_delete_sync(&state->timer);
 		flush_work(&state->work_i2c_poll);
 	}
-	cancel_delayed_work(&state->delayed_work_enable_hotplug);
+	cancel_delayed_work_sync(&state->delayed_work_enable_hotplug);
 	mutex_destroy(&state->confctl_mutex);
 err_hdl:
 	media_entity_cleanup(&sd->entity);

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:05:42 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366998; cv=none; b=m4c9lzqP9tWw7vHVkO7F3nCU4fNCX7Sem/goow4d6cZBHQELBQtHsHKVUYNpRMv+OwYVklw94sxf6F8Ftz0QHVSmedRfKGcG4ZlempsvzYJcufMJxZsG4Q7DGefzag3v41K+81ycDwAdNCPGiaj/ZZ4ucluOW6wWjlDCt/Z4kHA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366998; c=relaxed/simple;
	bh=+KQUGPDgpYt7MH4t3EpA/cqsnB0plJdYJGoHdQAS3hc=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=tfHnqNPbUdsM6y/7jFjCCNQFM+AmMLBsGyZZnH0JyDipVNhh9O25zVV++tpIw+qa8M3Tr/nVGd7mxj2OFF4puH/2TRJwsN6MvVAERdLzUaT0OuLdm6lvOB8UanlAhVqWZulFP68ePFAcMATbqzOON0mJt9Ht1IgsS1aOH9dst9Y=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xX6brBNa; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Dan Carpenter <[email-masked]>,
	[email-masked],
	Srinivas Kandagatla <[email-masked]>,
	Mark Brown <[email-masked]>
Subject: [PATCH 6.1 014/196] ASoC: qcom: audioreach: fix potential null pointer dereference
Date: Mon, 13 Oct 2025 16:43:07 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Srinivas Kandagatla <[email-masked]>

commit 8318e04ab2526b155773313b66a1542476ce1106 upstream.

It is possible that the topology parsing function
audioreach_widget_load_module_common() could return NULL or an error
pointer. Add missing NULL check so that we do not dereference it.

Reported-by: Dan Carpenter <[email-masked]>
Cc: [email-masked]
Fixes: 36ad9bf1d93d ("ASoC: qdsp6: audioreach: add topology support")
Signed-off-by: Srinivas Kandagatla <[email-masked]>
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Mark Brown <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 sound/soc/qcom/qdsp6/topology.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/soc/qcom/qdsp6/topology.c
+++ b/sound/soc/qcom/qdsp6/topology.c
@@ -504,8 +504,8 @@ static int audioreach_widget_load_module
 		return PTR_ERR(cont);
 
 	mod = audioreach_parse_common_tokens(apm, cont, &tplg_w->priv, w);
-	if (IS_ERR(mod))
-		return PTR_ERR(mod);
+	if (IS_ERR_OR_NULL(mod))
+		return mod ? PTR_ERR(mod) : -ENODEV;
 
 	dobj = &w->dobj;
 	dobj->private = mod;

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:07:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366865; cv=none; b=n/lREST8kyNUFkjegLWh/A9hr1CxtKdzWH2Mu+Psqn7xu8lq0s8GiiMTiKqXDftt8gctjZjNurF4F3vsW+9LZg9ls61j1hkV0Fo4KozLtpacQFuVW3+jHES+BLnVWkOFVypMCpXMR7cQfDNnsgAx2JzpzyFwVKq2KQUUaB+y9ig=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366865; c=relaxed/simple;
	bh=vBuJrjhM+U0I+2BoCm1x+HBC5RbMwhSFUBl8NBkkpIk=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=nJYSvojz8xgQXTEfNt0QK+eHb1ouu+jQDJlKRfnj9mkQvqGorYv7VNOXVowdXbq5VvsntZqoyJ55NGT4cA0kzj4ENsRgriRwiFRubnNLgJZguPP8vffAJ9xw42E1igOSHYSiRuXneFtVB6WNtLT7Y6xHeqWjOx1Rf4Tqxi2wI1g=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=imCV5819; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Duoming Zhou <[email-masked]>,
	Hans Verkuil <[email-masked]>
Subject: [PATCH 6.1 011/196] media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
Date: Mon, 13 Oct 2025 16:43:04 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Duoming Zhou <[email-masked]>

commit 01e03fb7db419d39e18d6090d4873c1bff103914 upstream.

The original code uses cancel_delayed_work() in flexcop_pci_remove(), which
does not guarantee that the delayed work item irq_check_work has fully
completed if it was already running. This leads to use-after-free scenarios
where flexcop_pci_remove() may free the flexcop_device while irq_check_work
is still active and attempts to dereference the device.

A typical race condition is illustrated below:

CPU 0 (remove)                         | CPU 1 (delayed work callback)
flexcop_pci_remove()                   | flexcop_pci_irq_check_work()
  cancel_delayed_work()                |
  flexcop_device_kfree(fc_pci->fc_dev) |
                                       |   fc = fc_pci->fc_dev; // UAF

This is confirmed by a KASAN report:

==================================================================
BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0
Write of size 8 at addr ffff8880093aa8c8 by task bash/135
...
Call Trace:
 <IRQ>
 dump_stack_lvl+0x55/0x70
 print_report+0xcf/0x610
 ? __run_timer_base.part.0+0x7d7/0x8c0
 kasan_report+0xb8/0xf0
 ? __run_timer_base.part.0+0x7d7/0x8c0
 __run_timer_base.part.0+0x7d7/0x8c0
 ? __pfx___run_timer_base.part.0+0x10/0x10
 ? __pfx_read_tsc+0x10/0x10
 ? ktime_get+0x60/0x140
 ? lapic_next_event+0x11/0x20
 ? clockevents_program_event+0x1d4/0x2a0
 run_timer_softirq+0xd1/0x190
 handle_softirqs+0x16a/0x550
 irq_exit_rcu+0xaf/0xe0
 sysvec_apic_timer_interrupt+0x70/0x80
 </IRQ>
...

Allocated by task 1:
 kasan_save_stack+0x24/0x50
 kasan_save_track+0x14/0x30
 __kasan_kmalloc+0x7f/0x90
 __kmalloc_noprof+0x1be/0x460
 flexcop_device_kmalloc+0x54/0xe0
 flexcop_pci_probe+0x1f/0x9d0
 local_pci_probe+0xdc/0x190
 pci_device_probe+0x2fe/0x470
 really_probe+0x1ca/0x5c0
 __driver_probe_device+0x248/0x310
 driver_probe_device+0x44/0x120
 __driver_attach+0xd2/0x310
 bus_for_each_dev+0xed/0x170
 bus_add_driver+0x208/0x500
 driver_register+0x132/0x460
 do_one_initcall+0x89/0x300
 kernel_init_freeable+0x40d/0x720
 kernel_init+0x1a/0x150
 ret_from_fork+0x10c/0x1a0
 ret_from_fork_asm+0x1a/0x30

Freed by task 135:
 kasan_save_stack+0x24/0x50
 kasan_save_track+0x14/0x30
 kasan_save_free_info+0x3a/0x60
 __kasan_slab_free+0x3f/0x50
 kfree+0x137/0x370
 flexcop_device_kfree+0x32/0x50
 pci_device_remove+0xa6/0x1d0
 device_release_driver_internal+0xf8/0x210
 pci_stop_bus_device+0x105/0x150
 pci_stop_and_remove_bus_device_locked+0x15/0x30
 remove_store+0xcc/0xe0
 kernfs_fop_write_iter+0x2c3/0x440
 vfs_write+0x871/0xd70
 ksys_write+0xee/0x1c0
 do_syscall_64+0xac/0x280
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
...

Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
that the delayed work item is properly canceled and any executing delayed
work has finished before the device memory is deallocated.

This bug was initially identified through static analysis. To reproduce
and test it, I simulated the B2C2 FlexCop PCI device in QEMU and introduced
artificial delays within the flexcop_pci_irq_check_work() function to
increase the likelihood of triggering the bug.

Fixes: 382c5546d618 ("V4L/DVB (10694): [PATCH] software IRQ watchdog for Flexcop B2C2 DVB PCI cards")
Cc: [email-masked]
Signed-off-by: Duoming Zhou <[email-masked]>
Signed-off-by: Hans Verkuil <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/media/pci/b2c2/flexcop-pci.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/pci/b2c2/flexcop-pci.c
+++ b/drivers/media/pci/b2c2/flexcop-pci.c
@@ -411,7 +411,7 @@ static void flexcop_pci_remove(struct pc
 	struct flexcop_pci *fc_pci = pci_get_drvdata(pdev);
 
 	if (irq_chk_intv > 0)
-		cancel_delayed_work(&fc_pci->irq_check_work);
+		cancel_delayed_work_sync(&fc_pci->irq_check_work);
 
 	flexcop_pci_dma_exit(fc_pci);
 	flexcop_device_exit(fc_pci->fc_dev);

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 15:05:26 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366862; cv=none; b=QC0ykVKjD7CMJUB4+6DaYneZOlydvMFF9WcrIBN5T7Q9Z24wT11j+qDv8xsQ1JgI7yjMNmKjNGa5WBxw8TxordSyZHyTEM6TqP9xqQYvo4l2cyaw9ykXPbwnJ+WdbSLfpw7NXUmDSULMGUPl01FmHdkBuoav/EGQ7xlp1X7n02I=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366862; c=relaxed/simple;
	bh=RjOEXcl0Wux6GVKIPupxMPAFyb3AOOSo8hxnZzEWerU=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=WUydS9k+nHh19v0WZTosZYyt2eDXdde6rw78h966STVLGpMbNLNOtsWk7J8jMkx1PtQnIoo1tipXMXPO9RJEbsXoqWNJAULh9466v+Tvf7zXCi+t2mw1MNo8wTuBF44w93xbQeXS9UYB1porso++JWeFhdgxaLWZTXqSFYDCMYU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XsSkjW1f; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	Wang Haoran <[email-masked]>,
	ziiiro <[email-masked]>,
	"Martin K. Petersen" <[email-masked]>
Subject: [PATCH 6.1 010/196] scsi: target: target_core_configfs: Add length check to avoid buffer overflow
Date: Mon, 13 Oct 2025 16:43:03 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [139.178.88.99 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 4

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wang Haoran <[email-masked]>

commit 27e06650a5eafe832a90fd2604f0c5e920857fae upstream.

A buffer overflow arises from the usage of snprintf to write into the
buffer "buf" in target_lu_gp_members_show function located in
/drivers/target/target_core_configfs.c. This buffer is allocated with
size LU_GROUP_NAME_BUF (256 bytes).

snprintf(...) formats multiple strings into buf with the HBA name
(hba->hba_group.cg_item), a slash character, a devicename (dev->
dev_group.cg_item) and a newline character, the total formatted string
length may exceed the buffer size of 256 bytes.

Since snprintf() returns the total number of bytes that would have been
written (the length of %s/%sn ), this value may exceed the buffer length
(256 bytes) passed to memcpy(), this will ultimately cause function
memcpy reporting a buffer overflow error.

An additional check of the return value of snprintf() can avoid this
buffer overflow.

Reported-by: Wang Haoran <[email-masked]>
Reported-by: ziiiro <[email-masked]>
Signed-off-by: Wang Haoran <[email-masked]>
Signed-off-by: Martin K. Petersen <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 drivers/target/target_core_configfs.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -2691,7 +2691,7 @@ static ssize_t target_lu_gp_members_show
 			config_item_name(&dev->dev_group.cg_item));
 		cur_len++; /* Extra byte for NULL terminator */
 
-		if ((cur_len + len) > PAGE_SIZE) {
+		if ((cur_len + len) > PAGE_SIZE || cur_len > LU_GROUP_NAME_BUF) {
 			pr_warn("Ran out of lu_gp_show_attr"
 				"_members buffer\n");
 			break;

From - Mon Oct 13 15:56:51 2025
Delivery-date: Mon, 13 Oct 2025 14:57:05 +0000
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1760366898; cv=none; b=QHre+pwEm17Vw3gZUCC1xztdQi3f5hW3+W+k2PiHnkZqjLFWE3BJqEAIaVYlrzruFHMGDhc0bm9djnT8pk6krtxcuouxIOZMi+Kur2N/C9Yt6umq0uKYWWsehJ1kDu48/GSwAul+c1NrfwLrG3c+qdHGswt8GrJTlPIHb15cjkA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1760366898; c=relaxed/simple;
	bh=Et98TPsNTIRdi4pRiQLrFeQi4NvA0kUu83E67pl2dLY=;
	h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=Bk+SeXJLfp2PBSf21SqsMbT083MZRaciiojsze3gXJuV6aWgpaBmUOkeC7qPKi40bPa6ubB3QDA1gVnIMCEynaHZt7Ow3E5Du6IKNvHyJPwzpA5IRv/wsp1epgBJKABs9ZrPT+uH8XP6JKYT4dVfsbFAtHHM9yKAkTkfdcbsywU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=1pFQ0YM/; arc=none smtp.client-ip=10.30.226.201
From: Greg Kroah-Hartman <[email-masked]>
To: [email-masked]
Cc: Greg Kroah-Hartman <[email-masked]>,
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked],
	[email-masked]
Subject: [PATCH 6.1 000/196] 6.1.156-rc1 review
Date: Mon, 13 Oct 2025 16:42:53 +0200
DKIMCheck: Server passes DKIM test, 0 Spam score
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: linuxfoundation.org]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to
                             DNSWL was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [142.0.200.124 listed in list.dnswl.org]
  1.5 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                             mail domains are different
  2.0 SUSPICIOUS_REWARD      BODY: Contains suspicious reward/winning
                             language
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
 -1.0 MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list
                             manager
 -0.0 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
SpamTally: Final spam score: 24

This is the start of the stable review cycle for the 6.1.156 release.
There are 196 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 15 Oct 2025 14:42:41 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.156-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email-masked]>
    Linux 6.1.156-rc1

K Prateek Nayak <[email-masked]>
    drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug

Yicong Yang <[email-masked]>
    cacheinfo: Fix LLC is not exported through sysfs

Pierre Gondois <[email-masked]>
    cacheinfo: Initialize variables in fetch_cache_info()

Miaoqian Lin <[email-masked]>
    usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call

Sven Peter <[email-masked]>
    usb: typec: tipd: Clear interrupts first

Oleksij Rempel <[email-masked]>
    net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock

Salah Triki <[email-masked]>
    bus: fsl-mc: Check return value of platform_get_resource()

Bartosz Golaszewski <[email-masked]>
    pinctrl: check the return value of pinmux_ops::get_function_name()

Zhen Ni <[email-masked]>
    Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak

Marek Vasut <[email-masked]>
    Input: atmel_mxt_ts - allow reset GPIO to sleep

Ling Xu <[email-masked]>
    misc: fastrpc: Skip reference for DMA handles

Ling Xu <[email-masked]>
    misc: fastrpc: fix possible map leak in fastrpc_put_args

Ling Xu <[email-masked]>
    misc: fastrpc: Fix fastrpc_map_lookup operation

Guangshuo Li <[email-masked]>
    nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()

Yang Shi <[email-masked]>
    mm: hugetlb: avoid soft lockup when mprotect to large memory area

Jan Kara <[email-masked]>
    ext4: fix checks for orphan inodes

Matvey Kovalev <[email-masked]>
    ksmbd: fix error code overwriting in smb2_get_info_filesystem()

Zheng Qixing <[email-masked]>
    dm: fix NULL pointer dereference in __dm_suspend()

Zheng Qixing <[email-masked]>
    dm: fix queue start/stop imbalance under suspend/load/resume races

Bartosz Golaszewski <[email-masked]>
    mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()

Deepak Sharma <[email-masked]>
    net: nfc: nci: Add parameter validation for packet data

Larshin Sergey <[email-masked]>
    fs: udf: fix OOB read in lengthAllocDescs handling

Naman Jain <[email-masked]>
    uio_hv_generic: Let userspace take care of interrupt mask

Phillip Lougher <[email-masked]>
    Squashfs: fix uninit-value in squashfs_get_parent

zhang jiao <[email-masked]>
    vhost: vringh: Modify the return value check

Jakub Kicinski <[email-masked]>
    Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"

Moshe Shemesh <[email-masked]>
    net/mlx5: fw reset, add reset timeout work

Shay Drory <[email-masked]>
    net/mlx5: pagealloc: Fix reclaim race during command interface teardown

Moshe Shemesh <[email-masked]>
    net/mlx5: Stop polling for command response if interface goes down

Yeounsu Moon <[email-masked]>
    net: dlink: handle copy_thresh allocation failure

Kohei Enju <[email-masked]>
    net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable

Kohei Enju <[email-masked]>
    nfp: fix RSS hash key size when RSS is not supported

Erick Karanja <[email-masked]>
    mtd: rawnand: atmel: Fix error handling path in atmel_nand_controller_add_nands

Donet Tom <[email-masked]>
    drivers/base/node: fix double free in register_one_node()

Dan Carpenter <[email-masked]>
    ocfs2: fix double free in user_cluster_connect()

Nishanth Menon <[email-masked]>
    hwrng: ks-sa - fix division by zero in ks_sa_rng_init

Luiz Augusto von Dentz <[email-masked]>
    Bluetooth: hci_sync: Fix using random address for BIG/PA advertisements

Pauli Virtanen <[email-masked]>
    Bluetooth: ISO: don't leak skb in ISO_CONT RX

Luiz Augusto von Dentz <[email-masked]>
    Bluetooth: ISO: Fix possible UAF on iso_conn_free

Luiz Augusto von Dentz <[email-masked]>
    Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO

Michael S. Tsirkin <[email-masked]>
    vhost: vringh: Fix copy_to_iter return value check

I Viswanath <[email-masked]>
    net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast

Bernard Metzler <[email-masked]>
    RDMA/siw: Always report immediate post SQ errors

Cristian Ciocaltea <[email-masked]>
    usb: vhci-hcd: Prevent suspending virtually attached devices

Ranjan Kumar <[email-masked]>
    scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()

Slavin Liu <[email-masked]>
    ipvs: Defer ip_vs_ftp unregister during netns cleanup

Anthony Iliopoulos <[email-masked]>
    NFSv4.1: fix backchannel max_resp_sz verification check

Leo Yan <[email-masked]>
    coresight: trbe: Return NULL pointer for allocation failures

Yuanfang Zhang <[email-masked]>
    coresight-etm4x: Conditionally access register TRCEXTINSELR

Stephan Gerhold <[email-masked]>
    remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice

Nagarjuna Kristam <[email-masked]>
    PCI: tegra194: Fix duplicate PLL disable in pex_ep_event_pex_rst_assert()

Fedor Pchelkin <[email-masked]>
    wifi: rtw89: avoid circular locking dependency in ser_state_run()

Chenghai Huang <[email-masked]>
    crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_{from,to}_user for M7

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_to_user for Niagara 4

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III

Michael Karcher <[email-masked]>
    sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC

Aditya Kumar Singh <[email-masked]>
    wifi: mac80211: fix Rx packet handling when pubsta information is not available

Baochen Qiang <[email-masked]>
    wifi: ath10k: avoid unnecessary wait for service ready message

Bagas Sanjaya <[email-masked]>
    Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram

Vlad Dumitrescu <[email-masked]>
    IB/sa: Fix sa_local_svc_timeout_ms read race

Parav Pandit <[email-masked]>
    RDMA/core: Resolve MAC of next-hop device without ARP support

Michal Pecio <[email-masked]>
    Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"

wangzijie <[email-masked]>
    f2fs: fix zero-sized extent for precache extents

Qianfeng Rong <[email-masked]>
    scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()

Qianfeng Rong <[email-masked]>
    scsi: qla2xxx: edif: Fix incorrect sign of error code

Colin Ian King <[email-masked]>
    ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message

Abdun Nihaal <[email-masked]>
    wifi: mt76: fix potential memory leak in mt76_wmac_probe()

Håkon Bugge <[email-masked]>
    RDMA/cm: Rate limit destroy CM ID timeout error message

Donet Tom <[email-masked]>
    drivers/base/node: handle error properly in register_one_node()

Christophe Leroy <[email-masked]>
    watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog

Zhen Ni <[email-masked]>
    netfilter: ipset: Remove unused htable_bits in macro ahash_region

Hans de Goede <[email-masked]>
    iio: consumers: Fix offset handling in iio_convert_raw_to_processed()

Vitaly Grigoryev <[email-masked]>
    fs: ntfs3: Fix integer overflow in run_unpack()

Qianfeng Rong <[email-masked]>
    drm/msm/dpu: fix incorrect type for ret

Takashi Iwai <[email-masked]>
    ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping

Takashi Iwai <[email-masked]>
    ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping

Takashi Iwai <[email-masked]>
    ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping

Wang Liang <[email-masked]>
    pps: fix warning in pps_register_cdev when register device fail

Colin Ian King <[email-masked]>
    misc: genwqe: Fix incorrect cmd field being reported in error

William Wu <[email-masked]>
    usb: gadget: configfs: Correctly set use_os_string at bind

Xichao Zhao <[email-masked]>
    usb: phy: twl6030: Fix incorrect type for ret

Qianfeng Rong <[email-masked]>
    drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()

Eric Dumazet <[email-masked]>
    tcp: fix __tcp_close() to only send RST when required

Alok Tiwari <[email-masked]>
    PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation

Stefan Kerkmann <[email-masked]>
    wifi: mwifiex: send world regulatory domain to driver

Timur Kristóf <[email-masked]>
    drm/amd/pm: Disable SCLK switching on Oland with high pixel clocks (v3)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Disable MCLK switching with non-DC at 120 Hz+ (v2)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Adjust si_upload_smc_data register programming (v3)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Fix si_upload_smc_data (v3)

Timur Kristóf <[email-masked]>
    drm/amd/pm: Disable ULV even if unsupported (v3)

Timur Kristóf <[email-masked]>
    drm/amdgpu: Power up UVD 3 for FW validation (v2)

Chenghai Huang <[email-masked]>
    crypto: hisilicon - re-enable address prefetch after device resuming

Chenghai Huang <[email-masked]>
    crypto: hisilicon/zip - remove unnecessary validation for high-performance mode configurations

Arnd Bergmann <[email-masked]>
    media: st-delta: avoid excessive stack usage

Qianfeng Rong <[email-masked]>
    ALSA: lx_core: use int type to store negative error codes

Zhang Shurong <[email-masked]>
    media: rj54n1cb0c: Fix memleak in rj54n1_probe()

Thomas Fourier <[email-masked]>
    scsi: myrs: Fix dma_alloc_coherent() error check

Niklas Cassel <[email-masked]>
    scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod

Arnd Bergmann <[email-masked]>
    hwrng: nomadik - add ARM_AMBA dependency

Liao Yuanhong <[email-masked]>
    drm/amd/display: Remove redundant semicolons

Dan Carpenter <[email-masked]>
    serial: max310x: Add error checking in probe()

Dan Carpenter <[email-masked]>
    usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup

Brahmajit Das <[email-masked]>
    drm/radeon/r600_cs: clean up of dead code in r600_cs

Brigham Campbell <[email-masked]>
    drm/panel: novatek-nt35560: Fix invalid return value

Daniel Borkmann <[email-masked]>
    bpf: Enforce expected_attach_type for tailcall compatibility

Kunihiko Hayashi <[email-masked]>
    i2c: designware: Add disabling clocks when probe fails

Leilk.Liu <[email-masked]>
    i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD

Dmitry Baryshkov <[email-masked]>
    thermal/drivers/qcom/lmh: Add missing IRQ includes

Dmitry Baryshkov <[email-masked]>
    thermal/drivers/qcom: Make LMH select QCOM_SCM

Vadim Pasternak <[email-masked]>
    hwmon: (mlxreg-fan) Separate methods of fan setting coming from different subsystems

Zhouyi Zhou <[email-masked]>
    tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers

Rafael J. Wysocki <[email-masked]>
    smp: Fix up and expand the smp_call_function_many() kerneldoc

Paul Chaignon <[email-masked]>
    bpf: Explicitly check accesses to bpf_sock_addr

Akhilesh Patil <[email-masked]>
    selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported

Stanley Chu <[email-masked]>
    i3c: master: svc: Recycle unused IBI slot

Stanley Chu <[email-masked]>
    i3c: master: svc: Use manual response for IBI events

Daniel Wagner <[email-masked]>
    nvmet-fc: move lsop put work to nvmet_fc_ls_req_op

Uwe Kleine-König <[email-masked]>
    pwm: tiehrpwm: Fix corner case in clock divisor calculation

AngeloGioacchino Del Regno <[email-masked]>
    arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible

Johan Hovold <[email-masked]>
    cpuidle: qcom-spm: fix device and OF node leaks at probe

Johan Hovold <[email-masked]>
    firmware: firmware: meson-sm: fix compile-test default

Eric Dumazet <[email-masked]>
    nbd: restrict sockets to TCP and UDP

Genjian Zhang <[email-masked]>
    null_blk: Fix the description of the cache_size module argument

Qianfeng Rong <[email-masked]>
    pinctrl: renesas: Use int type to store negative error codes

Andy Yan <[email-masked]>
    power: supply: cw2015: Fix a alignment coding style issue

Dan Carpenter <[email-masked]>
    PM / devfreq: mtk-cci: Fix potential error pointer dereference in probe()

Rafael J. Wysocki <[email-masked]>
    PM: sleep: core: Clear power.must_resume in noirq suspend error path

Qianfeng Rong <[email-masked]>
    block: use int to store blk_stack_limits() return value

Qianfeng Rong <[email-masked]>
    regulator: scmi: Use int type to store negative error codes

Nicolas Ferre <[email-masked]>
    ARM: at91: pm: fix MCKx restore routine

Li Nan <[email-masked]>
    blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx

Da Xue <[email-masked]>
    pinctrl: meson-gxl: add missing i2c_d pinmux

Sneh Mankad <[email-masked]>
    soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS

Huisong Li <[email-masked]>
    ACPI: processor: idle: Fix memory leak when register cpuidle device failed

Florian Fainelli <[email-masked]>
    cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()

Yureka Lilian <[email-masked]>
    libbpf: Fix reuse of DEVMAP

Tao Chen <[email-masked]>
    bpf: Remove migrate_disable in kprobe_multi_link_prog_run

Matt Bobrowski <[email-masked]>
    bpf/selftests: Fix test_tcpnotify_user

Geert Uytterhoeven <[email-masked]>
    regmap: Remove superfluous check for !config in __regmap_init()

Biju Das <[email-masked]>
    arm64: dts: renesas: rzg2lc-smarc: Disable CAN-FD channel0

Uros Bizjak <[email-masked]>
    x86/vdso: Fix output operand size of RDPID

Stefan Metzmacher <[email-masked]>
    smb: server: fix IRD/ORD negotiation with the client

Leo Yan <[email-masked]>
    perf: arm_spe: Prevent overflow in PERF_IDX2OFF()

Leo Yan <[email-masked]>
    coresight: trbe: Prevent overflow in PERF_IDX2OFF()

Bala-Vignesh-Reddy <[email-masked]>
    selftests: arm64: Check fread return value in exec_target

Johannes Nixdorf <[email-masked]>
    seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast

Geert Uytterhoeven <[email-masked]>
    init: INITRAMFS_PRESERVE_MTIME should depend on BLK_DEV_INITRD

Jeff Layton <[email-masked]>
    filelock: add FL_RECLAIM to show_fl_flags() macro

Nalivayko Sergey <[email-masked]>
    net/9p: fix double req put in p9_fd_cancelled

Herbert Xu <[email-masked]>
    crypto: rng - Ensure set_ent is always present

Rafael J. Wysocki <[email-masked]>
    driver core/PM: Set power.no_callbacks along with power.no_pm

Ovidiu Panait <[email-masked]>
    staging: axis-fifo: flush RX FIFO on read errors

Ovidiu Panait <[email-masked]>
    staging: axis-fifo: fix TX handling on copy_from_user() failure

Ovidiu Panait <[email-masked]>
    staging: axis-fifo: fix maximum TX packet length check

Raphael Gallais-Pou <[email-masked]>
    serial: stm32: allow selecting console when the driver is module

Arnaud Lecomte <[email-masked]>
    hid: fix I2C read buffer overflow in raw_event() for mcp2221

Duy Nguyen <[email-masked]>
    can: rcar_canfd: Fix controller mode setting

Chen Yufeng <[email-masked]>
    can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled

David Sterba <[email-masked]>
    btrfs: ref-verify: handle damaged extent root tree

Jack Yu <[email-masked]>
    ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue

hupu <[email-masked]>
    perf subcmd: avoid crash in exclude_cmds when excludes is empty

Mikulas Patocka <[email-masked]>
    dm-integrity: limit MAX_TAG_SIZE to 255

Bitterblue Smith <[email-masked]>
    wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188

Xiaowei Li <[email-masked]>
    USB: serial: option: add SIMCom 8230C compositions

David Laight <[email-masked]>
    minmax.h: remove some #defines that are only expanded once

David Laight <[email-masked]>
    minmax.h: simplify the variants of clamp()

David Laight <[email-masked]>
    minmax.h: move all the clamp() definitions after the min/max() ones

David Laight <[email-masked]>
    minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()

David Laight <[email-masked]>
    minmax.h: reduce the #define expansion of min(), max() and clamp()

David Laight <[email-masked]>
    minmax.h: update some comments

David Laight <[email-masked]>
    minmax.h: add whitespace around operators and after commas

Linus Torvalds <[email-masked]>
    minmax: fix up min3() and max3() too

Linus Torvalds <[email-masked]>
    minmax: improve macro expansion and type checking

Linus Torvalds <[email-masked]>
    minmax: simplify min()/max()/clamp() implementation

Linus Torvalds <[email-masked]>
    minmax: don't use max() in situations that want a C constant expression

Duoming Zhou <[email-masked]>
    media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe

Duoming Zhou <[email-masked]>
    media: tuner: xc5000: Fix use-after-free in xc5000_release

Ricardo Ribalda <[email-masked]>
    media: tunner: xc5000: Refactor firmware load

Will Deacon <[email-masked]>
    KVM: arm64: Fix softirq masking in FPSIMD register saving sequence

Srinivas Kandagatla <[email-masked]>
    ASoC: qcom: audioreach: fix potential null pointer dereference

Thadeu Lima de Souza Cascardo <[email-masked]>
    media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID

Larshin Sergey <[email-masked]>
    media: rc: fix races with imon_disconnect()

Duoming Zhou <[email-masked]>
    media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove

Wang Haoran <[email-masked]>
    scsi: target: target_core_configfs: Add length check to avoid buffer overflow

Kees Cook <[email-masked]>
    gcc-plugins: Remove TODO_verify_il for GCC >= 16

Pierre Gondois <[email-masked]>
    arch_topology: Build cacheinfo from primary CPU

Pierre Gondois <[email-masked]>
    ACPI: PPTT: Update acpi_find_last_cache_level() to acpi_get_cache_info()

Pierre Gondois <[email-masked]>
    ACPI: PPTT: Remove acpi_find_cache_levels()

Pierre Gondois <[email-masked]>
    cacheinfo: Check 'cache-unified' property to count cache leaves

Pierre Gondois <[email-masked]>
    cacheinfo: Return error code in init_of_cache_level()

Pierre Gondois <[email-masked]>
    cacheinfo: Use RISC-V's init_cache_level() as generic OF implementation

Kenta Akagi <[email-masked]>
    selftests: mptcp: connect: fix build regression caused by backport

Breno Leitao <[email-masked]>
    crypto: sha256 - fix crash at kexec

-------------

Diffstat:

 Documentation/trace/histogram-design.rst           |   4 +-
 Makefile                                           |   4 +-
 arch/arm/mach-at91/pm_suspend.S                    |   4 +-
 arch/arm64/boot/dts/mediatek/mt8516-pumpkin.dts    |   2 +-
 arch/arm64/boot/dts/renesas/rzg2lc-smarc.dtsi      |   5 +-
 arch/arm64/kernel/cacheinfo.c                      |  11 +-
 arch/arm64/kernel/fpsimd.c                         |   8 +-
 arch/riscv/kernel/cacheinfo.c                      |  42 ----
 arch/sparc/lib/M7memcpy.S                          |  20 +-
 arch/sparc/lib/Memcpy_utils.S                      |   9 +
 arch/sparc/lib/NG4memcpy.S                         |   2 +-
 arch/sparc/lib/NGmemcpy.S                          |  29 ++-
 arch/sparc/lib/U1memcpy.S                          |  19 +-
 arch/sparc/lib/U3memcpy.S                          |   2 +-
 arch/x86/include/asm/segment.h                     |   8 +-
 block/blk-mq-sysfs.c                               |   6 +-
 block/blk-settings.c                               |   3 +-
 crypto/rng.c                                       |   8 +
 drivers/acpi/nfit/core.c                           |   2 +-
 drivers/acpi/pptt.c                                |  93 ++++----
 drivers/acpi/processor_idle.c                      |   3 +
 drivers/base/arch_topology.c                       |  12 +-
 drivers/base/cacheinfo.c                           | 168 ++++++++++++---
 drivers/base/node.c                                |   4 +
 drivers/base/power/main.c                          |  14 +-
 drivers/base/regmap/regmap.c                       |   2 +-
 drivers/block/nbd.c                                |   8 +
 drivers/block/null_blk/main.c                      |   2 +-
 drivers/bus/fsl-mc/fsl-mc-bus.c                    |   3 +
 drivers/char/hw_random/Kconfig                     |   1 +
 drivers/char/hw_random/ks-sa-rng.c                 |   4 +
 drivers/cpufreq/scmi-cpufreq.c                     |  10 +
 drivers/cpuidle/cpuidle-qcom-spm.c                 |   7 +-
 drivers/crypto/hisilicon/debugfs.c                 |   1 +
 drivers/crypto/hisilicon/hpre/hpre_main.c          |   3 +-
 drivers/crypto/hisilicon/qm.c                      |   3 -
 drivers/crypto/hisilicon/sec2/sec_main.c           |  80 +++----
 drivers/crypto/hisilicon/zip/zip_main.c            |  17 +-
 drivers/devfreq/mtk-cci-devfreq.c                  |   3 +-
 drivers/firmware/meson/Kconfig                     |   2 +-
 drivers/gpu/drm/amd/amdgpu/uvd_v3_1.c              |  29 ++-
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c               |   2 +-
 .../display/dc/dml/dcn32/display_rq_dlg_calc_32.c  |   1 -
 drivers/gpu/drm/amd/pm/amdgpu_dpm_internal.c       |   7 +
 drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c         |  92 +++++---
 drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c             |   2 +-
 .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c    |   2 +-
 drivers/gpu/drm/panel/panel-novatek-nt35560.c      |   2 +-
 drivers/gpu/drm/radeon/r600_cs.c                   |   4 +-
 drivers/hid/hid-mcp2221.c                          |   4 +
 drivers/hwmon/mlxreg-fan.c                         |  24 ++-
 drivers/hwtracing/coresight/coresight-etm4x-core.c |  11 +-
 drivers/hwtracing/coresight/coresight-etm4x.h      |   2 +
 drivers/hwtracing/coresight/coresight-trbe.c       |   9 +-
 drivers/i2c/busses/i2c-designware-platdrv.c        |   1 +
 drivers/i2c/busses/i2c-mt65xx.c                    |  17 +-
 drivers/i3c/master/svc-i3c-master.c                |  31 ++-
 drivers/iio/inkern.c                               |   2 +-
 drivers/infiniband/core/addr.c                     |  10 +-
 drivers/infiniband/core/cm.c                       |   4 +-
 drivers/infiniband/core/sa_query.c                 |   6 +-
 drivers/infiniband/sw/siw/siw_verbs.c              |  25 ++-
 drivers/input/misc/uinput.c                        |   1 +
 drivers/input/touchscreen/atmel_mxt_ts.c           |   2 +-
 drivers/input/touchscreen/cyttsp4_core.c           |   2 +-
 drivers/irqchip/irq-sun6i-r.c                      |   2 +-
 drivers/md/dm-core.h                               |   1 +
 drivers/md/dm-integrity.c                          |   4 +-
 drivers/md/dm.c                                    |  13 +-
 drivers/media/i2c/rj54n1cb0c.c                     |   9 +-
 drivers/media/i2c/tc358743.c                       |   4 +-
 drivers/media/pci/b2c2/flexcop-pci.c               |   2 +-
 .../media/platform/st/sti/delta/delta-mjpeg-dec.c  |  20 +-
 drivers/media/rc/imon.c                            |  27 ++-
 drivers/media/tuners/xc5000.c                      |  41 ++--
 drivers/media/usb/uvc/uvc_driver.c                 |  73 ++++---
 drivers/media/usb/uvc/uvcvideo.h                   |   2 +
 drivers/mfd/vexpress-sysreg.c                      |   6 +-
 drivers/misc/fastrpc.c                             |  62 ++++--
 drivers/misc/genwqe/card_ddcb.c                    |   2 +-
 drivers/mtd/nand/raw/atmel/nand-controller.c       |   4 +-
 drivers/net/can/rcar/rcar_canfd.c                  |   7 +-
 drivers/net/can/spi/hi311x.c                       |  33 +--
 drivers/net/ethernet/amazon/ena/ena_ethtool.c      |   5 +-
 drivers/net/ethernet/dlink/dl2k.c                  |   7 +-
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c      |   6 +-
 .../ethernet/mellanox/mlx5/core/en/port_buffer.h   |  12 --
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |  17 +-
 drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c |  24 +++
 .../net/ethernet/mellanox/mlx5/core/pagealloc.c    |   7 +-
 .../net/ethernet/netronome/nfp/nfp_net_ethtool.c   |   2 +-
 drivers/net/usb/asix_devices.c                     |  29 +++
 drivers/net/usb/rtl8150.c                          |   2 -
 drivers/net/wireless/ath/ath10k/wmi.c              |  39 ++--
 drivers/net/wireless/marvell/mwifiex/cfg80211.c    |   7 +-
 drivers/net/wireless/mediatek/mt76/mt7603/soc.c    |   2 +-
 .../net/wireless/realtek/rtlwifi/rtl8192cu/sw.c    |   1 -
 drivers/net/wireless/realtek/rtw89/ser.c           |   3 +-
 drivers/nvme/target/fc.c                           |  19 +-
 drivers/pci/controller/dwc/pcie-tegra194.c         |   4 +-
 drivers/pci/controller/pci-tegra.c                 |   2 +-
 drivers/perf/arm_spe_pmu.c                         |   3 +-
 drivers/pinctrl/meson/pinctrl-meson-gxl.c          |  10 +
 drivers/pinctrl/pinmux.c                           |   2 +-
 drivers/pinctrl/renesas/pinctrl.c                  |   3 +-
 drivers/power/supply/cw2015_battery.c              |   3 +-
 drivers/pps/kapi.c                                 |   5 +-
 drivers/pps/pps.c                                  |   5 +-
 drivers/pwm/pwm-tiehrpwm.c                         |   4 +-
 drivers/regulator/scmi-regulator.c                 |   3 +-
 drivers/remoteproc/qcom_q6v5.c                     |   3 -
 drivers/scsi/mpt3sas/mpt3sas_transport.c           |   8 +-
 drivers/scsi/myrs.c                                |   8 +-
 drivers/scsi/pm8001/pm8001_sas.c                   |   9 +-
 drivers/scsi/qla2xxx/qla_edif.c                    |   4 +-
 drivers/scsi/qla2xxx/qla_init.c                    |   4 +-
 drivers/soc/qcom/rpmh-rsc.c                        |   7 +-
 drivers/staging/axis-fifo/axis-fifo.c              |  68 +++---
 drivers/target/target_core_configfs.c              |   2 +-
 drivers/thermal/qcom/Kconfig                       |   3 +-
 drivers/thermal/qcom/lmh.c                         |   2 +
 drivers/tty/serial/Kconfig                         |   2 +-
 drivers/tty/serial/max310x.c                       |   2 +
 drivers/uio/uio_hv_generic.c                       |   7 +-
 drivers/usb/cdns3/cdnsp-pci.c                      |   5 +-
 drivers/usb/gadget/configfs.c                      |   2 +
 drivers/usb/host/max3421-hcd.c                     |   2 +-
 drivers/usb/host/xhci-ring.c                       |  11 +-
 drivers/usb/phy/phy-twl6030-usb.c                  |   3 +-
 drivers/usb/serial/option.c                        |   6 +
 drivers/usb/typec/tipd/core.c                      |  24 +--
 drivers/usb/usbip/vhci_hcd.c                       |  22 ++
 drivers/vhost/vringh.c                             |  14 +-
 drivers/watchdog/mpc8xxx_wdt.c                     |   2 +
 fs/btrfs/ref-verify.c                              |   9 +-
 fs/btrfs/tree-checker.c                            |   2 +-
 fs/ext4/ext4.h                                     |  10 +
 fs/ext4/file.c                                     |   2 +-
 fs/ext4/inode.c                                    |   2 +-
 fs/ext4/orphan.c                                   |   6 +-
 fs/ext4/super.c                                    |   4 +-
 fs/f2fs/data.c                                     |   7 +-
 fs/nfs/nfs4proc.c                                  |   2 +-
 fs/ntfs3/run.c                                     |  12 +-
 fs/ocfs2/stack_user.c                              |   1 +
 fs/smb/server/smb2pdu.c                            |   3 +-
 fs/smb/server/transport_rdma.c                     |  97 +++++++--
 fs/squashfs/inode.c                                |   7 +
 fs/squashfs/squashfs_fs_i.h                        |   2 +-
 fs/udf/inode.c                                     |   3 +
 include/crypto/sha256_base.h                       |   2 +-
 include/linux/bpf.h                                |   1 +
 include/linux/cacheinfo.h                          |  11 +-
 include/linux/compiler.h                           |   9 +
 include/linux/device.h                             |   3 +
 include/linux/minmax.h                             | 236 ++++++++++++---------
 include/trace/events/filelock.h                    |   3 +-
 init/Kconfig                                       |   1 +
 kernel/bpf/core.c                                  |   5 +
 kernel/seccomp.c                                   |  12 +-
 kernel/smp.c                                       |  11 +-
 kernel/trace/bpf_trace.c                           |   9 +-
 lib/vsprintf.c                                     |   2 +-
 mm/hugetlb.c                                       |   2 +
 net/9p/trans_fd.c                                  |   8 +-
 net/bluetooth/hci_sync.c                           |  10 +-
 net/bluetooth/iso.c                                |   9 +-
 net/bluetooth/mgmt.c                               |  10 +-
 net/core/filter.c                                  |  16 +-
 net/ipv4/tcp.c                                     |   9 +-
 net/mac80211/rx.c                                  |  28 ++-
 net/netfilter/ipset/ip_set_hash_gen.h              |   8 +-
 net/netfilter/ipvs/ip_vs_ftp.c                     |   4 +-
 net/nfc/nci/ntf.c                                  | 135 ++++++++----
 scripts/gcc-plugins/gcc-common.h                   |   7 +
 sound/pci/lx6464es/lx_core.c                       |   4 +-
 sound/soc/codecs/rt5682s.c                         |  17 +-
 sound/soc/intel/boards/bytcht_es8316.c             |  20 +-
 sound/soc/intel/boards/bytcr_rt5640.c              |   7 +-
 sound/soc/intel/boards/bytcr_rt5651.c              |  26 ++-
 sound/soc/qcom/qdsp6/topology.c                    |   4 +-
 tools/include/nolibc/std.h                         |   2 +-
 tools/lib/bpf/libbpf.c                             |  10 +
 tools/lib/subcmd/help.c                            |   3 +
 tools/testing/nvdimm/test/ndtest.c                 |  13 +-
 tools/testing/selftests/arm64/pauth/exec_target.c  |   7 +-
 .../selftests/bpf/progs/test_tcpnotify_kern.c      |   1 -
 tools/testing/selftests/bpf/test_tcpnotify_user.c  |  20 +-
 tools/testing/selftests/net/mptcp/mptcp_connect.c  |   2 +-
 tools/testing/selftests/watchdog/watchdog-test.c   |   6 +
 190 files changed, 1637 insertions(+), 903 deletions(-)

From - Mon Oct 13 18:30:58 2025
Delivery-date: Mon, 13 Oct 2025 18:04:26 +0000