Changelog in Linux kernel 6.6.101

 
ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx [+ + +]
Author: Dawid Rezler <[email protected]>
Date:   Sun Jul 20 17:49:08 2025 +0200

    ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
    
    commit 9744ede7099e8a69c04aa23fbea44c15bc390c04 upstream.
    
    The mute LED on the HP Pavilion Laptop 15-eg0xxx,
    which uses the ALC287 codec, didn't work.
    This patch fixes the issue by enabling the ALC287_FIXUP_HP_GPIO_LED quirk.
    
    Tested on a physical device, the LED now works as intended.
    
    Signed-off-by: Dawid Rezler <[email protected]>
    Cc: <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

ALSA: hda/tegra: Add Tegra264 support [+ + +]
Author: Mohan Kumar D <[email protected]>
Date:   Mon May 12 06:42:58 2025 +0000

    ALSA: hda/tegra: Add Tegra264 support
    
    commit 1c4193917eb3279788968639f24d72ffeebdec6b upstream.
    
    Update HDA driver to support Tegra264 differences from legacy HDA,
    which includes: clocks/resets, always power on, and hardware-managed
    FPCI/IPFS initialization. The driver retrieves this chip-specific
    information from soc_data.
    
    Signed-off-by: Mohan Kumar D <[email protected]>
    Signed-off-by: Sheetal <[email protected]>
    Signed-off-by: Takashi Iwai <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Stable-dep-of: e0a911ac8685 ("ALSA: hda: Add missing NVIDIA HDA codec IDs")
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

ALSA: hda: Add missing NVIDIA HDA codec IDs [+ + +]
Author: Daniel Dadap <[email protected]>
Date:   Thu Jun 26 16:16:30 2025 -0500

    ALSA: hda: Add missing NVIDIA HDA codec IDs
    
    commit e0a911ac86857a73182edde9e50d9b4b949b7f01 upstream.
    
    Add codec IDs for several NVIDIA products with HDA controllers to the
    snd_hda_id_hdmi[] patch table.
    
    Signed-off-by: Daniel Dadap <[email protected]>
    Cc: <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
arm64/cpufeatures/kvm: Add ARMv8.9 FEAT_ECBHB bits in ID_AA64MMFR1 register [+ + +]
Author: Nianyao Tang <[email protected]>
Date:   Tue Jun 11 12:20:49 2024 +0000

    arm64/cpufeatures/kvm: Add ARMv8.9 FEAT_ECBHB bits in ID_AA64MMFR1 register
    
    commit e8cde32f111f7f5681a7bad3ec747e9e697569a9 upstream.
    
    Enable ECBHB bits in ID_AA64MMFR1 register as per ARM DDI 0487K.a
    specification.
    
    When guest OS read ID_AA64MMFR1_EL1, kvm emulate this reg using
    ftr_id_aa64mmfr1 and always return ID_AA64MMFR1_EL1.ECBHB=0 to guest.
    It results in guest syscall jump to tramp ventry, which is not needed
    in implementation with ID_AA64MMFR1_EL1.ECBHB=1.
    Let's make the guest syscall process the same as the host.
    
    Signed-off-by: Nianyao Tang <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Catalin Marinas <[email protected]>
    [ This fixes performance regressions introduced by commit 4117975672c4
      ("arm64: errata: Add newer ARM cores to the
      spectre_bhb_loop_affected() lists") for guests running on neoverse v2
      hardware, which supports ECBHB. ]
    Signed-off-by: Patrick Roy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() [+ + +]
Author: Ada Couprie Diaz <[email protected]>
Date:   Fri Jul 18 15:28:14 2025 +0100

    arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
    
    commit d42e6c20de6192f8e4ab4cf10be8c694ef27e8cb upstream.
    
    `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change
    to different stacks along with the Shadow Call Stack if it is enabled.
    Those two stack changes cannot be done atomically and both functions
    can be interrupted by SErrors or Debug Exceptions which, though unlikely,
    is very much broken : if interrupted, we can end up with mismatched stacks
    and Shadow Call Stack leading to clobbered stacks.
    
    In `cpu_switch_to()`, it can happen when SP_EL0 points to the new task,
    but x18 stills points to the old task's SCS. When the interrupt handler
    tries to save the task's SCS pointer, it will save the old task
    SCS pointer (x18) into the new task struct (pointed to by SP_EL0),
    clobbering it.
    
    In `call_on_irq_stack()`, it can happen when switching from the task stack
    to the IRQ stack and when switching back. In both cases, we can be
    interrupted when the SCS pointer points to the IRQ SCS, but SP points to
    the task stack. The nested interrupt handler pushes its return addresses
    on the IRQ SCS. It then detects that SP points to the task stack,
    calls `call_on_irq_stack()` and clobbers the task SCS pointer with
    the IRQ SCS pointer, which it will also use !
    
    This leads to tasks returning to addresses on the wrong SCS,
    or even on the IRQ SCS, triggering kernel panics via CONFIG_VMAP_STACK
    or FPAC if enabled.
    
    This is possible on a default config, but unlikely.
    However, when enabling CONFIG_ARM64_PSEUDO_NMI, DAIF is unmasked and
    instead the GIC is responsible for filtering what interrupts the CPU
    should receive based on priority.
    Given the goal of emulating NMIs, pseudo-NMIs can be received by the CPU
    even in `cpu_switch_to()` and `call_on_irq_stack()`, possibly *very*
    frequently depending on the system configuration and workload, leading
    to unpredictable kernel panics.
    
    Completely mask DAIF in `cpu_switch_to()` and restore it when returning.
    Do the same in `call_on_irq_stack()`, but restore and mask around
    the branch.
    Mask DAIF even if CONFIG_SHADOW_CALL_STACK is not enabled for consistency
    of behaviour between all configurations.
    
    Introduce and use an assembly macro for saving and masking DAIF,
    as the existing one saves but only masks IF.
    
    Cc: <[email protected]>
    Signed-off-by: Ada Couprie Diaz <[email protected]>
    Reported-by: Cristian Prundeanu <[email protected]>
    Fixes: 59b37fe52f49 ("arm64: Stash shadow stack pointer in the task struct on interrupt")
    Tested-by: Cristian Prundeanu <[email protected]>
    Acked-by: Will Deacon <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Will Deacon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS [+ + +]
Author: Nathan Chancellor <[email protected]>
Date:   Mon Jul 28 10:35:52 2025 -0400

    ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
    
    [ Upstream commit 87c4e1459e80bf65066f864c762ef4dc932fad4b ]
    
    After commit d5c8d6e0fa61 ("kbuild: Update assembler calls to use proper
    flags and language target"), which updated as-instr to use the
    'assembler-with-cpp' language option, the Kbuild version of as-instr
    always fails internally for arch/arm with
    
      <command-line>: fatal error: asm/unified.h: No such file or directory
      compilation terminated.
    
    because '-include' flags are now taken into account by the compiler
    driver and as-instr does not have '$(LINUXINCLUDE)', so unified.h is not
    found.
    
    This went unnoticed at the time of the Kbuild change because the last
    use of as-instr in Kbuild that arch/arm could reach was removed in 5.7
    by commit 541ad0150ca4 ("arm: Remove 32bit KVM host support") but a
    stable backport of the Kbuild change to before that point exposed this
    potential issue if one were to be reintroduced.
    
    Follow the general pattern of '-include' paths throughout the tree and
    make unified.h absolute using '$(srctree)' to ensure KBUILD_AFLAGS can
    be used independently.
    
    Closes: https://lore.kernel.org/CACo-S-1qbCX4WAVFA63dWfHtrRHZBTyyr2js8Lx=Az03XHTTHg@mail.gmail.com/
    
    Cc: [email protected]
    Fixes: d5c8d6e0fa61 ("kbuild: Update assembler calls to use proper flags and language target")
    Reported-by: KernelCI bot <[email protected]>
    Reviewed-by: Masahiro Yamada <[email protected]>
    Signed-off-by: Nathan Chancellor <[email protected]>
    Signed-off-by: Russell King (Oracle) <[email protected]>
    [ No KBUILD_RUSTFLAGS in <=6.12 ]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint() [+ + +]
Author: Ma Ke <[email protected]>
Date:   Thu Jul 17 10:23:07 2025 +0800

    bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint()
    
    commit bddbe13d36a02d5097b99cf02354d5752ad1ac60 upstream.
    
    The fsl_mc_get_endpoint() function may call fsl_mc_device_lookup()
    twice, which would increment the device's reference count twice if
    both lookups find a device. This could lead to a reference count leak.
    
    Found by code review.
    
    Cc: [email protected]
    Fixes: 1ac210d128ef ("bus: fsl-mc: add the fsl_mc_get_endpoint function")
    Signed-off-by: Ma Ke <[email protected]>
    Tested-by: Ioana Ciornei <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Fixes: 8567494cebe5 ("bus: fsl-mc: rescan devices if endpoint not found")
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
can: dev: can_restart(): move debug message and stats after successful restart [+ + +]
Author: Marc Kleine-Budde <[email protected]>
Date:   Fri Sep 29 10:18:02 2023 +0200

    can: dev: can_restart(): move debug message and stats after successful restart
    
    [ Upstream commit f0e0c809c0be05fe865b9ac128ef3ee35c276021 ]
    
    Move the debug message "restarted" and the CAN restart stats_after_
    the successful restart of the CAN device, because the restart may
    fail.
    
    While there update the error message from printing the error number to
    printing symbolic error names.
    
    Link: https://lore.kernel.org/all/20231005-can-dev-fix-can-restart-v2-4-91b5c1fd922c@pengutronix.de
    Reviewed-by: Vincent Mailhol <[email protected]>
    [mkl: mention stats in subject and description, too]
    Signed-off-by: Marc Kleine-Budde <[email protected]>
    Stable-dep-of: c1f3f9797c1f ("can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode")
    Signed-off-by: Sasha Levin <[email protected]>

can: dev: can_restart(): reverse logic to remove need for goto [+ + +]
Author: Marc Kleine-Budde <[email protected]>
Date:   Fri Sep 29 09:47:38 2023 +0200

    can: dev: can_restart(): reverse logic to remove need for goto
    
    [ Upstream commit 8f3ec204d340af183fb2bb21b8e797ac2ed012b2 ]
    
    Reverse the logic in the if statement and eliminate the need for a
    goto to simplify code readability.
    
    Link: https://lore.kernel.org/all/20231005-can-dev-fix-can-restart-v2-3-91b5c1fd922c@pengutronix.de
    Reviewed-by: Vincent Mailhol <[email protected]>
    Signed-off-by: Marc Kleine-Budde <[email protected]>
    Stable-dep-of: c1f3f9797c1f ("can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode")
    Signed-off-by: Sasha Levin <[email protected]>

can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode [+ + +]
Author: Marc Kleine-Budde <[email protected]>
Date:   Tue Jul 15 22:35:46 2025 +0200

    can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
    
    [ Upstream commit c1f3f9797c1f44a762e6f5f72520b2e520537b52 ]
    
    Andrei Lalaev reported a NULL pointer deref when a CAN device is
    restarted from Bus Off and the driver does not implement the struct
    can_priv::do_set_mode callback.
    
    There are 2 code path that call struct can_priv::do_set_mode:
    - directly by a manual restart from the user space, via
      can_changelink()
    - delayed automatic restart after bus off (deactivated by default)
    
    To prevent the NULL pointer deference, refuse a manual restart or
    configure the automatic restart delay in can_changelink() and report
    the error via extack to user space.
    
    As an additional safety measure let can_restart() return an error if
    can_priv::do_set_mode is not set instead of dereferencing it
    unchecked.
    
    Reported-by: Andrei Lalaev <[email protected]>
    Closes: https://lore.kernel.org/all/[email protected]
    Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
    Link: https://patch.msgid.link/20250718-fix-nullptr-deref-do_set_mode-v1-1-0b520097bb96@pengutronix.de
    Signed-off-by: Marc Kleine-Budde <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
comedi: comedi_test: Fix possible deletion of uninitialized timers [+ + +]
Author: Ian Abbott <[email protected]>
Date:   Tue Jul 8 14:06:27 2025 +0100

    comedi: comedi_test: Fix possible deletion of uninitialized timers
    
    commit 1b98304c09a0192598d0767f1eb8c83d7e793091 upstream.
    
    In `waveform_common_attach()`, the two timers `&devpriv->ai_timer` and
    `&devpriv->ao_timer` are initialized after the allocation of the device
    private data by `comedi_alloc_devpriv()` and the subdevices by
    `comedi_alloc_subdevices()`.  The function may return with an error
    between those function calls.  In that case, `waveform_detach()` will be
    called by the Comedi core to clean up.  The check that
    `waveform_detach()` uses to decide whether to delete the timers is
    incorrect.  It only checks that the device private data was allocated,
    but that does not guarantee that the timers were initialized.  It also
    needs to check that the subdevices were allocated.  Fix it.
    
    Fixes: 73e0e4dfed4c ("staging: comedi: comedi_test: fix timer lock-up")
    Cc: [email protected] # 6.15+
    Signed-off-by: Ian Abbott <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    [ changed timer_delete_sync() to del_timer_sync() ]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
crypto: powerpc/poly1305 - add depends on BROKEN for now [+ + +]
Author: Eric Biggers <[email protected]>
Date:   Wed Jul 23 22:54:19 2025 -0400

    crypto: powerpc/poly1305 - add depends on BROKEN for now
    
    [ Upstream commit bc8169003b41e89fe7052e408cf9fdbecb4017fe ]
    
    As discussed in the thread containing
    https://lore.kernel.org/linux-crypto/20250510053308.GB505731@sol/, the
    Power10-optimized Poly1305 code is currently not safe to call in softirq
    context.  Disable it for now.  It can be re-enabled once it is fixed.
    
    Fixes: ba8f8624fde2 ("crypto: poly1305-p10 - Glue code for optmized Poly1305 implementation for ppc64le")
    Cc: [email protected]
    Signed-off-by: Eric Biggers <[email protected]>
    Signed-off-by: Herbert Xu <[email protected]>
    [ applied to arch/powerpc/crypto/Kconfig ]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

crypto: qat - add shutdown handler to qat_dh895xcc [+ + +]
Author: Giovanni Cabiddu <[email protected]>
Date:   Fri Jul 25 22:27:05 2025 -0400

    crypto: qat - add shutdown handler to qat_dh895xcc
    
    [ Upstream commit 2c4e8b228733bfbcaf49408fdf94d220f6eb78fc ]
    
    During a warm reset via kexec, the system bypasses the driver removal
    sequence, meaning that the remove() callback is not invoked.
    If a QAT device is not shutdown properly, the device driver will fail to
    load in a newly rebooted kernel.
    
    This might result in output like the following after the kexec reboot:
    
        QAT: AE0 is inactive!!
        QAT: failed to get device out of reset
        dh895xcc 0000:3f:00.0: qat_hal_clr_reset error
        dh895xcc 0000:3f:00.0: Failed to init the AEs
        dh895xcc 0000:3f:00.0: Failed to initialise Acceleration Engine
        dh895xcc 0000:3f:00.0: Resetting device qat_dev0
        dh895xcc 0000:3f:00.0: probe with driver dh895xcc failed with error -14
    
    Implement the shutdown() handler that hooks into the reboot notifier
    list. This brings down the QAT device and ensures it is shut down
    properly.
    
    Cc: <[email protected]>
    Fixes: 7afa232e76ce ("crypto: qat - Intel(R) QAT DH895xcc accelerator")
    Reviewed-by: Ahsan Atta <[email protected]>
    Reviewed-by: Andy Shevchenko <[email protected]>
    Signed-off-by: Giovanni Cabiddu <[email protected]>
    Signed-off-by: Herbert Xu <[email protected]>
    [ added false parameter to adf_dev_down() call ]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
dpaa2-eth: Fix device reference count leak in MAC endpoint handling [+ + +]
Author: Ma Ke <[email protected]>
Date:   Thu Jul 17 10:23:08 2025 +0800

    dpaa2-eth: Fix device reference count leak in MAC endpoint handling
    
    commit ee9f3a81ab08dfe0538dbd1746f81fd4d5147fdc upstream.
    
    The fsl_mc_get_endpoint() function uses device_find_child() for
    localization, which implicitly calls get_device() to increment the
    device's reference count before returning the pointer. However, the
    caller dpaa2_eth_connect_mac() fails to properly release this
    reference in multiple scenarios. We should call put_device() to
    decrement reference count properly.
    
    As comment of device_find_child() says, 'NOTE: you will need to drop
    the reference with put_device() after use'.
    
    Found by code review.
    
    Cc: [email protected]
    Fixes: 719479230893 ("dpaa2-eth: add MAC/PHY support through phylink")
    Signed-off-by: Ma Ke <[email protected]>
    Tested-by: Ioana Ciornei <[email protected]>
    Reviewed-by: Ioana Ciornei <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
dpaa2-switch: Fix device reference count leak in MAC endpoint handling [+ + +]
Author: Ma Ke <[email protected]>
Date:   Thu Jul 17 10:23:09 2025 +0800

    dpaa2-switch: Fix device reference count leak in MAC endpoint handling
    
    commit 96e056ffba912ef18a72177f71956a5b347b5177 upstream.
    
    The fsl_mc_get_endpoint() function uses device_find_child() for
    localization, which implicitly calls get_device() to increment the
    device's reference count before returning the pointer. However, the
    caller dpaa2_switch_port_connect_mac() fails to properly release this
    reference in multiple scenarios. We should call put_device() to
    decrement reference count properly.
    
    As comment of device_find_child() says, 'NOTE: you will need to drop
    the reference with put_device() after use'.
    
    Found by code review.
    
    Cc: [email protected]
    Fixes: 84cba72956fd ("dpaa2-switch: integrate the MAC endpoint support")
    Signed-off-by: Ma Ke <[email protected]>
    Tested-by: Ioana Ciornei <[email protected]>
    Reviewed-by: Ioana Ciornei <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
drm/amdkfd: Don't call mmput from MMU notifier callback [+ + +]
Author: Philip Yang <[email protected]>
Date:   Fri Jun 20 18:32:32 2025 -0400

    drm/amdkfd: Don't call mmput from MMU notifier callback
    
    commit cf234231fcbc7d391e2135b9518613218cc5347f upstream.
    
    If the process is exiting, the mmput inside mmu notifier callback from
    compactd or fork or numa balancing could release the last reference
    of mm struct to call exit_mmap and free_pgtable, this triggers deadlock
    with below backtrace.
    
    The deadlock will leak kfd process as mmu notifier release is not called
    and cause VRAM leaking.
    
    The fix is to take mm reference mmget_non_zero when adding prange to the
    deferred list to pair with mmput in deferred list work.
    
    If prange split and add into pchild list, the pchild work_item.mm is not
    used, so remove the mm parameter from svm_range_unmap_split and
    svm_range_add_child.
    
    The backtrace of hung task:
    
     INFO: task python:348105 blocked for more than 64512 seconds.
     Call Trace:
      __schedule+0x1c3/0x550
      schedule+0x46/0xb0
      rwsem_down_write_slowpath+0x24b/0x4c0
      unlink_anon_vmas+0xb1/0x1c0
      free_pgtables+0xa9/0x130
      exit_mmap+0xbc/0x1a0
      mmput+0x5a/0x140
      svm_range_cpu_invalidate_pagetables+0x2b/0x40 [amdgpu]
      mn_itree_invalidate+0x72/0xc0
      __mmu_notifier_invalidate_range_start+0x48/0x60
      try_to_unmap_one+0x10fa/0x1400
      rmap_walk_anon+0x196/0x460
      try_to_unmap+0xbb/0x210
      migrate_page_unmap+0x54d/0x7e0
      migrate_pages_batch+0x1c3/0xae0
      migrate_pages_sync+0x98/0x240
      migrate_pages+0x25c/0x520
      compact_zone+0x29d/0x590
      compact_zone_order+0xb6/0xf0
      try_to_compact_pages+0xbe/0x220
      __alloc_pages_direct_compact+0x96/0x1a0
      __alloc_pages_slowpath+0x410/0x930
      __alloc_pages_nodemask+0x3a9/0x3e0
      do_huge_pmd_anonymous_page+0xd7/0x3e0
      __handle_mm_fault+0x5e3/0x5f0
      handle_mm_fault+0xf7/0x2e0
      hmm_vma_fault.isra.0+0x4d/0xa0
      walk_pmd_range.isra.0+0xa8/0x310
      walk_pud_range+0x167/0x240
      walk_pgd_range+0x55/0x100
      __walk_page_range+0x87/0x90
      walk_page_range+0xf6/0x160
      hmm_range_fault+0x4f/0x90
      amdgpu_hmm_range_get_pages+0x123/0x230 [amdgpu]
      amdgpu_ttm_tt_get_user_pages+0xb1/0x150 [amdgpu]
      init_user_pages+0xb1/0x2a0 [amdgpu]
      amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x543/0x7d0 [amdgpu]
      kfd_ioctl_alloc_memory_of_gpu+0x24c/0x4e0 [amdgpu]
      kfd_ioctl+0x29d/0x500 [amdgpu]
    
    Fixes: fa582c6f3684 ("drm/amdkfd: Use mmget_not_zero in MMU notifier")
    Signed-off-by: Philip Yang <[email protected]>
    Reviewed-by: Felix Kuehling <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    (cherry picked from commit a29e067bd38946f752b0ef855f3dfff87e77bec7)
    Cc: [email protected]
    [ updated additional svm_range_add_child calls in svm_range_split_by_granularity to remove mm parameter ]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe() [+ + +]
Author: Douglas Anderson <[email protected]>
Date:   Mon Jul 14 13:06:32 2025 -0700

    drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe()
    
    [ Upstream commit 15a7ca747d9538c2ad8b0c81dd4c1261e0736c82 ]
    
    As reported by the kernel test robot, a recent patch introduced an
    unnecessary semicolon. Remove it.
    
    Fixes: 55e8ff842051 ("drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type")
    Reported-by: kernel test robot <[email protected]>
    Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/
    Reviewed-by: Devarsh Thakkar <[email protected]>
    Signed-off-by: Douglas Anderson <[email protected]>
    Link: https://lore.kernel.org/r/20250714130631.1.I1cfae3222e344a3b3c770d079ee6b6f7f3b5d636@changeid
    Signed-off-by: Sasha Levin <[email protected]>

 
drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x [+ + +]
Author: Ville Syrjälä <[email protected]>
Date:   Thu Jul 10 23:17:12 2025 +0300

    drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
    
    commit 9e0c433d0c05fde284025264b89eaa4ad59f0a3e upstream.
    
    On g4x we currently use the 96MHz non-SSC refclk, which can't actually
    generate an exact 2.7 Gbps link rate. In practice we end up with 2.688
    Gbps which seems to be close enough to actually work, but link training
    is currently failing due to miscalculating the DP_LINK_BW value (we
    calcualte it directly from port_clock which reflects the actual PLL
    outpout frequency).
    
    Ideas how to fix this:
    - nudge port_clock back up to 270000 during PLL computation/readout
    - track port_clock and the nominal link rate separately so they might
      differ a bit
    - switch to the 100MHz refclk, but that one should be SSC so perhaps
      not something we want
    
    While we ponder about a better solution apply some band aid to the
    immediate issue of miscalculated DP_LINK_BW value. With this
    I can again use 2.7 Gbps link rate on g4x.
    
    Cc: [email protected]
    Fixes: 665a7b04092c ("drm/i915: Feed the DPLL output freq back into crtc_state")
    Signed-off-by: Ville Syrjälä <[email protected]>
    Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
    Reviewed-by: Imre Deak <[email protected]>
    (cherry picked from commit a8b874694db5cae7baaf522756f87acd956e6e66)
    Signed-off-by: Rodrigo Vivi <[email protected]>
    [ changed display->platform.g4x to IS_G4X(i915) ]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
drm/sched: Remove optimization that causes hang when killing dependent jobs [+ + +]
Author: Lin.Cao <[email protected]>
Date:   Tue Jul 29 11:40:45 2025 -0400

    drm/sched: Remove optimization that causes hang when killing dependent jobs
    
    [ Upstream commit 15f77764e90a713ee3916ca424757688e4f565b9 ]
    
    When application A submits jobs and application B submits a job with a
    dependency on A's fence, the normal flow wakes up the scheduler after
    processing each job. However, the optimization in
    drm_sched_entity_add_dependency_cb() uses a callback that only clears
    dependencies without waking up the scheduler.
    
    When application A is killed before its jobs can run, the callback gets
    triggered but only clears the dependency without waking up the scheduler,
    causing the scheduler to enter sleep state and application B to hang.
    
    Remove the optimization by deleting drm_sched_entity_clear_dep() and its
    usage, ensuring the scheduler is always woken up when dependencies are
    cleared.
    
    Fixes: 777dbd458c89 ("drm/amdgpu: drop a dummy wakeup scheduler")
    Cc: [email protected] # v4.6+
    Signed-off-by: Lin.Cao <[email protected]>
    Reviewed-by: Christian König <[email protected]>
    Signed-off-by: Philipp Stanner <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    [ replaced drm_sched_wakeup() calls with drm_sched_wakeup_if_can_queue() ]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
e1000e: disregard NVM checksum on tgp when valid checksum bit is not set [+ + +]
Author: Jacek Kowalski <[email protected]>
Date:   Mon Jun 30 10:33:39 2025 +0200

    e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
    
    commit 536fd741c7ac907d63166cdae1081b1febfab613 upstream.
    
    As described by Vitaly Lifshits:
    
    > Starting from Tiger Lake, LAN NVM is locked for writes by SW, so the
    > driver cannot perform checksum validation and correction. This means
    > that all NVM images must leave the factory with correct checksum and
    > checksum valid bit set. Since Tiger Lake devices were the first to have
    > this lock, some systems in the field did not meet this requirement.
    > Therefore, for these transitional devices we skip checksum update and
    > verification, if the valid bit is not set.
    
    Signed-off-by: Jacek Kowalski <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Reviewed-by: Vitaly Lifshits <[email protected]>
    Fixes: 4051f68318ca9 ("e1000e: Do not take care about recovery NVM checksum")
    Cc: [email protected]
    Tested-by: Mor Bar-Gabay <[email protected]>
    Signed-off-by: Tony Nguyen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

e1000e: ignore uninitialized checksum word on tgp [+ + +]
Author: Jacek Kowalski <[email protected]>
Date:   Mon Jun 30 10:35:00 2025 +0200

    e1000e: ignore uninitialized checksum word on tgp
    
    commit 61114910a5f6a71d0b6ea3b95082dfe031b19dfe upstream.
    
    As described by Vitaly Lifshits:
    
    > Starting from Tiger Lake, LAN NVM is locked for writes by SW, so the
    > driver cannot perform checksum validation and correction. This means
    > that all NVM images must leave the factory with correct checksum and
    > checksum valid bit set.
    
    Unfortunately some systems have left the factory with an uninitialized
    value of 0xFFFF at register address 0x3F (checksum word location).
    So on Tiger Lake platform we ignore the computed checksum when such
    condition is encountered.
    
    Signed-off-by: Jacek Kowalski <[email protected]>
    Tested-by: Vlad URSU <[email protected]>
    Fixes: 4051f68318ca9 ("e1000e: Do not take care about recovery NVM checksum")
    Cc: [email protected]
    Reviewed-by: Simon Horman <[email protected]>
    Reviewed-by: Vitaly Lifshits <[email protected]>
    Tested-by: Mor Bar-Gabay <[email protected]>
    Signed-off-by: Tony Nguyen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
erofs: address D-cache aliasing [+ + +]
Author: Gao Xiang <[email protected]>
Date:   Wed Jul 9 11:46:14 2025 +0800

    erofs: address D-cache aliasing
    
    commit 27917e8194f91dffd8b4825350c63cb68e98ce58 upstream.
    
    Flush the D-cache before unlocking folios for compressed inodes, as
    they are dirtied during decompression.
    
    Avoid calling flush_dcache_folio() on every CPU write, since it's more
    like playing whack-a-mole without real benefit.
    
    It has no impact on x86 and arm64/risc-v: on x86, flush_dcache_folio()
    is a no-op, and on arm64/risc-v, PG_dcache_clean (PG_arch_1) is clear
    for new page cache folios.  However, certain ARM boards are affected,
    as reported.
    
    Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
    Closes: https://lore.kernel.org/r/[email protected]
    Closes: https://lore.kernel.org/r/[email protected]
    Tested-by: Jan Kiszka <[email protected]>
    Tested-by: Stefan Kerkmann <[email protected]>
    Signed-off-by: Gao Xiang <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Gao Xiang <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
gve: Fix stuck TX queue for DQ queue format [+ + +]
Author: Praveen Kaligineedi <[email protected]>
Date:   Thu Jul 17 19:20:24 2025 +0000

    gve: Fix stuck TX queue for DQ queue format
    
    commit b03f15c0192b184078206760c839054ae6eb4eaa upstream.
    
    gve_tx_timeout was calculating missed completions in a way that is only
    relevant in the GQ queue format. Additionally, it was attempting to
    disable device interrupts, which is not needed in either GQ or DQ queue
    formats.
    
    As a result, TX timeouts with the DQ queue format likely would have
    triggered early resets without kicking the queue at all.
    
    This patch drops the check for pending work altogether and always kicks
    the queue after validating the queue has not seen a TX timeout too
    recently.
    
    Cc: [email protected]
    Fixes: 87a7f321bb6a ("gve: Recover from queue stall due to missed IRQ")
    Co-developed-by: Tim Hostetler <[email protected]>
    Signed-off-by: Tim Hostetler <[email protected]>
    Signed-off-by: Praveen Kaligineedi <[email protected]>
    Signed-off-by: Harshitha Ramamurthy <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
i2c: qup: jump out of the loop in case of timeout [+ + +]
Author: Yang Xiwen <[email protected]>
Date:   Mon Jun 16 00:01:10 2025 +0800

    i2c: qup: jump out of the loop in case of timeout
    
    commit a7982a14b3012527a9583d12525cd0dc9f8d8934 upstream.
    
    Original logic only sets the return value but doesn't jump out of the
    loop if the bus is kept active by a client. This is not expected. A
    malicious or buggy i2c client can hang the kernel in this case and
    should be avoided. This is observed during a long time test with a
    PCA953x GPIO extender.
    
    Fix it by changing the logic to not only sets the return value, but also
    jumps out of the loop and return to the caller with -ETIMEDOUT.
    
    Fixes: fbfab1ab0658 ("i2c: qup: reorganization of driver code to remove polling for qup v1")
    Signed-off-by: Yang Xiwen <[email protected]>
    Cc: <[email protected]> # v4.17+
    Signed-off-by: Andi Shyti <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

i2c: tegra: Fix reset error handling with ACPI [+ + +]
Author: Akhil R <[email protected]>
Date:   Thu Jul 10 18:42:04 2025 +0530

    i2c: tegra: Fix reset error handling with ACPI
    
    commit 56344e241c543f17e8102fa13466ad5c3e7dc9ff upstream.
    
    The acpi_evaluate_object() returns an ACPI error code and not
    Linux one. For the some platforms the err will have positive code
    which may be interpreted incorrectly. Use device_reset() for
    reset control which handles it correctly.
    
    Fixes: bd2fdedbf2ba ("i2c: tegra: Add the ACPI support")
    Reported-by: Andy Shevchenko <[email protected]>
    Signed-off-by: Akhil R <[email protected]>
    Cc: <[email protected]> # v5.17+
    Reviewed-by: Andy Shevchenko <[email protected]>
    Signed-off-by: Andi Shyti <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

i2c: virtio: Avoid hang by using interruptible completion wait [+ + +]
Author: Viresh Kumar <[email protected]>
Date:   Thu Jul 3 17:01:02 2025 +0530

    i2c: virtio: Avoid hang by using interruptible completion wait
    
    commit a663b3c47ab10f66130818cf94eb59c971541c3f upstream.
    
    The current implementation uses wait_for_completion(), which can cause
    the caller to hang indefinitely if the transfer never completes.
    
    Switch to wait_for_completion_interruptible() so that the operation can
    be interrupted by signals.
    
    Fixes: 84e1d0bf1d71 ("i2c: virtio: disable timeout handling")
    Signed-off-by: Viresh Kumar <[email protected]>
    Cc: <[email protected]> # v5.16+
    Signed-off-by: Andi Shyti <[email protected]>
    Link: https://lore.kernel.org/r/b8944e9cab8eb959d888ae80add6f2a686159ba2.1751541962.git.viresh.kumar@linaro.org
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
i40e: Add rx_missed_errors for buffer exhaustion [+ + +]
Author: Yajun Deng <[email protected]>
Date:   Wed Sep 6 15:27:57 2023 +0800

    i40e: Add rx_missed_errors for buffer exhaustion
    
    [ Upstream commit 5337d294973331660e84e41836a54014de22e5b0 ]
    
    As the comment in struct rtnl_link_stats64, rx_dropped should not
    include packets dropped by the device due to buffer exhaustion.
    They are counted in rx_missed_errors, procfs folds those two counters
    together.
    
    Add rx_missed_errors for buffer exhaustion, rx_missed_errors corresponds
    to rx_discards, rx_dropped corresponds to rx_discards_other.
    
    Signed-off-by: Yajun Deng <[email protected]>
    Tested-by: Arpana Arland <[email protected]> (A Contingent worker at Intel)
    Signed-off-by: Tony Nguyen <[email protected]>
    Stable-dep-of: 50b2af451597 ("i40e: report VF tx_dropped with tx_errors instead of tx_discards")
    Signed-off-by: Sasha Levin <[email protected]>

i40e: report VF tx_dropped with tx_errors instead of tx_discards [+ + +]
Author: Dennis Chen <[email protected]>
Date:   Wed Jun 18 15:52:40 2025 -0400

    i40e: report VF tx_dropped with tx_errors instead of tx_discards
    
    [ Upstream commit 50b2af451597ca6eefe9d4543f8bbf8de8aa00e7 ]
    
    Currently the tx_dropped field in VF stats is not updated correctly
    when reading stats from the PF. This is because it reads from
    i40e_eth_stats.tx_discards which seems to be unused for per VSI stats,
    as it is not updated by i40e_update_eth_stats() and the corresponding
    register, GLV_TDPC, is not implemented[1].
    
    Use i40e_eth_stats.tx_errors instead, which is actually updated by
    i40e_update_eth_stats() by reading from GLV_TEPC.
    
    To test, create a VF and try to send bad packets through it:
    
    $ echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs
    $ cat test.py
    from scapy.all import *
    
    vlan_pkt = Ether(dst="ff:ff:ff:ff:ff:ff") / Dot1Q(vlan=999) / IP(dst="192.168.0.1") / ICMP()
    ttl_pkt = IP(dst="8.8.8.8", ttl=0) / ICMP()
    
    print("Send packet with bad VLAN tag")
    sendp(vlan_pkt, iface="enp2s0f0v0")
    print("Send packet with TTL=0")
    sendp(ttl_pkt, iface="enp2s0f0v0")
    $ ip -s link show dev enp2s0f0
    16: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
        link/ether 3c:ec:ef:b7:e0:ac brd ff:ff:ff:ff:ff:ff
        RX:  bytes packets errors dropped  missed   mcast
                 0       0      0       0       0       0
        TX:  bytes packets errors dropped carrier collsns
                 0       0      0       0       0       0
        vf 0     link/ether e2:c6:fd:c1:1e:92 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
        RX: bytes  packets  mcast   bcast   dropped
                 0        0       0       0        0
        TX: bytes  packets   dropped
                 0        0        0
    $ python test.py
    Send packet with bad VLAN tag
    .
    Sent 1 packets.
    Send packet with TTL=0
    .
    Sent 1 packets.
    $ ip -s link show dev enp2s0f0
    16: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
        link/ether 3c:ec:ef:b7:e0:ac brd ff:ff:ff:ff:ff:ff
        RX:  bytes packets errors dropped  missed   mcast
                 0       0      0       0       0       0
        TX:  bytes packets errors dropped carrier collsns
                 0       0      0       0       0       0
        vf 0     link/ether e2:c6:fd:c1:1e:92 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
        RX: bytes  packets  mcast   bcast   dropped
                 0        0       0       0        0
        TX: bytes  packets   dropped
                 0        0        0
    
    A packet with non-existent VLAN tag and a packet with TTL = 0 are sent,
    but tx_dropped is not incremented.
    
    After patch:
    
    $ ip -s link show dev enp2s0f0
    19: enp2s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
        link/ether 3c:ec:ef:b7:e0:ac brd ff:ff:ff:ff:ff:ff
        RX:  bytes packets errors dropped  missed   mcast
                 0       0      0       0       0       0
        TX:  bytes packets errors dropped carrier collsns
                 0       0      0       0       0       0
        vf 0     link/ether 4a:b7:3d:37:f7:56 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
        RX: bytes  packets  mcast   bcast   dropped
                 0        0       0       0        0
        TX: bytes  packets   dropped
                 0        0        2
    
    Fixes: dc645daef9af5bcbd9c ("i40e: implement VF stats NDO")
    Signed-off-by: Dennis Chen <[email protected]>
    Link: https://www.intel.com/content/www/us/en/content-details/596333/intel-ethernet-controller-x710-tm4-at2-carlsville-datasheet.html
    Reviewed-by: Simon Horman <[email protected]>
    Tested-by: Rafal Romanowski <[email protected]>
    Signed-off-by: Tony Nguyen <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

i40e: When removing VF MAC filters, only check PF-set MAC [+ + +]
Author: Jamie Bainbridge <[email protected]>
Date:   Wed Jun 25 09:29:18 2025 +1000

    i40e: When removing VF MAC filters, only check PF-set MAC
    
    [ Upstream commit 5a0df02999dbe838c3feed54b1d59e9445f68b89 ]
    
    When the PF is processing an Admin Queue message to delete a VF's MACs
    from the MAC filter, we currently check if the PF set the MAC and if
    the VF is trusted.
    
    This results in undesirable behaviour, where if a trusted VF with a
    PF-set MAC sets itself down (which sends an AQ message to delete the
    VF's MAC filters) then the VF MAC is erased from the interface.
    
    This results in the VF losing its PF-set MAC which should not happen.
    
    There is no need to check for trust at all, because an untrusted VF
    cannot change its own MAC. The only check needed is whether the PF set
    the MAC. If the PF set the MAC, then don't erase the MAC on link-down.
    
    Resolve this by changing the deletion check only for PF-set MAC.
    
    (the out-of-tree driver has also intentionally removed the check for VF
    trust here with OOT driver version 2.26.8, this changes the Linux kernel
    driver behaviour and comment to match the OOT driver behaviour)
    
    Fixes: ea2a1cfc3b201 ("i40e: Fix VF MAC filter removal")
    Signed-off-by: Jamie Bainbridge <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Tested-by: Rafal Romanowski <[email protected]>
    Signed-off-by: Tony Nguyen <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
ice: Fix a null pointer dereference in ice_copy_and_init_pkg() [+ + +]
Author: Haoxiang Li <[email protected]>
Date:   Thu Jul 3 17:52:32 2025 +0800

    ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
    
    commit 4ff12d82dac119b4b99b5a78b5af3bf2474c0a36 upstream.
    
    Add check for the return value of devm_kmemdup()
    to prevent potential null pointer dereference.
    
    Fixes: c76488109616 ("ice: Implement Dynamic Device Personalization (DDP) download")
    Cc: [email protected]
    Signed-off-by: Haoxiang Li <[email protected]>
    Reviewed-by: Michal Swiatkowski <[email protected]>
    Reviewed-by: Aleksandr Loktionov <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Tested-by: Rinitha S <[email protected]> (A Contingent worker at Intel)
    Signed-off-by: Tony Nguyen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
iio: adc: ad7949: use spi_is_bpw_supported() [+ + +]
Author: David Lechner <[email protected]>
Date:   Wed Jun 11 10:04:58 2025 -0500

    iio: adc: ad7949: use spi_is_bpw_supported()
    
    [ Upstream commit 7b86482632788acd48d7b9ee1867f5ad3a32ccbb ]
    
    Use spi_is_bpw_supported() instead of directly accessing spi->controller
    ->bits_per_word_mask. bits_per_word_mask may be 0, which implies that
    8-bits-per-word is supported. spi_is_bpw_supported() takes this into
    account while spi_ctrl_mask == SPI_BPW_MASK(8) does not.
    
    Fixes: 0b2a740b424e ("iio: adc: ad7949: enable use with non 14/16-bit controllers")
    Closes: https://lore.kernel.org/linux-spi/[email protected]/
    Signed-off-by: David Lechner <[email protected]>
    Reviewed-by: Andy Shevchenko <[email protected]>
    Link: https://patch.msgid.link/20250611-iio-adc-ad7949-use-spi_is_bpw_supported-v1-1-c4e15bfd326e@baylibre.com
    Signed-off-by: Jonathan Cameron <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

iio: hid-sensor-prox: Fix incorrect OFFSET calculation [+ + +]
Author: Zhang Lixu <[email protected]>
Date:   Thu Jul 24 11:36:40 2025 -0400

    iio: hid-sensor-prox: Fix incorrect OFFSET calculation
    
    [ Upstream commit 79dabbd505210e41c88060806c92c052496dd61c ]
    
    The OFFSET calculation in the prox_read_raw() was incorrectly using the
    unit exponent, which is intended for SCALE calculations.
    
    Remove the incorrect OFFSET calculation and set it to a fixed value of 0.
    
    Cc: [email protected]
    Fixes: 39a3a0138f61 ("iio: hid-sensors: Added Proximity Sensor Driver")
    Signed-off-by: Zhang Lixu <[email protected]>
    Acked-by: Srinivas Pandruvada <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jonathan Cameron <[email protected]>
    [ adapted prox_attr array access to single structure member access ]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

iio: hid-sensor-prox: Restore lost scale assignments [+ + +]
Author: Zhang Lixu <[email protected]>
Date:   Thu Jul 24 11:36:37 2025 -0400

    iio: hid-sensor-prox: Restore lost scale assignments
    
    [ Upstream commit 83ded7cfaccccd2f4041769c313b58b4c9e265ad ]
    
    The variables `scale_pre_decml`, `scale_post_decml`, and `scale_precision`
    were assigned in commit d68c592e02f6 ("iio: hid-sensor-prox: Fix scale not
    correct issue"), but due to a merge conflict in
    commit 9c15db92a8e5 ("Merge tag 'iio-for-5.13a' of
    https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-next"),
    these assignments were lost.
    
    Add back lost assignments and replace `st->prox_attr` with
    `st->prox_attr[0]` because commit 596ef5cf654b ("iio: hid-sensor-prox: Add
    support for more channels") changed `prox_attr` to an array.
    
    Cc: [email protected] # 5.13+
    Fixes: 9c15db92a8e5 ("Merge tag 'iio-for-5.13a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-next")
    Signed-off-by: Zhang Lixu <[email protected]>
    Acked-by: Srinivas Pandruvada <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jonathan Cameron <[email protected]>
    [ changed st->prox_attr[0] array access to st->prox_attr single struct member ]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT [+ + +]
Author: Fabrice Gasnier <[email protected]>
Date:   Fri May 30 15:36:43 2025 -0700

    Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
    
    commit f4a8f561d08e39f7833d4a278ebfb12a41eef15f upstream.
    
    When enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in
    hard irq context, but the input_event() takes a spin_lock, which isn't
    allowed there as it is converted to a rt_spin_lock().
    
    [ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
    [ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0
    ...
    [ 4054.290195]  __might_resched+0x13c/0x1f4
    [ 4054.290209]  rt_spin_lock+0x54/0x11c
    [ 4054.290219]  input_event+0x48/0x80
    [ 4054.290230]  gpio_keys_irq_timer+0x4c/0x78
    [ 4054.290243]  __hrtimer_run_queues+0x1a4/0x438
    [ 4054.290257]  hrtimer_interrupt+0xe4/0x240
    [ 4054.290269]  arch_timer_handler_phys+0x2c/0x44
    [ 4054.290283]  handle_percpu_devid_irq+0x8c/0x14c
    [ 4054.290297]  handle_irq_desc+0x40/0x58
    [ 4054.290307]  generic_handle_domain_irq+0x1c/0x28
    [ 4054.290316]  gic_handle_irq+0x44/0xcc
    
    Considering the gpio_keys_irq_isr() can run in any context, e.g. it can
    be threaded, it seems there's no point in requesting the timer isr to
    run in hard irq context.
    
    Relax the hrtimer not to use the hard context.
    
    Fixes: 019002f20cb5 ("Input: gpio-keys - use hrtimer for release timer")
    Suggested-by: Sebastian Andrzej Siewior <[email protected]>
    Signed-off-by: Fabrice Gasnier <[email protected]>
    Signed-off-by: Gatien Chevallier <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Cc: [email protected]
    Signed-off-by: Dmitry Torokhov <[email protected]>
    [ adjusted context ]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
 
interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node [+ + +]
Author: Xilin Wu <[email protected]>
Date:   Fri Jun 13 22:53:38 2025 +0800

    interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node
    
    [ Upstream commit 886a94f008dd1a1702ee66dd035c266f70fd9e90 ]
    
    This allows adding interconnect paths for PCIe 1 in device tree later.
    
    Fixes: 46bdcac533cc ("interconnect: qcom: Add SC7280 interconnect provider driver")
    Signed-off-by: Xilin Wu <[email protected]>
    Reviewed-by: Dmitry Baryshkov <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Georgi Djakov <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
jfs: reject on-disk inodes of an unsupported type [+ + +]
Author: Dmitry Antipov <[email protected]>
Date:   Thu Nov 7 08:42:28 2024 +0300

    jfs: reject on-disk inodes of an unsupported type
    
    commit 8c3f9a70d2d4dd6c640afe294b05c6a0a45434d9 upstream.
    
    Syzbot has reported the following BUG:
    
    kernel BUG at fs/inode.c:668!
    Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
    CPU: 3 UID: 0 PID: 139 Comm: jfsCommit Not tainted 6.12.0-rc4-syzkaller-00085-g4e46774408d9 #0
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
    RIP: 0010:clear_inode+0x168/0x190
    Code: 4c 89 f7 e8 ba fe e5 ff e9 61 ff ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 7c c1 4c 89 f7 e8 90 ff e5 ff eb b7
     0b e8 01 5d 7f ff 90 0f 0b e8 f9 5c 7f ff 90 0f 0b e8 f1 5c 7f
    RSP: 0018:ffffc900027dfae8 EFLAGS: 00010093
    RAX: ffffffff82157a87 RBX: 0000000000000001 RCX: ffff888104d4b980
    RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
    RBP: ffffc900027dfc90 R08: ffffffff82157977 R09: fffff520004fbf38
    R10: dffffc0000000000 R11: fffff520004fbf38 R12: dffffc0000000000
    R13: ffff88811315bc00 R14: ffff88811315bda8 R15: ffff88811315bb80
    FS:  0000000000000000(0000) GS:ffff888135f00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00005565222e0578 CR3: 0000000026ef0000 CR4: 00000000000006f0
    Call Trace:
     <TASK>
     ? __die_body+0x5f/0xb0
     ? die+0x9e/0xc0
     ? do_trap+0x15a/0x3a0
     ? clear_inode+0x168/0x190
     ? do_error_trap+0x1dc/0x2c0
     ? clear_inode+0x168/0x190
     ? __pfx_do_error_trap+0x10/0x10
     ? report_bug+0x3cd/0x500
     ? handle_invalid_op+0x34/0x40
     ? clear_inode+0x168/0x190
     ? exc_invalid_op+0x38/0x50
     ? asm_exc_invalid_op+0x1a/0x20
     ? clear_inode+0x57/0x190
     ? clear_inode+0x167/0x190
     ? clear_inode+0x168/0x190
     ? clear_inode+0x167/0x190
     jfs_evict_inode+0xb5/0x440
     ? __pfx_jfs_evict_inode+0x10/0x10
     evict+0x4ea/0x9b0
     ? __pfx_evict+0x10/0x10
     ? iput+0x713/0xa50
     txUpdateMap+0x931/0xb10
     ? __pfx_txUpdateMap+0x10/0x10
     jfs_lazycommit+0x49a/0xb80
     ? _raw_spin_unlock_irqrestore+0x8f/0x140
     ? lockdep_hardirqs_on+0x99/0x150
     ? __pfx_jfs_lazycommit+0x10/0x10
     ? __pfx_default_wake_function+0x10/0x10
     ? __kthread_parkme+0x169/0x1d0
     ? __pfx_jfs_lazycommit+0x10/0x10
     kthread+0x2f2/0x390
     ? __pfx_jfs_lazycommit+0x10/0x10
     ? __pfx_kthread+0x10/0x10
     ret_from_fork+0x4d/0x80
     ? __pfx_kthread+0x10/0x10
     ret_from_fork_asm+0x1a/0x30
     </TASK>
    
    This happens when 'clear_inode()' makes an attempt to finalize an underlying
    JFS inode of unknown type. According to JFS layout description from
    https://jfs.sourceforge.net/project/pub/jfslayout.pdf, inode types from 5 to
    15 are reserved for future extensions and should not be encountered on a valid
    filesystem. So add an extra check for valid inode type in 'copy_from_dinode()'.
    
    Reported-by: [email protected]
    Closes: https://syzkaller.appspot.com/bug?extid=ac2116e48989e84a2893
    Fixes: 79ac5a46c5c1 ("jfs_lookup(): don't bother with . or ..")
    Signed-off-by: Dmitry Antipov <[email protected]>
    Signed-off-by: Dave Kleikamp <[email protected]>
    Signed-off-by: Aditya Dutt <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
kasan: use vmalloc_dump_obj() for vmalloc error reports [+ + +]
Author: Marco Elver <[email protected]>
Date:   Wed Jul 16 17:23:28 2025 +0200

    kasan: use vmalloc_dump_obj() for vmalloc error reports
    
    commit 6ade153349c6bb990d170cecc3e8bdd8628119ab upstream.
    
    Since 6ee9b3d84775 ("kasan: remove kasan_find_vm_area() to prevent
    possible deadlock"), more detailed info about the vmalloc mapping and the
    origin was dropped due to potential deadlocks.
    
    While fixing the deadlock is necessary, that patch was too quick in
    killing an otherwise useful feature, and did no due-diligence in
    understanding if an alternative option is available.
    
    Restore printing more helpful vmalloc allocation info in KASAN reports
    with the help of vmalloc_dump_obj().  Example report:
    
    | BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x4c9/0x610
    | Read of size 1 at addr ffffc900002fd7f3 by task kunit_try_catch/493
    |
    | CPU: [...]
    | Call Trace:
    |  <TASK>
    |  dump_stack_lvl+0xa8/0xf0
    |  print_report+0x17e/0x810
    |  kasan_report+0x155/0x190
    |  vmalloc_oob+0x4c9/0x610
    |  [...]
    |
    | The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900002fd000 allocated at vmalloc_oob+0x36/0x610
    | The buggy address belongs to the physical page:
    | page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x126364
    | flags: 0x200000000000000(node=0|zone=2)
    | raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000
    | raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
    | page dumped because: kasan: bad access detected
    |
    | [..]
    
    Link: https://lkml.kernel.org/r/[email protected]
    Fixes: 6ee9b3d84775 ("kasan: remove kasan_find_vm_area() to prevent possible deadlock")
    Signed-off-by: Marco Elver <[email protected]>
    Suggested-by: Uladzislau Rezki <[email protected]>
    Acked-by: Uladzislau Rezki (Sony) <[email protected]>
    Cc: Alexander Potapenko <[email protected]>
    Cc: Andrey Konovalov <[email protected]>
    Cc: Andrey Ryabinin <[email protected]>
    Cc: Sebastian Andrzej Siewior <[email protected]>
    Cc: Yeoreum Yun <[email protected]>
    Cc: Yunseong Kim <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
ksmbd: add free_transport ops in ksmbd connection [+ + +]
Author: Namjae Jeon <[email protected]>
Date:   Tue Jun 10 18:52:56 2025 +0900

    ksmbd: add free_transport ops in ksmbd connection
    
    commit a89f5fae998bdc4d0505306f93844c9ae059d50c upstream.
    
    free_transport function for tcp connection can be called from smbdirect.
    It will cause kernel oops. This patch add free_transport ops in ksmbd
    connection, and add each free_transports for tcp and smbdirect.
    
    Fixes: 21a4e47578d4 ("ksmbd: fix use-after-free in __smb2_lease_break_noti()")
    Reviewed-by: Stefan Metzmacher <[email protected]>
    Signed-off-by: Namjae Jeon <[email protected]>
    Signed-off-by: Steve French <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

ksmbd: fix use-after-free in __smb2_lease_break_noti() [+ + +]
Author: Namjae Jeon <[email protected]>
Date:   Sat Jul 26 11:52:17 2025 -0400

    ksmbd: fix use-after-free in __smb2_lease_break_noti()
    
    [ Upstream commit 21a4e47578d44c6b37c4fc4aba8ed7cc8dbb13de ]
    
    Move tcp_transport free to ksmbd_conn_free. If ksmbd connection is
    referenced when ksmbd server thread terminates, It will not be freed,
    but conn->tcp_transport is freed. __smb2_lease_break_noti can be performed
    asynchronously when the connection is disconnected. __smb2_lease_break_noti
    calls ksmbd_conn_write, which can cause use-after-free
    when conn->ksmbd_transport is already freed.
    
    Cc: [email protected]
    Reported-by: Norbert Szetei <[email protected]>
    Tested-by: Norbert Szetei <[email protected]>
    Signed-off-by: Namjae Jeon <[email protected]>
    Signed-off-by: Steve French <[email protected]>
    [ Removed declaration of non-existent function ksmbd_find_netdev_name_iface_list() from transport_tcp.h. ]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
Linux: Linux 6.6.101 [+ + +]
Author: Greg Kroah-Hartman <[email protected]>
Date:   Fri Aug 1 09:47:33 2025 +0100

    Linux 6.6.101
    
    Link: https://lore.kernel.org/r/[email protected]
    Tested-by: Brett A C Sheffield <[email protected]>
    Tested-by: Peter Schneider <[email protected]>
    Tested-by: Mark Brown <[email protected]>
    Tested-by: Jon Hunter <[email protected]>
    Tested-by: Shuah Khan <[email protected]>
    Tested-by: Shuah Khan <[email protected]>
    Tested-by: Harshit Mogalapalli <[email protected]>
    Tested-by: Ron Economos <[email protected]>
    Tested-by: Linux Kernel Functional Testing <[email protected]>
    Tested-by: Miguel Ojeda <[email protected]>
    Tested-by: Hardik Garg <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n [+ + +]
Author: Harry Yoo <[email protected]>
Date:   Fri Jul 4 19:30:53 2025 +0900

    mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
    
    commit 694d6b99923eb05a8fd188be44e26077d19f0e21 upstream.
    
    Commit 48b4800a1c6a ("zsmalloc: page migration support") added support for
    migrating zsmalloc pages using the movable_operations migration framework.
    However, the commit did not take into account that zsmalloc supports
    migration only when CONFIG_COMPACTION is enabled.  Tracing shows that
    zsmalloc was still passing the __GFP_MOVABLE flag even when compaction is
    not supported.
    
    This can result in unmovable pages being allocated from movable page
    blocks (even without stealing page blocks), ZONE_MOVABLE and CMA area.
    
    Possible user visible effects:
    - Some ZONE_MOVABLE memory can be not actually movable
    - CMA allocation can fail because of this
    - Increased memory fragmentation due to ignoring the page mobility
      grouping feature
    I'm not really sure who uses kernels without compaction support, though :(
    
    
    To fix this, clear the __GFP_MOVABLE flag when
    !IS_ENABLED(CONFIG_COMPACTION).
    
    Link: https://lkml.kernel.org/r/[email protected]
    Fixes: 48b4800a1c6a ("zsmalloc: page migration support")
    Signed-off-by: Harry Yoo <[email protected]>
    Acked-by: David Hildenbrand <[email protected]>
    Reviewed-by: Sergey Senozhatsky <[email protected]>
    Cc: Minchan Kim <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma [+ + +]
Author: Liu Shixin <[email protected]>
Date:   Sat Jan 11 11:45:11 2025 +0800

    mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma
    
    commit f1897f2f08b28ae59476d8b73374b08f856973af upstream.
    
    syzkaller reported such a BUG_ON():
    
     ------------[ cut here ]------------
     kernel BUG at mm/khugepaged.c:1835!
     Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
     ...
     CPU: 6 UID: 0 PID: 8009 Comm: syz.15.106 Kdump: loaded Tainted: G        W          6.13.0-rc6 #22
     Tainted: [W]=WARN
     Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
     pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
     pc : collapse_file+0xa44/0x1400
     lr : collapse_file+0x88/0x1400
     sp : ffff80008afe3a60
     ...
     Call trace:
      collapse_file+0xa44/0x1400 (P)
      hpage_collapse_scan_file+0x278/0x400
      madvise_collapse+0x1bc/0x678
      madvise_vma_behavior+0x32c/0x448
      madvise_walk_vmas.constprop.0+0xbc/0x140
      do_madvise.part.0+0xdc/0x2c8
      __arm64_sys_madvise+0x68/0x88
      invoke_syscall+0x50/0x120
      el0_svc_common.constprop.0+0xc8/0xf0
      do_el0_svc+0x24/0x38
      el0_svc+0x34/0x128
      el0t_64_sync_handler+0xc8/0xd0
      el0t_64_sync+0x190/0x198
    
    This indicates that the pgoff is unaligned.  After analysis, I confirm the
    vma is mapped to /dev/zero.  Such a vma certainly has vm_file, but it is
    set to anonymous by mmap_zero().  So even if it's mmapped by 2m-unaligned,
    it can pass the check in thp_vma_allowable_order() as it is an
    anonymous-mmap, but then be collapsed as a file-mmap.
    
    It seems the problem has existed for a long time, but actually, since we
    have khugepaged_max_ptes_none check before, we will skip collapse it as it
    is /dev/zero and so has no present page.  But commit d8ea7cc8547c limit
    the check for only khugepaged, so the BUG_ON() can be triggered by
    madvise_collapse().
    
    Add vma_is_anonymous() check to make such vma be processed by
    hpage_collapse_scan_pmd().
    
    Link: https://lkml.kernel.org/r/[email protected]
    Fixes: d8ea7cc8547c ("mm/khugepaged: add flag to predicate khugepaged-only behavior")
    Signed-off-by: Liu Shixin <[email protected]>
    Reviewed-by: Yang Shi <[email protected]>
    Acked-by: David Hildenbrand <[email protected]>
    Cc: Chengming Zhou <[email protected]>
    Cc: Johannes Weiner <[email protected]>
    Cc: Kefeng Wang <[email protected]>
    Cc: Mattew Wilcox <[email protected]>
    Cc: Muchun Song <[email protected]>
    Cc: Nanyong Sun <[email protected]>
    Cc: Qi Zheng <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    [acsjakub: backport, clean apply]
    Signed-off-by: Jakub Acs <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
mptcp: make fallback action and fallback decision atomic [+ + +]
Author: Paolo Abeni <[email protected]>
Date:   Mon Jul 28 11:14:49 2025 +0200

    mptcp: make fallback action and fallback decision atomic
    
    commit f8a1d9b18c5efc76784f5a326e905f641f839894 upstream.
    
    Syzkaller reported the following splat:
    
      WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline]
      WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline]
      WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline]
      WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153
      Modules linked in:
      CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary)
      Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
      RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline]
      RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline]
      RIP: 0010:check_fully_established net/mptcp/options.c:982 [inline]
      RIP: 0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153
      Code: 24 18 e8 bb 2a 00 fd e9 1b df ff ff e8 b1 21 0f 00 e8 ec 5f c4 fc 44 0f b7 ac 24 b0 00 00 00 e9 54 f1 ff ff e8 d9 5f c4 fc 90 <0f> 0b 90 e9 b8 f4 ff ff e8 8b 2a 00 fd e9 8d e6 ff ff e8 81 2a 00
      RSP: 0018:ffff8880a3f08448 EFLAGS: 00010246
      RAX: 0000000000000000 RBX: ffff8880180a8000 RCX: ffffffff84afcf45
      RDX: ffff888090223700 RSI: ffffffff84afdaa7 RDI: 0000000000000001
      RBP: ffff888017955780 R08: 0000000000000001 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
      R13: ffff8880180a8910 R14: ffff8880a3e9d058 R15: 0000000000000000
      FS:  00005555791b8500(0000) GS:ffff88811c495000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 000000110c2800b7 CR3: 0000000058e44000 CR4: 0000000000350ef0
      Call Trace:
       <IRQ>
       tcp_reset+0x26f/0x2b0 net/ipv4/tcp_input.c:4432
       tcp_validate_incoming+0x1057/0x1b60 net/ipv4/tcp_input.c:5975
       tcp_rcv_established+0x5b5/0x21f0 net/ipv4/tcp_input.c:6166
       tcp_v4_do_rcv+0x5dc/0xa70 net/ipv4/tcp_ipv4.c:1925
       tcp_v4_rcv+0x3473/0x44a0 net/ipv4/tcp_ipv4.c:2363
       ip_protocol_deliver_rcu+0xba/0x480 net/ipv4/ip_input.c:205
       ip_local_deliver_finish+0x2f1/0x500 net/ipv4/ip_input.c:233
       NF_HOOK include/linux/netfilter.h:317 [inline]
       NF_HOOK include/linux/netfilter.h:311 [inline]
       ip_local_deliver+0x1be/0x560 net/ipv4/ip_input.c:254
       dst_input include/net/dst.h:469 [inline]
       ip_rcv_finish net/ipv4/ip_input.c:447 [inline]
       NF_HOOK include/linux/netfilter.h:317 [inline]
       NF_HOOK include/linux/netfilter.h:311 [inline]
       ip_rcv+0x514/0x810 net/ipv4/ip_input.c:567
       __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5975
       __netif_receive_skb+0x1f/0x120 net/core/dev.c:6088
       process_backlog+0x301/0x1360 net/core/dev.c:6440
       __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7453
       napi_poll net/core/dev.c:7517 [inline]
       net_rx_action+0xb44/0x1010 net/core/dev.c:7644
       handle_softirqs+0x1d0/0x770 kernel/softirq.c:579
       do_softirq+0x3f/0x90 kernel/softirq.c:480
       </IRQ>
       <TASK>
       __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:407
       local_bh_enable include/linux/bottom_half.h:33 [inline]
       inet_csk_listen_stop+0x2c5/0x1070 net/ipv4/inet_connection_sock.c:1524
       mptcp_check_listen_stop.part.0+0x1cc/0x220 net/mptcp/protocol.c:2985
       mptcp_check_listen_stop net/mptcp/mib.h:118 [inline]
       __mptcp_close+0x9b9/0xbd0 net/mptcp/protocol.c:3000
       mptcp_close+0x2f/0x140 net/mptcp/protocol.c:3066
       inet_release+0xed/0x200 net/ipv4/af_inet.c:435
       inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487
       __sock_release+0xb3/0x270 net/socket.c:649
       sock_close+0x1c/0x30 net/socket.c:1439
       __fput+0x402/0xb70 fs/file_table.c:465
       task_work_run+0x150/0x240 kernel/task_work.c:227
       resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
       exit_to_user_mode_loop+0xd4/0xe0 kernel/entry/common.c:114
       exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
       syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
       syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
       do_syscall_64+0x245/0x360 arch/x86/entry/syscall_64.c:100
       entry_SYSCALL_64_after_hwframe+0x77/0x7f
      RIP: 0033:0x7fc92f8a36ad
      Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
      RSP: 002b:00007ffcf52802d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
      RAX: 0000000000000000 RBX: 00007ffcf52803a8 RCX: 00007fc92f8a36ad
      RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
      RBP: 00007fc92fae7ba0 R08: 0000000000000001 R09: 0000002800000000
      R10: 00007fc92f700000 R11: 0000000000000246 R12: 00007fc92fae5fac
      R13: 00007fc92fae5fa0 R14: 0000000000026d00 R15: 0000000000026c51
       </TASK>
      irq event stamp: 4068
      hardirqs last  enabled at (4076): [<ffffffff81544816>] __up_console_sem+0x76/0x80 kernel/printk/printk.c:344
      hardirqs last disabled at (4085): [<ffffffff815447fb>] __up_console_sem+0x5b/0x80 kernel/printk/printk.c:342
      softirqs last  enabled at (3096): [<ffffffff840e1be0>] local_bh_enable include/linux/bottom_half.h:33 [inline]
      softirqs last  enabled at (3096): [<ffffffff840e1be0>] inet_csk_listen_stop+0x2c0/0x1070 net/ipv4/inet_connection_sock.c:1524
      softirqs last disabled at (3097): [<ffffffff813b6b9f>] do_softirq+0x3f/0x90 kernel/softirq.c:480
    
    Since we need to track the 'fallback is possible' condition and the
    fallback status separately, there are a few possible races open between
    the check and the actual fallback action.
    
    Add a spinlock to protect the fallback related information and use it
    close all the possible related races. While at it also remove the
    too-early clearing of allow_infinite_fallback in __mptcp_subflow_connect():
    the field will be correctly cleared by subflow_finish_connect() if/when
    the connection will complete successfully.
    
    If fallback is not possible, as per RFC, reset the current subflow.
    
    Since the fallback operation can now fail and return value should be
    checked, rename the helper accordingly.
    
    Fixes: 0530020a7c8f ("mptcp: track and update contiguous data status")
    Cc: [email protected]
    Reported-by: Matthieu Baerts <[email protected]>
    Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/570
    Reported-by: [email protected]
    Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/555
    Signed-off-by: Paolo Abeni <[email protected]>
    Reviewed-by: Matthieu Baerts (NGI0) <[email protected]>
    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    [ Conflicts in protocol.h, because commit 6ebf6f90ab4a ("mptcp: add
      mptcpi_subflows_total counter") is not in this version, and this
      causes conflicts in the context. Commit 65b02260a0e0 ("mptcp: export
      mptcp_subflow_early_fallback()") is also not in this version, and
      moves code from protocol.c to protocol.h, but the modification can
      still apply there. ]
    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

mptcp: plug races between subflow fail and subflow creation [+ + +]
Author: Paolo Abeni <[email protected]>
Date:   Mon Jul 28 11:14:50 2025 +0200

    mptcp: plug races between subflow fail and subflow creation
    
    commit def5b7b2643ebba696fc60ddf675dca13f073486 upstream.
    
    We have races similar to the one addressed by the previous patch between
    subflow failing and additional subflow creation. They are just harder to
    trigger.
    
    The solution is similar. Use a separate flag to track the condition
    'socket state prevent any additional subflow creation' protected by the
    fallback lock.
    
    The socket fallback makes such flag true, and also receiving or sending
    an MP_FAIL option.
    
    The field 'allow_infinite_fallback' is now always touched under the
    relevant lock, we can drop the ONCE annotation on write.
    
    Fixes: 478d770008b0 ("mptcp: send out MP_FAIL when data checksum fails")
    Cc: [email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Reviewed-by: Matthieu Baerts (NGI0) <[email protected]>
    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    [ Conflicts in subflow.c, because commit f1f26512a9bf ("mptcp: use plain
      bool instead of custom binary enum") and commit 46a5d3abedbe
      ("mptcp: fix typos in comments") are not in this version. Both are
      causing conflicts in the context, and the same modifications can still
      be applied. ]
    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

mptcp: reset fallback status gracefully at disconnect() time [+ + +]
Author: Paolo Abeni <[email protected]>
Date:   Mon Jul 28 11:14:51 2025 +0200

    mptcp: reset fallback status gracefully at disconnect() time
    
    commit da9b2fc7b73d147d88abe1922de5ab72d72d7756 upstream.
    
    mptcp_disconnect() clears the fallback bit unconditionally, without
    touching the associated flags.
    
    The bit clear is safe, as no fallback operation can race with that --
    all subflow are already in TCP_CLOSE status thanks to the previous
    FASTCLOSE -- but we need to consistently reset all the fallback related
    status.
    
    Also acquire the relevant lock, to avoid fouling static analyzers.
    
    Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation")
    Cc: [email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Reviewed-by: Matthieu Baerts (NGI0) <[email protected]>
    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec() [+ + +]
Author: Md Sadre Alam <[email protected]>
Date:   Wed Jul 23 22:31:05 2025 -0400

    mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec()
    
    [ Upstream commit 47bddabbf69da50999ec68be92b58356c687e1d6 ]
    
    For QPIC V2 onwards there is a separate register to read
    last code word "QPIC_NAND_READ_LOCATION_LAST_CW_n".
    
    qcom_param_page_type_exec() is used to read only one code word
    If it configures the number of code words to 1 in QPIC_NAND_DEV0_CFG0
    register then QPIC controller thinks its reading the last code word,
    since we are having separate register to read the last code word,
    we have to configure "QPIC_NAND_READ_LOCATION_LAST_CW_n" register
    to fetch data from QPIC buffer to system memory.
    
    Without this change page read was failing with timeout error
    
    / # hexdump -C /dev/mtd1
    [  129.206113] qcom-nandc 1cc8000.nand-controller: failure to read page/oob
    hexdump: /dev/mtd1: Connection timed out
    
    This issue only seen on SDX targets since SDX target used QPICv2. But
    same working on IPQ targets since IPQ used QPICv1.
    
    Cc: [email protected]
    Fixes: 89550beb098e ("mtd: rawnand: qcom: Implement exec_op()")
    Reviewed-by: Manivannan Sadhasivam <[email protected]>
    Tested-by: Lakshmi Sowjanya D <[email protected]>
    Signed-off-by: Md Sadre Alam <[email protected]>
    Signed-off-by: Miquel Raynal <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch [+ + +]
Author: Shahar Shitrit <[email protected]>
Date:   Thu Jul 17 15:06:10 2025 +0300

    net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
    
    [ Upstream commit 5b4c56ad4da0aa00b258ab50b1f5775b7d3108c7 ]
    
    In the original design, it is assumed local and peer eswitches have the
    same number of vfs. However, in new firmware, local and peer eswitches
    can have different number of vfs configured by mlxconfig.  In such
    configuration, it is incorrect to derive the number of vfs from the
    local device's eswitch.
    
    Fix this by updating the peer miss rules add and delete functions to use
    the peer device's eswitch and vf count instead of the local device's
    information, ensuring correct behavior regardless of vf configuration
    differences.
    
    Fixes: ac004b832128 ("net/mlx5e: E-Switch, Add peer miss rules")
    Signed-off-by: Shahar Shitrit <[email protected]>
    Reviewed-by: Mark Bloch <[email protected]>
    Signed-off-by: Tariq Toukan <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net/mlx5: Fix memory leak in cmd_exec() [+ + +]
Author: Chiara Meiohas <[email protected]>
Date:   Thu Jul 17 15:06:09 2025 +0300

    net/mlx5: Fix memory leak in cmd_exec()
    
    [ Upstream commit 3afa3ae3db52e3c216d77bd5907a5a86833806cc ]
    
    If cmd_exec() is called with callback and mlx5_cmd_invoke() returns an
    error, resources allocated in cmd_exec() will not be freed.
    
    Fix the code to release the resources if mlx5_cmd_invoke() returns an
    error.
    
    Fixes: f086470122d5 ("net/mlx5: cmdif, Return value improvements")
    Reported-by: Alex Tereshkin <[email protected]>
    Signed-off-by: Chiara Meiohas <[email protected]>
    Reviewed-by: Moshe Shemesh <[email protected]>
    Signed-off-by: Vlad Dumitrescu <[email protected]>
    Signed-off-by: Tariq Toukan <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class [+ + +]
Author: Xiang Mei <[email protected]>
Date:   Thu Jul 17 16:01:28 2025 -0700

    net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
    
    [ Upstream commit cf074eca0065bc5142e6004ae236bb35a2687fdf ]
    
    might_sleep could be trigger in the atomic context in qfq_delete_class.
    
    qfq_destroy_class was moved into atomic context locked
    by sch_tree_lock to avoid a race condition bug on
    qfq_aggregate. However, might_sleep could be triggered by
    qfq_destroy_class, which introduced sleeping in atomic context (path:
    qfq_destroy_class->qdisc_put->__qdisc_destroy->lockdep_unregister_key
    ->might_sleep).
    
    Considering the race is on the qfq_aggregate objects, keeping
    qfq_rm_from_agg in the lock but moving the left part out can solve
    this issue.
    
    Fixes: 5e28d5a3f774 ("net/sched: sch_qfq: Fix race condition on qfq_aggregate")
    Reported-by: Dan Carpenter <[email protected]>
    Signed-off-by: Xiang Mei <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Reviewed-by: Cong Wang <[email protected]>
    Reviewed-by: Dan Carpenter <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
net: appletalk: Fix use-after-free in AARP proxy probe [+ + +]
Author: Kito Xu (veritas501) <[email protected]>
Date:   Thu Jul 17 01:28:43 2025 +0000

    net: appletalk: Fix use-after-free in AARP proxy probe
    
    [ Upstream commit 6c4a92d07b0850342d3becf2e608f805e972467c ]
    
    The AARP proxy‐probe routine (aarp_proxy_probe_network) sends a probe,
    releases the aarp_lock, sleeps, then re-acquires the lock.  During that
    window an expire timer thread (__aarp_expire_timer) can remove and
    kfree() the same entry, leading to a use-after-free.
    
    race condition:
    
             cpu 0                          |            cpu 1
        atalk_sendmsg()                     |   atif_proxy_probe_device()
        aarp_send_ddp()                     |   aarp_proxy_probe_network()
        mod_timer()                         |   lock(aarp_lock) // LOCK!!
        timeout around 200ms                |   alloc(aarp_entry)
        and then call                       |   proxies[hash] = aarp_entry
        aarp_expire_timeout()               |   aarp_send_probe()
                                            |   unlock(aarp_lock) // UNLOCK!!
        lock(aarp_lock) // LOCK!!           |   msleep(100);
        __aarp_expire_timer(&proxies[ct])   |
        free(aarp_entry)                    |
        unlock(aarp_lock) // UNLOCK!!       |
                                            |   lock(aarp_lock) // LOCK!!
                                            |   UAF aarp_entry !!
    
    ==================================================================
    BUG: KASAN: slab-use-after-free in aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493
    Read of size 4 at addr ffff8880123aa360 by task repro/13278
    
    CPU: 3 UID: 0 PID: 13278 Comm: repro Not tainted 6.15.2 #3 PREEMPT(full)
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:94 [inline]
     dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120
     print_address_description mm/kasan/report.c:408 [inline]
     print_report+0xc1/0x630 mm/kasan/report.c:521
     kasan_report+0xca/0x100 mm/kasan/report.c:634
     aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493
     atif_proxy_probe_device net/appletalk/ddp.c:332 [inline]
     atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857
     atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818
     sock_do_ioctl+0xdc/0x260 net/socket.c:1190
     sock_ioctl+0x239/0x6a0 net/socket.c:1311
     vfs_ioctl fs/ioctl.c:51 [inline]
     __do_sys_ioctl fs/ioctl.c:906 [inline]
     __se_sys_ioctl fs/ioctl.c:892 [inline]
     __x64_sys_ioctl+0x194/0x200 fs/ioctl.c:892
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0xcb/0x250 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
     </TASK>
    
    Allocated:
     aarp_alloc net/appletalk/aarp.c:382 [inline]
     aarp_proxy_probe_network+0xd8/0x630 net/appletalk/aarp.c:468
     atif_proxy_probe_device net/appletalk/ddp.c:332 [inline]
     atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857
     atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818
    
    Freed:
     kfree+0x148/0x4d0 mm/slub.c:4841
     __aarp_expire net/appletalk/aarp.c:90 [inline]
     __aarp_expire_timer net/appletalk/aarp.c:261 [inline]
     aarp_expire_timeout+0x480/0x6e0 net/appletalk/aarp.c:317
    
    The buggy address belongs to the object at ffff8880123aa300
     which belongs to the cache kmalloc-192 of size 192
    The buggy address is located 96 bytes inside of
     freed 192-byte region [ffff8880123aa300, ffff8880123aa3c0)
    
    Memory state around the buggy address:
     ffff8880123aa200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
     ffff8880123aa280: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
    >ffff8880123aa300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                           ^
     ffff8880123aa380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
     ffff8880123aa400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    ==================================================================
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Kito Xu (veritas501) <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: hns3: default enable tx bounce buffer when smmu enabled [+ + +]
Author: Jijie Shao <[email protected]>
Date:   Tue Jul 22 20:54:23 2025 +0800

    net: hns3: default enable tx bounce buffer when smmu enabled
    
    [ Upstream commit e6ab19443b36a45ebfb392775cb17d6a78dd07ea ]
    
    The SMMU engine on HIP09 chip has a hardware issue.
    SMMU pagetable prefetch features may prefetch and use a invalid PTE
    even the PTE is valid at that time. This will cause the device trigger
    fake pagefaults. The solution is to avoid prefetching by adding a
    SYNC command when smmu mapping a iova. But the performance of nic has a
    sharp drop. Then we do this workaround, always enable tx bounce buffer,
    avoid mapping/unmapping on TX path.
    
    This issue only affects HNS3, so we always enable
    tx bounce buffer when smmu enabled to improve performance.
    
    Fixes: 295ba232a8c3 ("net: hns3: add device version to replace pci revision")
    Signed-off-by: Peiyang Wang <[email protected]>
    Signed-off-by: Jian Shen <[email protected]>
    Signed-off-by: Jijie Shao <[email protected]>
    Signed-off-by: Paolo Abeni <[email protected]>
    Stable-dep-of: 49ade8630f36 ("net: hns3: default enable tx bounce buffer when smmu enabled")
    Signed-off-by: Sasha Levin <[email protected]>

net: hns3: disable interrupt when ptp init failed [+ + +]
Author: Yonglong Liu <[email protected]>
Date:   Tue Jul 22 20:54:21 2025 +0800

    net: hns3: disable interrupt when ptp init failed
    
    [ Upstream commit cde304655f25d94a996c45b0f9956e7dcc2bc4c0 ]
    
    When ptp init failed, we'd better disable the interrupt and clear the
    flag, to avoid early report interrupt at next probe.
    
    Fixes: 0bf5eb788512 ("net: hns3: add support for PTP")
    Signed-off-by: Yonglong Liu <[email protected]>
    Signed-off-by: Jijie Shao <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: hns3: fix concurrent setting vlan filter issue [+ + +]
Author: Jian Shen <[email protected]>
Date:   Tue Jul 22 20:54:20 2025 +0800

    net: hns3: fix concurrent setting vlan filter issue
    
    [ Upstream commit 4555f8f8b6aa46940f55feb6a07704c2935b6d6e ]
    
    The vport->req_vlan_fltr_en may be changed concurrently by function
    hclge_sync_vlan_fltr_state() called in periodic work task and
    function hclge_enable_vport_vlan_filter() called by user configuration.
    It may cause the user configuration inoperative. Fixes it by protect
    the vport->req_vlan_fltr by vport_lock.
    
    Fixes: 2ba306627f59 ("net: hns3: add support for modify VLAN filter state")
    Signed-off-by: Jian Shen <[email protected]>
    Signed-off-by: Jijie Shao <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

net: hns3: fixed vf get max channels bug [+ + +]
Author: Jian Shen <[email protected]>
Date:   Tue Jul 22 20:54:22 2025 +0800

    net: hns3: fixed vf get max channels bug
    
    [ Upstream commit b3e75c0bcc53f647311960bc1b0970b9b480ca5a ]
    
    Currently, the queried maximum of vf channels is the maximum of channels
    supported by each TC. However, the actual maximum of channels is
    the maximum of channels supported by the device.
    
    Fixes: 849e46077689 ("net: hns3: add ethtool_ops.get_channels support for VF")
    Signed-off-by: Jian Shen <[email protected]>
    Signed-off-by: Hao Lan <[email protected]>
    Signed-off-by: Jijie Shao <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
nilfs2: reject invalid file types when reading inodes [+ + +]
Author: Ryusuke Konishi <[email protected]>
Date:   Thu Jul 10 22:49:08 2025 +0900

    nilfs2: reject invalid file types when reading inodes
    
    commit 4aead50caf67e01020c8be1945c3201e8a972a27 upstream.
    
    To prevent inodes with invalid file types from tripping through the vfs
    and causing malfunctions or assertion failures, add a missing sanity check
    when reading an inode from a block device.  If the file type is not valid,
    treat it as a filesystem error.
    
    Link: https://lkml.kernel.org/r/[email protected]
    Fixes: 05fe58fdc10d ("nilfs2: inode operations")
    Signed-off-by: Ryusuke Konishi <[email protected]>
    Reported-by: [email protected]
    Link: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
perf/x86/intel: Fix crash in icl_update_topdown_event() [+ + +]
Author: Kan Liang <[email protected]>
Date:   Thu Jul 24 00:06:12 2025 -0400

    perf/x86/intel: Fix crash in icl_update_topdown_event()
    
    [ Upstream commit b0823d5fbacb1c551d793cbfe7af24e0d1fa45ed ]
    
    The perf_fuzzer found a hard-lockup crash on a RaptorLake machine:
    
      Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000
      CPU: 23 UID: 0 PID: 0 Comm: swapper/23
      Tainted: [W]=WARN
      Hardware name: Dell Inc. Precision 9660/0VJ762
      RIP: 0010:native_read_pmc+0x7/0x40
      Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ...
      RSP: 000:fffb03100273de8 EFLAGS: 00010046
      ....
      Call Trace:
        <TASK>
        icl_update_topdown_event+0x165/0x190
        ? ktime_get+0x38/0xd0
        intel_pmu_read_event+0xf9/0x210
        __perf_event_read+0xf9/0x210
    
    CPUs 16-23 are E-core CPUs that don't support the perf metrics feature.
    The icl_update_topdown_event() should not be invoked on these CPUs.
    
    It's a regression of commit:
    
      f9bdf1f95339 ("perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read")
    
    The bug introduced by that commit is that the is_topdown_event() function
    is mistakenly used to replace the is_topdown_count() call to check if the
    topdown functions for the perf metrics feature should be invoked.
    
    Fix it.
    
    Fixes: f9bdf1f95339 ("perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read")
    Closes: https://lore.kernel.org/lkml/[email protected]/
    Reported-by: Vince Weaver <[email protected]>
    Signed-off-by: Kan Liang <[email protected]>
    Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
    Signed-off-by: Ingo Molnar <[email protected]>
    Tested-by: Vince Weaver <[email protected]>
    Cc: [email protected] # v6.15+
    Link: https://lore.kernel.org/r/[email protected]
    [ omitted PEBS check ]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
platform/x86: Fix initialization order for firmware_attributes_class [+ + +]
Author: Torsten Hilbrich <[email protected]>
Date:   Fri Jul 11 12:32:54 2025 +0200

    platform/x86: Fix initialization order for firmware_attributes_class
    
    [ Upstream commit 2bfe3ae1aa45f8b61cb0dc462114fd0c9636ad32 ]
    
    The think-lmi driver uses the firwmare_attributes_class. But this class
    is registered after think-lmi, causing the "think-lmi" directory in
    "/sys/class/firmware-attributes" to be missing when the driver is
    compiled as builtin.
    
    Fixes: 55922403807a ("platform/x86: think-lmi: Directly use firmware_attributes_class")
    Signed-off-by: Torsten Hilbrich <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Reviewed-by: Ilpo Järvinen <[email protected]>
    Signed-off-by: Ilpo Järvinen <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots [+ + +]
Author: Rong Zhang <[email protected]>
Date:   Tue Jul 8 00:38:07 2025 +0800

    platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots
    
    commit e10981075adce203eac0be866389309eeb8ef11e upstream.
    
    On some models supported by ideapad-laptop, the HW/FW can remember the
    state of keyboard backlight among boots. However, it is always turned
    off while shutting down, as a side effect of the LED class device
    unregistering sequence.
    
    This is inconvenient for users who always prefer turning on the
    keyboard backlight. Thus, set LED_RETAIN_AT_SHUTDOWN on the LED class
    device so that the state of keyboard backlight gets remembered, which
    also aligns with the behavior of manufacturer utilities on Windows.
    
    Fixes: 503325f84bc0 ("platform/x86: ideapad-laptop: add keyboard backlight control support")
    Cc: [email protected]
    Signed-off-by: Rong Zhang <[email protected]>
    Reviewed-by: Hans de Goede <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Reviewed-by: Ilpo Järvinen <[email protected]>
    Signed-off-by: Ilpo Järvinen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
RDMA/core: Rate limit GID cache warning messages [+ + +]
Author: Maor Gottlieb <[email protected]>
Date:   Mon Jun 16 11:26:21 2025 +0300

    RDMA/core: Rate limit GID cache warning messages
    
    [ Upstream commit 333e4d79316c9ed5877d7aac8b8ed22efc74e96d ]
    
    The GID cache warning messages can flood the kernel log when there are
    multiple failed attempts to add GIDs. This can happen when creating many
    virtual interfaces without having enough space for their GIDs in the GID
    table.
    
    Change pr_warn to pr_warn_ratelimited to prevent log flooding while still
    maintaining visibility of the issue.
    
    Link: https://patch.msgid.link/r/fd45ed4a1078e743f498b234c3ae816610ba1b18.1750062357.git.leon@kernel.org
    Signed-off-by: Maor Gottlieb <[email protected]>
    Signed-off-by: Leon Romanovsky <[email protected]>
    Signed-off-by: Jason Gunthorpe <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
regmap: fix potential memory leak of regmap_bus [+ + +]
Author: Abdun Nihaal <[email protected]>
Date:   Thu Jun 26 22:58:21 2025 +0530

    regmap: fix potential memory leak of regmap_bus
    
    [ Upstream commit c871c199accb39d0f4cb941ad0dccabfc21e9214 ]
    
    When __regmap_init() is called from __regmap_init_i2c() and
    __regmap_init_spi() (and their devm versions), the bus argument
    obtained from regmap_get_i2c_bus() and regmap_get_spi_bus(), may be
    allocated using kmemdup() to support quirks. In those cases, the
    bus->free_on_exit field is set to true.
    
    However, inside __regmap_init(), buf is not freed on any error path.
    This could lead to a memory leak of regmap_bus when __regmap_init()
    fails. Fix that by freeing bus on error path when free_on_exit is set.
    
    Fixes: ea030ca68819 ("regmap-i2c: Set regmap max raw r/w from quirks")
    Signed-off-by: Abdun Nihaal <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Mark Brown <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
regulator: core: fix NULL dereference on unbind due to stale coupling data [+ + +]
Author: Alessandro Carminati <[email protected]>
Date:   Thu Jun 26 08:38:09 2025 +0000

    regulator: core: fix NULL dereference on unbind due to stale coupling data
    
    [ Upstream commit ca46946a482238b0cdea459fb82fc837fb36260e ]
    
    Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can
    lead to NULL pointer dereference when regulators are accessed post-unbind.
    
    This can happen during runtime PM or other regulator operations that rely
    on coupling metadata.
    
    For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers
    a panic in regulator_lock_recursive() due to stale coupling state.
    
    Ensure n_coupled is set to 0 to prevent access to invalid pointers.
    
    Signed-off-by: Alessandro Carminati <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Mark Brown <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
resource: fix false warning in __request_region() [+ + +]
Author: Akinobu Mita <[email protected]>
Date:   Sat Jul 19 20:26:04 2025 +0900

    resource: fix false warning in __request_region()
    
    commit 91a229bb7ba86b2592c3f18c54b7b2c5e6fe0f95 upstream.
    
    A warning is raised when __request_region() detects a conflict with a
    resource whose resource.desc is IORES_DESC_DEVICE_PRIVATE_MEMORY.
    
    But this warning is only valid for iomem_resources.
    The hmem device resource uses resource.desc as the numa node id, which can
    cause spurious warnings.
    
    This warning appeared on a machine with multiple cxl memory expanders.
    One of the NUMA node id is 6, which is the same as the value of
    IORES_DESC_DEVICE_PRIVATE_MEMORY.
    
    In this environment it was just a spurious warning, but when I saw the
    warning I suspected a real problem so it's better to fix it.
    
    This change fixes this by restricting the warning to only iomem_resource.
    This also adds a missing new line to the warning message.
    
    Link: https://lkml.kernel.org/r/[email protected]
    Fixes: 7dab174e2e27 ("dax/hmem: Move hmem device registration to dax_hmem.ko")
    Signed-off-by: Akinobu Mita <[email protected]>
    Reviewed-by: Dan Williams <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test" [+ + +]
Author: Shung-Hsi Yu <[email protected]>
Date:   Tue Jul 29 13:36:51 2025 +0800

    Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test"
    
    This reverts commit 4730b07ef7745d7cd48c6aa9f72d75ac136d436f.
    
    The test depends on commit eb166e522c77 "bpf: Allow helper
    bpf_get_[ns_]current_pid_tgid() for all prog types", which was not part of the
    stable 6.6 code base, and thus the test will fail. Revert it since it is a
    false positive.
    
    Signed-off-by: Shung-Hsi Yu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
s390/ism: fix concurrency management in ism_cmd() [+ + +]
Author: Halil Pasic <[email protected]>
Date:   Tue Jul 22 18:18:17 2025 +0200

    s390/ism: fix concurrency management in ism_cmd()
    
    [ Upstream commit 897e8601b9cff1d054cdd53047f568b0e1995726 ]
    
    The s390x ISM device data sheet clearly states that only one
    request-response sequence is allowable per ISM function at any point in
    time.  Unfortunately as of today the s390/ism driver in Linux does not
    honor that requirement. This patch aims to rectify that.
    
    This problem was discovered based on Aliaksei's bug report which states
    that for certain workloads the ISM functions end up entering error state
    (with PEC 2 as seen from the logs) after a while and as a consequence
    connections handled by the respective function break, and for future
    connection requests the ISM device is not considered -- given it is in a
    dysfunctional state. During further debugging PEC 3A was observed as
    well.
    
    A kernel message like
    [ 1211.244319] zpci: 061a:00:00.0: Event 0x2 reports an error for PCI function 0x61a
    is a reliable indicator of the stated function entering error state
    with PEC 2. Let me also point out that a kernel message like
    [ 1211.244325] zpci: 061a:00:00.0: The ism driver bound to the device does not support error recovery
    is a reliable indicator that the ISM function won't be auto-recovered
    because the ISM driver currently lacks support for it.
    
    On a technical level, without this synchronization, commands (inputs to
    the FW) may be partially or fully overwritten (corrupted) by another CPU
    trying to issue commands on the same function. There is hard evidence that
    this can lead to DMB token values being used as DMB IOVAs, leading to
    PEC 2 PCI events indicating invalid DMA. But this is only one of the
    failure modes imaginable. In theory even completely losing one command
    and executing another one twice and then trying to interpret the outputs
    as if the command we intended to execute was actually executed and not
    the other one is also possible.  Frankly, I don't feel confident about
    providing an exhaustive list of possible consequences.
    
    Fixes: 684b89bc39ce ("s390/ism: add device driver for internal shared memory")
    Reported-by: Aliaksei Makarau <[email protected]>
    Tested-by: Mahanta Jambigi <[email protected]>
    Tested-by: Aliaksei Makarau <[email protected]>
    Signed-off-by: Halil Pasic <[email protected]>
    Reviewed-by: Alexandra Winter <[email protected]>
    Signed-off-by: Alexandra Winter <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
selftests: mptcp: connect: also cover alt modes [+ + +]
Author: Matthieu Baerts (NGI0) <[email protected]>
Date:   Tue Jul 15 20:43:28 2025 +0200

    selftests: mptcp: connect: also cover alt modes
    
    commit 37848a456fc38c191aedfe41f662cc24db8c23d9 upstream.
    
    The "mmap" and "sendfile" alternate modes for mptcp_connect.sh/.c are
    available from the beginning, but only tested when mptcp_connect.sh is
    manually launched with "-m mmap" or "-m sendfile", not via the
    kselftests helpers.
    
    The MPTCP CI was manually running "mptcp_connect.sh -m mmap", but not
    "-m sendfile". Plus other CIs, especially the ones validating the stable
    releases, were not validating these alternate modes.
    
    To make sure these modes are validated by these CIs, add two new test
    programs executing mptcp_connect.sh with the alternate modes.
    
    Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp")
    Cc: [email protected]
    Reviewed-by: Geliang Tang <[email protected]>
    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

selftests: mptcp: connect: also cover checksum [+ + +]
Author: Matthieu Baerts (NGI0) <[email protected]>
Date:   Tue Jul 15 20:43:29 2025 +0200

    selftests: mptcp: connect: also cover checksum
    
    commit fdf0f60a2bb02ba581d9e71d583e69dd0714a521 upstream.
    
    The checksum mode has been added a while ago, but it is only validated
    when manually launching mptcp_connect.sh with "-C".
    
    The different CIs were then not validating these MPTCP Connect tests
    with checksum enabled. To make sure they do, add a new test program
    executing mptcp_connect.sh with the checksum mode.
    
    Fixes: 94d66ba1d8e4 ("selftests: mptcp: enable checksum in mptcp_connect.sh")
    Cc: [email protected]
    Reviewed-by: Geliang Tang <[email protected]>
    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
spi: cadence-quadspi: fix cleanup of rx_chan on failure paths [+ + +]
Author: Khairul Anuar Romli <[email protected]>
Date:   Tue Jul 29 19:11:14 2025 +0200

    spi: cadence-quadspi: fix cleanup of rx_chan on failure paths
    
    commit 04a8ff1bc3514808481ddebd454342ad902a3f60 upstream.
    
    Remove incorrect checks on cqspi->rx_chan that cause driver breakage
    during failure cleanup. Ensure proper resource freeing on the success
    path when operating in cqspi->use_direct_mode, preventing leaks and
    improving stability.
    
    Signed-off-by: Khairul Anuar Romli <[email protected]>
    Reviewed-by: Dan Carpenter <[email protected]>
    Link: https://patch.msgid.link/89765a2b94f047ded4f14babaefb7ef92ba07cb2.1751274389.git.khairul.anuar.romli@altera.com
    Signed-off-by: Mark Brown <[email protected]>
    [Minor conflict resolved due to code context change.]
    Signed-off-by: Ronald Wahl <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
Linux: sprintf.h requires stdarg.h [+ + +]
Author: Stephen Rothwell <[email protected]>
Date:   Mon Jul 21 16:15:57 2025 +1000

    sprintf.h requires stdarg.h
    
    commit 0dec7201788b9152f06321d0dab46eed93834cda upstream.
    
    In file included from drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c:4:
    include/linux/sprintf.h:11:54: error: unknown type name 'va_list'
       11 | __printf(2, 0) int vsprintf(char *buf, const char *, va_list);
          |                                                      ^~~~~~~
    include/linux/sprintf.h:1:1: note: 'va_list' is defined in header '<stdarg.h>'; this is probably fixable by adding '#include <stdarg.h>'
    
    Link: https://lkml.kernel.org/r/[email protected]
    Fixes: 39ced19b9e60 ("lib/vsprintf: split out sprintf() and friends")
    Signed-off-by: Stephen Rothwell <[email protected]>
    Cc: Andriy Shevchenko <[email protected]>
    Cc: Herbert Xu <[email protected]>
    Cc: Petr Mladek <[email protected]>
    Cc: Steven Rostedt <[email protected]>
    Cc: Rasmus Villemoes <[email protected]>
    Cc: Sergey Senozhatsky <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
staging: vchiq_arm: Make vchiq_shutdown never fail [+ + +]
Author: Stefan Wahren <[email protected]>
Date:   Tue Jul 15 18:11:08 2025 +0200

    staging: vchiq_arm: Make vchiq_shutdown never fail
    
    [ Upstream commit f2b8ebfb867011ddbefbdf7b04ad62626cbc2afd ]
    
    Most of the users of vchiq_shutdown ignore the return value,
    which is bad because this could lead to resource leaks.
    So instead of changing all calls to vchiq_shutdown, it's easier
    to make vchiq_shutdown never fail.
    
    Fixes: 71bad7f08641 ("staging: add bcm2708 vchiq driver")
    Signed-off-by: Stefan Wahren <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
usb: typec: tcpm: allow switching to mode accessory to mux properly [+ + +]
Author: Michael Grzeschik <[email protected]>
Date:   Fri Apr 4 00:43:06 2025 +0200

    usb: typec: tcpm: allow switching to mode accessory to mux properly
    
    commit 8a50da849151e7e12b43c1d8fe7ad302223aef6b upstream.
    
    The funciton tcpm_acc_attach is not setting the proper state when
    calling tcpm_set_role. The function tcpm_set_role is currently only
    handling TYPEC_STATE_USB. For the tcpm_acc_attach to switch into other
    modal states tcpm_set_role needs to be extended by an extra state
    parameter. This patch is handling the proper state change when calling
    tcpm_acc_attach.
    
    Signed-off-by: Michael Grzeschik <[email protected]>
    Reviewed-by: Heikki Krogerus <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Stable-dep-of: bec15191d523 ("usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach")
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

usb: typec: tcpm: allow to use sink in accessory mode [+ + +]
Author: Michael Grzeschik <[email protected]>
Date:   Fri Apr 4 00:43:04 2025 +0200

    usb: typec: tcpm: allow to use sink in accessory mode
    
    commit 64843d0ba96d3eae297025562111d57585273366 upstream.
    
    Since the function tcpm_acc_attach is not setting the data and role for
    for the sink case we extend it to check for it first.
    
    Signed-off-by: Michael Grzeschik <[email protected]>
    Reviewed-by: Heikki Krogerus <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Stable-dep-of: bec15191d523 ("usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach")
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach [+ + +]
Author: RD Babiera <[email protected]>
Date:   Wed Jun 18 23:06:04 2025 +0000

    usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach
    
    commit bec15191d52300defa282e3fd83820f69e447116 upstream.
    
    This patch fixes Type-C compliance test TD 4.7.6 - Try.SNK DRP Connect
    SNKAS.
    
    tVbusON has a limit of 275ms when entering SRC_ATTACHED. Compliance
    testers can interpret the TryWait.Src to Attached.Src transition after
    Try.Snk as being in Attached.Src the entire time, so ~170ms is lost
    to the debounce timer.
    
    Setting the data role can be a costly operation in host mode, and when
    completed after 100ms can cause Type-C compliance test check TD 4.7.5.V.4
    to fail.
    
    Turn VBUS on before tcpm_set_roles to meet timing requirement.
    
    Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)")
    Cc: stable <[email protected]>
    Signed-off-by: RD Babiera <[email protected]>
    Reviewed-by: Badhri Jagan Sridharan <[email protected]>
    Reviewed-by: Heikki Krogerus <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
virtio_ring: Fix error reporting in virtqueue_resize [+ + +]
Author: Laurent Vivier <[email protected]>
Date:   Wed May 21 11:22:34 2025 +0200

    virtio_ring: Fix error reporting in virtqueue_resize
    
    [ Upstream commit 45ebc7e6c125ce93d2ddf82cd5bea20121bb0258 ]
    
    The virtqueue_resize() function was not correctly propagating error codes
    from its internal resize helper functions, specifically
    virtqueue_resize_packet() and virtqueue_resize_split(). If these helpers
    returned an error, but the subsequent call to virtqueue_enable_after_reset()
    succeeded, the original error from the resize operation would be masked.
    Consequently, virtqueue_resize() could incorrectly report success to its
    caller despite an underlying resize failure.
    
    This change restores the original code behavior:
    
           if (vdev->config->enable_vq_after_reset(_vq))
                   return -EBUSY;
    
           return err;
    
    Fix: commit ad48d53b5b3f ("virtio_ring: separate the logic of reset/enable from virtqueue_resize")
    Cc: [email protected]
    Signed-off-by: Laurent Vivier <[email protected]>
    Acked-by: Jason Wang <[email protected]>
    Link: https://patch.msgid.link/[email protected]
    Tested-by: Lei Yang <[email protected]>
    Acked-by: Michael S. Tsirkin <[email protected]>
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

 
wifi: mt76: mt7921: prevent decap offload config before STA initialization [+ + +]
Author: Deren Wu <[email protected]>
Date:   Wed Jul 23 14:27:51 2025 -0400

    wifi: mt76: mt7921: prevent decap offload config before STA initialization
    
    [ Upstream commit 7035a082348acf1d43ffb9ff735899f8e3863f8f ]
    
    The decap offload configuration should only be applied after the STA has
    been successfully initialized. Attempting to configure it earlier can lead
    to corruption of the MAC configuration in the chip's hardware state.
    
    Add an early check for `msta->deflink.wcid.sta` to ensure the station peer
    is properly initialized before proceeding with decapsulation offload
    configuration.
    
    Cc: [email protected]
    Fixes: 24299fc869f7 ("mt76: mt7921: enable rx header traslation offload")
    Signed-off-by: Deren Wu <[email protected]>
    Link: https://patch.msgid.link/f23a72ba7a3c1ad38ba9e13bb54ef21d6ef44ffb.1748149855.git.deren.wu@mediatek.com
    Signed-off-by: Felix Fietkau <[email protected]>
    [ Changed msta->deflink.wcid.sta to msta->wcid.sta ]
    Signed-off-by: Sasha Levin <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode() [+ + +]
Author: Michael Zhivich <[email protected]>
Date:   Wed Jul 23 09:40:19 2025 -0400

    x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode()
    
    For kernels compiled with CONFIG_INIT_STACK_NONE=y, the value of __reserved
    field in zen_patch_rev union on the stack may be garbage.  If so, it will
    prevent correct microcode check when consulting p.ucode_rev, resulting in
    incorrect mitigation selection.
    
    This is a stable-only fix.
    
    Cc: <[email protected]>
    Signed-off-by: Michael Zhivich <[email protected]>
    Fixes: 90293047df18 ("x86/bugs: Add a Transient Scheduler Attacks mitigation")
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

 
x86/hyperv: Fix usage of cpu_online_mask to get valid cpu [+ + +]
Author: Nuno Das Neves <[email protected]>
Date:   Thu Jul 3 15:44:34 2025 -0700

    x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
    
    [ Upstream commit bb169f80ed5a156ec3405e0e49c6b8e9ae264718 ]
    
    Accessing cpu_online_mask here is problematic because the cpus read lock
    is not held in this context.
    
    However, cpu_online_mask isn't needed here since the effective affinity
    mask is guaranteed to be valid in this callback. So, just use
    cpumask_first() to get the cpu instead of ANDing it with cpus_online_mask
    unnecessarily.
    
    Fixes: e39397d1fd68 ("x86/hyperv: implement an MSI domain for root partition")
    Reported-by: Michael Kelley <[email protected]>
    Closes: https://lore.kernel.org/linux-hyperv/SN6PR02MB4157639630F8AD2D8FD8F52FD475A@SN6PR02MB4157.namprd02.prod.outlook.com/
    Suggested-by: Thomas Gleixner <[email protected]>
    Signed-off-by: Nuno Das Neves <[email protected]>
    Reviewed-by: Michael Kelley <[email protected]>
    Link: https://lore.kernel.org/r/1751582677-30930-4-git-send-email-nunodasneves@linux.microsoft.com
    Signed-off-by: Wei Liu <[email protected]>
    Message-ID: <1751582677-30930-4-git-send-email-nunodasneves@linux.microsoft.com>
    Signed-off-by: Sasha Levin <[email protected]>

 
xfrm: interface: fix use-after-free after changing collect_md xfrm interface [+ + +]
Author: Eyal Birger <[email protected]>
Date:   Thu Jul 3 10:02:58 2025 -0700

    xfrm: interface: fix use-after-free after changing collect_md xfrm interface
    
    [ Upstream commit a90b2a1aaacbcf0f91d7e4868ad6c51c5dee814b ]
    
    collect_md property on xfrm interfaces can only be set on device creation,
    thus xfrmi_changelink() should fail when called on such interfaces.
    
    The check to enforce this was done only in the case where the xi was
    returned from xfrmi_locate() which doesn't look for the collect_md
    interface, and thus the validation was never reached.
    
    Calling changelink would thus errornously place the special interface xi
    in the xfrmi_net->xfrmi hash, but since it also exists in the
    xfrmi_net->collect_md_xfrmi pointer it would lead to a double free when
    the net namespace was taken down [1].
    
    Change the check to use the xi from netdev_priv which is available earlier
    in the function to prevent changes in xfrm collect_md interfaces.
    
    [1] resulting oops:
    [    8.516540] kernel BUG at net/core/dev.c:12029!
    [    8.516552] Oops: invalid opcode: 0000 [#1] SMP NOPTI
    [    8.516559] CPU: 0 UID: 0 PID: 12 Comm: kworker/u80:0 Not tainted 6.15.0-virtme #5 PREEMPT(voluntary)
    [    8.516565] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    [    8.516569] Workqueue: netns cleanup_net
    [    8.516579] RIP: 0010:unregister_netdevice_many_notify+0x101/0xab0
    [    8.516590] Code: 90 0f 0b 90 48 8b b0 78 01 00 00 48 8b 90 80 01 00 00 48 89 56 08 48 89 32 4c 89 80 78 01 00 00 48 89 b8 80 01 00 00 eb ac 90 <0f> 0b 48 8b 45 00 4c 8d a0 88 fe ff ff 48 39 c5 74 5c 41 80 bc 24
    [    8.516593] RSP: 0018:ffffa93b8006bd30 EFLAGS: 00010206
    [    8.516598] RAX: ffff98fe4226e000 RBX: ffffa93b8006bd58 RCX: ffffa93b8006bc60
    [    8.516601] RDX: 0000000000000004 RSI: 0000000000000000 RDI: dead000000000122
    [    8.516603] RBP: ffffa93b8006bdd8 R08: dead000000000100 R09: ffff98fe4133c100
    [    8.516605] R10: 0000000000000000 R11: 00000000000003d2 R12: ffffa93b8006be00
    [    8.516608] R13: ffffffff96c1a510 R14: ffffffff96c1a510 R15: ffffa93b8006be00
    [    8.516615] FS:  0000000000000000(0000) GS:ffff98fee73b7000(0000) knlGS:0000000000000000
    [    8.516619] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [    8.516622] CR2: 00007fcd2abd0700 CR3: 000000003aa40000 CR4: 0000000000752ef0
    [    8.516625] PKRU: 55555554
    [    8.516627] Call Trace:
    [    8.516632]  <TASK>
    [    8.516635]  ? rtnl_is_locked+0x15/0x20
    [    8.516641]  ? unregister_netdevice_queue+0x29/0xf0
    [    8.516650]  ops_undo_list+0x1f2/0x220
    [    8.516659]  cleanup_net+0x1ad/0x2e0
    [    8.516664]  process_one_work+0x160/0x380
    [    8.516673]  worker_thread+0x2aa/0x3c0
    [    8.516679]  ? __pfx_worker_thread+0x10/0x10
    [    8.516686]  kthread+0xfb/0x200
    [    8.516690]  ? __pfx_kthread+0x10/0x10
    [    8.516693]  ? __pfx_kthread+0x10/0x10
    [    8.516697]  ret_from_fork+0x82/0xf0
    [    8.516705]  ? __pfx_kthread+0x10/0x10
    [    8.516709]  ret_from_fork_asm+0x1a/0x30
    [    8.516718]  </TASK>
    
    Fixes: abc340b38ba2 ("xfrm: interface: support collect metadata mode")
    Reported-by: Lonial Con <[email protected]>
    Signed-off-by: Eyal Birger <[email protected]>
    Signed-off-by: Steffen Klassert <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>