--- /dev/null
+From 55f0bfc0370539213202f4ce1a07615327ac4713 Mon Sep 17 00:00:00 2001
+From: Yun Lu <luyun@kylinos.cn>
+Date: Fri, 11 Jul 2025 17:33:00 +0800
+Subject: af_packet: fix soft lockup issue caused by tpacket_snd()
+
+From: Yun Lu <luyun@kylinos.cn>
+
+commit 55f0bfc0370539213202f4ce1a07615327ac4713 upstream.
+
+When MSG_DONTWAIT is not set, the tpacket_snd operation will wait for
+pending_refcnt to decrement to zero before returning. The pending_refcnt
+is decremented by 1 when the skb->destructor function is called,
+indicating that the skb has been successfully sent and needs to be
+destroyed.
+
+If an error occurs during this process, the tpacket_snd() function will
+exit and return error, but pending_refcnt may not yet have decremented to
+zero. Assuming the next send operation is executed immediately, but there
+are no available frames to be sent in tx_ring (i.e., packet_current_frame
+returns NULL), and skb is also NULL, the function will not execute
+wait_for_completion_interruptible_timeout() to yield the CPU. Instead, it
+will enter a do-while loop, waiting for pending_refcnt to be zero. Even
+if the previous skb has completed transmission, the skb->destructor
+function can only be invoked in the ksoftirqd thread (assuming NAPI
+threading is enabled). When both the ksoftirqd thread and the tpacket_snd
+operation happen to run on the same CPU, and the CPU trapped in the
+do-while loop without yielding, the ksoftirqd thread will not get
+scheduled to run. As a result, pending_refcnt will never be reduced to
+zero, and the do-while loop cannot exit, eventually leading to a CPU soft
+lockup issue.
+
+In fact, skb is true for all but the first iterations of that loop, and
+as long as pending_refcnt is not zero, even if incremented by a previous
+call, wait_for_completion_interruptible_timeout() should be executed to
+yield the CPU, allowing the ksoftirqd thread to be scheduled. Therefore,
+the execution condition of this function should be modified to check if
+pending_refcnt is not zero, instead of check skb.
+
+- if (need_wait && skb) {
++ if (need_wait && packet_read_pending(&po->tx_ring)) {
+
+As a result, the judgment conditions are duplicated with the end code of
+the while loop, and packet_read_pending() is a very expensive function.
+Actually, this loop can only exit when ph is NULL, so the loop condition
+can be changed to while (1), and in the "ph = NULL" branch, if the
+subsequent condition of if is not met, the loop can break directly. Now,
+the loop logic remains the same as origin but is clearer and more obvious.
+
+Fixes: 89ed5b519004 ("af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET")
+Cc: stable@kernel.org
+Suggested-by: LongJun Tang <tanglongjun@kylinos.cn>
+Signed-off-by: Yun Lu <luyun@kylinos.cn>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/packet/af_packet.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2852,15 +2852,21 @@ static int tpacket_snd(struct packet_soc
+ ph = packet_current_frame(po, &po->tx_ring,
+ TP_STATUS_SEND_REQUEST);
+ if (unlikely(ph == NULL)) {
+- if (need_wait && skb) {
++ /* Note: packet_read_pending() might be slow if we
++ * have to call it as it's per_cpu variable, but in
++ * fast-path we don't have to call it, only when ph
++ * is NULL, we need to check the pending_refcnt.
++ */
++ if (need_wait && packet_read_pending(&po->tx_ring)) {
+ timeo = wait_for_completion_interruptible_timeout(&po->skb_completion, timeo);
+ if (timeo <= 0) {
+ err = !timeo ? -ETIMEDOUT : -ERESTARTSYS;
+ goto out_put;
+ }
+- }
+- /* check for additional frames */
+- continue;
++ /* check for additional frames */
++ continue;
++ } else
++ break;
+ }
+
+ skb = NULL;
+@@ -2949,14 +2955,7 @@ tpacket_error:
+ }
+ packet_increment_head(&po->tx_ring);
+ len_sum += tp_len;
+- } while (likely((ph != NULL) ||
+- /* Note: packet_read_pending() might be slow if we have
+- * to call it as it's per_cpu variable, but in fast-path
+- * we already short-circuit the loop with the first
+- * condition, and luckily don't have to go that path
+- * anyway.
+- */
+- (need_wait && packet_read_pending(&po->tx_ring))));
++ } while (1);
+
+ err = len_sum;
+ goto out_put;
--- /dev/null
+From c1ba3c0cbdb5e53a8ec5d708e99cd4c497028a13 Mon Sep 17 00:00:00 2001
+From: Yun Lu <luyun@kylinos.cn>
+Date: Fri, 11 Jul 2025 17:32:59 +0800
+Subject: af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
+
+From: Yun Lu <luyun@kylinos.cn>
+
+commit c1ba3c0cbdb5e53a8ec5d708e99cd4c497028a13 upstream.
+
+Due to the changes in commit 581073f626e3 ("af_packet: do not call
+packet_read_pending() from tpacket_destruct_skb()"), every time
+tpacket_destruct_skb() is executed, the skb_completion is marked as
+completed. When wait_for_completion_interruptible_timeout() returns
+completed, the pending_refcnt has not yet been reduced to zero.
+Therefore, when ph is NULL, the wait function may need to be called
+multiple times until packet_read_pending() finally returns zero.
+
+We should call sock_sndtimeo() only once, otherwise the SO_SNDTIMEO
+constraint could be way off.
+
+Fixes: 581073f626e3 ("af_packet: do not call packet_read_pending() from tpacket_destruct_skb()")
+Cc: stable@kernel.org
+Suggested-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Yun Lu <luyun@kylinos.cn>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/packet/af_packet.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2791,7 +2791,7 @@ static int tpacket_snd(struct packet_soc
+ int len_sum = 0;
+ int status = TP_STATUS_AVAILABLE;
+ int hlen, tlen, copylen = 0;
+- long timeo = 0;
++ long timeo;
+
+ mutex_lock(&po->pg_vec_lock);
+
+@@ -2845,6 +2845,7 @@ static int tpacket_snd(struct packet_soc
+ if ((size_max > dev->mtu + reserve + VLAN_HLEN) && !vnet_hdr_sz)
+ size_max = dev->mtu + reserve + VLAN_HLEN;
+
++ timeo = sock_sndtimeo(&po->sk, msg->msg_flags & MSG_DONTWAIT);
+ reinit_completion(&po->skb_completion);
+
+ do {
+@@ -2852,7 +2853,6 @@ static int tpacket_snd(struct packet_soc
+ TP_STATUS_SEND_REQUEST);
+ if (unlikely(ph == NULL)) {
+ if (need_wait && skb) {
+- timeo = sock_sndtimeo(&po->sk, msg->msg_flags & MSG_DONTWAIT);
+ timeo = wait_for_completion_interruptible_timeout(&po->skb_completion, timeo);
+ if (timeo <= 0) {
+ err = !timeo ? -ETIMEDOUT : -ERESTARTSYS;
--- /dev/null
+From e201c19ddeed6b37f05617e529d8efa079657ed7 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 15 Jul 2025 08:29:04 +0200
+Subject: ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit e201c19ddeed6b37f05617e529d8efa079657ed7 upstream.
+
+ASUS ROG Strix G712LWS (PCI SSID 1043:1a83) requires the quirk for
+ALC294 headset mode in order to make the speaker and headset I/O
+working properly.
+
+Cc: <stable@vger.kernel.org>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220334
+Link: https://patch.msgid.link/20250715062906.11857-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10303,6 +10303,7 @@ static const struct hda_quirk alc269_fix
+ SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+ SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC245_FIXUP_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x1a83, "ASUS UM5302LA", ALC294_FIXUP_CS35L41_I2C_2),
++ SND_PCI_QUIRK(0x1043, 0x1a8e, "ASUS G712LWS", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x1043, 0x1a8f, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x1b11, "ASUS UX431DA", ALC294_FIXUP_ASUS_COEF_1B),
+ SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
--- /dev/null
+From fbe94be09fa81343d623a86ec64a742759b669b3 Mon Sep 17 00:00:00 2001
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+Date: Mon, 23 Jun 2025 15:25:45 +0200
+Subject: arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+commit fbe94be09fa81343d623a86ec64a742759b669b3 upstream.
+
+LDO5 regulator is used to power the i.MX8MM NVCC_SD2 I/O supply, that is
+used for the SD2 card interface and also for some GPIOs.
+
+When the SD card interface is not enabled the regulator subsystem could
+turn off this supply, since it is not used anywhere else, however this
+will also remove the power to some other GPIOs, for example one I/O that
+is used to power the ethernet phy, leading to a non working ethernet
+interface.
+
+[ 31.820515] On-module +V3.3_1.8_SD (LDO5): disabling
+[ 31.821761] PMIC_USDHC_VSELECT: disabling
+[ 32.764949] fec 30be0000.ethernet end0: Link is Down
+
+Fix this keeping the LDO5 supply always on.
+
+Cc: stable@vger.kernel.org
+Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini")
+Fixes: f5aab0438ef1 ("regulator: pca9450: Fix enable register for LDO5")
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi
+@@ -470,6 +470,7 @@
+ };
+
+ reg_nvcc_sd: LDO5 {
++ regulator-always-on;
+ regulator-max-microvolt = <3300000>;
+ regulator-min-microvolt = <1800000>;
+ regulator-name = "On-module +V3.3_1.8_SD (LDO5)";
--- /dev/null
+From 0bdaca0922175478ddeadf8e515faa5269f6fae6 Mon Sep 17 00:00:00 2001
+From: Tim Harvey <tharvey@gateworks.com>
+Date: Wed, 4 Jun 2025 15:56:30 -0700
+Subject: arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
+
+From: Tim Harvey <tharvey@gateworks.com>
+
+commit 0bdaca0922175478ddeadf8e515faa5269f6fae6 upstream.
+
+The IMX8MPDS Table 37 [1] shows that the max SPI master read frequency
+depends on the pins the interface is muxed behind with ECSPI2
+muxed behind ECSPI2 supporting up to 25MHz.
+
+Adjust the spi-max-frequency based on these findings.
+
+[1] https://www.nxp.com/webapp/Download?colCode=IMX8MPIEC
+
+Fixes: 531936b218d8 ("arm64: dts: imx8mp-venice-gw74xx: update to revB PCB")
+Cc: stable@vger.kernel.org
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts
+@@ -185,7 +185,7 @@
+ #address-cells = <0x1>;
+ #size-cells = <0x1>;
+ reg = <0x0>;
+- spi-max-frequency = <36000000>;
++ spi-max-frequency = <25000000>;
+ };
+ };
+
--- /dev/null
+From 53b6445ad08f07b6f4a84f1434f543196009ed89 Mon Sep 17 00:00:00 2001
+From: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de>
+Date: Fri, 27 Jun 2025 15:17:12 +0200
+Subject: arm64: dts: rockchip: use cs-gpios for spi1 on ringneck
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de>
+
+commit 53b6445ad08f07b6f4a84f1434f543196009ed89 upstream.
+
+Hardware CS has a very slow rise time of about 6us,
+causing transmission errors when CS does not reach
+high between transaction.
+
+It looks like it's not driven actively when transitioning
+from low to high but switched to input, so only the CPU
+pull-up pulls it high, slowly. Transitions from high to low
+are fast. On the oscilloscope, CS looks like an irregular sawtooth
+pattern like this:
+ _____
+ ^ / |
+ ^ /| / |
+ /| / | / |
+ / | / | / |
+___/ |___/ |_____/ |___
+
+With cs-gpios we have a CS rise time of about 20ns, as it should be,
+and CS looks rectangular.
+
+This fixes the data errors when running a flashcp loop against a
+m25p40 spi flash.
+
+With the Rockchip 6.1 kernel we see the same slow rise time, but
+for some reason CS is always high for long enough to reach a solid
+high.
+
+The RK3399 and RK3588 SoCs use the same SPI driver, so we also
+checked our "Puma" (RK3399) and "Tiger" (RK3588) boards.
+They do not have this problem. Hardware CS rise time is good.
+
+Fixes: c484cf93f61b ("arm64: dts: rockchip: add PX30-µQ7 (Ringneck) SoM with Haikou baseboard")
+Cc: stable@vger.kernel.org
+Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
+Signed-off-by: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de>
+Link: https://lore.kernel.org/r/20250627131715.1074308-1-jakob.unterwurzacher@cherry.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi
++++ b/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi
+@@ -344,6 +344,18 @@
+ <0 RK_PA7 RK_FUNC_GPIO &pcfg_pull_up>;
+ };
+ };
++
++ spi1 {
++ spi1_csn0_gpio_pin: spi1-csn0-gpio-pin {
++ rockchip,pins =
++ <3 RK_PB1 RK_FUNC_GPIO &pcfg_pull_up_4ma>;
++ };
++
++ spi1_csn1_gpio_pin: spi1-csn1-gpio-pin {
++ rockchip,pins =
++ <3 RK_PB2 RK_FUNC_GPIO &pcfg_pull_up_4ma>;
++ };
++ };
+ };
+
+ &saradc {
+@@ -355,6 +367,17 @@
+ vqmmc-supply = <&vccio_sd>;
+ };
+
++&spi1 {
++ /*
++ * Hardware CS has a very slow rise time of about 6us,
++ * causing transmission errors.
++ * With cs-gpios we have a rise time of about 20ns.
++ */
++ cs-gpios = <&gpio3 RK_PB1 GPIO_ACTIVE_LOW>, <&gpio3 RK_PB2 GPIO_ACTIVE_LOW>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&spi1_clk &spi1_csn0_gpio_pin &spi1_csn1_gpio_pin &spi1_miso &spi1_mosi>;
++};
++
+ &tsadc {
+ status = "okay";
+ };
--- /dev/null
+From 188c6ba1dd925849c5d94885c8bbdeb0b3dcf510 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@linaro.org>
+Date: Tue, 1 Jul 2025 17:31:40 -0500
+Subject: dmaengine: nbpfaxi: Fix memory corruption in probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+commit 188c6ba1dd925849c5d94885c8bbdeb0b3dcf510 upstream.
+
+The nbpf->chan[] array is allocated earlier in the nbpf_probe() function
+and it has "num_channels" elements. These three loops iterate one
+element farther than they should and corrupt memory.
+
+The changes to the second loop are more involved. In this case, we're
+copying data from the irqbuf[] array into the nbpf->chan[] array. If
+the data in irqbuf[i] is the error IRQ then we skip it, so the iterators
+are not in sync. I added a check to ensure that we don't go beyond the
+end of the irqbuf[] array. I'm pretty sure this can't happen, but it
+seemed harmless to add a check.
+
+On the other hand, after the loop has ended there is a check to ensure
+that the "chan" iterator is where we expect it to be. In the original
+code we went one element beyond the end of the array so the iterator
+wasn't in the correct place and it would always return -EINVAL. However,
+now it will always be in the correct place. I deleted the check since
+we know the result.
+
+Cc: stable@vger.kernel.org
+Fixes: b45b262cefd5 ("dmaengine: add a driver for AMBA AXI NBPF DMAC IP cores")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/b13c5225-7eff-448c-badc-a2c98e9bcaca@sabinyo.mountain
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/nbpfaxi.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/dma/nbpfaxi.c
++++ b/drivers/dma/nbpfaxi.c
+@@ -1351,7 +1351,7 @@ static int nbpf_probe(struct platform_de
+ if (irqs == 1) {
+ eirq = irqbuf[0];
+
+- for (i = 0; i <= num_channels; i++)
++ for (i = 0; i < num_channels; i++)
+ nbpf->chan[i].irq = irqbuf[0];
+ } else {
+ eirq = platform_get_irq_byname(pdev, "error");
+@@ -1361,16 +1361,15 @@ static int nbpf_probe(struct platform_de
+ if (irqs == num_channels + 1) {
+ struct nbpf_channel *chan;
+
+- for (i = 0, chan = nbpf->chan; i <= num_channels;
++ for (i = 0, chan = nbpf->chan; i < num_channels;
+ i++, chan++) {
+ /* Skip the error IRQ */
+ if (irqbuf[i] == eirq)
+ i++;
++ if (i >= ARRAY_SIZE(irqbuf))
++ return -EINVAL;
+ chan->irq = irqbuf[i];
+ }
+-
+- if (chan != nbpf->chan + num_channels)
+- return -EINVAL;
+ } else {
+ /* 2 IRQs and more than one channel */
+ if (irqbuf[0] == eirq)
+@@ -1378,7 +1377,7 @@ static int nbpf_probe(struct platform_de
+ else
+ irq = irqbuf[0];
+
+- for (i = 0; i <= num_channels; i++)
++ for (i = 0; i < num_channels; i++)
+ nbpf->chan[i].irq = irq;
+ }
+ }
--- /dev/null
+From 83261934015c434fabb980a3e613b01d9976e877 Mon Sep 17 00:00:00 2001
+From: Eeli Haapalainen <eeli.haapalainen@protonmail.com>
+Date: Mon, 14 Jul 2025 08:13:09 +0300
+Subject: drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
+
+From: Eeli Haapalainen <eeli.haapalainen@protonmail.com>
+
+commit 83261934015c434fabb980a3e613b01d9976e877 upstream.
+
+Commit 42cdf6f687da ("drm/amdgpu/gfx8: always restore kcq MQDs") made the
+ring pointer always to be reset on resume from suspend. This caused compute
+rings to fail since the reset was done without also resetting it for the
+firmware. Reset wptr on the GPU to avoid a disconnect between the driver
+and firmware wptr.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3911
+Fixes: 42cdf6f687da ("drm/amdgpu/gfx8: always restore kcq MQDs")
+Signed-off-by: Eeli Haapalainen <eeli.haapalainen@protonmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 2becafc319db3d96205320f31cc0de4ee5a93747)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -4656,6 +4656,7 @@ static int gfx_v8_0_kcq_init_queue(struc
+ memcpy(mqd, adev->gfx.mec.mqd_backup[mqd_idx], sizeof(struct vi_mqd_allocation));
+ /* reset ring buffer */
+ ring->wptr = 0;
++ atomic64_set((atomic64_t *)ring->wptr_cpu_addr, 0);
+ amdgpu_ring_clear_ring(ring);
+ }
+ return 0;
--- /dev/null
+From c7cafd5b81cc07fb402e3068d134c21e60ea688c Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Wed, 16 Jul 2025 17:20:17 +0100
+Subject: io_uring/poll: fix POLLERR handling
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit c7cafd5b81cc07fb402e3068d134c21e60ea688c upstream.
+
+8c8492ca64e7 ("io_uring/net: don't retry connect operation on EPOLLERR")
+is a little dirty hack that
+1) wrongfully assumes that POLLERR equals to a failed request, which
+breaks all POLLERR users, e.g. all error queue recv interfaces.
+2) deviates the connection request behaviour from connect(2), and
+3) racy and solved at a wrong level.
+
+Nothing can be done with 2) now, and 3) is beyond the scope of the
+patch. At least solve 1) by moving the hack out of generic poll handling
+into io_connect().
+
+Cc: stable@vger.kernel.org
+Fixes: 8c8492ca64e79 ("io_uring/net: don't retry connect operation on EPOLLERR")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/3dc89036388d602ebd84c28e5042e457bdfc952b.1752682444.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/net.c | 12 ++++++++----
+ io_uring/poll.c | 2 --
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+--- a/io_uring/net.c
++++ b/io_uring/net.c
+@@ -1537,9 +1537,11 @@ int io_connect(struct io_kiocb *req, uns
+ io = &__io;
+ }
+
+- if (unlikely(req->flags & REQ_F_FAIL)) {
+- ret = -ECONNRESET;
+- goto out;
++ if (connect->in_progress) {
++ struct poll_table_struct pt = { ._key = EPOLLERR };
++
++ if (vfs_poll(req->file, &pt) & EPOLLERR)
++ goto get_sock_err;
+ }
+
+ file_flags = force_nonblock ? O_NONBLOCK : 0;
+@@ -1571,8 +1573,10 @@ int io_connect(struct io_kiocb *req, uns
+ * which means the previous result is good. For both of these,
+ * grab the sock_error() and use that for the completion.
+ */
+- if (ret == -EBADFD || ret == -EISCONN)
++ if (ret == -EBADFD || ret == -EISCONN) {
++get_sock_err:
+ ret = sock_error(sock_from_file(req->file)->sk);
++ }
+ }
+ if (ret == -ERESTARTSYS)
+ ret = -EINTR;
+--- a/io_uring/poll.c
++++ b/io_uring/poll.c
+@@ -308,8 +308,6 @@ static int io_poll_check_events(struct i
+ return IOU_POLL_REISSUE;
+ }
+ }
+- if (unlikely(req->cqe.res & EPOLLERR))
+- req_set_fail(req);
+ if (req->apoll_events & EPOLLONESHOT)
+ return IOU_POLL_DONE;
+
--- /dev/null
+From 0a9e7405131380b57e155f10242b2e25d2e51852 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 9 Jul 2025 11:55:46 +0200
+Subject: isofs: Verify inode mode when loading from disk
+
+From: Jan Kara <jack@suse.cz>
+
+commit 0a9e7405131380b57e155f10242b2e25d2e51852 upstream.
+
+Verify that the inode mode is sane when loading it from the disk to
+avoid complaints from VFS about setting up invalid inodes.
+
+Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com
+CC: stable@vger.kernel.org
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/20250709095545.31062-2-jack@suse.cz
+Acked-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/isofs/inode.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -1486,9 +1486,16 @@ static int isofs_read_inode(struct inode
+ inode->i_op = &page_symlink_inode_operations;
+ inode_nohighmem(inode);
+ inode->i_data.a_ops = &isofs_symlink_aops;
+- } else
++ } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
++ S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
+ /* XXX - parse_rock_ridge_inode() had already set i_rdev. */
+ init_special_inode(inode, inode->i_mode, inode->i_rdev);
++ } else {
++ printk(KERN_DEBUG "ISOFS: Invalid file type 0%04o for inode %lu.\n",
++ inode->i_mode, inode->i_ino);
++ ret = -EIO;
++ goto fail;
++ }
+
+ ret = 0;
+ out:
--- /dev/null
+From 21b34a3a204ed616373a12ec17dc127ebe51eab3 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Tue, 15 Jul 2025 15:56:05 -0700
+Subject: memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 21b34a3a204ed616373a12ec17dc127ebe51eab3 upstream.
+
+A new warning in clang [1] points out that id_reg is uninitialized then
+passed to memstick_init_req() as a const pointer:
+
+ drivers/memstick/core/memstick.c:330:59: error: variable 'id_reg' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 330 | memstick_init_req(&card->current_mrq, MS_TPC_READ_REG, &id_reg,
+ | ^~~~~~
+
+Commit de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull
+warning") intentionally passed this variable uninitialized to avoid an
+-Wnonnull warning from a NULL value that was previously there because
+id_reg is never read from the call to memstick_init_req() in
+h_memstick_read_dev_id(). Just zero initialize id_reg to avoid the
+warning, which is likely happening in the majority of builds using
+modern compilers that support '-ftrivial-auto-var-init=zero'.
+
+Cc: stable@vger.kernel.org
+Fixes: de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull warning")
+Link: https://github.com/llvm/llvm-project/commit/00dacf8c22f065cb52efb14cd091d441f19b319e [1]
+Closes: https://github.com/ClangBuiltLinux/linux/issues/2105
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Link: https://lore.kernel.org/r/20250715-memstick-fix-uninit-const-pointer-v1-1-f6753829c27a@kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/memstick/core/memstick.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -323,7 +323,7 @@ EXPORT_SYMBOL(memstick_init_req);
+ static int h_memstick_read_dev_id(struct memstick_dev *card,
+ struct memstick_request **mrq)
+ {
+- struct ms_id_register id_reg;
++ struct ms_id_register id_reg = {};
+
+ if (!(*mrq)) {
+ memstick_init_req(&card->current_mrq, MS_TPC_READ_REG, &id_reg,
--- /dev/null
+From ff09b71bf9daeca4f21d6e5e449641c9fad75b53 Mon Sep 17 00:00:00 2001
+From: Thomas Fourier <fourier.thomas@gmail.com>
+Date: Mon, 30 Jun 2025 11:35:07 +0200
+Subject: mmc: bcm2835: Fix dma_unmap_sg() nents value
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+commit ff09b71bf9daeca4f21d6e5e449641c9fad75b53 upstream.
+
+The dma_unmap_sg() functions should be called with the same nents as the
+dma_map_sg(), not the value the map function returned.
+
+Fixes: 2f5da678351f ("mmc: bcm2835: Properly handle dmaengine_prep_slave_sg")
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20250630093510.82871-2-fourier.thomas@gmail.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/bcm2835.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/bcm2835.c
++++ b/drivers/mmc/host/bcm2835.c
+@@ -502,7 +502,8 @@ void bcm2835_prepare_dma(struct bcm2835_
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+
+ if (!desc) {
+- dma_unmap_sg(dma_chan->device->dev, data->sg, sg_len, dir_data);
++ dma_unmap_sg(dma_chan->device->dev, data->sg, data->sg_len,
++ dir_data);
+ return;
+ }
+
--- /dev/null
+From 50c78f398e92fafa1cbba3469c95fe04b2e4206d Mon Sep 17 00:00:00 2001
+From: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
+Date: Thu, 26 Jun 2025 08:24:42 -0300
+Subject: mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
+
+From: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
+
+commit 50c78f398e92fafa1cbba3469c95fe04b2e4206d upstream.
+
+Disable command queuing on Intel GLK-based Positivo models.
+
+Without this quirk, CQE (Command Queuing Engine) causes instability
+or I/O errors during operation. Disabling it ensures stable
+operation on affected devices.
+
+Signed-off-by: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
+Fixes: bedf9fc01ff1 ("mmc: sdhci: Workaround broken command queuing on Intel GLK")
+Cc: stable@vger.kernel.org
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20250626112442.9791-1-edson.drosdeck@gmail.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-pci-core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -911,7 +911,8 @@ static bool glk_broken_cqhci(struct sdhc
+ {
+ return slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_GLK_EMMC &&
+ (dmi_match(DMI_BIOS_VENDOR, "LENOVO") ||
+- dmi_match(DMI_SYS_VENDOR, "IRBIS"));
++ dmi_match(DMI_SYS_VENDOR, "IRBIS") ||
++ dmi_match(DMI_SYS_VENDOR, "Positivo Tecnologia SA"));
+ }
+
+ static bool jsl_broken_hs400es(struct sdhci_pci_slot *slot)
--- /dev/null
+From 6d0b1c01847fedd7c85a5cdf59b8cfc7d14512e6 Mon Sep 17 00:00:00 2001
+From: Judith Mendez <jm@ti.com>
+Date: Thu, 26 Jun 2025 18:14:52 -0500
+Subject: mmc: sdhci_am654: Workaround for Errata i2312
+
+From: Judith Mendez <jm@ti.com>
+
+commit 6d0b1c01847fedd7c85a5cdf59b8cfc7d14512e6 upstream.
+
+Errata i2312 [0] for K3 silicon mentions the maximum obtainable
+timeout through MMC host controller is 700ms. And for commands taking
+longer than 700ms, hardware timeout should be disabled and software
+timeout should be used.
+
+The workaround for Errata i2312 can be achieved by adding
+SDHCI_QUIRK2_DISABLE_HW_TIMEOUT quirk in sdhci_am654.
+
+[0] https://www.ti.com/lit/pdf/sprz487
+
+Signed-off-by: Judith Mendez <jm@ti.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Fixes: 41fd4caeb00b ("mmc: sdhci_am654: Add Initial Support for AM654 SDHCI driver")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20250626231452.3460987-1-jm@ti.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci_am654.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/host/sdhci_am654.c
++++ b/drivers/mmc/host/sdhci_am654.c
+@@ -559,7 +559,8 @@ static struct sdhci_ops sdhci_am654_ops
+ static const struct sdhci_pltfm_data sdhci_am654_pdata = {
+ .ops = &sdhci_am654_ops,
+ .quirks = SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12,
+- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
++ SDHCI_QUIRK2_DISABLE_HW_TIMEOUT,
+ };
+
+ static const struct sdhci_am654_driver_data sdhci_am654_sr1_drvdata = {
+@@ -589,7 +590,8 @@ static struct sdhci_ops sdhci_j721e_8bit
+ static const struct sdhci_pltfm_data sdhci_j721e_8bit_pdata = {
+ .ops = &sdhci_j721e_8bit_ops,
+ .quirks = SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12,
+- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
++ SDHCI_QUIRK2_DISABLE_HW_TIMEOUT,
+ };
+
+ static const struct sdhci_am654_driver_data sdhci_j721e_8bit_drvdata = {
+@@ -613,7 +615,8 @@ static struct sdhci_ops sdhci_j721e_4bit
+ static const struct sdhci_pltfm_data sdhci_j721e_4bit_pdata = {
+ .ops = &sdhci_j721e_4bit_ops,
+ .quirks = SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12,
+- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
++ SDHCI_QUIRK2_DISABLE_HW_TIMEOUT,
+ };
+
+ static const struct sdhci_am654_driver_data sdhci_j721e_4bit_drvdata = {
--- /dev/null
+From da9b2fc7b73d147d88abe1922de5ab72d72d7756 Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Mon, 14 Jul 2025 18:41:46 +0200
+Subject: mptcp: reset fallback status gracefully at disconnect() time
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit da9b2fc7b73d147d88abe1922de5ab72d72d7756 upstream.
+
+mptcp_disconnect() clears the fallback bit unconditionally, without
+touching the associated flags.
+
+The bit clear is safe, as no fallback operation can race with that --
+all subflow are already in TCP_CLOSE status thanks to the previous
+FASTCLOSE -- but we need to consistently reset all the fallback related
+status.
+
+Also acquire the relevant lock, to avoid fouling static analyzers.
+
+Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20250714-net-mptcp-fallback-races-v1-3-391aff963322@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -3183,7 +3183,16 @@ static int mptcp_disconnect(struct sock
+ * subflow
+ */
+ mptcp_destroy_common(msk, MPTCP_CF_FASTCLOSE);
++
++ /* The first subflow is already in TCP_CLOSE status, the following
++ * can't overlap with a fallback anymore
++ */
++ spin_lock_bh(&msk->fallback_lock);
++ msk->allow_subflows = true;
++ msk->allow_infinite_fallback = true;
+ WRITE_ONCE(msk->flags, 0);
++ spin_unlock_bh(&msk->fallback_lock);
++
+ msk->cb_flags = 0;
+ msk->recovery = false;
+ msk->can_ack = false;
--- /dev/null
+From 5fd77cc6bd9b368431a815a780e407b7781bcca0 Mon Sep 17 00:00:00 2001
+From: Jiawen Wu <jiawenwu@trustnetic.com>
+Date: Mon, 14 Jul 2025 10:47:54 +0800
+Subject: net: libwx: fix the using of Rx buffer DMA
+
+From: Jiawen Wu <jiawenwu@trustnetic.com>
+
+commit 5fd77cc6bd9b368431a815a780e407b7781bcca0 upstream.
+
+The wx_rx_buffer structure contained two DMA address fields: 'dma' and
+'page_dma'. However, only 'page_dma' was actually initialized and used
+to program the Rx descriptor. But 'dma' was uninitialized and used in
+some paths.
+
+This could lead to undefined behavior, including DMA errors or
+use-after-free, if the uninitialized 'dma' was used. Althrough such
+error has not yet occurred, it is worth fixing in the code.
+
+Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250714024755.17512-3-jiawenwu@trustnetic.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/wangxun/libwx/wx_lib.c | 4 ++--
+ drivers/net/ethernet/wangxun/libwx/wx_type.h | 1 -
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c
++++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
+@@ -307,7 +307,7 @@ static bool wx_alloc_mapped_page(struct
+ return false;
+ dma = page_pool_get_dma_addr(page);
+
+- bi->page_dma = dma;
++ bi->dma = dma;
+ bi->page = page;
+ bi->page_offset = 0;
+
+@@ -344,7 +344,7 @@ void wx_alloc_rx_buffers(struct wx_ring
+ DMA_FROM_DEVICE);
+
+ rx_desc->read.pkt_addr =
+- cpu_to_le64(bi->page_dma + bi->page_offset);
++ cpu_to_le64(bi->dma + bi->page_offset);
+
+ rx_desc++;
+ bi++;
+--- a/drivers/net/ethernet/wangxun/libwx/wx_type.h
++++ b/drivers/net/ethernet/wangxun/libwx/wx_type.h
+@@ -755,7 +755,6 @@ struct wx_tx_buffer {
+ struct wx_rx_buffer {
+ struct sk_buff *skb;
+ dma_addr_t dma;
+- dma_addr_t page_dma;
+ struct page *page;
+ unsigned int page_offset;
+ };
--- /dev/null
+From d992ed7e1b687ad7df0763d3e015a5358646210b Mon Sep 17 00:00:00 2001
+From: Jiawen Wu <jiawenwu@trustnetic.com>
+Date: Mon, 14 Jul 2025 10:47:55 +0800
+Subject: net: libwx: properly reset Rx ring descriptor
+
+From: Jiawen Wu <jiawenwu@trustnetic.com>
+
+commit d992ed7e1b687ad7df0763d3e015a5358646210b upstream.
+
+When device reset is triggered by feature changes such as toggling Rx
+VLAN offload, wx->do_reset() is called to reinitialize Rx rings. The
+hardware descriptor ring may retain stale values from previous sessions.
+And only set the length to 0 in rx_desc[0] would result in building
+malformed SKBs. Fix it to ensure a clean slate after device reset.
+
+[ 549.186435] [ C16] ------------[ cut here ]------------
+[ 549.186457] [ C16] kernel BUG at net/core/skbuff.c:2814!
+[ 549.186468] [ C16] Oops: invalid opcode: 0000 [#1] SMP NOPTI
+[ 549.186472] [ C16] CPU: 16 UID: 0 PID: 0 Comm: swapper/16 Kdump: loaded Not tainted 6.16.0-rc4+ #23 PREEMPT(voluntary)
+[ 549.186476] [ C16] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024
+[ 549.186478] [ C16] RIP: 0010:__pskb_pull_tail+0x3ff/0x510
+[ 549.186484] [ C16] Code: 06 f0 ff 4f 34 74 7b 4d 8b 8c 24 c8 00 00 00 45 8b 84 24 c0 00 00 00 e9 c8 fd ff ff 48 c7 44 24 08 00 00 00 00 e9 5e fe ff ff <0f> 0b 31 c0 e9 23 90 5b ff 41 f7 c6 ff 0f 00 00 75 bf 49 8b 06 a8
+[ 549.186487] [ C16] RSP: 0018:ffffb391c0640d70 EFLAGS: 00010282
+[ 549.186490] [ C16] RAX: 00000000fffffff2 RBX: ffff8fe7e4d40200 RCX: 00000000fffffff2
+[ 549.186492] [ C16] RDX: ffff8fe7c3a4bf8e RSI: 0000000000000180 RDI: ffff8fe7c3a4bf40
+[ 549.186494] [ C16] RBP: ffffb391c0640da8 R08: ffff8fe7c3a4c0c0 R09: 000000000000000e
+[ 549.186496] [ C16] R10: ffffb391c0640d88 R11: 000000000000000e R12: ffff8fe7e4d40200
+[ 549.186497] [ C16] R13: 00000000fffffff2 R14: ffff8fe7fa01a000 R15: 00000000fffffff2
+[ 549.186499] [ C16] FS: 0000000000000000(0000) GS:ffff8fef5ae40000(0000) knlGS:0000000000000000
+[ 549.186502] [ C16] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 549.186503] [ C16] CR2: 00007f77d81d6000 CR3: 000000051a032000 CR4: 0000000000750ef0
+[ 549.186505] [ C16] PKRU: 55555554
+[ 549.186507] [ C16] Call Trace:
+[ 549.186510] [ C16] <IRQ>
+[ 549.186513] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 549.186517] [ C16] __skb_pad+0xc7/0xf0
+[ 549.186523] [ C16] wx_clean_rx_irq+0x355/0x3b0 [libwx]
+[ 549.186533] [ C16] wx_poll+0x92/0x120 [libwx]
+[ 549.186540] [ C16] __napi_poll+0x28/0x190
+[ 549.186544] [ C16] net_rx_action+0x301/0x3f0
+[ 549.186548] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 549.186551] [ C16] ? __raw_spin_lock_irqsave+0x1e/0x50
+[ 549.186554] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 549.186557] [ C16] ? wake_up_nohz_cpu+0x35/0x160
+[ 549.186559] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 549.186563] [ C16] handle_softirqs+0xf9/0x2c0
+[ 549.186568] [ C16] __irq_exit_rcu+0xc7/0x130
+[ 549.186572] [ C16] common_interrupt+0xb8/0xd0
+[ 549.186576] [ C16] </IRQ>
+[ 549.186577] [ C16] <TASK>
+[ 549.186579] [ C16] asm_common_interrupt+0x22/0x40
+[ 549.186582] [ C16] RIP: 0010:cpuidle_enter_state+0xc2/0x420
+[ 549.186585] [ C16] Code: 00 00 e8 11 0e 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 0d ed 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d
+[ 549.186587] [ C16] RSP: 0018:ffffb391c0277e78 EFLAGS: 00000246
+[ 549.186590] [ C16] RAX: ffff8fef5ae40000 RBX: 0000000000000003 RCX: 0000000000000000
+[ 549.186591] [ C16] RDX: 0000007fde0faac5 RSI: ffffffff826e53f6 RDI: ffffffff826fa9b3
+[ 549.186593] [ C16] RBP: ffff8fe7c3a20800 R08: 0000000000000002 R09: 0000000000000000
+[ 549.186595] [ C16] R10: 0000000000000000 R11: 000000000000ffff R12: ffffffff82ed7a40
+[ 549.186596] [ C16] R13: 0000007fde0faac5 R14: 0000000000000003 R15: 0000000000000000
+[ 549.186601] [ C16] ? cpuidle_enter_state+0xb3/0x420
+[ 549.186605] [ C16] cpuidle_enter+0x29/0x40
+[ 549.186609] [ C16] cpuidle_idle_call+0xfd/0x170
+[ 549.186613] [ C16] do_idle+0x7a/0xc0
+[ 549.186616] [ C16] cpu_startup_entry+0x25/0x30
+[ 549.186618] [ C16] start_secondary+0x117/0x140
+[ 549.186623] [ C16] common_startup_64+0x13e/0x148
+[ 549.186628] [ C16] </TASK>
+
+Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250714024755.17512-4-jiawenwu@trustnetic.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +++----
+ drivers/net/ethernet/wangxun/libwx/wx_lib.c | 5 +++++
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/wangxun/libwx/wx_hw.c
++++ b/drivers/net/ethernet/wangxun/libwx/wx_hw.c
+@@ -1348,7 +1348,6 @@ static void wx_configure_rx_ring(struct
+ struct wx_ring *ring)
+ {
+ u16 reg_idx = ring->reg_idx;
+- union wx_rx_desc *rx_desc;
+ u64 rdba = ring->dma;
+ u32 rxdctl;
+
+@@ -1378,9 +1377,9 @@ static void wx_configure_rx_ring(struct
+ memset(ring->rx_buffer_info, 0,
+ sizeof(struct wx_rx_buffer) * ring->count);
+
+- /* initialize Rx descriptor 0 */
+- rx_desc = WX_RX_DESC(ring, 0);
+- rx_desc->wb.upper.length = 0;
++ /* reset ntu and ntc to place SW in sync with hardware */
++ ring->next_to_clean = 0;
++ ring->next_to_use = 0;
+
+ /* enable receive descriptor ring */
+ wr32m(wx, WX_PX_RR_CFG(reg_idx),
+--- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c
++++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
+@@ -357,6 +357,8 @@ void wx_alloc_rx_buffers(struct wx_ring
+
+ /* clear the status bits for the next_to_use descriptor */
+ rx_desc->wb.upper.status_error = 0;
++ /* clear the length for the next_to_use descriptor */
++ rx_desc->wb.upper.length = 0;
+
+ cleaned_count--;
+ } while (cleaned_count);
+@@ -2173,6 +2175,9 @@ static void wx_clean_rx_ring(struct wx_r
+ }
+ }
+
++ /* Zero out the descriptor ring */
++ memset(rx_ring->desc, 0, rx_ring->size);
++
+ rx_ring->next_to_alloc = 0;
+ rx_ring->next_to_clean = 0;
+ rx_ring->next_to_use = 0;
--- /dev/null
+From 1b7e585c04cd5f0731dd25ffd396277e55fae0e6 Mon Sep 17 00:00:00 2001
+From: Jiawen Wu <jiawenwu@trustnetic.com>
+Date: Mon, 14 Jul 2025 10:47:53 +0800
+Subject: net: libwx: remove duplicate page_pool_put_full_page()
+
+From: Jiawen Wu <jiawenwu@trustnetic.com>
+
+commit 1b7e585c04cd5f0731dd25ffd396277e55fae0e6 upstream.
+
+page_pool_put_full_page() should only be invoked when freeing Rx buffers
+or building a skb if the size is too short. At other times, the pages
+need to be reused. So remove the redundant page put. In the original
+code, double free pages cause kernel panic:
+
+[ 876.949834] __irq_exit_rcu+0xc7/0x130
+[ 876.949836] common_interrupt+0xb8/0xd0
+[ 876.949838] </IRQ>
+[ 876.949838] <TASK>
+[ 876.949840] asm_common_interrupt+0x22/0x40
+[ 876.949841] RIP: 0010:cpuidle_enter_state+0xc2/0x420
+[ 876.949843] Code: 00 00 e8 d1 1d 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 cd fc 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d
+[ 876.949844] RSP: 0018:ffffaa7340267e78 EFLAGS: 00000246
+[ 876.949845] RAX: ffff9e3f135be000 RBX: 0000000000000002 RCX: 0000000000000000
+[ 876.949846] RDX: 000000cc2dc4cb7c RSI: ffffffff89ee49ae RDI: ffffffff89ef9f9e
+[ 876.949847] RBP: ffff9e378f940800 R08: 0000000000000002 R09: 00000000000000ed
+[ 876.949848] R10: 000000000000afc8 R11: ffff9e3e9e5a9b6c R12: ffffffff8a6d8580
+[ 876.949849] R13: 000000cc2dc4cb7c R14: 0000000000000002 R15: 0000000000000000
+[ 876.949852] ? cpuidle_enter_state+0xb3/0x420
+[ 876.949855] cpuidle_enter+0x29/0x40
+[ 876.949857] cpuidle_idle_call+0xfd/0x170
+[ 876.949859] do_idle+0x7a/0xc0
+[ 876.949861] cpu_startup_entry+0x25/0x30
+[ 876.949862] start_secondary+0x117/0x140
+[ 876.949864] common_startup_64+0x13e/0x148
+[ 876.949867] </TASK>
+[ 876.949868] ---[ end trace 0000000000000000 ]---
+[ 876.949869] ------------[ cut here ]------------
+[ 876.949870] list_del corruption, ffffead40445a348->next is NULL
+[ 876.949873] WARNING: CPU: 14 PID: 0 at lib/list_debug.c:52 __list_del_entry_valid_or_report+0x67/0x120
+[ 876.949875] Modules linked in: snd_hrtimer(E) bnep(E) binfmt_misc(E) amdgpu(E) squashfs(E) vfat(E) loop(E) fat(E) amd_atl(E) snd_hda_codec_realtek(E) intel_rapl_msr(E) snd_hda_codec_generic(E) intel_rapl_common(E) snd_hda_scodec_component(E) snd_hda_codec_hdmi(E) snd_hda_intel(E) edac_mce_amd(E) snd_intel_dspcfg(E) snd_hda_codec(E) snd_hda_core(E) amdxcp(E) kvm_amd(E) snd_hwdep(E) gpu_sched(E) drm_panel_backlight_quirks(E) cec(E) snd_pcm(E) drm_buddy(E) snd_seq_dummy(E) drm_ttm_helper(E) btusb(E) kvm(E) snd_seq_oss(E) btrtl(E) ttm(E) btintel(E) snd_seq_midi(E) btbcm(E) drm_exec(E) snd_seq_midi_event(E) i2c_algo_bit(E) snd_rawmidi(E) bluetooth(E) drm_suballoc_helper(E) irqbypass(E) snd_seq(E) ghash_clmulni_intel(E) sha512_ssse3(E) drm_display_helper(E) aesni_intel(E) snd_seq_device(E) rfkill(E) snd_timer(E) gf128mul(E) drm_client_lib(E) drm_kms_helper(E) snd(E) i2c_piix4(E) joydev(E) soundcore(E) wmi_bmof(E) ccp(E) k10temp(E) i2c_smbus(E) gpio_amdpt(E) i2c_designware_platform(E) gpio_generic(E) sg(E)
+[ 876.949914] i2c_designware_core(E) sch_fq_codel(E) parport_pc(E) drm(E) ppdev(E) lp(E) parport(E) fuse(E) nfnetlink(E) ip_tables(E) ext4 crc16 mbcache jbd2 sd_mod sfp mdio_i2c i2c_core txgbe ahci ngbe pcs_xpcs libahci libwx r8169 phylink libata realtek ptp pps_core video wmi
+[ 876.949933] CPU: 14 UID: 0 PID: 0 Comm: swapper/14 Kdump: loaded Tainted: G W E 6.16.0-rc2+ #20 PREEMPT(voluntary)
+[ 876.949935] Tainted: [W]=WARN, [E]=UNSIGNED_MODULE
+[ 876.949936] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024
+[ 876.949936] RIP: 0010:__list_del_entry_valid_or_report+0x67/0x120
+[ 876.949938] Code: 00 00 00 48 39 7d 08 0f 85 a6 00 00 00 5b b8 01 00 00 00 5d 41 5c e9 73 0d 93 ff 48 89 fe 48 c7 c7 a0 31 e8 89 e8 59 7c b3 ff <0f> 0b 31 c0 5b 5d 41 5c e9 57 0d 93 ff 48 89 fe 48 c7 c7 c8 31 e8
+[ 876.949940] RSP: 0018:ffffaa73405d0c60 EFLAGS: 00010282
+[ 876.949941] RAX: 0000000000000000 RBX: ffffead40445a348 RCX: 0000000000000000
+[ 876.949942] RDX: 0000000000000105 RSI: 0000000000000001 RDI: 00000000ffffffff
+[ 876.949943] RBP: 0000000000000000 R08: 000000010006dfde R09: ffffffff8a47d150
+[ 876.949944] R10: ffffffff8a47d150 R11: 0000000000000003 R12: dead000000000122
+[ 876.949945] R13: ffff9e3e9e5af700 R14: ffffead40445a348 R15: ffff9e3e9e5af720
+[ 876.949946] FS: 0000000000000000(0000) GS:ffff9e3f135be000(0000) knlGS:0000000000000000
+[ 876.949947] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 876.949948] CR2: 00007fa58b480048 CR3: 0000000156724000 CR4: 0000000000750ef0
+[ 876.949949] PKRU: 55555554
+[ 876.949950] Call Trace:
+[ 876.949951] <IRQ>
+[ 876.949952] __rmqueue_pcplist+0x53/0x2c0
+[ 876.949955] alloc_pages_bulk_noprof+0x2e0/0x660
+[ 876.949958] __page_pool_alloc_pages_slow+0xa9/0x400
+[ 876.949961] page_pool_alloc_pages+0xa/0x20
+[ 876.949963] wx_alloc_rx_buffers+0xd7/0x110 [libwx]
+[ 876.949967] wx_clean_rx_irq+0x262/0x430 [libwx]
+[ 876.949971] wx_poll+0x92/0x130 [libwx]
+[ 876.949975] __napi_poll+0x28/0x190
+[ 876.949977] net_rx_action+0x301/0x3f0
+[ 876.949980] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 876.949981] ? profile_tick+0x30/0x70
+[ 876.949983] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 876.949984] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 876.949986] ? timerqueue_add+0xa3/0xc0
+[ 876.949988] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 876.949989] ? __raise_softirq_irqoff+0x16/0x70
+[ 876.949991] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 876.949993] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 876.949994] ? wx_msix_clean_rings+0x41/0x50 [libwx]
+[ 876.949998] handle_softirqs+0xf9/0x2c0
+
+Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250714024755.17512-2-jiawenwu@trustnetic.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/wangxun/libwx/wx_lib.c | 11 -----------
+ drivers/net/ethernet/wangxun/libwx/wx_type.h | 1 -
+ 2 files changed, 12 deletions(-)
+
+--- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c
++++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c
+@@ -171,10 +171,6 @@ static void wx_dma_sync_frag(struct wx_r
+ skb_frag_off(frag),
+ skb_frag_size(frag),
+ DMA_FROM_DEVICE);
+-
+- /* If the page was released, just unmap it. */
+- if (unlikely(WX_CB(skb)->page_released))
+- page_pool_put_full_page(rx_ring->page_pool, rx_buffer->page, false);
+ }
+
+ static struct wx_rx_buffer *wx_get_rx_buffer(struct wx_ring *rx_ring,
+@@ -224,10 +220,6 @@ static void wx_put_rx_buffer(struct wx_r
+ struct sk_buff *skb,
+ int rx_buffer_pgcnt)
+ {
+- if (!IS_ERR(skb) && WX_CB(skb)->dma == rx_buffer->dma)
+- /* the page has been released from the ring */
+- WX_CB(skb)->page_released = true;
+-
+ /* clear contents of rx_buffer */
+ rx_buffer->page = NULL;
+ rx_buffer->skb = NULL;
+@@ -2158,9 +2150,6 @@ static void wx_clean_rx_ring(struct wx_r
+ if (rx_buffer->skb) {
+ struct sk_buff *skb = rx_buffer->skb;
+
+- if (WX_CB(skb)->page_released)
+- page_pool_put_full_page(rx_ring->page_pool, rx_buffer->page, false);
+-
+ dev_kfree_skb(skb);
+ }
+
+--- a/drivers/net/ethernet/wangxun/libwx/wx_type.h
++++ b/drivers/net/ethernet/wangxun/libwx/wx_type.h
+@@ -668,7 +668,6 @@ enum wx_reset_type {
+ struct wx_cb {
+ dma_addr_t dma;
+ u16 append_cnt; /* number of skb's appended */
+- bool page_released;
+ bool dma_released;
+ };
+
--- /dev/null
+From ad4f6df4f384905bc85f9fbfc1c0c198fb563286 Mon Sep 17 00:00:00 2001
+From: Maor Gottlieb <maorg@nvidia.com>
+Date: Wed, 16 Jul 2025 10:29:29 +0300
+Subject: net/mlx5: Update the list of the PCI supported devices
+
+From: Maor Gottlieb <maorg@nvidia.com>
+
+commit ad4f6df4f384905bc85f9fbfc1c0c198fb563286 upstream.
+
+Add the upcoming ConnectX-10 device ID to the table of supported
+PCI device IDs.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Reviewed-by: Eran Ben Elisha <eranbe@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/1752650969-148501-1-git-send-email-tariqt@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -2206,6 +2206,7 @@ static const struct pci_device_id mlx5_c
+ { PCI_VDEVICE(MELLANOX, 0x1021) }, /* ConnectX-7 */
+ { PCI_VDEVICE(MELLANOX, 0x1023) }, /* ConnectX-8 */
+ { PCI_VDEVICE(MELLANOX, 0x1025) }, /* ConnectX-9 */
++ { PCI_VDEVICE(MELLANOX, 0x1027) }, /* ConnectX-10 */
+ { PCI_VDEVICE(MELLANOX, 0xa2d2) }, /* BlueField integrated ConnectX-5 network controller */
+ { PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF}, /* BlueField integrated ConnectX-5 network controller VF */
+ { PCI_VDEVICE(MELLANOX, 0xa2d6) }, /* BlueField-2 integrated ConnectX-6 Dx network controller */
--- /dev/null
+From 17ba793f381eb813596d6de1cc6820bcbda5ed8b Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Tue, 15 Jul 2025 16:15:40 -0700
+Subject: phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 17ba793f381eb813596d6de1cc6820bcbda5ed8b upstream.
+
+A new warning in clang [1] points out a place in pep_sock_accept() where
+dst is uninitialized then passed as a const pointer to pep_find_pipe():
+
+ net/phonet/pep.c:829:37: error: variable 'dst' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer]
+ 829 | newsk = pep_find_pipe(&pn->hlist, &dst, pipe_handle);
+ | ^~~:
+
+Move the call to pn_skb_get_dst_sockaddr(), which initializes dst, to
+before the call to pep_find_pipe(), so that dst is consistently used
+initialized throughout the function.
+
+Cc: stable@vger.kernel.org
+Fixes: f7ae8d59f661 ("Phonet: allocate sock from accept syscall rather than soft IRQ")
+Link: https://github.com/llvm/llvm-project/commit/00dacf8c22f065cb52efb14cd091d441f19b319e [1]
+Closes: https://github.com/ClangBuiltLinux/linux/issues/2101
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Link: https://patch.msgid.link/20250715-net-phonet-fix-uninit-const-pointer-v1-1-8efd1bd188b3@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/phonet/pep.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/phonet/pep.c
++++ b/net/phonet/pep.c
+@@ -826,6 +826,7 @@ static struct sock *pep_sock_accept(stru
+ }
+
+ /* Check for duplicate pipe handle */
++ pn_skb_get_dst_sockaddr(skb, &dst);
+ newsk = pep_find_pipe(&pn->hlist, &dst, pipe_handle);
+ if (unlikely(newsk)) {
+ __sock_put(newsk);
+@@ -850,7 +851,6 @@ static struct sock *pep_sock_accept(stru
+ newsk->sk_destruct = pipe_destruct;
+
+ newpn = pep_sk(newsk);
+- pn_skb_get_dst_sockaddr(skb, &dst);
+ pn_skb_get_src_sockaddr(skb, &src);
+ newpn->pn_sk.sobject = pn_sockaddr_get_object(&dst);
+ newpn->pn_sk.dobject = pn_sockaddr_get_object(&src);
tracing-probes-avoid-using-params-uninitialized-in-parse_btf_arg.patch
tracing-add-down_write-trace_event_sem-when-adding-trace-event.patch
tracing-osnoise-fix-crash-in-timerlat_dump_stack.patch
+drm-amdgpu-gfx8-reset-compute-ring-wptr-on-the-gpu-on-resume.patch
+alsa-hda-realtek-add-quirk-for-asus-rog-strix-g712lws.patch
+io_uring-poll-fix-pollerr-handling.patch
+mptcp-reset-fallback-status-gracefully-at-disconnect-time.patch
+phonet-pep-move-call-to-pn_skb_get_dst_sockaddr-earlier-in-pep_sock_accept.patch
+net-mlx5-update-the-list-of-the-pci-supported-devices.patch
+arm64-dts-imx8mp-venice-gw74xx-fix-tpm-spi-frequency.patch
+arm64-dts-freescale-imx8mm-verdin-keep-ldo5-always-on.patch
+arm64-dts-rockchip-use-cs-gpios-for-spi1-on-ringneck.patch
+af_packet-fix-the-so_sndtimeo-constraint-not-effective-on-tpacked_snd.patch
+af_packet-fix-soft-lockup-issue-caused-by-tpacket_snd.patch
+dmaengine-nbpfaxi-fix-memory-corruption-in-probe.patch
+isofs-verify-inode-mode-when-loading-from-disk.patch
+memstick-core-zero-initialize-id_reg-in-h_memstick_read_dev_id.patch
+mmc-bcm2835-fix-dma_unmap_sg-nents-value.patch
+mmc-sdhci-pci-quirk-for-broken-command-queuing-on-intel-glk-based-positivo-models.patch
+mmc-sdhci_am654-workaround-for-errata-i2312.patch
+net-libwx-remove-duplicate-page_pool_put_full_page.patch
+net-libwx-fix-the-using-of-rx-buffer-dma.patch
+net-libwx-properly-reset-rx-ring-descriptor.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
