--- /dev/null
+From 309e14949743614c9e0cf3b43b18869618e1bc17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 09:00:18 +0300
+Subject: ALSA: firewire-lib: Avoid division by zero in
+ apply_constraint_to_size()
+
+From: Andrey Shumilin <shum.sdl@nppct.ru>
+
+[ Upstream commit 72cafe63b35d06b5cfbaf807e90ae657907858da ]
+
+The step variable is initialized to zero. It is changed in the loop,
+but if it's not changed it will remain zero. Add a variable check
+before the division.
+
+The observed behavior was introduced by commit 826b5de90c0b
+("ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size"),
+and it is difficult to show that any of the interval parameters will
+satisfy the snd_interval_test() condition with data from the
+amdtp_rate_table[] table.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 826b5de90c0b ("ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size")
+Signed-off-by: Andrey Shumilin <shum.sdl@nppct.ru>
+Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://patch.msgid.link/20241018060018.1189537-1-shum.sdl@nppct.ru
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/amdtp-stream.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c
+index c827d7d8d8003..ea3a7d69f1c46 100644
+--- a/sound/firewire/amdtp-stream.c
++++ b/sound/firewire/amdtp-stream.c
+@@ -172,6 +172,9 @@ static int apply_constraint_to_size(struct snd_pcm_hw_params *params,
+ step = max(step, amdtp_syt_intervals[i]);
+ }
+
++ if (step == 0)
++ return -EINVAL;
++
+ t.min = roundup(s->min, step);
+ t.max = rounddown(s->max, step);
+ t.integer = 1;
+--
+2.43.0
+
--- /dev/null
+From 8564ef1eb6e241437963cee0017dd000d6fa8e36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2024 16:13:10 +0800
+Subject: ALSA: hda/realtek: Update default depop procedure
+
+From: Kailang Yang <kailang@realtek.com>
+
+[ Upstream commit e3ea2757c312e51bbf62ebc434a6f7df1e3a201f ]
+
+Old procedure has a chance to meet Headphone no output.
+
+Fixes: c2d6af53a43f ("ALSA: hda/realtek - Add default procedure for suspend and resume state")
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Link: https://lore.kernel.org/17b717a0a0b04a77aea4a8ec820cba13@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 38 ++++++++++++++++-------------------
+ 1 file changed, 17 insertions(+), 21 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index a2737c1ff9204..60929ea679f3d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3857,20 +3857,18 @@ static void alc_default_init(struct hda_codec *codec)
+
+ hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
+
+- if (hp_pin_sense)
++ if (hp_pin_sense) {
+ msleep(2);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+-
+- if (hp_pin_sense)
+- msleep(85);
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
++ msleep(75);
+
+- if (hp_pin_sense)
+- msleep(100);
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE);
++ msleep(75);
++ }
+ }
+
+ static void alc_default_shutup(struct hda_codec *codec)
+@@ -3886,22 +3884,20 @@ static void alc_default_shutup(struct hda_codec *codec)
+
+ hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
+
+- if (hp_pin_sense)
++ if (hp_pin_sense) {
+ msleep(2);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+-
+- if (hp_pin_sense)
+- msleep(85);
+-
+- if (!spec->no_shutup_pins)
+ snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+
+- if (hp_pin_sense)
+- msleep(100);
++ msleep(75);
+
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++
++ msleep(75);
++ }
+ alc_auto_setup_eapd(codec, false);
+ alc_shutup_pins(codec);
+ }
+--
+2.43.0
+
--- /dev/null
+From 260027f3408f7ce1202f529830bafe86238692cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2024 10:36:11 +0200
+Subject: ASoC: dt-bindings: davinci-mcasp: Fix interrupt properties
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 8380dbf1b9ef66e3ce6c1d660fd7259637c2a929 ]
+
+Combinations of "tx" alone, "rx" alone and "tx", "rx" together are
+supposedly valid (see link below), which is not the case today as "rx"
+alone is not accepted by the current binding.
+
+Let's rework the two interrupt properties to expose all correct
+possibilities.
+
+Cc: Péter Ujfalusi <peter.ujfalusi@gmail.com>
+Link: https://lore.kernel.org/linux-sound/20241003102552.2c11840e@xps-13/T/#m277fce1d49c50d94e071f7890aed472fa2c64052
+Fixes: 8be90641a0bb ("ASoC: dt-bindings: davinci-mcasp: convert McASP bindings to yaml schema")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://patch.msgid.link/20241003083611.461894-1-miquel.raynal@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bindings/sound/davinci-mcasp-audio.yaml | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml b/Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml
+index ab3206ffa4af8..beef193aaaeba 100644
+--- a/Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml
++++ b/Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml
+@@ -102,21 +102,21 @@ properties:
+ default: 2
+
+ interrupts:
+- oneOf:
+- - minItems: 1
+- items:
+- - description: TX interrupt
+- - description: RX interrupt
+- - items:
+- - description: common/combined interrupt
++ minItems: 1
++ maxItems: 2
+
+ interrupt-names:
+ oneOf:
+- - minItems: 1
++ - description: TX interrupt
++ const: tx
++ - description: RX interrupt
++ const: rx
++ - description: TX and RX interrupts
+ items:
+ - const: tx
+ - const: rx
+- - const: common
++ - description: Common/combined interrupt
++ const: common
+
+ fck_parent:
+ $ref: /schemas/types.yaml#/definitions/string
+--
+2.43.0
+
--- /dev/null
+From eacf1bfe353e8828aa7f18706b6c83bb53eaecbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 22:47:49 +0200
+Subject: ASoC: dt-bindings: davinci-mcasp: Fix interrupts property
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 17d8adc4cd5181c13c1041b197b76efc09eaf8a8 ]
+
+My understanding of the interrupts property is that it can either be:
+1/ - TX
+2/ - TX
+ - RX
+3/ - Common/combined.
+
+There are very little chances that either:
+ - TX
+ - Common/combined
+or even
+ - TX
+ - RX
+ - Common/combined
+could be a thing.
+
+Looking at the interrupt-names definition (which uses oneOf instead of
+anyOf), it makes indeed little sense to use anyOf in the interrupts
+definition. I believe this is just a mistake, hence let's fix it.
+
+Fixes: 8be90641a0bb ("ASoC: dt-bindings: davinci-mcasp: convert McASP bindings to yaml schema")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://patch.msgid.link/20241001204749.390054-1-miquel.raynal@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 8380dbf1b9ef ("ASoC: dt-bindings: davinci-mcasp: Fix interrupt properties")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/sound/davinci-mcasp-audio.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml b/Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml
+index 7735e08d35ba1..ab3206ffa4af8 100644
+--- a/Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml
++++ b/Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml
+@@ -102,7 +102,7 @@ properties:
+ default: 2
+
+ interrupts:
+- anyOf:
++ oneOf:
+ - minItems: 1
+ items:
+ - description: TX interrupt
+--
+2.43.0
+
--- /dev/null
+From 536042ac26f4ab155b306e25e5520b1bb11feddc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 16:15:07 +0900
+Subject: ASoC: fsl_micfil: Add a flag to distinguish with different volume
+ control types
+
+From: Chancel Liu <chancel.liu@nxp.com>
+
+[ Upstream commit da95e891dd5d5de6c5ebc010bd028a2e028de093 ]
+
+On i.MX8MM the register of volume control has positive and negative
+values. It is different from other platforms like i.MX8MP and i.MX93
+which only have positive values. Add a volume_sx flag to use SX_TLV
+volume control for this kind of platform. Use common TLV volume control
+for other platforms.
+
+Fixes: cdfa92eb90f5 ("ASoC: fsl_micfil: Correct the number of steps on SX controls")
+Signed-off-by: Chancel Liu <chancel.liu@nxp.com>
+Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
+Link: https://patch.msgid.link/20241017071507.2577786-1-chancel.liu@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_micfil.c | 43 +++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 42 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/fsl/fsl_micfil.c b/sound/soc/fsl/fsl_micfil.c
+index 22b240a70ad48..a3d580b2bbf46 100644
+--- a/sound/soc/fsl/fsl_micfil.c
++++ b/sound/soc/fsl/fsl_micfil.c
+@@ -67,6 +67,7 @@ struct fsl_micfil_soc_data {
+ bool imx;
+ bool use_edma;
+ bool use_verid;
++ bool volume_sx;
+ u64 formats;
+ };
+
+@@ -76,6 +77,7 @@ static struct fsl_micfil_soc_data fsl_micfil_imx8mm = {
+ .fifo_depth = 8,
+ .dataline = 0xf,
+ .formats = SNDRV_PCM_FMTBIT_S16_LE,
++ .volume_sx = true,
+ };
+
+ static struct fsl_micfil_soc_data fsl_micfil_imx8mp = {
+@@ -84,6 +86,7 @@ static struct fsl_micfil_soc_data fsl_micfil_imx8mp = {
+ .fifo_depth = 32,
+ .dataline = 0xf,
+ .formats = SNDRV_PCM_FMTBIT_S32_LE,
++ .volume_sx = false,
+ };
+
+ static struct fsl_micfil_soc_data fsl_micfil_imx93 = {
+@@ -94,6 +97,7 @@ static struct fsl_micfil_soc_data fsl_micfil_imx93 = {
+ .formats = SNDRV_PCM_FMTBIT_S32_LE,
+ .use_edma = true,
+ .use_verid = true,
++ .volume_sx = false,
+ };
+
+ static const struct of_device_id fsl_micfil_dt_ids[] = {
+@@ -317,7 +321,26 @@ static int hwvad_detected(struct snd_kcontrol *kcontrol,
+ return 0;
+ }
+
+-static const struct snd_kcontrol_new fsl_micfil_snd_controls[] = {
++static const struct snd_kcontrol_new fsl_micfil_volume_controls[] = {
++ SOC_SINGLE_TLV("CH0 Volume", REG_MICFIL_OUT_CTRL,
++ MICFIL_OUTGAIN_CHX_SHIFT(0), 0xF, 0, gain_tlv),
++ SOC_SINGLE_TLV("CH1 Volume", REG_MICFIL_OUT_CTRL,
++ MICFIL_OUTGAIN_CHX_SHIFT(1), 0xF, 0, gain_tlv),
++ SOC_SINGLE_TLV("CH2 Volume", REG_MICFIL_OUT_CTRL,
++ MICFIL_OUTGAIN_CHX_SHIFT(2), 0xF, 0, gain_tlv),
++ SOC_SINGLE_TLV("CH3 Volume", REG_MICFIL_OUT_CTRL,
++ MICFIL_OUTGAIN_CHX_SHIFT(3), 0xF, 0, gain_tlv),
++ SOC_SINGLE_TLV("CH4 Volume", REG_MICFIL_OUT_CTRL,
++ MICFIL_OUTGAIN_CHX_SHIFT(4), 0xF, 0, gain_tlv),
++ SOC_SINGLE_TLV("CH5 Volume", REG_MICFIL_OUT_CTRL,
++ MICFIL_OUTGAIN_CHX_SHIFT(5), 0xF, 0, gain_tlv),
++ SOC_SINGLE_TLV("CH6 Volume", REG_MICFIL_OUT_CTRL,
++ MICFIL_OUTGAIN_CHX_SHIFT(6), 0xF, 0, gain_tlv),
++ SOC_SINGLE_TLV("CH7 Volume", REG_MICFIL_OUT_CTRL,
++ MICFIL_OUTGAIN_CHX_SHIFT(7), 0xF, 0, gain_tlv),
++};
++
++static const struct snd_kcontrol_new fsl_micfil_volume_sx_controls[] = {
+ SOC_SINGLE_SX_TLV("CH0 Volume", REG_MICFIL_OUT_CTRL,
+ MICFIL_OUTGAIN_CHX_SHIFT(0), 0x8, 0xF, gain_tlv),
+ SOC_SINGLE_SX_TLV("CH1 Volume", REG_MICFIL_OUT_CTRL,
+@@ -334,6 +357,9 @@ static const struct snd_kcontrol_new fsl_micfil_snd_controls[] = {
+ MICFIL_OUTGAIN_CHX_SHIFT(6), 0x8, 0xF, gain_tlv),
+ SOC_SINGLE_SX_TLV("CH7 Volume", REG_MICFIL_OUT_CTRL,
+ MICFIL_OUTGAIN_CHX_SHIFT(7), 0x8, 0xF, gain_tlv),
++};
++
++static const struct snd_kcontrol_new fsl_micfil_snd_controls[] = {
+ SOC_ENUM_EXT("MICFIL Quality Select",
+ fsl_micfil_quality_enum,
+ micfil_quality_get, micfil_quality_set),
+@@ -801,6 +827,20 @@ static int fsl_micfil_dai_probe(struct snd_soc_dai *cpu_dai)
+ return 0;
+ }
+
++static int fsl_micfil_component_probe(struct snd_soc_component *component)
++{
++ struct fsl_micfil *micfil = snd_soc_component_get_drvdata(component);
++
++ if (micfil->soc->volume_sx)
++ snd_soc_add_component_controls(component, fsl_micfil_volume_sx_controls,
++ ARRAY_SIZE(fsl_micfil_volume_sx_controls));
++ else
++ snd_soc_add_component_controls(component, fsl_micfil_volume_controls,
++ ARRAY_SIZE(fsl_micfil_volume_controls));
++
++ return 0;
++}
++
+ static const struct snd_soc_dai_ops fsl_micfil_dai_ops = {
+ .probe = fsl_micfil_dai_probe,
+ .startup = fsl_micfil_startup,
+@@ -821,6 +861,7 @@ static struct snd_soc_dai_driver fsl_micfil_dai = {
+
+ static const struct snd_soc_component_driver fsl_micfil_component = {
+ .name = "fsl-micfil-dai",
++ .probe = fsl_micfil_component_probe,
+ .controls = fsl_micfil_snd_controls,
+ .num_controls = ARRAY_SIZE(fsl_micfil_snd_controls),
+ .legacy_dai_naming = 1,
+--
+2.43.0
+
--- /dev/null
+From acc6b63c3c8e960d4e054fd5907fd3af233cc6ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2024 15:52:27 +0800
+Subject: ASoC: loongson: Fix component check failed on FDT systems
+
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+
+[ Upstream commit a6134e7b4d4a14e0942f113a6df1d518baa2a0a4 ]
+
+Add missing snd_soc_dai_link.platforms assignment to avoid
+soc_dai_link_sanity_check() failure.
+
+Fixes: d24028606e76 ("ASoC: loongson: Add Loongson ASoC Sound Card Support")
+Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
+Link: https://patch.msgid.link/6645888f2f9e8a1d8d799109f867d0f97fd78c58.1728459624.git.zhoubinbin@loongson.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/loongson/loongson_card.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/loongson/loongson_card.c b/sound/soc/loongson/loongson_card.c
+index 2c8dbdba27c5f..cc0bb6f9772e1 100644
+--- a/sound/soc/loongson/loongson_card.c
++++ b/sound/soc/loongson/loongson_card.c
+@@ -137,6 +137,7 @@ static int loongson_card_parse_of(struct loongson_card_data *data)
+ dev_err(dev, "getting cpu dlc error (%d)\n", ret);
+ goto err;
+ }
++ loongson_dai_links[i].platforms->of_node = loongson_dai_links[i].cpus->of_node;
+
+ ret = snd_soc_of_get_dlc(codec, NULL, loongson_dai_links[i].codecs, 0);
+ if (ret < 0) {
+--
+2.43.0
+
--- /dev/null
+From 8d083511d3d04ab42e9bc8a74721933c7f46eb52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2024 19:20:32 +0100
+Subject: ASoC: max98388: Fix missing increment of variable slot_found
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit ca2803fadfd239abf155ef4a563b22a9507ee4b2 ]
+
+The variable slot_found is being initialized to zero and inside
+a for-loop is being checked if it's reached MAX_NUM_CH, however,
+this is currently impossible since slot_found is never changed.
+In a previous loop a similar coding pattern is used and slot_found
+is being incremented. It appears the increment of slot_found is
+missing from the loop, so fix the code by adding in the increment.
+
+Fixes: 6a8e1d46f062 ("ASoC: max98388: add amplifier driver")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Link: https://patch.msgid.link/20241010182032.776280-1-colin.i.king@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98388.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/max98388.c b/sound/soc/codecs/max98388.c
+index b847d7c59ec01..99986090b4a63 100644
+--- a/sound/soc/codecs/max98388.c
++++ b/sound/soc/codecs/max98388.c
+@@ -763,6 +763,7 @@ static int max98388_dai_tdm_slot(struct snd_soc_dai *dai,
+ addr = MAX98388_R2044_PCM_TX_CTRL1 + (cnt / 8);
+ bits = cnt % 8;
+ regmap_update_bits(max98388->regmap, addr, bits, bits);
++ slot_found++;
+ if (slot_found >= MAX_NUM_CH)
+ break;
+ }
+--
+2.43.0
+
--- /dev/null
+From 0479c879de7b75053f5d412845b7673f6419d120 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2024 15:14:32 +0100
+Subject: ASoC: rsnd: Fix probe failure on HiHope boards due to endpoint
+ parsing
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 9b064d200aa8fee9d1d7ced05d8a617e45966715 ]
+
+On the HiHope boards, we have a single port with a single endpoint defined
+as below:
+....
+ rsnd_port: port {
+ rsnd_endpoint: endpoint {
+ remote-endpoint = <&dw_hdmi0_snd_in>;
+
+ dai-format = "i2s";
+ bitclock-master = <&rsnd_endpoint>;
+ frame-master = <&rsnd_endpoint>;
+
+ playback = <&ssi2>;
+ };
+ };
+....
+
+With commit 547b02f74e4a ("ASoC: rsnd: enable multi Component support for
+Audio Graph Card/Card2"), support for multiple ports was added. This caused
+probe failures on HiHope boards, as the endpoint could not be retrieved due
+to incorrect device node pointers being used.
+
+This patch fixes the issue by updating the `rsnd_dai_of_node()` and
+`rsnd_dai_probe()` functions to use the correct device node pointers based
+on the port names ('port' or 'ports'). It ensures that the endpoint is
+properly parsed for both single and multi-port configurations, restoring
+compatibility with HiHope boards.
+
+Fixes: 547b02f74e4a ("ASoC: rsnd: enable multi Component support for Audio Graph Card/Card2")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://patch.msgid.link/20241010141432.716868-1-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/core.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
+index 63b3c8bf0fdef..eda8de2264395 100644
+--- a/sound/soc/sh/rcar/core.c
++++ b/sound/soc/sh/rcar/core.c
+@@ -1298,7 +1298,9 @@ static int rsnd_dai_of_node(struct rsnd_priv *priv, int *is_graph)
+ if (!of_node_name_eq(ports, "ports") &&
+ !of_node_name_eq(ports, "port"))
+ continue;
+- priv->component_dais[i] = of_graph_get_endpoint_count(ports);
++ priv->component_dais[i] =
++ of_graph_get_endpoint_count(of_node_name_eq(ports, "ports") ?
++ ports : np);
+ nr += priv->component_dais[i];
+ i++;
+ if (i >= RSND_MAX_COMPONENT) {
+@@ -1510,7 +1512,8 @@ static int rsnd_dai_probe(struct rsnd_priv *priv)
+ if (!of_node_name_eq(ports, "ports") &&
+ !of_node_name_eq(ports, "port"))
+ continue;
+- for_each_endpoint_of_node(ports, dai_np) {
++ for_each_endpoint_of_node(of_node_name_eq(ports, "ports") ?
++ ports : np, dai_np) {
+ __rsnd_dai_probe(priv, dai_np, dai_np, 0, dai_i);
+ if (!rsnd_is_gen1(priv) && !rsnd_is_gen2(priv)) {
+ rdai = rsnd_rdai_get(priv, dai_i);
+--
+2.43.0
+
--- /dev/null
+From 0813c73cace581b4443ffab36a850803741766e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2024 10:12:30 +0200
+Subject: ASoC: topology: Bump minimal topology ABI version
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit 9eb2142a2ae8c8fdfce2aaa4c110f5a6f6b0b56e ]
+
+When v4 topology support was removed, minimal topology ABI version
+should have been bumped.
+
+Fixes: fe4a07454256 ("ASoC: Drop soc-topology ABI v4 support")
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Link: https://patch.msgid.link/20241009081230.304918-1-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/sound/asoc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/sound/asoc.h b/include/uapi/sound/asoc.h
+index 99333cbd3114e..c117672d44394 100644
+--- a/include/uapi/sound/asoc.h
++++ b/include/uapi/sound/asoc.h
+@@ -88,7 +88,7 @@
+
+ /* ABI version */
+ #define SND_SOC_TPLG_ABI_VERSION 0x5 /* current version */
+-#define SND_SOC_TPLG_ABI_VERSION_MIN 0x4 /* oldest version supported */
++#define SND_SOC_TPLG_ABI_VERSION_MIN 0x5 /* oldest version supported */
+
+ /* Max size of TLV data */
+ #define SND_SOC_TPLG_TLV_SIZE 32
+--
+2.43.0
+
--- /dev/null
+From 5d8d185f65e775da95cac733c8db42adf8441d09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2024 09:24:30 +0800
+Subject: cifs: fix warning when destroy 'cifs_io_request_pool'
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit 2ce1007f42b8a6a0814386cb056feb28dc6d6091 ]
+
+There's a issue as follows:
+WARNING: CPU: 1 PID: 27826 at mm/slub.c:4698 free_large_kmalloc+0xac/0xe0
+RIP: 0010:free_large_kmalloc+0xac/0xe0
+Call Trace:
+ <TASK>
+ ? __warn+0xea/0x330
+ mempool_destroy+0x13f/0x1d0
+ init_cifs+0xa50/0xff0 [cifs]
+ do_one_initcall+0xdc/0x550
+ do_init_module+0x22d/0x6b0
+ load_module+0x4e96/0x5ff0
+ init_module_from_file+0xcd/0x130
+ idempotent_init_module+0x330/0x620
+ __x64_sys_finit_module+0xb3/0x110
+ do_syscall_64+0xc1/0x1d0
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Obviously, 'cifs_io_request_pool' is not created by mempool_create().
+So just use mempool_exit() to revert 'cifs_io_request_pool'.
+
+Fixes: edea94a69730 ("cifs: Add mempools for cifs_io_request and cifs_io_subrequest structs")
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Acked-by: David Howells <dhowells@redhat.com
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/cifsfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c
+index 33e2860010158..9bdb6e7f1dc3a 100644
+--- a/fs/smb/client/cifsfs.c
++++ b/fs/smb/client/cifsfs.c
+@@ -1780,7 +1780,7 @@ static int cifs_init_netfs(void)
+ nomem_subreqpool:
+ kmem_cache_destroy(cifs_io_subrequest_cachep);
+ nomem_subreq:
+- mempool_destroy(&cifs_io_request_pool);
++ mempool_exit(&cifs_io_request_pool);
+ nomem_reqpool:
+ kmem_cache_destroy(cifs_io_request_cachep);
+ nomem_req:
+--
+2.43.0
+
--- /dev/null
+From d58a10f7a246985e25c392c71b4290b69571584a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 10:29:52 +0800
+Subject: cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception
+
+From: liwei <liwei728@huawei.com>
+
+[ Upstream commit d93df29bdab133b85e94b3c328e7fe26a0ebd56c ]
+
+When the nominal_freq recorded by the kernel is equal to the lowest_freq,
+and the frequency adjustment operation is triggered externally, there is
+a logic error in cppc_perf_to_khz()/cppc_khz_to_perf(), resulting in perf
+and khz conversion errors.
+
+Fix this by adding a branch processing logic when nominal_freq is equal
+to lowest_freq.
+
+Fixes: ec1c7ad47664 ("cpufreq: CPPC: Fix performance/frequency conversion")
+Signed-off-by: liwei <liwei728@huawei.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Link: https://patch.msgid.link/20241024022952.2627694-1-liwei728@huawei.com
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/cppc_acpi.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
+index 5b06e236aabef..ed91dfd4fdca7 100644
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -1916,9 +1916,15 @@ unsigned int cppc_perf_to_khz(struct cppc_perf_caps *caps, unsigned int perf)
+ u64 mul, div;
+
+ if (caps->lowest_freq && caps->nominal_freq) {
+- mul = caps->nominal_freq - caps->lowest_freq;
++ /* Avoid special case when nominal_freq is equal to lowest_freq */
++ if (caps->lowest_freq == caps->nominal_freq) {
++ mul = caps->nominal_freq;
++ div = caps->nominal_perf;
++ } else {
++ mul = caps->nominal_freq - caps->lowest_freq;
++ div = caps->nominal_perf - caps->lowest_perf;
++ }
+ mul *= KHZ_PER_MHZ;
+- div = caps->nominal_perf - caps->lowest_perf;
+ offset = caps->nominal_freq * KHZ_PER_MHZ -
+ div64_u64(caps->nominal_perf * mul, div);
+ } else {
+@@ -1939,11 +1945,17 @@ unsigned int cppc_khz_to_perf(struct cppc_perf_caps *caps, unsigned int freq)
+ {
+ s64 retval, offset = 0;
+ static u64 max_khz;
+- u64 mul, div;
++ u64 mul, div;
+
+ if (caps->lowest_freq && caps->nominal_freq) {
+- mul = caps->nominal_perf - caps->lowest_perf;
+- div = caps->nominal_freq - caps->lowest_freq;
++ /* Avoid special case when nominal_freq is equal to lowest_freq */
++ if (caps->lowest_freq == caps->nominal_freq) {
++ mul = caps->nominal_perf;
++ div = caps->nominal_freq;
++ } else {
++ mul = caps->nominal_perf - caps->lowest_perf;
++ div = caps->nominal_freq - caps->lowest_freq;
++ }
+ /*
+ * We don't need to convert to kHz for computing offset and can
+ * directly use nominal_freq and lowest_freq as the div64_u64
+--
+2.43.0
+
--- /dev/null
+From 96f1d50b7699d03e5e5cc356d0b171ebd9fee6cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 15:12:49 +0000
+Subject: fbdev: wm8505fb: select CONFIG_FB_IOMEM_FOPS
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 51521d2e2c35959cc70a62ccddf694965e29c950 ]
+
+The fb_io_mmap() function is used in the file operations but
+not enabled in all configurations unless FB_IOMEM_FOPS gets
+selected:
+
+ld.lld-20: error: undefined symbol: fb_io_mmap
+ referenced by wm8505fb.c
+ drivers/video/fbdev/wm8505fb.o:(wm8505fb_ops) in archive vmlinux.a
+
+Fixes: 11754a504608 ("fbdev/wm8505fb: Initialize fb_ops to fbdev I/O-memory helpers")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
+index ea36c6956bf36..1af0ccf7967ab 100644
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -1374,6 +1374,7 @@ config FB_VT8500
+ config FB_WM8505
+ bool "Wondermedia WM8xxx-series frame buffer support"
+ depends on (FB = y) && HAS_IOMEM && (ARCH_VT8500 || COMPILE_TEST)
++ select FB_IOMEM_FOPS
+ select FB_SYS_FILLRECT if (!FB_WMT_GE_ROPS)
+ select FB_SYS_COPYAREA if (!FB_WMT_GE_ROPS)
+ select FB_SYS_IMAGEBLIT
+--
+2.43.0
+
--- /dev/null
+From baaf3cb43b0b48db630815a617935817356bcc52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 21:27:58 +0200
+Subject: fs: pass offset and result to backing_file end_write() callback
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit f03b296e8b516dbd63f57fc9056c1b0da1b9a0ff ]
+
+This is needed for extending fuse inode size after fuse passthrough write.
+
+Suggested-by: Miklos Szeredi <miklos@szeredi.hu>
+Link: https://lore.kernel.org/linux-fsdevel/CAJfpegs=cvZ_NYy6Q_D42XhYS=Sjj5poM1b5TzXzOVvX=R36aA@mail.gmail.com/
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Stable-dep-of: 20121d3f58f0 ("fuse: update inode size after extending passthrough write")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/backing-file.c | 8 ++++----
+ fs/fuse/passthrough.c | 6 +++---
+ fs/overlayfs/file.c | 9 +++++++--
+ include/linux/backing-file.h | 2 +-
+ 4 files changed, 15 insertions(+), 10 deletions(-)
+
+diff --git a/fs/backing-file.c b/fs/backing-file.c
+index 8860dac58c37e..09a9be945d45e 100644
+--- a/fs/backing-file.c
++++ b/fs/backing-file.c
+@@ -80,7 +80,7 @@ struct backing_aio {
+ refcount_t ref;
+ struct kiocb *orig_iocb;
+ /* used for aio completion */
+- void (*end_write)(struct file *);
++ void (*end_write)(struct file *, loff_t, ssize_t);
+ struct work_struct work;
+ long res;
+ };
+@@ -109,7 +109,7 @@ static void backing_aio_cleanup(struct backing_aio *aio, long res)
+ struct kiocb *orig_iocb = aio->orig_iocb;
+
+ if (aio->end_write)
+- aio->end_write(orig_iocb->ki_filp);
++ aio->end_write(orig_iocb->ki_filp, iocb->ki_pos, res);
+
+ orig_iocb->ki_pos = iocb->ki_pos;
+ backing_aio_put(aio);
+@@ -239,7 +239,7 @@ ssize_t backing_file_write_iter(struct file *file, struct iov_iter *iter,
+
+ ret = vfs_iter_write(file, iter, &iocb->ki_pos, rwf);
+ if (ctx->end_write)
+- ctx->end_write(ctx->user_file);
++ ctx->end_write(ctx->user_file, iocb->ki_pos, ret);
+ } else {
+ struct backing_aio *aio;
+
+@@ -317,7 +317,7 @@ ssize_t backing_file_splice_write(struct pipe_inode_info *pipe,
+ revert_creds(old_cred);
+
+ if (ctx->end_write)
+- ctx->end_write(ctx->user_file);
++ ctx->end_write(ctx->user_file, ppos ? *ppos : 0, ret);
+
+ return ret;
+ }
+diff --git a/fs/fuse/passthrough.c b/fs/fuse/passthrough.c
+index 9666d13884ce5..f0f87d1c9a945 100644
+--- a/fs/fuse/passthrough.c
++++ b/fs/fuse/passthrough.c
+@@ -18,7 +18,7 @@ static void fuse_file_accessed(struct file *file)
+ fuse_invalidate_atime(inode);
+ }
+
+-static void fuse_file_modified(struct file *file)
++static void fuse_passthrough_end_write(struct file *file, loff_t pos, ssize_t ret)
+ {
+ struct inode *inode = file_inode(file);
+
+@@ -63,7 +63,7 @@ ssize_t fuse_passthrough_write_iter(struct kiocb *iocb,
+ struct backing_file_ctx ctx = {
+ .cred = ff->cred,
+ .user_file = file,
+- .end_write = fuse_file_modified,
++ .end_write = fuse_passthrough_end_write,
+ };
+
+ pr_debug("%s: backing_file=0x%p, pos=%lld, len=%zu\n", __func__,
+@@ -110,7 +110,7 @@ ssize_t fuse_passthrough_splice_write(struct pipe_inode_info *pipe,
+ struct backing_file_ctx ctx = {
+ .cred = ff->cred,
+ .user_file = out,
+- .end_write = fuse_file_modified,
++ .end_write = fuse_passthrough_end_write,
+ };
+
+ pr_debug("%s: backing_file=0x%p, pos=%lld, len=%zu, flags=0x%x\n", __func__,
+diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
+index 1a411cae57ed9..7b085f89e5a15 100644
+--- a/fs/overlayfs/file.c
++++ b/fs/overlayfs/file.c
+@@ -229,6 +229,11 @@ static void ovl_file_modified(struct file *file)
+ ovl_copyattr(file_inode(file));
+ }
+
++static void ovl_file_end_write(struct file *file, loff_t pos, ssize_t ret)
++{
++ ovl_file_modified(file);
++}
++
+ static void ovl_file_accessed(struct file *file)
+ {
+ struct inode *inode, *upperinode;
+@@ -292,7 +297,7 @@ static ssize_t ovl_write_iter(struct kiocb *iocb, struct iov_iter *iter)
+ struct backing_file_ctx ctx = {
+ .cred = ovl_creds(inode->i_sb),
+ .user_file = file,
+- .end_write = ovl_file_modified,
++ .end_write = ovl_file_end_write,
+ };
+
+ if (!iov_iter_count(iter))
+@@ -362,7 +367,7 @@ static ssize_t ovl_splice_write(struct pipe_inode_info *pipe, struct file *out,
+ struct backing_file_ctx ctx = {
+ .cred = ovl_creds(inode->i_sb),
+ .user_file = out,
+- .end_write = ovl_file_modified,
++ .end_write = ovl_file_end_write,
+ };
+
+ inode_lock(inode);
+diff --git a/include/linux/backing-file.h b/include/linux/backing-file.h
+index 4b61b0e577209..2eed0ffb5e8f8 100644
+--- a/include/linux/backing-file.h
++++ b/include/linux/backing-file.h
+@@ -16,7 +16,7 @@ struct backing_file_ctx {
+ const struct cred *cred;
+ struct file *user_file;
+ void (*accessed)(struct file *);
+- void (*end_write)(struct file *);
++ void (*end_write)(struct file *, loff_t, ssize_t);
+ };
+
+ struct file *backing_file_open(const struct path *user_path, int flags,
+--
+2.43.0
+
--- /dev/null
+From 4634ed8d06715ad0db5ef2989fb09511d5fa93ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 21:27:59 +0200
+Subject: fuse: update inode size after extending passthrough write
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit 20121d3f58f06e977ca43eb6efe1fb23b1d2f6d9 ]
+
+yangyun reported that libfuse test test_copy_file_range() copies zero
+bytes from a newly written file when fuse passthrough is enabled.
+
+The reason is that extending passthrough write is not updating the fuse
+inode size and when vfs_copy_file_range() observes a zero size inode,
+it returns without calling the filesystem copy_file_range() method.
+
+Fix this by adjusting the fuse inode size after an extending passthrough
+write.
+
+This does not provide cache coherency of fuse inode attributes and
+backing inode attributes, but it should prevent situations where fuse
+inode size is too small, causing read/copy to be wrongly shortened.
+
+Reported-by: yangyun <yangyun50@huawei.com>
+Closes: https://github.com/libfuse/libfuse/issues/1048
+Fixes: 57e1176e6086 ("fuse: implement read/write passthrough")
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/passthrough.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/fuse/passthrough.c b/fs/fuse/passthrough.c
+index f0f87d1c9a945..d1b570d39501c 100644
+--- a/fs/fuse/passthrough.c
++++ b/fs/fuse/passthrough.c
+@@ -22,7 +22,7 @@ static void fuse_passthrough_end_write(struct file *file, loff_t pos, ssize_t re
+ {
+ struct inode *inode = file_inode(file);
+
+- fuse_invalidate_attr_mask(inode, FUSE_STATX_MODSIZE);
++ fuse_write_update_attr(inode, pos, ret);
+ }
+
+ ssize_t fuse_passthrough_read_iter(struct kiocb *iocb, struct iov_iter *iter)
+--
+2.43.0
+
--- /dev/null
+From 1936dc0e923f5536b0ab44ef175dcf18760f7e86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 16:25:40 +0800
+Subject: nfsd: cancel nfsd_shrinker_work using sync mode in
+ nfs4_state_shutdown_net
+
+From: Yang Erkun <yangerkun@huaweicloud.com>
+
+[ Upstream commit d5ff2fb2e7167e9483846e34148e60c0c016a1f6 ]
+
+In the normal case, when we excute `echo 0 > /proc/fs/nfsd/threads`, the
+function `nfs4_state_destroy_net` in `nfs4_state_shutdown_net` will
+release all resources related to the hashed `nfs4_client`. If the
+`nfsd_client_shrinker` is running concurrently, the `expire_client`
+function will first unhash this client and then destroy it. This can
+lead to the following warning. Additionally, numerous use-after-free
+errors may occur as well.
+
+nfsd_client_shrinker echo 0 > /proc/fs/nfsd/threads
+
+expire_client nfsd_shutdown_net
+ unhash_client ...
+ nfs4_state_shutdown_net
+ /* won't wait shrinker exit */
+ /* cancel_work(&nn->nfsd_shrinker_work)
+ * nfsd_file for this /* won't destroy unhashed client1 */
+ * client1 still alive nfs4_state_destroy_net
+ */
+
+ nfsd_file_cache_shutdown
+ /* trigger warning */
+ kmem_cache_destroy(nfsd_file_slab)
+ kmem_cache_destroy(nfsd_file_mark_slab)
+ /* release nfsd_file and mark */
+ __destroy_client
+
+====================================================================
+BUG nfsd_file (Not tainted): Objects remaining in nfsd_file on
+__kmem_cache_shutdown()
+--------------------------------------------------------------------
+CPU: 4 UID: 0 PID: 764 Comm: sh Not tainted 6.12.0-rc3+ #1
+
+ dump_stack_lvl+0x53/0x70
+ slab_err+0xb0/0xf0
+ __kmem_cache_shutdown+0x15c/0x310
+ kmem_cache_destroy+0x66/0x160
+ nfsd_file_cache_shutdown+0xac/0x210 [nfsd]
+ nfsd_destroy_serv+0x251/0x2a0 [nfsd]
+ nfsd_svc+0x125/0x1e0 [nfsd]
+ write_threads+0x16a/0x2a0 [nfsd]
+ nfsctl_transaction_write+0x74/0xa0 [nfsd]
+ vfs_write+0x1a5/0x6d0
+ ksys_write+0xc1/0x160
+ do_syscall_64+0x5f/0x170
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+====================================================================
+BUG nfsd_file_mark (Tainted: G B W ): Objects remaining
+nfsd_file_mark on __kmem_cache_shutdown()
+--------------------------------------------------------------------
+
+ dump_stack_lvl+0x53/0x70
+ slab_err+0xb0/0xf0
+ __kmem_cache_shutdown+0x15c/0x310
+ kmem_cache_destroy+0x66/0x160
+ nfsd_file_cache_shutdown+0xc8/0x210 [nfsd]
+ nfsd_destroy_serv+0x251/0x2a0 [nfsd]
+ nfsd_svc+0x125/0x1e0 [nfsd]
+ write_threads+0x16a/0x2a0 [nfsd]
+ nfsctl_transaction_write+0x74/0xa0 [nfsd]
+ vfs_write+0x1a5/0x6d0
+ ksys_write+0xc1/0x160
+ do_syscall_64+0x5f/0x170
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+To resolve this issue, cancel `nfsd_shrinker_work` using synchronous
+mode in nfs4_state_shutdown_net.
+
+Fixes: 7c24fa225081 ("NFSD: replace delayed_work with work_struct for nfsd_client_shrinker")
+Signed-off-by: Yang Erkun <yangerkun@huaweicloud.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 64cf5d7b7a4e2..150b637f03ee6 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -8687,7 +8687,7 @@ nfs4_state_shutdown_net(struct net *net)
+ struct nfsd_net *nn = net_generic(net, nfsd_net_id);
+
+ shrinker_free(nn->nfsd_client_shrinker);
+- cancel_work(&nn->nfsd_shrinker_work);
++ cancel_work_sync(&nn->nfsd_shrinker_work);
+ cancel_delayed_work_sync(&nn->laundromat_work);
+ locks_end_grace(&nn->nfsd4_manager);
+
+--
+2.43.0
+
--- /dev/null
+From 56e414e04e6ae2d05577c1490e062aa00726fe70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2024 10:43:41 +0200
+Subject: PCI: Hold rescan lock while adding devices during host probe
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit 1d59d474e1cb7d4fdf87dfaf96f44647f13ea590 ]
+
+Since adding the PCI power control code, we may end up with a race between
+the pwrctl platform device rescanning the bus and host controller probe
+functions. The latter need to take the rescan lock when adding devices or
+we may end up in an undefined state having two incompletely added devices
+and hit the following crash when trying to remove the device over sysfs:
+
+ Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+ Internal error: Oops: 0000000096000004 [#1] SMP
+ Call trace:
+ __pi_strlen+0x14/0x150
+ kernfs_find_ns+0x80/0x13c
+ kernfs_remove_by_name_ns+0x54/0xf0
+ sysfs_remove_bin_file+0x24/0x34
+ pci_remove_resource_files+0x3c/0x84
+ pci_remove_sysfs_dev_files+0x28/0x38
+ pci_stop_bus_device+0x8c/0xd8
+ pci_stop_bus_device+0x40/0xd8
+ pci_stop_and_remove_bus_device_locked+0x28/0x48
+ remove_store+0x70/0xb0
+ dev_attr_store+0x20/0x38
+ sysfs_kf_write+0x58/0x78
+ kernfs_fop_write_iter+0xe8/0x184
+ vfs_write+0x2dc/0x308
+ ksys_write+0x7c/0xec
+
+Fixes: 4565d2652a37 ("PCI/pwrctl: Add PCI power control core code")
+Link: https://lore.kernel.org/r/20241003084342.27501-1-brgl@bgdev.pl
+Reported-by: Konrad Dybcio <konradybcio@kernel.org>
+Tested-by: Konrad Dybcio <konradybcio@kernel.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/probe.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index e9e56bbb3b59d..d203e23b75620 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -3106,7 +3106,9 @@ int pci_host_probe(struct pci_host_bridge *bridge)
+ list_for_each_entry(child, &bus->children, node)
+ pcie_bus_configure_settings(child);
+
++ pci_lock_rescan_remove();
+ pci_bus_add_devices(bus);
++ pci_unlock_rescan_remove();
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(pci_host_probe);
+--
+2.43.0
+
--- /dev/null
+From 392c15dc52f8b34469d0ae8131f0fdce9c4235db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2024 11:24:46 +0200
+Subject: PCI/pwrctl: Abandon QCom WCN probe on pre-pwrseq device-trees
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit ad783b9f8e78572fff3b04b6caee7bea3821eea8 ]
+
+Old device trees for some platforms already define wifi nodes for the WCN
+family of chips since before power sequencing was added upstream.
+
+These nodes don't consume the regulator outputs from the PMU, and if we
+allow this driver to bind to one of such "incomplete" nodes, we'll see a
+kernel log error about the infinite probe deferral.
+
+Extend the driver by adding a platform data struct matched against the
+compatible. This struct contains the pwrseq target string as well as a
+validation function called right after entering probe().
+
+For Qualcomm WCN models, check the existence of the regulator supply
+property that indicates the DT is already using power sequencing and return
+-ENODEV if it's not there, indicating to the driver model that the device
+should not be bound to the pwrctl driver.
+
+Link: https://lore.kernel.org/r/20241007092447.18616-1-brgl@bgdev.pl
+Fixes: 6140d185a43d ("PCI/pwrctl: Add a PCI power control driver for power sequenced devices")
+Reported-by: Johan Hovold <johan@kernel.org>
+Closes: https://lore.kernel.org/all/Zv565olMDDGHyYVt@hovoldconsulting.com/
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pwrctl/pci-pwrctl-pwrseq.c | 55 +++++++++++++++++++++++---
+ 1 file changed, 50 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pci/pwrctl/pci-pwrctl-pwrseq.c b/drivers/pci/pwrctl/pci-pwrctl-pwrseq.c
+index a23a4312574b9..0e6bd47671c2e 100644
+--- a/drivers/pci/pwrctl/pci-pwrctl-pwrseq.c
++++ b/drivers/pci/pwrctl/pci-pwrctl-pwrseq.c
+@@ -6,9 +6,9 @@
+ #include <linux/device.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/module.h>
+-#include <linux/of.h>
+ #include <linux/pci-pwrctl.h>
+ #include <linux/platform_device.h>
++#include <linux/property.h>
+ #include <linux/pwrseq/consumer.h>
+ #include <linux/slab.h>
+ #include <linux/types.h>
+@@ -18,6 +18,40 @@ struct pci_pwrctl_pwrseq_data {
+ struct pwrseq_desc *pwrseq;
+ };
+
++struct pci_pwrctl_pwrseq_pdata {
++ const char *target;
++ /*
++ * Called before doing anything else to perform device-specific
++ * verification between requesting the power sequencing handle.
++ */
++ int (*validate_device)(struct device *dev);
++};
++
++static int pci_pwrctl_pwrseq_qcm_wcn_validate_device(struct device *dev)
++{
++ /*
++ * Old device trees for some platforms already define wifi nodes for
++ * the WCN family of chips since before power sequencing was added
++ * upstream.
++ *
++ * These nodes don't consume the regulator outputs from the PMU, and
++ * if we allow this driver to bind to one of such "incomplete" nodes,
++ * we'll see a kernel log error about the indefinite probe deferral.
++ *
++ * Check the existence of the regulator supply that exists on all
++ * WCN models before moving forward.
++ */
++ if (!device_property_present(dev, "vddaon-supply"))
++ return -ENODEV;
++
++ return 0;
++}
++
++static const struct pci_pwrctl_pwrseq_pdata pci_pwrctl_pwrseq_qcom_wcn_pdata = {
++ .target = "wlan",
++ .validate_device = pci_pwrctl_pwrseq_qcm_wcn_validate_device,
++};
++
+ static void devm_pci_pwrctl_pwrseq_power_off(void *data)
+ {
+ struct pwrseq_desc *pwrseq = data;
+@@ -27,15 +61,26 @@ static void devm_pci_pwrctl_pwrseq_power_off(void *data)
+
+ static int pci_pwrctl_pwrseq_probe(struct platform_device *pdev)
+ {
++ const struct pci_pwrctl_pwrseq_pdata *pdata;
+ struct pci_pwrctl_pwrseq_data *data;
+ struct device *dev = &pdev->dev;
+ int ret;
+
++ pdata = device_get_match_data(dev);
++ if (!pdata || !pdata->target)
++ return -EINVAL;
++
++ if (pdata->validate_device) {
++ ret = pdata->validate_device(dev);
++ if (ret)
++ return ret;
++ }
++
+ data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
+ if (!data)
+ return -ENOMEM;
+
+- data->pwrseq = devm_pwrseq_get(dev, of_device_get_match_data(dev));
++ data->pwrseq = devm_pwrseq_get(dev, pdata->target);
+ if (IS_ERR(data->pwrseq))
+ return dev_err_probe(dev, PTR_ERR(data->pwrseq),
+ "Failed to get the power sequencer\n");
+@@ -64,17 +109,17 @@ static const struct of_device_id pci_pwrctl_pwrseq_of_match[] = {
+ {
+ /* ATH11K in QCA6390 package. */
+ .compatible = "pci17cb,1101",
+- .data = "wlan",
++ .data = &pci_pwrctl_pwrseq_qcom_wcn_pdata,
+ },
+ {
+ /* ATH11K in WCN6855 package. */
+ .compatible = "pci17cb,1103",
+- .data = "wlan",
++ .data = &pci_pwrctl_pwrseq_qcom_wcn_pdata,
+ },
+ {
+ /* ATH12K in WCN7850 package. */
+ .compatible = "pci17cb,1107",
+- .data = "wlan",
++ .data = &pci_pwrctl_pwrseq_qcom_wcn_pdata,
+ },
+ { }
+ };
+--
+2.43.0
+
--- /dev/null
+From 4ce44818317134b7ef74f5e98560ec15711918f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Aug 2024 21:12:00 +0200
+Subject: PCI/pwrctl: Add WCN6855 support
+
+From: Konrad Dybcio <konradybcio@kernel.org>
+
+[ Upstream commit 0da59840f10141988e949d8519ed9182991caf17 ]
+
+Add support for ATH11K inside the WCN6855 package to the power sequencing
+PCI power control driver.
+
+Link: https://lore.kernel.org/r/20240813191201.155123-1-brgl@bgdev.pl
+[Bartosz: split Konrad's bigger patch, write the commit message]
+Co-developed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Konrad Dybcio <konradybcio@kernel.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Konrad Dybcio <konradybcio@kernel.org>
+Stable-dep-of: ad783b9f8e78 ("PCI/pwrctl: Abandon QCom WCN probe on pre-pwrseq device-trees")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pwrctl/pci-pwrctl-pwrseq.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/pci/pwrctl/pci-pwrctl-pwrseq.c b/drivers/pci/pwrctl/pci-pwrctl-pwrseq.c
+index f07758c9edadd..a23a4312574b9 100644
+--- a/drivers/pci/pwrctl/pci-pwrctl-pwrseq.c
++++ b/drivers/pci/pwrctl/pci-pwrctl-pwrseq.c
+@@ -66,6 +66,11 @@ static const struct of_device_id pci_pwrctl_pwrseq_of_match[] = {
+ .compatible = "pci17cb,1101",
+ .data = "wlan",
+ },
++ {
++ /* ATH11K in WCN6855 package. */
++ .compatible = "pci17cb,1103",
++ .data = "wlan",
++ },
+ {
+ /* ATH12K in WCN7850 package. */
+ .compatible = "pci17cb,1107",
+--
+2.43.0
+
--- /dev/null
+From 168a3c8743bf1908399b64d3fd988942fe45ccd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 10:12:05 +0800
+Subject: powercap: dtpm_devfreq: Fix error check against
+ dev_pm_qos_add_request()
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit 5209d1b654f1db80509040cc694c7814a1b547e3 ]
+
+The caller of the function dev_pm_qos_add_request() checks again a non
+zero value but dev_pm_qos_add_request() can return '1' if the request
+already exists. Therefore, the setup function fails while the QoS
+request actually did not failed.
+
+Fix that by changing the check against a negative value like all the
+other callers of the function.
+
+Fixes: e44655617317 ("powercap/drivers/dtpm: Add dtpm devfreq with energy model support")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
+Link: https://patch.msgid.link/20241018021205.46460-1-yuancan@huawei.com
+[ rjw: Subject edit ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/powercap/dtpm_devfreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/powercap/dtpm_devfreq.c b/drivers/powercap/dtpm_devfreq.c
+index f40bce8176df2..d1dff6ccab120 100644
+--- a/drivers/powercap/dtpm_devfreq.c
++++ b/drivers/powercap/dtpm_devfreq.c
+@@ -178,7 +178,7 @@ static int __dtpm_devfreq_setup(struct devfreq *devfreq, struct dtpm *parent)
+ ret = dev_pm_qos_add_request(dev, &dtpm_devfreq->qos_req,
+ DEV_PM_QOS_MAX_FREQUENCY,
+ PM_QOS_MAX_FREQUENCY_DEFAULT_VALUE);
+- if (ret) {
++ if (ret < 0) {
+ pr_err("Failed to add QoS request: %d\n", ret);
+ goto out_dtpm_unregister;
+ }
+--
+2.43.0
+
net-dsa-mv88e6xxx-read-cycle-counter-period-from-har.patch
net-dsa-mv88e6xxx-support-4000ps-cycle-counter-perio.patch
bpf-add-the-missing-bpf_link_type-invocation-for-soc.patch
+asoc-dt-bindings-davinci-mcasp-fix-interrupts-proper.patch
+asoc-dt-bindings-davinci-mcasp-fix-interrupt-propert.patch
+asoc-loongson-fix-component-check-failed-on-fdt-syst.patch
+asoc-topology-bump-minimal-topology-abi-version.patch
+asoc-max98388-fix-missing-increment-of-variable-slot.patch
+asoc-rsnd-fix-probe-failure-on-hihope-boards-due-to-.patch
+pci-hold-rescan-lock-while-adding-devices-during-hos.patch
+fs-pass-offset-and-result-to-backing_file-end_write-.patch
+fuse-update-inode-size-after-extending-passthrough-w.patch
+asoc-fsl_micfil-add-a-flag-to-distinguish-with-diffe.patch
+alsa-firewire-lib-avoid-division-by-zero-in-apply_co.patch
+fbdev-wm8505fb-select-config_fb_iomem_fops.patch
+powercap-dtpm_devfreq-fix-error-check-against-dev_pm.patch
+nfsd-cancel-nfsd_shrinker_work-using-sync-mode-in-nf.patch
+alsa-hda-realtek-update-default-depop-procedure.patch
+smb-client-handle-kstrdup-failures-for-passwords.patch
+cifs-fix-warning-when-destroy-cifs_io_request_pool.patch
+pci-pwrctl-add-wcn6855-support.patch
+pci-pwrctl-abandon-qcom-wcn-probe-on-pre-pwrseq-devi.patch
+cpufreq-cppc-fix-perf_to_khz-khz_to_perf-conversion-.patch
--- /dev/null
+From cd535eca7c871d4f5119dd3507c4687ff824b42e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2024 15:21:26 -0300
+Subject: smb: client: Handle kstrdup failures for passwords
+
+From: Henrique Carvalho <henrique.carvalho@suse.com>
+
+[ Upstream commit 9a5dd61151399ad5a5d69aad28ab164734c1e3bc ]
+
+In smb3_reconfigure(), after duplicating ctx->password and
+ctx->password2 with kstrdup(), we need to check for allocation
+failures.
+
+If ses->password allocation fails, return -ENOMEM.
+If ses->password2 allocation fails, free ses->password, set it
+to NULL, and return -ENOMEM.
+
+Fixes: c1eb537bf456 ("cifs: allow changing password during remount")
+Reviewed-by: David Howells <dhowells@redhat.com
+Signed-off-by: Haoxiang Li <make24@iscas.ac.cn>
+Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/fs_context.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c
+index bc926ab2555bc..4069b69fbc7e0 100644
+--- a/fs/smb/client/fs_context.c
++++ b/fs/smb/client/fs_context.c
+@@ -920,8 +920,15 @@ static int smb3_reconfigure(struct fs_context *fc)
+ else {
+ kfree_sensitive(ses->password);
+ ses->password = kstrdup(ctx->password, GFP_KERNEL);
++ if (!ses->password)
++ return -ENOMEM;
+ kfree_sensitive(ses->password2);
+ ses->password2 = kstrdup(ctx->password2, GFP_KERNEL);
++ if (!ses->password2) {
++ kfree_sensitive(ses->password);
++ ses->password = NULL;
++ return -ENOMEM;
++ }
+ }
+ STEAL_STRING(cifs_sb, ctx, domainname);
+ STEAL_STRING(cifs_sb, ctx, nodename);
+--
+2.43.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
