--- /dev/null
+From stable+bounces-172666-greg=kroah.com@vger.kernel.org Sun Aug 24 01:47:38 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 19:47:31 -0400
+Subject: compiler: remove __ADDRESSABLE_ASM{_STR,}() again
+To: stable@vger.kernel.org
+Cc: Jan Beulich <jbeulich@suse.com>, Josh Poimboeuf <jpoimboe@kernel.org>, Juergen Gross <jgross@suse.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250823234731.2467994-1-sashal@kernel.org>
+
+From: Jan Beulich <jbeulich@suse.com>
+
+[ Upstream commit 8ea815399c3fcce1889bd951fec25b5b9a3979c1 ]
+
+__ADDRESSABLE_ASM_STR() is where the necessary stringification happens.
+As long as "sym" doesn't contain any odd characters, no quoting is
+required for its use with .quad / .long. In fact the quotation gets in
+the way with gas 2.25; it's only from 2.26 onwards that quoted symbols
+are half-way properly supported.
+
+However, assembly being different from C anyway, drop
+__ADDRESSABLE_ASM_STR() and its helper macro altogether. A simple
+.global directive will suffice to get the symbol "declared", i.e. into
+the symbol table. While there also stop open-coding STATIC_CALL_TRAMP()
+and STATIC_CALL_KEY().
+
+Fixes: 0ef8047b737d ("x86/static-call: provide a way to do very early static-call updates")
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Message-ID: <609d2c74-de13-4fae-ab1a-1ec44afb948d@suse.com>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/xen/hypercall.h | 5 +++--
+ include/linux/compiler.h | 8 --------
+ 2 files changed, 3 insertions(+), 10 deletions(-)
+
+--- a/arch/x86/include/asm/xen/hypercall.h
++++ b/arch/x86/include/asm/xen/hypercall.h
+@@ -94,12 +94,13 @@ DECLARE_STATIC_CALL(xen_hypercall, xen_h
+ #ifdef MODULE
+ #define __ADDRESSABLE_xen_hypercall
+ #else
+-#define __ADDRESSABLE_xen_hypercall __ADDRESSABLE_ASM_STR(__SCK__xen_hypercall)
++#define __ADDRESSABLE_xen_hypercall \
++ __stringify(.global STATIC_CALL_KEY(xen_hypercall);)
+ #endif
+
+ #define __HYPERCALL \
+ __ADDRESSABLE_xen_hypercall \
+- "call __SCT__xen_hypercall"
++ __stringify(call STATIC_CALL_TRAMP(xen_hypercall))
+
+ #define __HYPERCALL_ENTRY(x) "a" (x)
+
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -223,14 +223,6 @@ static inline void *offset_to_ptr(const
+ #define __ADDRESSABLE(sym) \
+ ___ADDRESSABLE(sym, __section(".discard.addressable"))
+
+-#define __ADDRESSABLE_ASM(sym) \
+- .pushsection .discard.addressable,"aw"; \
+- .align ARCH_SEL(8,4); \
+- ARCH_SEL(.quad, .long) __stringify(sym); \
+- .popsection;
+-
+-#define __ADDRESSABLE_ASM_STR(sym) __stringify(__ADDRESSABLE_ASM(sym))
+-
+ /* &a[0] degrades to a pointer: a different type from an array */
+ #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
+
--- /dev/null
+From stable+bounces-172657-greg=kroah.com@vger.kernel.org Sat Aug 23 18:56:28 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 12:56:18 -0400
+Subject: drm/i915/icl+/tc: Cache the max lane count value
+To: stable@vger.kernel.org
+Cc: Imre Deak <imre.deak@intel.com>, Charlton Lin <charlton.lin@intel.com>, Khaled Almahallawy <khaled.almahallawy@intel.com>, Mika Kahola <mika.kahola@intel.com>, Tvrtko Ursulin <tursulin@ursulin.net>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250823165618.2341421-1-sashal@kernel.org>
+
+From: Imre Deak <imre.deak@intel.com>
+
+[ Upstream commit 5fd35236546abe780eaadb7561e09953719d4fc3 ]
+
+The PHY's pin assignment value in the TCSS_DDI_STATUS register - as set
+by the HW/FW based on the connected DP-alt sink's TypeC/PD pin
+assignment negotiation - gets cleared by the HW/FW on LNL+ as soon as
+the sink gets disconnected, even if the PHY ownership got acquired
+already by the driver (and hence the PHY itself is still connected and
+used by the display). This is similar to how the PHY Ready flag gets
+cleared on LNL+ in the same register.
+
+To be able to query the max lane count value on LNL+ - which is based on
+the above pin assignment - at all times even after the sink gets
+disconnected, the max lane count must be determined and cached during
+the PHY's HW readout and connect sequences. Do that here, leaving the
+actual use of the cached value to a follow-up change.
+
+v2: Don't read out the pin configuration if the PHY is disconnected.
+
+Cc: stable@vger.kernel.org # v6.8+
+Reported-by: Charlton Lin <charlton.lin@intel.com>
+Tested-by: Khaled Almahallawy <khaled.almahallawy@intel.com>
+Reviewed-by: Mika Kahola <mika.kahola@intel.com>
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Link: https://lore.kernel.org/r/20250811080152.906216-3-imre.deak@intel.com
+(cherry picked from commit 3e32438fc406761f81b1928d210b3d2a5e7501a0)
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+[ adapted APIs from intel_display to drm_i915_private structures ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_tc.c | 55 +++++++++++++++++++++++++++-----
+ 1 file changed, 47 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_tc.c
++++ b/drivers/gpu/drm/i915/display/intel_tc.c
+@@ -63,6 +63,7 @@ struct intel_tc_port {
+ enum tc_port_mode init_mode;
+ enum phy_fia phy_fia;
+ u8 phy_fia_idx;
++ u8 max_lane_count;
+ };
+
+ static enum intel_display_power_domain
+@@ -366,12 +367,12 @@ static int intel_tc_port_get_max_lane_co
+ }
+ }
+
+-int intel_tc_port_max_lane_count(struct intel_digital_port *dig_port)
++static int get_max_lane_count(struct intel_tc_port *tc)
+ {
++ struct intel_digital_port *dig_port = tc->dig_port;
+ struct drm_i915_private *i915 = to_i915(dig_port->base.base.dev);
+- struct intel_tc_port *tc = to_tc_port(dig_port);
+
+- if (!intel_encoder_is_tc(&dig_port->base) || tc->mode != TC_PORT_DP_ALT)
++ if (tc->mode != TC_PORT_DP_ALT)
+ return 4;
+
+ assert_tc_cold_blocked(tc);
+@@ -385,6 +386,21 @@ int intel_tc_port_max_lane_count(struct
+ return intel_tc_port_get_max_lane_count(dig_port);
+ }
+
++static void read_pin_configuration(struct intel_tc_port *tc)
++{
++ tc->max_lane_count = get_max_lane_count(tc);
++}
++
++int intel_tc_port_max_lane_count(struct intel_digital_port *dig_port)
++{
++ struct intel_tc_port *tc = to_tc_port(dig_port);
++
++ if (!intel_encoder_is_tc(&dig_port->base))
++ return 4;
++
++ return get_max_lane_count(tc);
++}
++
+ void intel_tc_port_set_fia_lane_count(struct intel_digital_port *dig_port,
+ int required_lanes)
+ {
+@@ -597,9 +613,12 @@ static void icl_tc_phy_get_hw_state(stru
+ tc_cold_wref = __tc_cold_block(tc, &domain);
+
+ tc->mode = tc_phy_get_current_mode(tc);
+- if (tc->mode != TC_PORT_DISCONNECTED)
++ if (tc->mode != TC_PORT_DISCONNECTED) {
+ tc->lock_wakeref = tc_cold_block(tc);
+
++ read_pin_configuration(tc);
++ }
++
+ __tc_cold_unblock(tc, domain, tc_cold_wref);
+ }
+
+@@ -657,8 +676,11 @@ static bool icl_tc_phy_connect(struct in
+
+ tc->lock_wakeref = tc_cold_block(tc);
+
+- if (tc->mode == TC_PORT_TBT_ALT)
++ if (tc->mode == TC_PORT_TBT_ALT) {
++ read_pin_configuration(tc);
++
+ return true;
++ }
+
+ if ((!tc_phy_is_ready(tc) ||
+ !icl_tc_phy_take_ownership(tc, true)) &&
+@@ -669,6 +691,7 @@ static bool icl_tc_phy_connect(struct in
+ goto out_unblock_tc_cold;
+ }
+
++ read_pin_configuration(tc);
+
+ if (!tc_phy_verify_legacy_or_dp_alt_mode(tc, required_lanes))
+ goto out_release_phy;
+@@ -859,9 +882,12 @@ static void adlp_tc_phy_get_hw_state(str
+ port_wakeref = intel_display_power_get(i915, port_power_domain);
+
+ tc->mode = tc_phy_get_current_mode(tc);
+- if (tc->mode != TC_PORT_DISCONNECTED)
++ if (tc->mode != TC_PORT_DISCONNECTED) {
+ tc->lock_wakeref = tc_cold_block(tc);
+
++ read_pin_configuration(tc);
++ }
++
+ intel_display_power_put(i915, port_power_domain, port_wakeref);
+ }
+
+@@ -874,6 +900,9 @@ static bool adlp_tc_phy_connect(struct i
+
+ if (tc->mode == TC_PORT_TBT_ALT) {
+ tc->lock_wakeref = tc_cold_block(tc);
++
++ read_pin_configuration(tc);
++
+ return true;
+ }
+
+@@ -895,6 +924,8 @@ static bool adlp_tc_phy_connect(struct i
+
+ tc->lock_wakeref = tc_cold_block(tc);
+
++ read_pin_configuration(tc);
++
+ if (!tc_phy_verify_legacy_or_dp_alt_mode(tc, required_lanes))
+ goto out_unblock_tc_cold;
+
+@@ -1094,9 +1125,12 @@ static void xelpdp_tc_phy_get_hw_state(s
+ tc_cold_wref = __tc_cold_block(tc, &domain);
+
+ tc->mode = tc_phy_get_current_mode(tc);
+- if (tc->mode != TC_PORT_DISCONNECTED)
++ if (tc->mode != TC_PORT_DISCONNECTED) {
+ tc->lock_wakeref = tc_cold_block(tc);
+
++ read_pin_configuration(tc);
++ }
++
+ drm_WARN_ON(&i915->drm,
+ (tc->mode == TC_PORT_DP_ALT || tc->mode == TC_PORT_LEGACY) &&
+ !xelpdp_tc_phy_tcss_power_is_enabled(tc));
+@@ -1108,14 +1142,19 @@ static bool xelpdp_tc_phy_connect(struct
+ {
+ tc->lock_wakeref = tc_cold_block(tc);
+
+- if (tc->mode == TC_PORT_TBT_ALT)
++ if (tc->mode == TC_PORT_TBT_ALT) {
++ read_pin_configuration(tc);
++
+ return true;
++ }
+
+ if (!xelpdp_tc_phy_enable_tcss_power(tc, true))
+ goto out_unblock_tccold;
+
+ xelpdp_tc_phy_take_ownership(tc, true);
+
++ read_pin_configuration(tc);
++
+ if (!tc_phy_verify_legacy_or_dp_alt_mode(tc, required_lanes))
+ goto out_release_phy;
+
--- /dev/null
+From stable+bounces-172670-greg=kroah.com@vger.kernel.org Sun Aug 24 02:32:24 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 20:32:15 -0400
+Subject: drm/i915/icl+/tc: Convert AUX powered WARN to a debug message
+To: stable@vger.kernel.org
+Cc: Imre Deak <imre.deak@intel.com>, Charlton Lin <charlton.lin@intel.com>, Khaled Almahallawy <khaled.almahallawy@intel.com>, Mika Kahola <mika.kahola@intel.com>, Tvrtko Ursulin <tursulin@ursulin.net>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250824003215.2541102-1-sashal@kernel.org>
+
+From: Imre Deak <imre.deak@intel.com>
+
+[ Upstream commit d7fa5754e83cd36c4327eb2d806064e598a72ff6 ]
+
+The BIOS can leave the AUX power well enabled on an output, even if this
+isn't required (on platforms where the AUX power is only needed for an
+AUX access). This was observed at least on PTL. To avoid the WARN which
+would be triggered by this during the HW readout, convert the WARN to a
+debug message.
+
+Cc: stable@vger.kernel.org # v6.8+
+Reported-by: Charlton Lin <charlton.lin@intel.com>
+Tested-by: Khaled Almahallawy <khaled.almahallawy@intel.com>
+Reviewed-by: Mika Kahola <mika.kahola@intel.com>
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Link: https://lore.kernel.org/r/20250811080152.906216-6-imre.deak@intel.com
+(cherry picked from commit 6cb52cba474b2bec1a3018d3dbf75292059a29a1)
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+[ display->drm API => i915->drm ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_tc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_tc.c
++++ b/drivers/gpu/drm/i915/display/intel_tc.c
+@@ -1416,7 +1416,8 @@ static void intel_tc_port_reset_mode(str
+
+ aux_domain = intel_aux_power_domain(dig_port);
+ aux_powered = intel_display_power_is_enabled(i915, aux_domain);
+- drm_WARN_ON(&i915->drm, aux_powered);
++ drm_dbg_kms(&i915->drm, "Port %s: AUX powered %d\n",
++ tc->port_name, aux_powered);
+ }
+
+ tc_phy_disconnect(tc);
--- /dev/null
+From stable+bounces-172682-greg=kroah.com@vger.kernel.org Sun Aug 24 03:29:42 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 21:29:32 -0400
+Subject: iio: light: as73211: Ensure buffer holes are zeroed
+To: stable@vger.kernel.org
+Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>, Matti Vaittinen <mazziesaccount@gmail.com>, Andy Shevchenko <andy@kernel.org>, Stable@vger.kernel.org, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250824012932.2578686-2-sashal@kernel.org>
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit 433b99e922943efdfd62b9a8e3ad1604838181f2 ]
+
+Given that the buffer is copied to a kfifo that ultimately user space
+can read, ensure we zero it.
+
+Fixes: 403e5586b52e ("iio: light: as73211: New driver")
+Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Link: https://patch.msgid.link/20250802164436.515988-2-jic23@kernel.org
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/as73211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/light/as73211.c
++++ b/drivers/iio/light/as73211.c
+@@ -643,7 +643,7 @@ static irqreturn_t as73211_trigger_handl
+ struct {
+ __le16 chan[4];
+ aligned_s64 ts;
+- } scan;
++ } scan = { };
+ int data_result, ret;
+
+ mutex_lock(&data->mutex);
--- /dev/null
+From stable+bounces-172681-greg=kroah.com@vger.kernel.org Sun Aug 24 03:29:41 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 21:29:31 -0400
+Subject: iio: light: Use aligned_s64 instead of open coding alignment.
+To: stable@vger.kernel.org
+Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>, Matti Vaittinen <mazziesaccount@gmail.com>, Andy Shevchenko <andriy.shevchenko@linux.intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250824012932.2578686-1-sashal@kernel.org>
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit a801016da0bbb955acf1a551584790e3816bb4db ]
+
+Use this new type to both slightly simplify the code and avoid
+confusing static analysis tools. Mostly this series is about consistency
+to avoid this code pattern getting copied into more drivers.
+
+Acked-By: Matti Vaittinen <mazziesaccount@gmail.com> #For bu27034, rpr0521
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20241215182912.481706-9-jic23@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Stable-dep-of: 433b99e92294 ("iio: light: as73211: Ensure buffer holes are zeroed")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/adjd_s311.c | 2 +-
+ drivers/iio/light/as73211.c | 2 +-
+ drivers/iio/light/bh1745.c | 2 +-
+ drivers/iio/light/isl29125.c | 2 +-
+ drivers/iio/light/ltr501.c | 2 +-
+ drivers/iio/light/max44000.c | 2 +-
+ drivers/iio/light/rohm-bu27034.c | 2 +-
+ drivers/iio/light/rpr0521.c | 2 +-
+ drivers/iio/light/st_uvis25.h | 2 +-
+ drivers/iio/light/tcs3414.c | 2 +-
+ drivers/iio/light/tcs3472.c | 2 +-
+ 11 files changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/iio/light/adjd_s311.c
++++ b/drivers/iio/light/adjd_s311.c
+@@ -56,7 +56,7 @@ struct adjd_s311_data {
+ struct i2c_client *client;
+ struct {
+ s16 chans[4];
+- s64 ts __aligned(8);
++ aligned_s64 ts;
+ } scan;
+ };
+
+--- a/drivers/iio/light/as73211.c
++++ b/drivers/iio/light/as73211.c
+@@ -642,7 +642,7 @@ static irqreturn_t as73211_trigger_handl
+ struct as73211_data *data = iio_priv(indio_dev);
+ struct {
+ __le16 chan[4];
+- s64 ts __aligned(8);
++ aligned_s64 ts;
+ } scan;
+ int data_result, ret;
+
+--- a/drivers/iio/light/bh1745.c
++++ b/drivers/iio/light/bh1745.c
+@@ -743,7 +743,7 @@ static irqreturn_t bh1745_trigger_handle
+ struct bh1745_data *data = iio_priv(indio_dev);
+ struct {
+ u16 chans[4];
+- s64 timestamp __aligned(8);
++ aligned_s64 timestamp;
+ } scan;
+ u16 value;
+ int ret;
+--- a/drivers/iio/light/isl29125.c
++++ b/drivers/iio/light/isl29125.c
+@@ -54,7 +54,7 @@ struct isl29125_data {
+ /* Ensure timestamp is naturally aligned */
+ struct {
+ u16 chans[3];
+- s64 timestamp __aligned(8);
++ aligned_s64 timestamp;
+ } scan;
+ };
+
+--- a/drivers/iio/light/ltr501.c
++++ b/drivers/iio/light/ltr501.c
+@@ -1285,7 +1285,7 @@ static irqreturn_t ltr501_trigger_handle
+ struct ltr501_data *data = iio_priv(indio_dev);
+ struct {
+ u16 channels[3];
+- s64 ts __aligned(8);
++ aligned_s64 ts;
+ } scan;
+ __le16 als_buf[2];
+ u8 mask = 0;
+--- a/drivers/iio/light/max44000.c
++++ b/drivers/iio/light/max44000.c
+@@ -78,7 +78,7 @@ struct max44000_data {
+ /* Ensure naturally aligned timestamp */
+ struct {
+ u16 channels[2];
+- s64 ts __aligned(8);
++ aligned_s64 ts;
+ } scan;
+ };
+
+--- a/drivers/iio/light/rohm-bu27034.c
++++ b/drivers/iio/light/rohm-bu27034.c
+@@ -205,7 +205,7 @@ struct bu27034_data {
+ struct {
+ u32 mlux;
+ __le16 channels[BU27034_NUM_HW_DATA_CHANS];
+- s64 ts __aligned(8);
++ aligned_s64 ts;
+ } scan;
+ };
+
+--- a/drivers/iio/light/rpr0521.c
++++ b/drivers/iio/light/rpr0521.c
+@@ -203,7 +203,7 @@ struct rpr0521_data {
+ struct {
+ __le16 channels[3];
+ u8 garbage;
+- s64 ts __aligned(8);
++ aligned_s64 ts;
+ } scan;
+ };
+
+--- a/drivers/iio/light/st_uvis25.h
++++ b/drivers/iio/light/st_uvis25.h
+@@ -30,7 +30,7 @@ struct st_uvis25_hw {
+ /* Ensure timestamp is naturally aligned */
+ struct {
+ u8 chan;
+- s64 ts __aligned(8);
++ aligned_s64 ts;
+ } scan;
+ };
+
+--- a/drivers/iio/light/tcs3414.c
++++ b/drivers/iio/light/tcs3414.c
+@@ -56,7 +56,7 @@ struct tcs3414_data {
+ /* Ensure timestamp is naturally aligned */
+ struct {
+ u16 chans[4];
+- s64 timestamp __aligned(8);
++ aligned_s64 timestamp;
+ } scan;
+ };
+
+--- a/drivers/iio/light/tcs3472.c
++++ b/drivers/iio/light/tcs3472.c
+@@ -67,7 +67,7 @@ struct tcs3472_data {
+ /* Ensure timestamp is naturally aligned */
+ struct {
+ u16 chans[4];
+- s64 timestamp __aligned(8);
++ aligned_s64 timestamp;
+ } scan;
+ };
+
--- /dev/null
+From stable+bounces-172680-greg=kroah.com@vger.kernel.org Sun Aug 24 03:20:15 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 21:20:08 -0400
+Subject: iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read()
+To: stable@vger.kernel.org
+Cc: "David Lechner" <dlechner@baylibre.com>, "Nuno Sá" <nuno.sa@analog.com>, Stable@vger.kernel.org, "Jonathan Cameron" <Jonathan.Cameron@huawei.com>, "Sasha Levin" <sashal@kernel.org>
+Message-ID: <20250824012008.2575688-1-sashal@kernel.org>
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit ae5bc07ec9f73a41734270ef3f800c5c8a7e0ad3 ]
+
+Replace using stack-allocated buffers with a DMA-safe buffer for use
+with spi_read(). This allows the driver to be safely used with
+DMA-enabled SPI controllers.
+
+The buffer array is also converted to a struct with a union to make the
+usage of the memory in the buffer more clear and ensure proper alignment.
+
+Fixes: 1f25ca11d84a ("iio: temperature: add support for Maxim thermocouple chips")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://patch.msgid.link/20250721-iio-use-more-iio_declare_buffer_with_ts-3-v2-1-0c68d41ccf6c@baylibre.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+[ iio_push_to_buffers_with_ts() => iio_push_to_buffers_with_timestamp() ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/temperature/maxim_thermocouple.c | 26 ++++++++++++++++----------
+ 1 file changed, 16 insertions(+), 10 deletions(-)
+
+--- a/drivers/iio/temperature/maxim_thermocouple.c
++++ b/drivers/iio/temperature/maxim_thermocouple.c
+@@ -12,6 +12,7 @@
+ #include <linux/mutex.h>
+ #include <linux/err.h>
+ #include <linux/spi/spi.h>
++#include <linux/types.h>
+ #include <linux/iio/iio.h>
+ #include <linux/iio/sysfs.h>
+ #include <linux/iio/trigger.h>
+@@ -122,8 +123,15 @@ struct maxim_thermocouple_data {
+ struct spi_device *spi;
+ const struct maxim_thermocouple_chip *chip;
+ char tc_type;
+-
+- u8 buffer[16] __aligned(IIO_DMA_MINALIGN);
++ /* Buffer for reading up to 2 hardware channels. */
++ struct {
++ union {
++ __be16 raw16;
++ __be32 raw32;
++ __be16 raw[2];
++ };
++ aligned_s64 timestamp;
++ } buffer __aligned(IIO_DMA_MINALIGN);
+ };
+
+ static int maxim_thermocouple_read(struct maxim_thermocouple_data *data,
+@@ -131,18 +139,16 @@ static int maxim_thermocouple_read(struc
+ {
+ unsigned int storage_bytes = data->chip->read_size;
+ unsigned int shift = chan->scan_type.shift + (chan->address * 8);
+- __be16 buf16;
+- __be32 buf32;
+ int ret;
+
+ switch (storage_bytes) {
+ case 2:
+- ret = spi_read(data->spi, (void *)&buf16, storage_bytes);
+- *val = be16_to_cpu(buf16);
++ ret = spi_read(data->spi, &data->buffer.raw16, storage_bytes);
++ *val = be16_to_cpu(data->buffer.raw16);
+ break;
+ case 4:
+- ret = spi_read(data->spi, (void *)&buf32, storage_bytes);
+- *val = be32_to_cpu(buf32);
++ ret = spi_read(data->spi, &data->buffer.raw32, storage_bytes);
++ *val = be32_to_cpu(data->buffer.raw32);
+ break;
+ default:
+ ret = -EINVAL;
+@@ -167,9 +173,9 @@ static irqreturn_t maxim_thermocouple_tr
+ struct maxim_thermocouple_data *data = iio_priv(indio_dev);
+ int ret;
+
+- ret = spi_read(data->spi, data->buffer, data->chip->read_size);
++ ret = spi_read(data->spi, data->buffer.raw, data->chip->read_size);
+ if (!ret) {
+- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer,
+ iio_get_time_ns(indio_dev));
+ }
+
usb-dwc3-ignore-late-xfernotready-event-to-prevent-halt-timeout.patch
usb-dwc3-remove-warn_on-for-device-endpoint-command-timeouts.patch
usb-dwc3-pci-add-support-for-the-intel-wildcat-lake.patch
+iio-light-use-aligned_s64-instead-of-open-coding-alignment.patch
+iio-light-as73211-ensure-buffer-holes-are-zeroed.patch
+iio-temperature-maxim_thermocouple-use-dma-safe-buffer-for-spi_read.patch
+tracing-remove-unneeded-goto-out-logic.patch
+tracing-limit-access-to-parser-buffer-when-trace_get_user-failed.patch
+drm-i915-icl-tc-convert-aux-powered-warn-to-a-debug-message.patch
+compiler-remove-__addressable_asm-_str-again.patch
+drm-i915-icl-tc-cache-the-max-lane-count-value.patch
--- /dev/null
+From stable+bounces-172678-greg=kroah.com@vger.kernel.org Sun Aug 24 03:19:03 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 21:18:55 -0400
+Subject: tracing: Limit access to parser->buffer when trace_get_user failed
+To: stable@vger.kernel.org
+Cc: Pu Lehui <pulehui@huawei.com>, "Steven Rostedt (Google)" <rostedt@goodmis.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250824011855.2574804-2-sashal@kernel.org>
+
+From: Pu Lehui <pulehui@huawei.com>
+
+[ Upstream commit 6a909ea83f226803ea0e718f6e88613df9234d58 ]
+
+When the length of the string written to set_ftrace_filter exceeds
+FTRACE_BUFF_MAX, the following KASAN alarm will be triggered:
+
+BUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0
+Read of size 1 at addr ffff0000d00bd5ba by task ash/165
+
+CPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty
+Hardware name: linux,dummy-virt (DT)
+Call trace:
+ show_stack+0x34/0x50 (C)
+ dump_stack_lvl+0xa0/0x158
+ print_address_description.constprop.0+0x88/0x398
+ print_report+0xb0/0x280
+ kasan_report+0xa4/0xf0
+ __asan_report_load1_noabort+0x20/0x30
+ strsep+0x18c/0x1b0
+ ftrace_process_regex.isra.0+0x100/0x2d8
+ ftrace_regex_release+0x484/0x618
+ __fput+0x364/0xa58
+ ____fput+0x28/0x40
+ task_work_run+0x154/0x278
+ do_notify_resume+0x1f0/0x220
+ el0_svc+0xec/0xf0
+ el0t_64_sync_handler+0xa0/0xe8
+ el0t_64_sync+0x1ac/0x1b0
+
+The reason is that trace_get_user will fail when processing a string
+longer than FTRACE_BUFF_MAX, but not set the end of parser->buffer to 0.
+Then an OOB access will be triggered in ftrace_regex_release->
+ftrace_process_regex->strsep->strpbrk. We can solve this problem by
+limiting access to parser->buffer when trace_get_user failed.
+
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/20250813040232.1344527-1-pulehui@huaweicloud.com
+Fixes: 8c9af478c06b ("ftrace: Handle commands when closing set_ftrace_filter file")
+Signed-off-by: Pu Lehui <pulehui@huawei.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace.c | 18 ++++++++++++------
+ kernel/trace/trace.h | 8 +++++++-
+ 2 files changed, 19 insertions(+), 7 deletions(-)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -1754,7 +1754,7 @@ int trace_get_user(struct trace_parser *
+
+ ret = get_user(ch, ubuf++);
+ if (ret)
+- return ret;
++ goto fail;
+
+ read++;
+ cnt--;
+@@ -1768,7 +1768,7 @@ int trace_get_user(struct trace_parser *
+ while (cnt && isspace(ch)) {
+ ret = get_user(ch, ubuf++);
+ if (ret)
+- return ret;
++ goto fail;
+ read++;
+ cnt--;
+ }
+@@ -1786,12 +1786,14 @@ int trace_get_user(struct trace_parser *
+ while (cnt && !isspace(ch) && ch) {
+ if (parser->idx < parser->size - 1)
+ parser->buffer[parser->idx++] = ch;
+- else
+- return -EINVAL;
++ else {
++ ret = -EINVAL;
++ goto fail;
++ }
+
+ ret = get_user(ch, ubuf++);
+ if (ret)
+- return ret;
++ goto fail;
+ read++;
+ cnt--;
+ }
+@@ -1806,11 +1808,15 @@ int trace_get_user(struct trace_parser *
+ /* Make sure the parsed string always terminates with '\0'. */
+ parser->buffer[parser->idx] = 0;
+ } else {
+- return -EINVAL;
++ ret = -EINVAL;
++ goto fail;
+ }
+
+ *ppos += read;
+ return read;
++fail:
++ trace_parser_fail(parser);
++ return ret;
+ }
+
+ /* TODO add a seq_buf_to_buffer() */
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -1230,6 +1230,7 @@ bool ftrace_event_is_function(struct tra
+ */
+ struct trace_parser {
+ bool cont;
++ bool fail;
+ char *buffer;
+ unsigned idx;
+ unsigned size;
+@@ -1237,7 +1238,7 @@ struct trace_parser {
+
+ static inline bool trace_parser_loaded(struct trace_parser *parser)
+ {
+- return (parser->idx != 0);
++ return !parser->fail && parser->idx != 0;
+ }
+
+ static inline bool trace_parser_cont(struct trace_parser *parser)
+@@ -1251,6 +1252,11 @@ static inline void trace_parser_clear(st
+ parser->idx = 0;
+ }
+
++static inline void trace_parser_fail(struct trace_parser *parser)
++{
++ parser->fail = true;
++}
++
+ extern int trace_parser_get_init(struct trace_parser *parser, int size);
+ extern void trace_parser_put(struct trace_parser *parser);
+ extern int trace_get_user(struct trace_parser *parser, const char __user *ubuf,
--- /dev/null
+From stable+bounces-172677-greg=kroah.com@vger.kernel.org Sun Aug 24 03:19:02 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 21:18:54 -0400
+Subject: tracing: Remove unneeded goto out logic
+To: stable@vger.kernel.org
+Cc: Steven Rostedt <rostedt@goodmis.org>, Masami Hiramatsu <mhiramat@kernel.org>, Mark Rutland <mark.rutland@arm.com>, Mathieu Desnoyers <mathieu.desnoyers@efficios.com>, Andrew Morton <akpm@linux-foundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250824011855.2574804-1-sashal@kernel.org>
+
+From: Steven Rostedt <rostedt@goodmis.org>
+
+[ Upstream commit c89504a703fb779052213add0e8ed642f4a4f1c8 ]
+
+Several places in the trace.c file there's a goto out where the out is
+simply a return. There's no reason to jump to the out label if it's not
+doing any more logic but simply returning from the function.
+
+Replace the goto outs with a return and remove the out labels.
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Link: https://lore.kernel.org/20250801203857.538726745@kernel.org
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Stable-dep-of: 6a909ea83f22 ("tracing: Limit access to parser->buffer when trace_get_user failed")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace.c | 38 +++++++++++++++-----------------------
+ 1 file changed, 15 insertions(+), 23 deletions(-)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -1754,7 +1754,7 @@ int trace_get_user(struct trace_parser *
+
+ ret = get_user(ch, ubuf++);
+ if (ret)
+- goto out;
++ return ret;
+
+ read++;
+ cnt--;
+@@ -1768,7 +1768,7 @@ int trace_get_user(struct trace_parser *
+ while (cnt && isspace(ch)) {
+ ret = get_user(ch, ubuf++);
+ if (ret)
+- goto out;
++ return ret;
+ read++;
+ cnt--;
+ }
+@@ -1778,8 +1778,7 @@ int trace_get_user(struct trace_parser *
+ /* only spaces were written */
+ if (isspace(ch) || !ch) {
+ *ppos += read;
+- ret = read;
+- goto out;
++ return read;
+ }
+ }
+
+@@ -1787,13 +1786,12 @@ int trace_get_user(struct trace_parser *
+ while (cnt && !isspace(ch) && ch) {
+ if (parser->idx < parser->size - 1)
+ parser->buffer[parser->idx++] = ch;
+- else {
+- ret = -EINVAL;
+- goto out;
+- }
++ else
++ return -EINVAL;
++
+ ret = get_user(ch, ubuf++);
+ if (ret)
+- goto out;
++ return ret;
+ read++;
+ cnt--;
+ }
+@@ -1808,15 +1806,11 @@ int trace_get_user(struct trace_parser *
+ /* Make sure the parsed string always terminates with '\0'. */
+ parser->buffer[parser->idx] = 0;
+ } else {
+- ret = -EINVAL;
+- goto out;
++ return -EINVAL;
+ }
+
+ *ppos += read;
+- ret = read;
+-
+-out:
+- return ret;
++ return read;
+ }
+
+ /* TODO add a seq_buf_to_buffer() */
+@@ -2318,10 +2312,10 @@ int __init register_tracer(struct tracer
+ mutex_unlock(&trace_types_lock);
+
+ if (ret || !default_bootup_tracer)
+- goto out_unlock;
++ return ret;
+
+ if (strncmp(default_bootup_tracer, type->name, MAX_TRACER_SIZE))
+- goto out_unlock;
++ return 0;
+
+ printk(KERN_INFO "Starting tracer '%s'\n", type->name);
+ /* Do we want this tracer to start on bootup? */
+@@ -2333,8 +2327,7 @@ int __init register_tracer(struct tracer
+ /* disable other selftests, since this will break it. */
+ disable_tracing_selftest("running a tracer");
+
+- out_unlock:
+- return ret;
++ return 0;
+ }
+
+ static void tracing_reset_cpu(struct array_buffer *buf, int cpu)
+@@ -8563,12 +8556,12 @@ ftrace_trace_snapshot_callback(struct tr
+ out_reg:
+ ret = tracing_arm_snapshot(tr);
+ if (ret < 0)
+- goto out;
++ return ret;
+
+ ret = register_ftrace_function_probe(glob, tr, ops, count);
+ if (ret < 0)
+ tracing_disarm_snapshot(tr);
+- out:
++
+ return ret < 0 ? ret : 0;
+ }
+
+@@ -10469,7 +10462,7 @@ __init static int tracer_alloc_buffers(v
+ BUILD_BUG_ON(TRACE_ITER_LAST_BIT > TRACE_FLAGS_MAX_SIZE);
+
+ if (!alloc_cpumask_var(&tracing_buffer_mask, GFP_KERNEL))
+- goto out;
++ return -ENOMEM;
+
+ if (!alloc_cpumask_var(&global_trace.tracing_cpumask, GFP_KERNEL))
+ goto out_free_buffer_mask;
+@@ -10582,7 +10575,6 @@ out_free_cpumask:
+ free_cpumask_var(global_trace.tracing_cpumask);
+ out_free_buffer_mask:
+ free_cpumask_var(tracing_buffer_mask);
+-out:
+ return ret;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
