--- /dev/null
+From 2437513a814b3e93bd02879740a8a06e52e2cf7d Mon Sep 17 00:00:00 2001
+From: Li Zhong <floridsleeves@gmail.com>
+Date: Fri, 2 Sep 2022 00:37:30 -0700
+Subject: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value
+
+From: Li Zhong <floridsleeves@gmail.com>
+
+commit 2437513a814b3e93bd02879740a8a06e52e2cf7d upstream.
+
+The return value of acpi_fetch_acpi_dev() could be NULL, which would
+cause a NULL pointer dereference to occur in acpi_device_hid().
+
+Signed-off-by: Li Zhong <floridsleeves@gmail.com>
+[ rjw: Subject and changelog edits, added empty line after if () ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Teddy Astie <teddy.astie@vates.tech>
+Signed-off-by: Yann Sionneau <yann.sionneau@vates.tech>
+Reported-by: Dillon C <dchan@dchan.tech>
+Tested-by: Dillon C <dchan@dchan.tech>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/processor_idle.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1125,7 +1125,9 @@ static int acpi_processor_get_lpi_info(s
+
+ status = acpi_get_parent(handle, &pr_ahandle);
+ while (ACPI_SUCCESS(status)) {
+- acpi_bus_get_device(pr_ahandle, &d);
++ if (acpi_bus_get_device(pr_ahandle, &d))
++ break;
++
+ handle = pr_ahandle;
+
+ if (strcmp(acpi_device_hid(d), ACPI_PROCESSOR_CONTAINER_HID))
--- /dev/null
+From 342debc12183b51773b3345ba267e9263bdfaaef Mon Sep 17 00:00:00 2001
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Thu, 3 Apr 2025 14:16:31 -0700
+Subject: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+commit 342debc12183b51773b3345ba267e9263bdfaaef upstream.
+
+After making all ->qlen_notify() callbacks idempotent, now it is safe to
+remove the check of qlen!=0 from both fq_codel_dequeue() and
+codel_qdisc_dequeue().
+
+Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
+Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM")
+Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250403211636.166257-1-xiyou.wangcong@gmail.com
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Siddh Raman Pant <siddh.raman.pant@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_codel.c | 5 +----
+ net/sched/sch_fq_codel.c | 6 ++----
+ 2 files changed, 3 insertions(+), 8 deletions(-)
+
+--- a/net/sched/sch_codel.c
++++ b/net/sched/sch_codel.c
+@@ -95,10 +95,7 @@ static struct sk_buff *codel_qdisc_deque
+ &q->stats, qdisc_pkt_len, codel_get_enqueue_time,
+ drop_func, dequeue_func);
+
+- /* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
+- * or HTB crashes. Defer it for next round.
+- */
+- if (q->stats.drop_count && sch->q.qlen) {
++ if (q->stats.drop_count) {
+ qdisc_tree_reduce_backlog(sch, q->stats.drop_count, q->stats.drop_len);
+ q->stats.drop_count = 0;
+ q->stats.drop_len = 0;
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -314,10 +314,8 @@ begin:
+ }
+ qdisc_bstats_update(sch, skb);
+ flow->deficit -= qdisc_pkt_len(skb);
+- /* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
+- * or HTB crashes. Defer it for next round.
+- */
+- if (q->cstats.drop_count && sch->q.qlen) {
++
++ if (q->cstats.drop_count) {
+ qdisc_tree_reduce_backlog(sch, q->cstats.drop_count,
+ q->cstats.drop_len);
+ q->cstats.drop_count = 0;
--- /dev/null
+From 936599ca514973d44a766b7376c6bbdc96b6a8cc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <thomas.weissschuh@linutronix.de>
+Date: Mon, 28 Jul 2025 15:47:37 +0200
+Subject: kbuild: userprogs: use correct linker when mixing clang and GNU ld
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+commit 936599ca514973d44a766b7376c6bbdc96b6a8cc upstream.
+
+The userprogs infrastructure does not expect clang being used with GNU ld
+and in that case uses /usr/bin/ld for linking, not the configured $(LD).
+This fallback is problematic as it will break when cross-compiling.
+Mixing clang and GNU ld is used for example when building for SPARC64,
+as ld.lld is not sufficient; see Documentation/kbuild/llvm.rst.
+
+Relax the check around --ld-path so it gets used for all linkers.
+
+Fixes: dfc1b168a8c4 ("kbuild: userprogs: use correct lld when linking through clang")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+[nathan: Work around wrapping '--ld-path' in cc-option in older stable
+ branches due to older minimum LLVM version]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -1130,7 +1130,7 @@ KBUILD_USERCFLAGS += $(filter -m32 -m64
+ KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS))
+
+ # userspace programs are linked via the compiler, use the correct linker
+-ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_LD_IS_LLD),yy)
++ifdef CONFIG_CC_IS_CLANG
+ KBUILD_USERLDFLAGS += $(call cc-option, --ld-path=$(LD))
+ endif
+
--- /dev/null
+From stable+bounces-165651-greg=kroah.com@vger.kernel.org Thu Jul 31 13:24:31 2025
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Thu, 31 Jul 2025 13:24:00 +0200
+Subject: mptcp: do not queue data on closed subflows
+To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org
+Cc: Paolo Abeni <pabeni@redhat.com>, sashal@kernel.org, Dipanjan Das <mail.dipanjan.das@gmail.com>, Mat Martineau <mathew.j.martineau@linux.intel.com>, "David S. Miller" <davem@davemloft.net>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Message-ID: <20250731112353.2638719-14-matttbe@kernel.org>
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit c886d70286bf3ad411eb3d689328a67f7102c6ae upstream.
+
+Dipanjan reported a syzbot splat at close time:
+
+WARNING: CPU: 1 PID: 10818 at net/ipv4/af_inet.c:153
+inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153
+Modules linked in: uio_ivshmem(OE) uio(E)
+CPU: 1 PID: 10818 Comm: kworker/1:16 Tainted: G OE
+5.19.0-rc6-g2eae0556bb9d #2
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+1.13.0-1ubuntu1.1 04/01/2014
+Workqueue: events mptcp_worker
+RIP: 0010:inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153
+Code: 21 02 00 00 41 8b 9c 24 28 02 00 00 e9 07 ff ff ff e8 34 4d 91
+f9 89 ee 4c 89 e7 e8 4a 47 60 ff e9 a6 fc ff ff e8 20 4d 91 f9 <0f> 0b
+e9 84 fe ff ff e8 14 4d 91 f9 0f 0b e9 d4 fd ff ff e8 08 4d
+RSP: 0018:ffffc9001b35fa78 EFLAGS: 00010246
+RAX: 0000000000000000 RBX: 00000000002879d0 RCX: ffff8881326f3b00
+RDX: 0000000000000000 RSI: ffff8881326f3b00 RDI: 0000000000000002
+RBP: ffff888179662674 R08: ffffffff87e983a0 R09: 0000000000000000
+R10: 0000000000000005 R11: 00000000000004ea R12: ffff888179662400
+R13: ffff888179662428 R14: 0000000000000001 R15: ffff88817e38e258
+FS: 0000000000000000(0000) GS:ffff8881f5f00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000020007bc0 CR3: 0000000179592000 CR4: 0000000000150ee0
+Call Trace:
+ <TASK>
+ __sk_destruct+0x4f/0x8e0 net/core/sock.c:2067
+ sk_destruct+0xbd/0xe0 net/core/sock.c:2112
+ __sk_free+0xef/0x3d0 net/core/sock.c:2123
+ sk_free+0x78/0xa0 net/core/sock.c:2134
+ sock_put include/net/sock.h:1927 [inline]
+ __mptcp_close_ssk+0x50f/0x780 net/mptcp/protocol.c:2351
+ __mptcp_destroy_sock+0x332/0x760 net/mptcp/protocol.c:2828
+ mptcp_worker+0x5d2/0xc90 net/mptcp/protocol.c:2586
+ process_one_work+0x9cc/0x1650 kernel/workqueue.c:2289
+ worker_thread+0x623/0x1070 kernel/workqueue.c:2436
+ kthread+0x2e9/0x3a0 kernel/kthread.c:376
+ ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
+ </TASK>
+
+The root cause of the problem is that an mptcp-level (re)transmit can
+race with mptcp_close() and the packet scheduler checks the subflow
+state before acquiring the socket lock: we can try to (re)transmit on
+an already closed ssk.
+
+Fix the issue checking again the subflow socket status under the
+subflow socket lock protection. Additionally add the missing check
+for the fallback-to-tcp case.
+
+Fixes: d5f49190def6 ("mptcp: allow picking different xmit subflows")
+Reported-by: Dipanjan Das <mail.dipanjan.das@gmail.com>
+Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 8 +++++++-
+ net/mptcp/protocol.h | 11 +++++++----
+ 2 files changed, 14 insertions(+), 5 deletions(-)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -1350,6 +1350,9 @@ static int mptcp_sendmsg_frag(struct soc
+ info->limit > dfrag->data_len))
+ return 0;
+
++ if (unlikely(!__tcp_can_send(ssk)))
++ return -EAGAIN;
++
+ /* compute send limit */
+ info->mss_now = tcp_send_mss(ssk, &info->size_goal, info->flags);
+ copy = info->size_goal;
+@@ -1512,7 +1515,8 @@ static struct sock *mptcp_subflow_get_se
+ if (__mptcp_check_fallback(msk)) {
+ if (!msk->first)
+ return NULL;
+- return sk_stream_memory_free(msk->first) ? msk->first : NULL;
++ return __tcp_can_send(msk->first) &&
++ sk_stream_memory_free(msk->first) ? msk->first : NULL;
+ }
+
+ /* re-use last subflow, if the burst allow that */
+@@ -1638,6 +1642,8 @@ void __mptcp_push_pending(struct sock *s
+
+ ret = mptcp_sendmsg_frag(sk, ssk, dfrag, &info);
+ if (ret <= 0) {
++ if (ret == -EAGAIN)
++ continue;
+ mptcp_push_release(ssk, &info);
+ goto out;
+ }
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -599,16 +599,19 @@ void mptcp_info2sockaddr(const struct mp
+ struct sockaddr_storage *addr,
+ unsigned short family);
+
+-static inline bool __mptcp_subflow_active(struct mptcp_subflow_context *subflow)
++static inline bool __tcp_can_send(const struct sock *ssk)
+ {
+- struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
++ /* only send if our side has not closed yet */
++ return ((1 << inet_sk_state_load(ssk)) & (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT));
++}
+
++static inline bool __mptcp_subflow_active(struct mptcp_subflow_context *subflow)
++{
+ /* can't send if JOIN hasn't completed yet (i.e. is usable for mptcp) */
+ if (subflow->request_join && !subflow->fully_established)
+ return false;
+
+- /* only send if our side has not closed yet */
+- return ((1 << ssk->sk_state) & (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT));
++ return __tcp_can_send(mptcp_subflow_tcp_sock(subflow));
+ }
+
+ void mptcp_subflow_set_active(struct mptcp_subflow_context *subflow);
--- /dev/null
+From stable+bounces-165650-greg=kroah.com@vger.kernel.org Thu Jul 31 13:24:29 2025
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:59 +0200
+Subject: mptcp: drop unused sk in mptcp_push_release
+To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org
+Cc: Geliang Tang <geliang.tang@suse.com>, sashal@kernel.org, Matthieu Baerts <matthieu.baerts@tessares.net>, Mat Martineau <mathew.j.martineau@linux.intel.com>, Jakub Kicinski <kuba@kernel.org>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Message-ID: <20250731112353.2638719-13-matttbe@kernel.org>
+
+From: Geliang Tang <geliang.tang@suse.com>
+
+commit b8e0def397d7753206b1290e32f73b299a59984c upstream.
+
+Since mptcp_set_timeout() had removed from mptcp_push_release() in
+commit 33d41c9cd74c5 ("mptcp: more accurate timeout"), the argument
+sk in mptcp_push_release() became useless. Let's drop it.
+
+Fixes: 33d41c9cd74c5 ("mptcp: more accurate timeout")
+Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Geliang Tang <geliang.tang@suse.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: c886d70286bf ("mptcp: do not queue data on closed subflows")
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -1568,8 +1568,7 @@ static struct sock *mptcp_subflow_get_se
+ return NULL;
+ }
+
+-static void mptcp_push_release(struct sock *sk, struct sock *ssk,
+- struct mptcp_sendmsg_info *info)
++static void mptcp_push_release(struct sock *ssk, struct mptcp_sendmsg_info *info)
+ {
+ tcp_push(ssk, 0, info->mss_now, tcp_sk(ssk)->nonagle, info->size_goal);
+ release_sock(ssk);
+@@ -1626,7 +1625,7 @@ void __mptcp_push_pending(struct sock *s
+ * the last round, release prev_ssk
+ */
+ if (ssk != prev_ssk && prev_ssk)
+- mptcp_push_release(sk, prev_ssk, &info);
++ mptcp_push_release(prev_ssk, &info);
+ if (!ssk)
+ goto out;
+
+@@ -1639,7 +1638,7 @@ void __mptcp_push_pending(struct sock *s
+
+ ret = mptcp_sendmsg_frag(sk, ssk, dfrag, &info);
+ if (ret <= 0) {
+- mptcp_push_release(sk, ssk, &info);
++ mptcp_push_release(ssk, &info);
+ goto out;
+ }
+
+@@ -1654,7 +1653,7 @@ void __mptcp_push_pending(struct sock *s
+
+ /* at this point we held the socket lock for the last subflow we used */
+ if (ssk)
+- mptcp_push_release(sk, ssk, &info);
++ mptcp_push_release(ssk, &info);
+
+ out:
+ /* ensure the rtx timer is running */
--- /dev/null
+From stable+bounces-165647-greg=kroah.com@vger.kernel.org Thu Jul 31 13:24:24 2025
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:56 +0200
+Subject: mptcp: fix error mibs accounting
+To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org
+Cc: Paolo Abeni <pabeni@redhat.com>, sashal@kernel.org, Mat Martineau <mathew.j.martineau@linux.intel.com>, Jakub Kicinski <kuba@kernel.org>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Message-ID: <20250731112353.2638719-10-matttbe@kernel.org>
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 0c1f78a49af721490a5ad70b73e8b4d382465dae upstream.
+
+The current accounting for MP_FAIL and FASTCLOSE is not very
+accurate: both can be increased even when the related option is
+not really sent. Move the accounting into the correct place.
+
+Fixes: eb7f33654dc1 ("mptcp: add the mibs for MP_FAIL")
+Fixes: 1e75629cb964 ("mptcp: add the mibs for MP_FASTCLOSE")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ Conflicts, because commit f284c0c77321 ("mptcp: implement fastclose
+ xmit path") is not in this version. That's OK, the new helper added
+ by this commit doesn't need to be modified. ]
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/options.c | 1 +
+ net/mptcp/subflow.c | 4 +---
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+--- a/net/mptcp/options.c
++++ b/net/mptcp/options.c
+@@ -793,6 +793,7 @@ static bool mptcp_established_options_mp
+ opts->fail_seq = subflow->map_seq;
+
+ pr_debug("MP_FAIL fail_seq=%llu\n", opts->fail_seq);
++ MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPFAILTX);
+
+ return true;
+ }
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -963,10 +963,8 @@ static enum mapping_status validate_data
+ subflow->map_data_csum);
+ if (unlikely(csum)) {
+ MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DATACSUMERR);
+- if (subflow->mp_join || subflow->valid_csum_seen) {
++ if (subflow->mp_join || subflow->valid_csum_seen)
+ subflow->send_mp_fail = 1;
+- MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_MPFAILTX);
+- }
+ return subflow->mp_join ? MAPPING_INVALID : MAPPING_DUMMY;
+ }
+
--- /dev/null
+From stable+bounces-165648-greg=kroah.com@vger.kernel.org Thu Jul 31 13:24:25 2025
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:57 +0200
+Subject: mptcp: introduce MAPPING_BAD_CSUM
+To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org
+Cc: Paolo Abeni <pabeni@redhat.com>, sashal@kernel.org, Mat Martineau <mathew.j.martineau@linux.intel.com>, Jakub Kicinski <kuba@kernel.org>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Message-ID: <20250731112353.2638719-11-matttbe@kernel.org>
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 31bf11de146c3f8892093ff39f8f9b3069d6a852 upstream.
+
+This allow moving a couple of conditional out of the fast path,
+making the code more easy to follow and will simplify the next
+patch.
+
+Fixes: ae66fb2ba6c3 ("mptcp: Do TCP fallback on early DSS checksum failure")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ Conflicts in subflow.c, because commit 0348c690ed37 ("mptcp: add the
+ fallback check") is not in this version. This commit is linked to a
+ new feature, changing the context around. The new condition can still
+ be added at the same place. ]
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/subflow.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -848,7 +848,8 @@ enum mapping_status {
+ MAPPING_INVALID,
+ MAPPING_EMPTY,
+ MAPPING_DATA_FIN,
+- MAPPING_DUMMY
++ MAPPING_DUMMY,
++ MAPPING_BAD_CSUM
+ };
+
+ static void dbg_bad_map(struct mptcp_subflow_context *subflow, u32 ssn)
+@@ -963,9 +964,7 @@ static enum mapping_status validate_data
+ subflow->map_data_csum);
+ if (unlikely(csum)) {
+ MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DATACSUMERR);
+- if (subflow->mp_join || subflow->valid_csum_seen)
+- subflow->send_mp_fail = 1;
+- return subflow->mp_join ? MAPPING_INVALID : MAPPING_DUMMY;
++ return MAPPING_BAD_CSUM;
+ }
+
+ subflow->valid_csum_seen = 1;
+@@ -1188,10 +1187,8 @@ static bool subflow_check_data_avail(str
+
+ status = get_mapping_status(ssk, msk);
+ trace_subflow_check_data_avail(status, skb_peek(&ssk->sk_receive_queue));
+- if (unlikely(status == MAPPING_INVALID))
+- goto fallback;
+-
+- if (unlikely(status == MAPPING_DUMMY))
++ if (unlikely(status == MAPPING_INVALID || status == MAPPING_DUMMY ||
++ status == MAPPING_BAD_CSUM))
+ goto fallback;
+
+ if (status != MAPPING_OK)
+@@ -1232,7 +1229,10 @@ no_data:
+
+ fallback:
+ /* RFC 8684 section 3.7. */
+- if (subflow->send_mp_fail) {
++ if (status == MAPPING_BAD_CSUM &&
++ (subflow->mp_join || subflow->valid_csum_seen)) {
++ subflow->send_mp_fail = 1;
++
+ if (mptcp_has_another_subflow(ssk) ||
+ !READ_ONCE(msk->allow_infinite_fallback)) {
+ while ((skb = skb_peek(&ssk->sk_receive_queue)))
--- /dev/null
+From 886e67100b904cb1b106ed1dfa8a60696aff519a Mon Sep 17 00:00:00 2001
+From: Nirmal Patel <nirmal.patel@linux.intel.com>
+Date: Wed, 11 May 2022 02:57:06 -0700
+Subject: PCI: vmd: Assign VMD IRQ domain before enumeration
+
+From: Nirmal Patel <nirmal.patel@linux.intel.com>
+
+commit 886e67100b904cb1b106ed1dfa8a60696aff519a upstream.
+
+During the boot process all the PCI devices are assigned default PCI-MSI
+IRQ domain including VMD endpoint devices. If interrupt-remapping is
+enabled by IOMMU, the PCI devices except VMD get new INTEL-IR-MSI IRQ
+domain. And VMD is supposed to create and assign a separate VMD-MSI IRQ
+domain for its child devices in order to support MSI-X remapping
+capabilities.
+
+Now when MSI-X remapping in VMD is disabled in order to improve
+performance, VMD skips VMD-MSI IRQ domain assignment process to its
+child devices. Thus the devices behind VMD get default PCI-MSI IRQ
+domain instead of INTEL-IR-MSI IRQ domain when VMD creates root bus and
+configures child devices.
+
+As a result host OS fails to boot and DMAR errors were observed when
+interrupt remapping was enabled on Intel Icelake CPUs. For instance:
+
+ DMAR: DRHD: handling fault status reg 2
+ DMAR: [INTR-REMAP] Request device [0xe2:0x00.0] fault index 0xa00 [fault reason 0x25] Blocked a compatibility format interrupt request
+
+To fix this issue, dev_msi_info struct in dev struct maintains correct
+value of IRQ domain. VMD will use this information to assign proper IRQ
+domain to its child devices when it doesn't create a separate IRQ domain.
+
+Link: https://lore.kernel.org/r/20220511095707.25403-2-nirmal.patel@linux.intel.com
+Signed-off-by: Nirmal Patel <nirmal.patel@linux.intel.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+[ This patch has already been backported to the Ubuntu 5.15 kernel
+ and fixes boot issues on Intel platforms with VMD rev 04,
+ confirmed on version 5.15.189. ]
+Signed-off-by: Artur Piechocki <artur.piechocki@open-e.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/vmd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -799,6 +799,9 @@ static int vmd_enable_domain(struct vmd_
+ vmd_attach_resources(vmd);
+ if (vmd->irq_domain)
+ dev_set_msi_domain(&vmd->bus->dev, vmd->irq_domain);
++ else
++ dev_set_msi_domain(&vmd->bus->dev,
++ dev_get_msi_domain(&vmd->dev->dev));
+
+ WARN(sysfs_create_link(&vmd->dev->dev.kobj, &vmd->bus->dev.kobj,
+ "domain"), "Can't create symlink to domain\n");
--- /dev/null
+From df008598b3a00be02a8051fde89ca0fbc416bd55 Mon Sep 17 00:00:00 2001
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Thu, 3 Apr 2025 14:10:24 -0700
+Subject: sch_drr: make drr_qlen_notify() idempotent
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+commit df008598b3a00be02a8051fde89ca0fbc416bd55 upstream.
+
+drr_qlen_notify() always deletes the DRR class from its active list
+with list_del(), therefore, it is not idempotent and not friendly
+to its callers, like fq_codel_dequeue().
+
+Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers'
+life. Also change other list_del()'s to list_del_init() just to be
+extra safe.
+
+Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250403211033.166059-3-xiyou.wangcong@gmail.com
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Siddh Raman Pant <siddh.raman.pant@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_drr.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/net/sched/sch_drr.c
++++ b/net/sched/sch_drr.c
+@@ -111,6 +111,7 @@ static int drr_change_class(struct Qdisc
+ if (cl == NULL)
+ return -ENOBUFS;
+
++ INIT_LIST_HEAD(&cl->alist);
+ cl->common.classid = classid;
+ cl->quantum = quantum;
+ cl->qdisc = qdisc_create_dflt(sch->dev_queue,
+@@ -235,7 +236,7 @@ static void drr_qlen_notify(struct Qdisc
+ {
+ struct drr_class *cl = (struct drr_class *)arg;
+
+- list_del(&cl->alist);
++ list_del_init(&cl->alist);
+ }
+
+ static int drr_dump_class(struct Qdisc *sch, unsigned long arg,
+@@ -402,7 +403,7 @@ static struct sk_buff *drr_dequeue(struc
+ if (unlikely(skb == NULL))
+ goto out;
+ if (cl->qdisc->q.qlen == 0)
+- list_del(&cl->alist);
++ list_del_init(&cl->alist);
+
+ bstats_update(&cl->bstats, skb);
+ qdisc_bstats_update(sch, skb);
+@@ -443,7 +444,7 @@ static void drr_reset_qdisc(struct Qdisc
+ for (i = 0; i < q->clhash.hashsize; i++) {
+ hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
+ if (cl->qdisc->q.qlen)
+- list_del(&cl->alist);
++ list_del_init(&cl->alist);
+ qdisc_reset(cl->qdisc);
+ }
+ }
--- /dev/null
+From 3769478610135e82b262640252d90f6efb05be71 Mon Sep 17 00:00:00 2001
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Mon, 28 Apr 2025 16:29:54 -0700
+Subject: sch_htb: make htb_deactivate() idempotent
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+commit 3769478610135e82b262640252d90f6efb05be71 upstream.
+
+Alan reported a NULL pointer dereference in htb_next_rb_node()
+after we made htb_qlen_notify() idempotent.
+
+It turns out in the following case it introduced some regression:
+
+htb_dequeue_tree():
+ |-> fq_codel_dequeue()
+ |-> qdisc_tree_reduce_backlog()
+ |-> htb_qlen_notify()
+ |-> htb_deactivate()
+ |-> htb_next_rb_node()
+ |-> htb_deactivate()
+
+For htb_next_rb_node(), after calling the 1st htb_deactivate(), the
+clprio[prio]->ptr could be already set to NULL, which means
+htb_next_rb_node() is vulnerable here.
+
+For htb_deactivate(), although we checked qlen before calling it, in
+case of qlen==0 after qdisc_tree_reduce_backlog(), we may call it again
+which triggers the warning inside.
+
+To fix the issues here, we need to:
+
+1) Make htb_deactivate() idempotent, that is, simply return if we
+ already call it before.
+2) Make htb_next_rb_node() safe against ptr==NULL.
+
+Many thanks to Alan for testing and for the reproducer.
+
+Fixes: 5ba8b837b522 ("sch_htb: make htb_qlen_notify() idempotent")
+Reported-by: Alan J. Wylie <alan@wylie.me.uk>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Link: https://patch.msgid.link/20250428232955.1740419-2-xiyou.wangcong@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Siddh Raman Pant <siddh.raman.pant@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_htb.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+--- a/net/sched/sch_htb.c
++++ b/net/sched/sch_htb.c
+@@ -345,7 +345,8 @@ static void htb_add_to_wait_tree(struct
+ */
+ static inline void htb_next_rb_node(struct rb_node **n)
+ {
+- *n = rb_next(*n);
++ if (*n)
++ *n = rb_next(*n);
+ }
+
+ /**
+@@ -606,8 +607,8 @@ static inline void htb_activate(struct h
+ */
+ static inline void htb_deactivate(struct htb_sched *q, struct htb_class *cl)
+ {
+- WARN_ON(!cl->prio_activity);
+-
++ if (!cl->prio_activity)
++ return;
+ htb_deactivate_prios(q, cl);
+ cl->prio_activity = 0;
+ }
+@@ -1506,8 +1507,6 @@ static void htb_qlen_notify(struct Qdisc
+ {
+ struct htb_class *cl = (struct htb_class *)arg;
+
+- if (!cl->prio_activity)
+- return;
+ htb_deactivate(qdisc_priv(sch), cl);
+ }
+
+@@ -1762,8 +1761,7 @@ static int htb_delete(struct Qdisc *sch,
+ if (cl->parent)
+ cl->parent->children--;
+
+- if (cl->prio_activity)
+- htb_deactivate(q, cl);
++ htb_deactivate(q, cl);
+
+ if (cl->cmode != HTB_CAN_SEND)
+ htb_safe_rb_erase(&cl->pq_node,
+@@ -1975,8 +1973,7 @@ static int htb_change_class(struct Qdisc
+ /* turn parent into inner node */
+ qdisc_purge_queue(parent->leaf.q);
+ parent_qdisc = parent->leaf.q;
+- if (parent->prio_activity)
+- htb_deactivate(q, parent);
++ htb_deactivate(q, parent);
+
+ /* remove from evt list because of level change */
+ if (parent->cmode != HTB_CAN_SEND) {
--- /dev/null
+From 6de7435e6b81fe52c0ab4c7e181f6b5decd18eb1 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Wed, 23 Jul 2025 19:58:50 +0300
+Subject: scsi: ufs: ufs-pci: Fix default runtime and system PM levels
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 6de7435e6b81fe52c0ab4c7e181f6b5decd18eb1 upstream.
+
+Intel MTL-like host controllers support auto-hibernate. Using
+auto-hibernate with manual (driver initiated) hibernate produces more
+complex operation. For example, the host controller will have to exit
+auto-hibernate simply to allow the driver to enter hibernate state
+manually. That is not recommended.
+
+The default rpm_lvl and spm_lvl is 3, which includes manual hibernate.
+
+Change the default values to 2, which does not.
+
+Note, to be simpler to backport to stable kernels, utilize the UFS PCI
+driver's ->late_init() call back. Recent commits have made it possible
+to set up a controller-specific default in the regular ->init() call
+back, but not all stable kernels have those changes.
+
+Fixes: 4049f7acef3e ("scsi: ufs: ufs-pci: Add support for Intel MTL")
+Cc: stable@vger.kernel.org
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20250723165856.145750-3-adrian.hunter@intel.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/ufs/ufshcd-pci.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/ufs/ufshcd-pci.c
++++ b/drivers/scsi/ufs/ufshcd-pci.c
+@@ -454,10 +454,23 @@ static int ufs_intel_adl_init(struct ufs
+ return ufs_intel_common_init(hba);
+ }
+
++static void ufs_intel_mtl_late_init(struct ufs_hba *hba)
++{
++ hba->rpm_lvl = UFS_PM_LVL_2;
++ hba->spm_lvl = UFS_PM_LVL_2;
++}
++
+ static int ufs_intel_mtl_init(struct ufs_hba *hba)
+ {
++ struct ufs_host *ufs_host;
++ int err;
++
+ hba->caps |= UFSHCD_CAP_CRYPTO | UFSHCD_CAP_WB_EN;
+- return ufs_intel_common_init(hba);
++ err = ufs_intel_common_init(hba);
++ /* Get variant after it is set in ufs_intel_common_init() */
++ ufs_host = ufshcd_get_variant(hba);
++ ufs_host->late_init = ufs_intel_mtl_late_init;
++ return err;
+ }
+
+ static struct ufs_hba_variant_ops ufs_intel_cnl_hba_vops = {
--- /dev/null
+From 4428ddea832cfdb63e476eb2e5c8feb5d36057fe Mon Sep 17 00:00:00 2001
+From: Archana Patni <archana.patni@intel.com>
+Date: Wed, 23 Jul 2025 19:58:49 +0300
+Subject: scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers
+
+From: Archana Patni <archana.patni@intel.com>
+
+commit 4428ddea832cfdb63e476eb2e5c8feb5d36057fe upstream.
+
+UFSHCD core disables the UIC completion interrupt when issuing UIC
+hibernation commands, and re-enables it afterwards if it was enabled to
+start with, refer ufshcd_uic_pwr_ctrl(). For Intel MTL-like host
+controllers, accessing the register to re-enable the interrupt disrupts
+the state transition.
+
+Use hibern8_notify variant operation to disable the interrupt during the
+entire hibernation, thereby preventing the disruption.
+
+Fixes: 4049f7acef3e ("scsi: ufs: ufs-pci: Add support for Intel MTL")
+Cc: stable@vger.kernel.org
+Signed-off-by: Archana Patni <archana.patni@intel.com>
+Link: https://lore.kernel.org/r/20250723165856.145750-2-adrian.hunter@intel.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/ufs/ufshcd-pci.c | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+--- a/drivers/scsi/ufs/ufshcd-pci.c
++++ b/drivers/scsi/ufs/ufshcd-pci.c
+@@ -203,6 +203,32 @@ out:
+ return ret;
+ }
+
++static void ufs_intel_ctrl_uic_compl(struct ufs_hba *hba, bool enable)
++{
++ u32 set = ufshcd_readl(hba, REG_INTERRUPT_ENABLE);
++
++ if (enable)
++ set |= UIC_COMMAND_COMPL;
++ else
++ set &= ~UIC_COMMAND_COMPL;
++ ufshcd_writel(hba, set, REG_INTERRUPT_ENABLE);
++}
++
++static void ufs_intel_mtl_h8_notify(struct ufs_hba *hba,
++ enum uic_cmd_dme cmd,
++ enum ufs_notify_change_status status)
++{
++ /*
++ * Disable UIC COMPL INTR to prevent access to UFSHCI after
++ * checking HCS.UPMCRS
++ */
++ if (status == PRE_CHANGE && cmd == UIC_CMD_DME_HIBER_ENTER)
++ ufs_intel_ctrl_uic_compl(hba, false);
++
++ if (status == POST_CHANGE && cmd == UIC_CMD_DME_HIBER_EXIT)
++ ufs_intel_ctrl_uic_compl(hba, true);
++}
++
+ #define INTEL_ACTIVELTR 0x804
+ #define INTEL_IDLELTR 0x808
+
+@@ -476,6 +502,7 @@ static struct ufs_hba_variant_ops ufs_in
+ .init = ufs_intel_mtl_init,
+ .exit = ufs_intel_common_exit,
+ .hce_enable_notify = ufs_intel_hce_enable_notify,
++ .hibern8_notify = ufs_intel_mtl_h8_notify,
+ .link_startup_notify = ufs_intel_link_startup_notify,
+ .resume = ufs_intel_resume,
+ .device_reset = ufs_intel_device_reset,
--- /dev/null
+From stable+bounces-165646-greg=kroah.com@vger.kernel.org Thu Jul 31 13:24:22 2025
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:55 +0200
+Subject: selftests: mptcp: add missing join check
+To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org
+Cc: Matthieu Baerts <matthieu.baerts@tessares.net>, sashal@kernel.org, Paolo Abeni <pabeni@redhat.com>, Mat Martineau <mathew.j.martineau@linux.intel.com>, Jakub Kicinski <kuba@kernel.org>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Message-ID: <20250731112353.2638719-9-matttbe@kernel.org>
+
+From: Matthieu Baerts <matthieu.baerts@tessares.net>
+
+commit 857898eb4b28daf3faca3ae334c78b2bb141475e upstream.
+
+This function also writes the name of the test with its ID, making clear
+a new test has been executed.
+
+Without that, the ADD_ADDR results from this test was appended at the
+end of the previous test causing confusions. Especially when the second
+test was failing, we had:
+
+ 17 signal invalid addresses syn[ ok ] - synack[ ok ] - ack[ ok ]
+ add[ ok ] - echo [ ok ]
+ add[fail] got 2 ADD_ADDR[s] expected 3
+
+In fact, this 17th test was OK but not the 18th one.
+
+Now we have:
+
+ 17 signal invalid addresses syn[ ok ] - synack[ ok ] - ack[ ok ]
+ add[ ok ] - echo [ ok ]
+ 18 signal addresses race test syn[fail] got 2 JOIN[s] syn expected 3
+ - synack[fail] got 2 JOIN[s] synack expected
+ - ack[fail] got 2 JOIN[s] ack expected 3
+ add[fail] got 2 ADD_ADDR[s] expected 3
+
+Fixes: 33c563ad28e3 ("selftests: mptcp: add_addr and echo race test")
+Reported-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ Conflict in mptcp_join.sh, because commit 86e39e04482b ("mptcp: keep
+ track of local endpoint still available for each msk") is not in this
+ version and changed the context. The same line can still be applied at
+ the same place. ]
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_join.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+@@ -1138,6 +1138,7 @@ signal_address_tests()
+ ip netns exec $ns2 ./pm_nl_ctl add 10.0.3.2 flags signal
+ ip netns exec $ns2 ./pm_nl_ctl add 10.0.4.2 flags signal
+ run_tests $ns1 $ns2 10.0.1.1
++ chk_join_nr "signal addresses race test" 3 3 3
+ chk_add_nr 4 4
+ }
+
--- /dev/null
+From stable+bounces-165497-greg=kroah.com@vger.kernel.org Wed Jul 30 12:28:53 2025
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Wed, 30 Jul 2025 12:28:09 +0200
+Subject: selftests: mptcp: connect: also cover alt modes
+To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org
+Cc: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, sashal@kernel.org, Geliang Tang <geliang@kernel.org>, Jakub Kicinski <kuba@kernel.org>
+Message-ID: <20250730102806.1405622-7-matttbe@kernel.org>
+
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+
+[ Upstream commit 37848a456fc38c191aedfe41f662cc24db8c23d9 ]
+
+The "mmap" and "sendfile" alternate modes for mptcp_connect.sh/.c are
+available from the beginning, but only tested when mptcp_connect.sh is
+manually launched with "-m mmap" or "-m sendfile", not via the
+kselftests helpers.
+
+The MPTCP CI was manually running "mptcp_connect.sh -m mmap", but not
+"-m sendfile". Plus other CIs, especially the ones validating the stable
+releases, were not validating these alternate modes.
+
+To make sure these modes are validated by these CIs, add two new test
+programs executing mptcp_connect.sh with the alternate modes.
+
+Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp")
+Cc: stable@vger.kernel.org
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20250715-net-mptcp-sft-connect-alt-v2-1-8230ddd82454@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ Drop userspace_pm.sh from TEST_PROGS ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/Makefile | 3 ++-
+ tools/testing/selftests/net/mptcp/mptcp_connect_mmap.sh | 5 +++++
+ tools/testing/selftests/net/mptcp/mptcp_connect_sendfile.sh | 5 +++++
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+ create mode 100755 tools/testing/selftests/net/mptcp/mptcp_connect_mmap.sh
+ create mode 100755 tools/testing/selftests/net/mptcp/mptcp_connect_sendfile.sh
+
+--- a/tools/testing/selftests/net/mptcp/Makefile
++++ b/tools/testing/selftests/net/mptcp/Makefile
+@@ -5,7 +5,8 @@ KSFT_KHDR_INSTALL := 1
+
+ CFLAGS = -Wall -Wl,--no-as-needed -O2 -g -I$(top_srcdir)/usr/include
+
+-TEST_PROGS := mptcp_connect.sh pm_netlink.sh mptcp_join.sh diag.sh \
++TEST_PROGS := mptcp_connect.sh mptcp_connect_mmap.sh mptcp_connect_sendfile.sh \
++ pm_netlink.sh mptcp_join.sh diag.sh \
+ simult_flows.sh mptcp_sockopt.sh
+
+ TEST_GEN_FILES = mptcp_connect pm_nl_ctl
+--- /dev/null
++++ b/tools/testing/selftests/net/mptcp/mptcp_connect_mmap.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++# SPDX-License-Identifier: GPL-2.0
++
++MPTCP_LIB_KSFT_TEST="$(basename "${0}" .sh)" \
++ "$(dirname "${0}")/mptcp_connect.sh" -m mmap "${@}"
+--- /dev/null
++++ b/tools/testing/selftests/net/mptcp/mptcp_connect_sendfile.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++# SPDX-License-Identifier: GPL-2.0
++
++MPTCP_LIB_KSFT_TEST="$(basename "${0}" .sh)" \
++ "$(dirname "${0}")/mptcp_connect.sh" -m sendfile "${@}"
--- /dev/null
+From stable+bounces-165498-greg=kroah.com@vger.kernel.org Wed Jul 30 12:28:54 2025
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Wed, 30 Jul 2025 12:28:10 +0200
+Subject: selftests: mptcp: connect: also cover checksum
+To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org
+Cc: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, sashal@kernel.org, Geliang Tang <geliang@kernel.org>, Jakub Kicinski <kuba@kernel.org>
+Message-ID: <20250730102806.1405622-8-matttbe@kernel.org>
+
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+
+commit fdf0f60a2bb02ba581d9e71d583e69dd0714a521 upstream.
+
+The checksum mode has been added a while ago, but it is only validated
+when manually launching mptcp_connect.sh with "-C".
+
+The different CIs were then not validating these MPTCP Connect tests
+with checksum enabled. To make sure they do, add a new test program
+executing mptcp_connect.sh with the checksum mode.
+
+Fixes: 94d66ba1d8e4 ("selftests: mptcp: enable checksum in mptcp_connect.sh")
+Cc: stable@vger.kernel.org
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20250715-net-mptcp-sft-connect-alt-v2-2-8230ddd82454@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ Conflict in Makefile, in the context, because userspace_pm.sh test
+ has been introduced later, in commit 3ddabc433670 ("selftests: mptcp:
+ validate userspace PM tests by default"), which is not in this
+ version. ]
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/Makefile | 2 +-
+ tools/testing/selftests/net/mptcp/mptcp_connect_checksum.sh | 5 +++++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+ create mode 100755 tools/testing/selftests/net/mptcp/mptcp_connect_checksum.sh
+
+--- a/tools/testing/selftests/net/mptcp/Makefile
++++ b/tools/testing/selftests/net/mptcp/Makefile
+@@ -6,7 +6,7 @@ KSFT_KHDR_INSTALL := 1
+ CFLAGS = -Wall -Wl,--no-as-needed -O2 -g -I$(top_srcdir)/usr/include
+
+ TEST_PROGS := mptcp_connect.sh mptcp_connect_mmap.sh mptcp_connect_sendfile.sh \
+- pm_netlink.sh mptcp_join.sh diag.sh \
++ mptcp_connect_checksum.sh pm_netlink.sh mptcp_join.sh diag.sh \
+ simult_flows.sh mptcp_sockopt.sh
+
+ TEST_GEN_FILES = mptcp_connect pm_nl_ctl
+--- /dev/null
++++ b/tools/testing/selftests/net/mptcp/mptcp_connect_checksum.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++# SPDX-License-Identifier: GPL-2.0
++
++MPTCP_LIB_KSFT_TEST="$(basename "${0}" .sh)" \
++ "$(dirname "${0}")/mptcp_connect.sh" -C "${@}"
--- /dev/null
+From stable+bounces-165649-greg=kroah.com@vger.kernel.org Thu Jul 31 13:24:27 2025
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Thu, 31 Jul 2025 13:23:58 +0200
+Subject: selftests: mptcp: Initialize variables to quiet gcc 12 warnings
+To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org
+Cc: Mat Martineau <mathew.j.martineau@linux.intel.com>, sashal@kernel.org, Paolo Abeni <pabeni@redhat.com>, Jakub Kicinski <kuba@kernel.org>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Message-ID: <20250731112353.2638719-12-matttbe@kernel.org>
+
+From: Mat Martineau <mathew.j.martineau@linux.intel.com>
+
+commit fd37c2ecb21f7aee04ccca5f561469f07d00063c upstream.
+
+In a few MPTCP selftest tools, gcc 12 complains that the 'sock' variable
+might be used uninitialized. This is a false positive because the only
+code path that could lead to uninitialized access is where getaddrinfo()
+fails, but the local xgetaddrinfo() wrapper exits if such a failure
+occurs.
+
+Initialize the 'sock' variable anyway to allow the tools to build with
+gcc 12.
+
+Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp")
+Acked-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ mptcp_inq.c and mptcp_sockopt.c are not in this version. The fix can
+ still be applied in mptcp_connect.c without conflicts. ]
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_connect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
++++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
+@@ -188,7 +188,7 @@ static void set_mark(int fd, uint32_t ma
+ static int sock_listen_mptcp(const char * const listenaddr,
+ const char * const port)
+ {
+- int sock;
++ int sock = -1;
+ struct addrinfo hints = {
+ .ai_protocol = IPPROTO_TCP,
+ .ai_socktype = SOCK_STREAM,
--- /dev/null
+From stable+bounces-165496-greg=kroah.com@vger.kernel.org Wed Jul 30 12:28:51 2025
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Wed, 30 Jul 2025 12:28:08 +0200
+Subject: selftests: mptcp: make sendfile selftest work
+To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org
+Cc: Florian Westphal <fw@strlen.de>, sashal@kernel.org, Xiumei Mu <xmu@redhat.com>, Mat Martineau <mathew.j.martineau@linux.intel.com>, "David S. Miller" <davem@davemloft.net>, "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Message-ID: <20250730102806.1405622-6-matttbe@kernel.org>
+
+From: Florian Westphal <fw@strlen.de>
+
+commit df9e03aec3b14970df05b72d54f8ac9da3ab29e1 upstream.
+
+When the selftest got added, sendfile() on mptcp sockets returned
+-EOPNOTSUPP, so running 'mptcp_connect.sh -m sendfile' failed
+immediately.
+
+This is no longer the case, but the script fails anyway due to timeout.
+Let the receiver know once the sender has sent all data, just like
+with '-m mmap' mode.
+
+v2: need to respect cfg_wait too, as pm_userspace.sh relied
+on -m sendfile to keep the connection open (Mat Martineau)
+
+Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp")
+Reported-by: Xiumei Mu <xmu@redhat.com>
+Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_connect.c | 26 ++++++++++++++--------
+ 1 file changed, 17 insertions(+), 9 deletions(-)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
++++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
+@@ -451,6 +451,18 @@ static void set_nonblock(int fd)
+ fcntl(fd, F_SETFL, flags | O_NONBLOCK);
+ }
+
++static void shut_wr(int fd)
++{
++ /* Close our write side, ev. give some time
++ * for address notification and/or checking
++ * the current status
++ */
++ if (cfg_wait)
++ usleep(cfg_wait);
++
++ shutdown(fd, SHUT_WR);
++}
++
+ static int copyfd_io_poll(int infd, int peerfd, int outfd, bool *in_closed_after_out)
+ {
+ struct pollfd fds = {
+@@ -528,14 +540,7 @@ static int copyfd_io_poll(int infd, int
+ /* ... and peer also closed already */
+ break;
+
+- /* ... but we still receive.
+- * Close our write side, ev. give some time
+- * for address notification and/or checking
+- * the current status
+- */
+- if (cfg_wait)
+- usleep(cfg_wait);
+- shutdown(peerfd, SHUT_WR);
++ shut_wr(peerfd);
+ } else {
+ if (errno == EINTR)
+ continue;
+@@ -666,7 +671,7 @@ static int copyfd_io_mmap(int infd, int
+ if (err)
+ return err;
+
+- shutdown(peerfd, SHUT_WR);
++ shut_wr(peerfd);
+
+ err = do_recvfile(peerfd, outfd);
+ *in_closed_after_out = true;
+@@ -690,6 +695,9 @@ static int copyfd_io_sendfile(int infd,
+ err = do_sendfile(infd, peerfd, size);
+ if (err)
+ return err;
++
++ shut_wr(peerfd);
++
+ err = do_recvfile(peerfd, outfd);
+ *in_closed_after_out = true;
+ }
net-sched-ets-use-old-nbands-while-purging-unused-classes.patch
kvm-vmx-flush-shadow-vmcs-on-emergency-reboot.patch
btrfs-populate-otime-when-logging-an-inode-item.patch
+sch_drr-make-drr_qlen_notify-idempotent.patch
+codel-remove-sch-q.qlen-check-before-qdisc_tree_reduce_backlog.patch
+sch_htb-make-htb_deactivate-idempotent.patch
+pci-vmd-assign-vmd-irq-domain-before-enumeration.patch
+acpi-processor-idle-check-acpi_fetch_acpi_dev-return-value.patch
+kbuild-userprogs-use-correct-linker-when-mixing-clang-and-gnu-ld.patch
+selftests-mptcp-make-sendfile-selftest-work.patch
+selftests-mptcp-connect-also-cover-alt-modes.patch
+selftests-mptcp-connect-also-cover-checksum.patch
+selftests-mptcp-add-missing-join-check.patch
+mptcp-fix-error-mibs-accounting.patch
+mptcp-introduce-mapping_bad_csum.patch
+selftests-mptcp-initialize-variables-to-quiet-gcc-12-warnings.patch
+mptcp-drop-unused-sk-in-mptcp_push_release.patch
+mptcp-do-not-queue-data-on-closed-subflows.patch
+scsi-ufs-ufs-pci-fix-hibernate-state-transition-for-intel-mtl-like-host-controllers.patch
+scsi-ufs-ufs-pci-fix-default-runtime-and-system-pm-levels.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
