--- /dev/null
+From 4144a04827f4dc9cb978a01b181895cd7ddfc0ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 15:52:02 +0200
+Subject: dm-integrity: limit MAX_TAG_SIZE to 255
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ]
+
+MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size
+= ic->tag_size" assignment. We need to limit it to 255.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-integrity.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 07a7b4e51f0ef..6e5627975cdf5 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -119,7 +119,7 @@ struct journal_sector {
+ commit_id_t commit_id;
+ };
+
+-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK]))
++#define MAX_TAG_SIZE 255
+
+ #define METADATA_PADDING_SECTORS 8
+
+--
+2.51.0
+
--- /dev/null
+From 4257d6a294d825c8a527dc1def6e3650432909d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:16:55 +0800
+Subject: perf subcmd: avoid crash in exclude_cmds when excludes is empty
+
+From: hupu <hupu.gm@gmail.com>
+
+[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ]
+
+When cross-compiling the perf tool for ARM64, `perf help` may crash
+with the following assertion failure:
+
+ help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
+
+This happens when the perf binary is not named exactly "perf" or when
+multiple "perf-*" binaries exist in the same directory. In such cases,
+the `excludes` command list can be empty, which leads to the final
+assertion in exclude_cmds() being triggered.
+
+Add a simple guard at the beginning of exclude_cmds() to return early
+if excludes->cnt is zero, preventing the crash.
+
+Signed-off-by: hupu <hupu.gm@gmail.com>
+Reported-by: Guilherme Amadio <amadio@gentoo.org>
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/subcmd/help.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
+index 42f57b640f119..687307f2fe0f7 100644
+--- a/tools/lib/subcmd/help.c
++++ b/tools/lib/subcmd/help.c
+@@ -72,6 +72,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
+ size_t ci, cj, ei;
+ int cmp;
+
++ if (!excludes->cnt)
++ return;
++
+ ci = cj = ei = 0;
+ while (ci < cmds->cnt && ei < excludes->cnt) {
+ cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name);
+--
+2.51.0
+
media-tunner-xc5000-refactor-firmware-load.patch
media-tuner-xc5000-fix-use-after-free-in-xc5000_release.patch
media-i2c-tc358743-fix-use-after-free-bugs-caused-by-orphan-timer-in-probe.patch
+dm-integrity-limit-max_tag_size-to-255.patch
+perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch
--- /dev/null
+From b1e3f88636b83a94e8061d0d0b5ef64ef60c9603 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 15:52:02 +0200
+Subject: dm-integrity: limit MAX_TAG_SIZE to 255
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ]
+
+MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size
+= ic->tag_size" assignment. We need to limit it to 255.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-integrity.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index e9d553eea9cd4..8b8babed11f5f 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -124,7 +124,7 @@ struct journal_sector {
+ commit_id_t commit_id;
+ };
+
+-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK]))
++#define MAX_TAG_SIZE 255
+
+ #define METADATA_PADDING_SECTORS 8
+
+--
+2.51.0
+
--- /dev/null
+From b6759a1e506554e6ebf374da6e2b0090e09b7d33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:16:55 +0800
+Subject: perf subcmd: avoid crash in exclude_cmds when excludes is empty
+
+From: hupu <hupu.gm@gmail.com>
+
+[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ]
+
+When cross-compiling the perf tool for ARM64, `perf help` may crash
+with the following assertion failure:
+
+ help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
+
+This happens when the perf binary is not named exactly "perf" or when
+multiple "perf-*" binaries exist in the same directory. In such cases,
+the `excludes` command list can be empty, which leads to the final
+assertion in exclude_cmds() being triggered.
+
+Add a simple guard at the beginning of exclude_cmds() to return early
+if excludes->cnt is zero, preventing the crash.
+
+Signed-off-by: hupu <hupu.gm@gmail.com>
+Reported-by: Guilherme Amadio <amadio@gentoo.org>
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/subcmd/help.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
+index 42f57b640f119..687307f2fe0f7 100644
+--- a/tools/lib/subcmd/help.c
++++ b/tools/lib/subcmd/help.c
+@@ -72,6 +72,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
+ size_t ci, cj, ei;
+ int cmp;
+
++ if (!excludes->cnt)
++ return;
++
+ ci = cj = ei = 0;
+ while (ci < cmds->cnt && ei < excludes->cnt) {
+ cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name);
+--
+2.51.0
+
media-tunner-xc5000-refactor-firmware-load.patch
media-tuner-xc5000-fix-use-after-free-in-xc5000_release.patch
media-i2c-tc358743-fix-use-after-free-bugs-caused-by-orphan-timer-in-probe.patch
+dm-integrity-limit-max_tag_size-to-255.patch
+perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch
--- /dev/null
+From b9fe36ca9a6b7aa2be5a4049ccb868d8e423251c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 15:52:02 +0200
+Subject: dm-integrity: limit MAX_TAG_SIZE to 255
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ]
+
+MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size
+= ic->tag_size" assignment. We need to limit it to 255.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-integrity.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 15580ba773e72..38791b7e59ba3 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -116,7 +116,7 @@ struct journal_sector {
+ commit_id_t commit_id;
+ };
+
+-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK]))
++#define MAX_TAG_SIZE 255
+
+ #define METADATA_PADDING_SECTORS 8
+
+--
+2.51.0
+
--- /dev/null
+From 86947f32c8e5cd2f9ca08c7a5801558ffcc9fd86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:16:55 +0800
+Subject: perf subcmd: avoid crash in exclude_cmds when excludes is empty
+
+From: hupu <hupu.gm@gmail.com>
+
+[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ]
+
+When cross-compiling the perf tool for ARM64, `perf help` may crash
+with the following assertion failure:
+
+ help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
+
+This happens when the perf binary is not named exactly "perf" or when
+multiple "perf-*" binaries exist in the same directory. In such cases,
+the `excludes` command list can be empty, which leads to the final
+assertion in exclude_cmds() being triggered.
+
+Add a simple guard at the beginning of exclude_cmds() to return early
+if excludes->cnt is zero, preventing the crash.
+
+Signed-off-by: hupu <hupu.gm@gmail.com>
+Reported-by: Guilherme Amadio <amadio@gentoo.org>
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/subcmd/help.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
+index 4260c8b4257bd..10f134c64ada1 100644
+--- a/tools/lib/subcmd/help.c
++++ b/tools/lib/subcmd/help.c
+@@ -72,6 +72,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
+ size_t ci, cj, ei;
+ int cmp;
+
++ if (!excludes->cnt)
++ return;
++
+ ci = cj = ei = 0;
+ while (ci < cmds->cnt && ei < excludes->cnt) {
+ cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name);
+--
+2.51.0
+
media-imon-reorganize-serialization.patch
media-imon-grab-lock-earlier-in-imon_ir_change_protocol.patch
media-rc-fix-races-with-imon_disconnect.patch
+dm-integrity-limit-max_tag_size-to-255.patch
+perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch
--- /dev/null
+From 6e5a45feee6aed24f036fdc99c4bf4049ccd05b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 08:11:43 +0000
+Subject: ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
+
+From: Jack Yu <jack.yu@realtek.com>
+
+[ Upstream commit 1dd28fd86c3fa4e395031dd6f2ba920242107010 ]
+
+Adjust register settings for SAR adc button detection mode
+to fix noise issue in headset.
+
+Signed-off-by: Jack Yu <jack.yu@realtek.com>
+Link: https://patch.msgid.link/766cd1d2dd7a403ba65bb4cc44845f71@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682s.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c
+index 07d514b4ce707..76f07ef142246 100644
+--- a/sound/soc/codecs/rt5682s.c
++++ b/sound/soc/codecs/rt5682s.c
+@@ -653,14 +653,15 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode
+ switch (mode) {
+ case SAR_PWR_SAVING:
+ snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_3,
+- RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_DIS);
++ RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_EN);
+ snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1,
+- RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK,
+- RT5682S_CTRL_MB1_REG | RT5682S_CTRL_MB2_REG);
++ RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK |
++ RT5682S_VREF_POW_MASK, RT5682S_CTRL_MB1_FSM |
++ RT5682S_CTRL_MB2_FSM | RT5682S_VREF_POW_FSM);
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK |
+ RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS |
+- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU);
++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU);
+ usleep_range(5000, 5500);
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK, RT5682S_SAR_BUTDET_EN);
+@@ -688,7 +689,7 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK |
+ RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS |
+- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU);
++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU);
+ break;
+ default:
+ dev_err(component->dev, "Invalid SAR Power mode: %d\n", mode);
+@@ -725,7 +726,7 @@ static void rt5682s_disable_push_button_irq(struct snd_soc_component *component)
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK |
+ RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS |
+- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU);
++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU);
+ }
+
+ /**
+@@ -786,7 +787,7 @@ static int rt5682s_headset_detect(struct snd_soc_component *component, int jack_
+ jack_type = SND_JACK_HEADSET;
+ snd_soc_component_write(component, RT5682S_SAR_IL_CMD_3, 0x024c);
+ snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1,
+- RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_EN);
++ RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_DIS);
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_SEL_MB1_2_MASK, val << RT5682S_SAR_SEL_MB1_2_SFT);
+ rt5682s_enable_push_button_irq(component);
+@@ -966,7 +967,7 @@ static int rt5682s_set_jack_detect(struct snd_soc_component *component,
+ RT5682S_EMB_JD_MASK | RT5682S_DET_TYPE |
+ RT5682S_POL_FAST_OFF_MASK | RT5682S_MIC_CAP_MASK,
+ RT5682S_EMB_JD_EN | RT5682S_DET_TYPE |
+- RT5682S_POL_FAST_OFF_HIGH | RT5682S_MIC_CAP_HS);
++ RT5682S_POL_FAST_OFF_LOW | RT5682S_MIC_CAP_HS);
+ regmap_update_bits(rt5682s->regmap, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_POW_MASK, RT5682S_SAR_POW_EN);
+ regmap_update_bits(rt5682s->regmap, RT5682S_GPIO_CTRL_1,
+--
+2.51.0
+
--- /dev/null
+From 55a02e2c669bde180340a957ab07657ce2d3944f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 08:37:47 +0200
+Subject: btrfs: ref-verify: handle damaged extent root tree
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit ed4e6b5d644c4dd2bc2872ffec036b7da0ec2e27 ]
+
+Syzbot hits a problem with enabled ref-verify, ignorebadroots and a
+fuzzed/damaged extent tree. There's no fallback option like in other
+places that can deal with it so disable the whole ref-verify as it is
+just a debugging feature.
+
+Reported-by: syzbot+9c3e0cdfbfe351b0bc0e@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/all/0000000000001b6052062139be1c@google.com/
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ref-verify.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
+index 56ceb23bd7409..195fce42b982d 100644
+--- a/fs/btrfs/ref-verify.c
++++ b/fs/btrfs/ref-verify.c
+@@ -987,11 +987,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info)
+ if (!btrfs_test_opt(fs_info, REF_VERIFY))
+ return 0;
+
++ extent_root = btrfs_extent_root(fs_info, 0);
++ /* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */
++ if (IS_ERR(extent_root)) {
++ btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling");
++ btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY);
++ return 0;
++ }
++
+ path = btrfs_alloc_path();
+ if (!path)
+ return -ENOMEM;
+
+- extent_root = btrfs_extent_root(fs_info, 0);
+ eb = btrfs_read_lock_root_node(extent_root);
+ level = btrfs_header_level(eb);
+ path->nodes[level] = eb;
+--
+2.51.0
+
--- /dev/null
+From a081d379561e704eb57844f134db76c716fccb41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 23:08:20 +0800
+Subject: can: hi311x: fix null pointer dereference when resuming from sleep
+ before interface was enabled
+
+From: Chen Yufeng <chenyufeng@iie.ac.cn>
+
+[ Upstream commit 6b696808472197b77b888f50bc789a3bae077743 ]
+
+This issue is similar to the vulnerability in the `mcp251x` driver,
+which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from
+sleep before interface was brought up").
+
+In the `hi311x` driver, when the device resumes from sleep, the driver
+schedules `priv->restart_work`. However, if the network interface was
+not previously enabled, the `priv->wq` (workqueue) is not allocated and
+initialized, leading to a null pointer dereference.
+
+To fix this, we move the allocation and initialization of the workqueue
+from the `hi3110_open` function to the `hi3110_can_probe` function.
+This ensures that the workqueue is properly initialized before it is
+used during device resume. And added logic to destroy the workqueue
+in the error handling paths of `hi3110_can_probe` and in the
+`hi3110_can_remove` function to prevent resource leaks.
+
+Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
+Link: https://patch.msgid.link/20250911150820.250-1-chenyufeng@iie.ac.cn
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/spi/hi311x.c | 33 +++++++++++++++++----------------
+ 1 file changed, 17 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
+index 57ea7dfe8a596..1acd4fc7adc8b 100644
+--- a/drivers/net/can/spi/hi311x.c
++++ b/drivers/net/can/spi/hi311x.c
+@@ -545,8 +545,6 @@ static int hi3110_stop(struct net_device *net)
+
+ priv->force_quit = 1;
+ free_irq(spi->irq, priv);
+- destroy_workqueue(priv->wq);
+- priv->wq = NULL;
+
+ mutex_lock(&priv->hi3110_lock);
+
+@@ -771,34 +769,23 @@ static int hi3110_open(struct net_device *net)
+ goto out_close;
+ }
+
+- priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
+- 0);
+- if (!priv->wq) {
+- ret = -ENOMEM;
+- goto out_free_irq;
+- }
+- INIT_WORK(&priv->tx_work, hi3110_tx_work_handler);
+- INIT_WORK(&priv->restart_work, hi3110_restart_work_handler);
+-
+ ret = hi3110_hw_reset(spi);
+ if (ret)
+- goto out_free_wq;
++ goto out_free_irq;
+
+ ret = hi3110_setup(net);
+ if (ret)
+- goto out_free_wq;
++ goto out_free_irq;
+
+ ret = hi3110_set_normal_mode(spi);
+ if (ret)
+- goto out_free_wq;
++ goto out_free_irq;
+
+ netif_wake_queue(net);
+ mutex_unlock(&priv->hi3110_lock);
+
+ return 0;
+
+- out_free_wq:
+- destroy_workqueue(priv->wq);
+ out_free_irq:
+ free_irq(spi->irq, priv);
+ hi3110_hw_sleep(spi);
+@@ -915,6 +902,15 @@ static int hi3110_can_probe(struct spi_device *spi)
+ if (ret)
+ goto out_clk;
+
++ priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
++ 0);
++ if (!priv->wq) {
++ ret = -ENOMEM;
++ goto out_clk;
++ }
++ INIT_WORK(&priv->tx_work, hi3110_tx_work_handler);
++ INIT_WORK(&priv->restart_work, hi3110_restart_work_handler);
++
+ priv->spi = spi;
+ mutex_init(&priv->hi3110_lock);
+
+@@ -950,6 +946,8 @@ static int hi3110_can_probe(struct spi_device *spi)
+ return 0;
+
+ error_probe:
++ destroy_workqueue(priv->wq);
++ priv->wq = NULL;
+ hi3110_power_enable(priv->power, 0);
+
+ out_clk:
+@@ -970,6 +968,9 @@ static void hi3110_can_remove(struct spi_device *spi)
+
+ hi3110_power_enable(priv->power, 0);
+
++ destroy_workqueue(priv->wq);
++ priv->wq = NULL;
++
+ clk_disable_unprepare(priv->clk);
+
+ free_candev(net);
+--
+2.51.0
+
--- /dev/null
+From 07bbdbdf76148c08e021cc626d145315a346761e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 07:03:45 +0000
+Subject: can: rcar_canfd: Fix controller mode setting
+
+From: Duy Nguyen <duy.nguyen.rh@renesas.com>
+
+[ Upstream commit 5cff263606a10102a0ea19ff579eaa18fd5577ad ]
+
+Driver configures register to choose controller mode before
+setting all channels to reset mode leading to failure.
+The patch corrects operation of mode setting.
+
+Signed-off-by: Duy Nguyen <duy.nguyen.rh@renesas.com>
+Signed-off-by: Tranh Ha <tranh.ha.xb@renesas.com>
+Link: https://patch.msgid.link/TYWPR01MB87434739F83E27EDCD23DF44B416A@TYWPR01MB8743.jpnprd01.prod.outlook.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rcar/rcar_canfd.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
+index a1f68b74229e6..3d6daeea83553 100644
+--- a/drivers/net/can/rcar/rcar_canfd.c
++++ b/drivers/net/can/rcar/rcar_canfd.c
+@@ -717,9 +717,6 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv)
+ /* Reset Global error flags */
+ rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0);
+
+- /* Set the controller into appropriate mode */
+- rcar_canfd_set_mode(gpriv);
+-
+ /* Transition all Channels to reset mode */
+ for_each_set_bit(ch, &gpriv->channels_mask, gpriv->max_channels) {
+ rcar_canfd_clear_bit(gpriv->base,
+@@ -739,6 +736,10 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv)
+ return err;
+ }
+ }
++
++ /* Set the controller into appropriate mode */
++ rcar_canfd_set_mode(gpriv);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ec895bf65edf876ff6f306381860fc7afc88204f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 15:52:02 +0200
+Subject: dm-integrity: limit MAX_TAG_SIZE to 255
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ]
+
+MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size
+= ic->tag_size" assignment. We need to limit it to 255.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-integrity.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index fc9cb626ca917..19a0b1919a096 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -128,7 +128,7 @@ struct journal_sector {
+ commit_id_t commit_id;
+ };
+
+-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK]))
++#define MAX_TAG_SIZE 255
+
+ #define METADATA_PADDING_SECTORS 8
+
+--
+2.51.0
+
--- /dev/null
+From 8592f76b93208097ba8e4d98fa5ba14d5d6d608a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:16:55 +0800
+Subject: perf subcmd: avoid crash in exclude_cmds when excludes is empty
+
+From: hupu <hupu.gm@gmail.com>
+
+[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ]
+
+When cross-compiling the perf tool for ARM64, `perf help` may crash
+with the following assertion failure:
+
+ help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
+
+This happens when the perf binary is not named exactly "perf" or when
+multiple "perf-*" binaries exist in the same directory. In such cases,
+the `excludes` command list can be empty, which leads to the final
+assertion in exclude_cmds() being triggered.
+
+Add a simple guard at the beginning of exclude_cmds() to return early
+if excludes->cnt is zero, preventing the crash.
+
+Signed-off-by: hupu <hupu.gm@gmail.com>
+Reported-by: Guilherme Amadio <amadio@gentoo.org>
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/subcmd/help.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
+index 42f57b640f119..687307f2fe0f7 100644
+--- a/tools/lib/subcmd/help.c
++++ b/tools/lib/subcmd/help.c
+@@ -72,6 +72,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
+ size_t ci, cj, ei;
+ int cmp;
+
++ if (!excludes->cnt)
++ return;
++
+ ci = cj = ei = 0;
+ while (ci < cmds->cnt && ei < excludes->cnt) {
+ cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name);
+--
+2.51.0
+
minmax.h-move-all-the-clamp-definitions-after-the-min-max-ones.patch
minmax.h-simplify-the-variants-of-clamp.patch
minmax.h-remove-some-defines-that-are-only-expanded-once.patch
+dm-integrity-limit-max_tag_size-to-255.patch
+perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch
+asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch
+btrfs-ref-verify-handle-damaged-extent-root-tree.patch
+can-hi311x-fix-null-pointer-dereference-when-resumin.patch
+can-rcar_canfd-fix-controller-mode-setting.patch
--- /dev/null
+From ceec1ab0b3d891df7d67f4015c4fdf88d88a1f53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 11:15:47 +0530
+Subject: ASoC: amd: acp: Adjust pdm gain value
+
+From: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+
+[ Upstream commit f1d0260362d72f9f454dc1f9db2eeb80cb801f28 ]
+
+Set pdm gain value by setting PDM_MISC_CTRL_MASK value.
+To avoid low pdm gain value.
+
+Signed-off-by: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250821054606.1279178-1-venkataprasad.potturu@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp/amd.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/amd/acp/amd.h b/sound/soc/amd/acp/amd.h
+index 854269fea875f..aa0aa64202fe4 100644
+--- a/sound/soc/amd/acp/amd.h
++++ b/sound/soc/amd/acp/amd.h
+@@ -135,7 +135,7 @@
+ #define PDM_DMA_INTR_MASK 0x10000
+ #define PDM_DEC_64 0x2
+ #define PDM_CLK_FREQ_MASK 0x07
+-#define PDM_MISC_CTRL_MASK 0x10
++#define PDM_MISC_CTRL_MASK 0x18
+ #define PDM_ENABLE 0x01
+ #define PDM_DISABLE 0x00
+ #define DMA_EN_MASK 0x02
+--
+2.51.0
+
--- /dev/null
+From 5f102df56825457e38dea91a5e1861dbd89bd727 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 08:11:43 +0000
+Subject: ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
+
+From: Jack Yu <jack.yu@realtek.com>
+
+[ Upstream commit 1dd28fd86c3fa4e395031dd6f2ba920242107010 ]
+
+Adjust register settings for SAR adc button detection mode
+to fix noise issue in headset.
+
+Signed-off-by: Jack Yu <jack.yu@realtek.com>
+Link: https://patch.msgid.link/766cd1d2dd7a403ba65bb4cc44845f71@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682s.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c
+index ce2e88e066f3e..d773c96e2543c 100644
+--- a/sound/soc/codecs/rt5682s.c
++++ b/sound/soc/codecs/rt5682s.c
+@@ -653,14 +653,15 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode
+ switch (mode) {
+ case SAR_PWR_SAVING:
+ snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_3,
+- RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_DIS);
++ RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_EN);
+ snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1,
+- RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK,
+- RT5682S_CTRL_MB1_REG | RT5682S_CTRL_MB2_REG);
++ RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK |
++ RT5682S_VREF_POW_MASK, RT5682S_CTRL_MB1_FSM |
++ RT5682S_CTRL_MB2_FSM | RT5682S_VREF_POW_FSM);
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK |
+ RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS |
+- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU);
++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU);
+ usleep_range(5000, 5500);
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK, RT5682S_SAR_BUTDET_EN);
+@@ -688,7 +689,7 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK |
+ RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS |
+- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU);
++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU);
+ break;
+ default:
+ dev_err(component->dev, "Invalid SAR Power mode: %d\n", mode);
+@@ -725,7 +726,7 @@ static void rt5682s_disable_push_button_irq(struct snd_soc_component *component)
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK |
+ RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS |
+- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU);
++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU);
+ }
+
+ /**
+@@ -786,7 +787,7 @@ static int rt5682s_headset_detect(struct snd_soc_component *component, int jack_
+ jack_type = SND_JACK_HEADSET;
+ snd_soc_component_write(component, RT5682S_SAR_IL_CMD_3, 0x024c);
+ snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1,
+- RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_EN);
++ RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_DIS);
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_SEL_MB1_2_MASK, val << RT5682S_SAR_SEL_MB1_2_SFT);
+ rt5682s_enable_push_button_irq(component);
+@@ -966,7 +967,7 @@ static int rt5682s_set_jack_detect(struct snd_soc_component *component,
+ RT5682S_EMB_JD_MASK | RT5682S_DET_TYPE |
+ RT5682S_POL_FAST_OFF_MASK | RT5682S_MIC_CAP_MASK,
+ RT5682S_EMB_JD_EN | RT5682S_DET_TYPE |
+- RT5682S_POL_FAST_OFF_HIGH | RT5682S_MIC_CAP_HS);
++ RT5682S_POL_FAST_OFF_LOW | RT5682S_MIC_CAP_HS);
+ regmap_update_bits(rt5682s->regmap, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_POW_MASK, RT5682S_SAR_POW_EN);
+ regmap_update_bits(rt5682s->regmap, RT5682S_GPIO_CTRL_1,
+--
+2.51.0
+
--- /dev/null
+From 667e52c892a080789f12c0791608f09e1605016e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 08:37:47 +0200
+Subject: btrfs: ref-verify: handle damaged extent root tree
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit ed4e6b5d644c4dd2bc2872ffec036b7da0ec2e27 ]
+
+Syzbot hits a problem with enabled ref-verify, ignorebadroots and a
+fuzzed/damaged extent tree. There's no fallback option like in other
+places that can deal with it so disable the whole ref-verify as it is
+just a debugging feature.
+
+Reported-by: syzbot+9c3e0cdfbfe351b0bc0e@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/all/0000000000001b6052062139be1c@google.com/
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ref-verify.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
+index 2928abf7eb827..fc46190d26c8e 100644
+--- a/fs/btrfs/ref-verify.c
++++ b/fs/btrfs/ref-verify.c
+@@ -998,11 +998,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info)
+ if (!btrfs_test_opt(fs_info, REF_VERIFY))
+ return 0;
+
++ extent_root = btrfs_extent_root(fs_info, 0);
++ /* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */
++ if (IS_ERR(extent_root)) {
++ btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling");
++ btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY);
++ return 0;
++ }
++
+ path = btrfs_alloc_path();
+ if (!path)
+ return -ENOMEM;
+
+- extent_root = btrfs_extent_root(fs_info, 0);
+ eb = btrfs_read_lock_root_node(extent_root);
+ level = btrfs_header_level(eb);
+ path->nodes[level] = eb;
+--
+2.51.0
+
--- /dev/null
+From e0993112387a9767c025a1504e182bf3f3672f6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 23:08:20 +0800
+Subject: can: hi311x: fix null pointer dereference when resuming from sleep
+ before interface was enabled
+
+From: Chen Yufeng <chenyufeng@iie.ac.cn>
+
+[ Upstream commit 6b696808472197b77b888f50bc789a3bae077743 ]
+
+This issue is similar to the vulnerability in the `mcp251x` driver,
+which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from
+sleep before interface was brought up").
+
+In the `hi311x` driver, when the device resumes from sleep, the driver
+schedules `priv->restart_work`. However, if the network interface was
+not previously enabled, the `priv->wq` (workqueue) is not allocated and
+initialized, leading to a null pointer dereference.
+
+To fix this, we move the allocation and initialization of the workqueue
+from the `hi3110_open` function to the `hi3110_can_probe` function.
+This ensures that the workqueue is properly initialized before it is
+used during device resume. And added logic to destroy the workqueue
+in the error handling paths of `hi3110_can_probe` and in the
+`hi3110_can_remove` function to prevent resource leaks.
+
+Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
+Link: https://patch.msgid.link/20250911150820.250-1-chenyufeng@iie.ac.cn
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/spi/hi311x.c | 33 +++++++++++++++++----------------
+ 1 file changed, 17 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
+index ff39afc77d7d2..c9eba1d37b0eb 100644
+--- a/drivers/net/can/spi/hi311x.c
++++ b/drivers/net/can/spi/hi311x.c
+@@ -545,8 +545,6 @@ static int hi3110_stop(struct net_device *net)
+
+ priv->force_quit = 1;
+ free_irq(spi->irq, priv);
+- destroy_workqueue(priv->wq);
+- priv->wq = NULL;
+
+ mutex_lock(&priv->hi3110_lock);
+
+@@ -771,34 +769,23 @@ static int hi3110_open(struct net_device *net)
+ goto out_close;
+ }
+
+- priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
+- 0);
+- if (!priv->wq) {
+- ret = -ENOMEM;
+- goto out_free_irq;
+- }
+- INIT_WORK(&priv->tx_work, hi3110_tx_work_handler);
+- INIT_WORK(&priv->restart_work, hi3110_restart_work_handler);
+-
+ ret = hi3110_hw_reset(spi);
+ if (ret)
+- goto out_free_wq;
++ goto out_free_irq;
+
+ ret = hi3110_setup(net);
+ if (ret)
+- goto out_free_wq;
++ goto out_free_irq;
+
+ ret = hi3110_set_normal_mode(spi);
+ if (ret)
+- goto out_free_wq;
++ goto out_free_irq;
+
+ netif_wake_queue(net);
+ mutex_unlock(&priv->hi3110_lock);
+
+ return 0;
+
+- out_free_wq:
+- destroy_workqueue(priv->wq);
+ out_free_irq:
+ free_irq(spi->irq, priv);
+ hi3110_hw_sleep(spi);
+@@ -910,6 +897,15 @@ static int hi3110_can_probe(struct spi_device *spi)
+ if (ret)
+ goto out_clk;
+
++ priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
++ 0);
++ if (!priv->wq) {
++ ret = -ENOMEM;
++ goto out_clk;
++ }
++ INIT_WORK(&priv->tx_work, hi3110_tx_work_handler);
++ INIT_WORK(&priv->restart_work, hi3110_restart_work_handler);
++
+ priv->spi = spi;
+ mutex_init(&priv->hi3110_lock);
+
+@@ -945,6 +941,8 @@ static int hi3110_can_probe(struct spi_device *spi)
+ return 0;
+
+ error_probe:
++ destroy_workqueue(priv->wq);
++ priv->wq = NULL;
+ hi3110_power_enable(priv->power, 0);
+
+ out_clk:
+@@ -965,6 +963,9 @@ static void hi3110_can_remove(struct spi_device *spi)
+
+ hi3110_power_enable(priv->power, 0);
+
++ destroy_workqueue(priv->wq);
++ priv->wq = NULL;
++
+ clk_disable_unprepare(priv->clk);
+
+ free_candev(net);
+--
+2.51.0
+
--- /dev/null
+From 97854ed2add66516bb1489a5fb8c3e84b7b3dcbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 07:03:45 +0000
+Subject: can: rcar_canfd: Fix controller mode setting
+
+From: Duy Nguyen <duy.nguyen.rh@renesas.com>
+
+[ Upstream commit 5cff263606a10102a0ea19ff579eaa18fd5577ad ]
+
+Driver configures register to choose controller mode before
+setting all channels to reset mode leading to failure.
+The patch corrects operation of mode setting.
+
+Signed-off-by: Duy Nguyen <duy.nguyen.rh@renesas.com>
+Signed-off-by: Tranh Ha <tranh.ha.xb@renesas.com>
+Link: https://patch.msgid.link/TYWPR01MB87434739F83E27EDCD23DF44B416A@TYWPR01MB8743.jpnprd01.prod.outlook.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rcar/rcar_canfd.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
+index aa3df0d05b853..24dd15c917228 100644
+--- a/drivers/net/can/rcar/rcar_canfd.c
++++ b/drivers/net/can/rcar/rcar_canfd.c
+@@ -732,9 +732,6 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv)
+ /* Reset Global error flags */
+ rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0);
+
+- /* Set the controller into appropriate mode */
+- rcar_canfd_set_mode(gpriv);
+-
+ /* Transition all Channels to reset mode */
+ for_each_set_bit(ch, &gpriv->channels_mask, gpriv->info->max_channels) {
+ rcar_canfd_clear_bit(gpriv->base,
+@@ -754,6 +751,10 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv)
+ return err;
+ }
+ }
++
++ /* Set the controller into appropriate mode */
++ rcar_canfd_set_mode(gpriv);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 89e7d3438081d53fe0ce88691f7ba4cc9af566a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 15:52:02 +0200
+Subject: dm-integrity: limit MAX_TAG_SIZE to 255
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ]
+
+MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size
+= ic->tag_size" assignment. We need to limit it to 255.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-integrity.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 450e1a7e7bac7..444cf35feebf4 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -133,7 +133,7 @@ struct journal_sector {
+ commit_id_t commit_id;
+ };
+
+-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK]))
++#define MAX_TAG_SIZE 255
+
+ #define METADATA_PADDING_SECTORS 8
+
+--
+2.51.0
+
--- /dev/null
+From 59cb3a4c096dc2a2c25c91826dae6218af308c3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 09:59:25 +0800
+Subject: netfs: Prevent duplicate unlocking
+
+From: Lizhi Xu <lizhi.xu@windriver.com>
+
+[ Upstream commit 66d938e89e940e512f4c3deac938ecef399c13f9 ]
+
+The filio lock has been released here, so there is no need to jump to
+error_folio_unlock to release it again.
+
+Reported-by: syzbot+b73c7d94a151e2ee1e9b@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=b73c7d94a151e2ee1e9b
+Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
+Acked-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/netfs/buffered_write.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/netfs/buffered_write.c b/fs/netfs/buffered_write.c
+index 896d1d4219ed9..be77a137cc871 100644
+--- a/fs/netfs/buffered_write.c
++++ b/fs/netfs/buffered_write.c
+@@ -340,7 +340,7 @@ ssize_t netfs_perform_write(struct kiocb *iocb, struct iov_iter *iter,
+ folio_put(folio);
+ ret = filemap_write_and_wait_range(mapping, fpos, fpos + flen - 1);
+ if (ret < 0)
+- goto error_folio_unlock;
++ goto out;
+ continue;
+
+ copied:
+--
+2.51.0
+
--- /dev/null
+From bbf78c215c628b7186715876aab1cb9f502f6c5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:16:55 +0800
+Subject: perf subcmd: avoid crash in exclude_cmds when excludes is empty
+
+From: hupu <hupu.gm@gmail.com>
+
+[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ]
+
+When cross-compiling the perf tool for ARM64, `perf help` may crash
+with the following assertion failure:
+
+ help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
+
+This happens when the perf binary is not named exactly "perf" or when
+multiple "perf-*" binaries exist in the same directory. In such cases,
+the `excludes` command list can be empty, which leads to the final
+assertion in exclude_cmds() being triggered.
+
+Add a simple guard at the beginning of exclude_cmds() to return early
+if excludes->cnt is zero, preventing the crash.
+
+Signed-off-by: hupu <hupu.gm@gmail.com>
+Reported-by: Guilherme Amadio <amadio@gentoo.org>
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/subcmd/help.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
+index 9ef569492560e..ddaeb4eb3e249 100644
+--- a/tools/lib/subcmd/help.c
++++ b/tools/lib/subcmd/help.c
+@@ -75,6 +75,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
+ size_t ci, cj, ei;
+ int cmp;
+
++ if (!excludes->cnt)
++ return;
++
+ ci = cj = ei = 0;
+ while (ci < cmds->cnt && ei < excludes->cnt) {
+ cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name);
+--
+2.51.0
+
--- /dev/null
+From e953a7a8ec2c13f98fb340994cd116204ccee67f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 09:06:11 +0000
+Subject: platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: aprilgrimoire <aprilgrimoire@proton.me>
+
+[ Upstream commit 8822e8be86d40410ddd2ac8ff44f3050c9ecf9c6 ]
+
+The firmware of Mechrevo Yilong15Pro emits a spurious keyboard interrupt on
+events including closing the lid. When a user closes the lid on an already
+suspended system this causes the system to wake up.
+Add Mechrevo Yilong15Pro Series (GM5HG7A) to the list of quirk
+spurious_8042 to work around this issue.
+
+Link: https://lore.kernel.org/linux-pm/6ww4uu6Gl4F5n6VY5dl1ufASfKzs4DhMxAN8BuqUpCoqU3PQukVSVSBCl_lKIzkQ-S8kt1acPd58eyolhkWN32lMLFj4ViI0Tdu2jwhnYZ8=@proton.me/
+Signed-off-by: April Grimoire <aprilgrimoire@proton.me>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/IvSc_IN5Pa0wRXElTk_fEl-cTpMZxg6TCQk_7aRUkTd9vJUp_ZeC0NdXZ0z6Tn7B-XiqqqQvCH65lq6FqhuECBMEYWcHQmWm1Jo7Br8kpeg=@proton.me
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index 6f5437d210a61..b872baf35808f 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -233,6 +233,14 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"),
+ }
+ },
++ {
++ .ident = "MECHREVO Yilong15Pro Series GM5HG7A",
++ .driver_data = &quirk_spurious_8042,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MECHREVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Yilong15Pro Series GM5HG7A"),
++ }
++ },
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=220116 */
+ {
+ .ident = "PCSpecialist Lafite Pro V 14M",
+--
+2.51.0
+
--- /dev/null
+From edf300f601daf8723cf67cd20a85627369773cb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 18:46:49 +0200
+Subject: platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042
+ quirks list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christoffer Sandberg <cs@tuxedo.de>
+
+[ Upstream commit 12a3dd4d2cd9232d4e4df3b9a5b3d745db559941 ]
+
+Prevents instant wakeup ~1s after suspend
+
+Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20250916164700.32896-1-wse@tuxedocomputers.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index b872baf35808f..9fd2829ee2ab4 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -250,6 +250,13 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Lafite Pro V 14M"),
+ }
+ },
++ {
++ .ident = "TUXEDO Stellaris Slim 15 AMD Gen6",
++ .driver_data = &quirk_spurious_8042,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"),
++ }
++ },
+ {
+ .ident = "TUXEDO InfinityBook Pro 14/15 AMD Gen10",
+ .driver_data = &quirk_spurious_8042,
+--
+2.51.0
+
--- /dev/null
+From ee611b0dba31786f70c8eb59985d411f6dd7406b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 14:35:46 +0530
+Subject: platform/x86/amd/pmf: Support new ACPI ID AMDI0108
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 1b09d08866277677d11726116f5e786d5ba00173 ]
+
+Include the ACPI ID AMDI0108, which is used on upcoming AMD platforms, in
+the PMF driver's list of supported devices.
+
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250915090546.2759130-1-Shyam-sundar.S-k@amd.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmf/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/amd/pmf/core.c b/drivers/platform/x86/amd/pmf/core.c
+index 719caa2a00f05..8a1e2268d301a 100644
+--- a/drivers/platform/x86/amd/pmf/core.c
++++ b/drivers/platform/x86/amd/pmf/core.c
+@@ -406,6 +406,7 @@ static const struct acpi_device_id amd_pmf_acpi_ids[] = {
+ {"AMDI0103", 0},
+ {"AMDI0105", 0},
+ {"AMDI0107", 0},
++ {"AMDI0108", 0},
+ { }
+ };
+ MODULE_DEVICE_TABLE(acpi, amd_pmf_acpi_ids);
+--
+2.51.0
+
wifi-rtw89-fix-use-after-free-in-rtw89_core_tx_kick_off_and_wait.patch
media-i2c-tc358743-fix-use-after-free-bugs-caused-by-orphan-timer-in-probe.patch
+asoc-amd-acp-adjust-pdm-gain-value.patch
+dm-integrity-limit-max_tag_size-to-255.patch
+platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch
+perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch
+platform-x86-amd-pmf-support-new-acpi-id-amdi0108.patch
+asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch
+btrfs-ref-verify-handle-damaged-extent-root-tree.patch
+netfs-prevent-duplicate-unlocking.patch
+can-hi311x-fix-null-pointer-dereference-when-resumin.patch
+can-rcar_canfd-fix-controller-mode-setting.patch
+platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch
--- /dev/null
+From 8a94c2dcbe50cd3c3d91cdc82331624938cb8475 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 11:15:47 +0530
+Subject: ASoC: amd: acp: Adjust pdm gain value
+
+From: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+
+[ Upstream commit f1d0260362d72f9f454dc1f9db2eeb80cb801f28 ]
+
+Set pdm gain value by setting PDM_MISC_CTRL_MASK value.
+To avoid low pdm gain value.
+
+Signed-off-by: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250821054606.1279178-1-venkataprasad.potturu@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp/amd.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/amd/acp/amd.h b/sound/soc/amd/acp/amd.h
+index cb8d97122f95c..73a028e672462 100644
+--- a/sound/soc/amd/acp/amd.h
++++ b/sound/soc/amd/acp/amd.h
+@@ -130,7 +130,7 @@
+ #define PDM_DMA_INTR_MASK 0x10000
+ #define PDM_DEC_64 0x2
+ #define PDM_CLK_FREQ_MASK 0x07
+-#define PDM_MISC_CTRL_MASK 0x10
++#define PDM_MISC_CTRL_MASK 0x18
+ #define PDM_ENABLE 0x01
+ #define PDM_DISABLE 0x00
+ #define DMA_EN_MASK 0x02
+--
+2.51.0
+
--- /dev/null
+From 5866501f0312a6c9a6ccaeba5f0bcc757fc2b545 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 08:11:43 +0000
+Subject: ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
+
+From: Jack Yu <jack.yu@realtek.com>
+
+[ Upstream commit 1dd28fd86c3fa4e395031dd6f2ba920242107010 ]
+
+Adjust register settings for SAR adc button detection mode
+to fix noise issue in headset.
+
+Signed-off-by: Jack Yu <jack.yu@realtek.com>
+Link: https://patch.msgid.link/766cd1d2dd7a403ba65bb4cc44845f71@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682s.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c
+index 73c4b3c31f8c4..d44f7574631dc 100644
+--- a/sound/soc/codecs/rt5682s.c
++++ b/sound/soc/codecs/rt5682s.c
+@@ -653,14 +653,15 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode
+ switch (mode) {
+ case SAR_PWR_SAVING:
+ snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_3,
+- RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_DIS);
++ RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_EN);
+ snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1,
+- RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK,
+- RT5682S_CTRL_MB1_REG | RT5682S_CTRL_MB2_REG);
++ RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK |
++ RT5682S_VREF_POW_MASK, RT5682S_CTRL_MB1_FSM |
++ RT5682S_CTRL_MB2_FSM | RT5682S_VREF_POW_FSM);
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK |
+ RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS |
+- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU);
++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU);
+ usleep_range(5000, 5500);
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK, RT5682S_SAR_BUTDET_EN);
+@@ -688,7 +689,7 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK |
+ RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS |
+- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU);
++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU);
+ break;
+ default:
+ dev_err(component->dev, "Invalid SAR Power mode: %d\n", mode);
+@@ -725,7 +726,7 @@ static void rt5682s_disable_push_button_irq(struct snd_soc_component *component)
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK |
+ RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS |
+- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU);
++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU);
+ }
+
+ /**
+@@ -786,7 +787,7 @@ static int rt5682s_headset_detect(struct snd_soc_component *component, int jack_
+ jack_type = SND_JACK_HEADSET;
+ snd_soc_component_write(component, RT5682S_SAR_IL_CMD_3, 0x024c);
+ snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1,
+- RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_EN);
++ RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_DIS);
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_SEL_MB1_2_MASK, val << RT5682S_SAR_SEL_MB1_2_SFT);
+ rt5682s_enable_push_button_irq(component);
+@@ -966,7 +967,7 @@ static int rt5682s_set_jack_detect(struct snd_soc_component *component,
+ RT5682S_EMB_JD_MASK | RT5682S_DET_TYPE |
+ RT5682S_POL_FAST_OFF_MASK | RT5682S_MIC_CAP_MASK,
+ RT5682S_EMB_JD_EN | RT5682S_DET_TYPE |
+- RT5682S_POL_FAST_OFF_HIGH | RT5682S_MIC_CAP_HS);
++ RT5682S_POL_FAST_OFF_LOW | RT5682S_MIC_CAP_HS);
+ regmap_update_bits(rt5682s->regmap, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_POW_MASK, RT5682S_SAR_POW_EN);
+ regmap_update_bits(rt5682s->regmap, RT5682S_GPIO_CTRL_1,
+--
+2.51.0
+
--- /dev/null
+From 650598d7f0f98f5a9bc64c5166482e29157e08c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 16:57:57 +0800
+Subject: ASoC: rt712: avoid skipping the blind write
+
+From: Shuming Fan <shumingf@realtek.com>
+
+[ Upstream commit f54d87dad7619c8026e95b848d6ef677b9f2b55f ]
+
+Some devices might not use the DMIC function of the RT712VB.
+Therefore, this patch avoids skipping the blind write with RT712VB.
+
+Signed-off-by: Shuming Fan <shumingf@realtek.com>
+Link: https://patch.msgid.link/20250901085757.1287945-1-shumingf@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt712-sdca.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/codecs/rt712-sdca.c b/sound/soc/codecs/rt712-sdca.c
+index 570c2af1245d6..0c57aee766b5c 100644
+--- a/sound/soc/codecs/rt712-sdca.c
++++ b/sound/soc/codecs/rt712-sdca.c
+@@ -1891,11 +1891,9 @@ int rt712_sdca_io_init(struct device *dev, struct sdw_slave *slave)
+
+ rt712_sdca_va_io_init(rt712);
+ } else {
+- if (!rt712->dmic_function_found) {
+- dev_err(&slave->dev, "%s RT712 VB detected but no SMART_MIC function exposed in ACPI\n",
++ if (!rt712->dmic_function_found)
++ dev_warn(&slave->dev, "%s RT712 VB detected but no SMART_MIC function exposed in ACPI\n",
+ __func__);
+- goto suspend;
+- }
+
+ /* multilanes and DMIC are supported by rt712vb */
+ prop->lane_control_support = true;
+--
+2.51.0
+
--- /dev/null
+From 3423a5817b7e5cc1858e3b7634846f2b5f819a35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 08:37:47 +0200
+Subject: btrfs: ref-verify: handle damaged extent root tree
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit ed4e6b5d644c4dd2bc2872ffec036b7da0ec2e27 ]
+
+Syzbot hits a problem with enabled ref-verify, ignorebadroots and a
+fuzzed/damaged extent tree. There's no fallback option like in other
+places that can deal with it so disable the whole ref-verify as it is
+just a debugging feature.
+
+Reported-by: syzbot+9c3e0cdfbfe351b0bc0e@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/all/0000000000001b6052062139be1c@google.com/
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ref-verify.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
+index 2928abf7eb827..fc46190d26c8e 100644
+--- a/fs/btrfs/ref-verify.c
++++ b/fs/btrfs/ref-verify.c
+@@ -998,11 +998,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info)
+ if (!btrfs_test_opt(fs_info, REF_VERIFY))
+ return 0;
+
++ extent_root = btrfs_extent_root(fs_info, 0);
++ /* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */
++ if (IS_ERR(extent_root)) {
++ btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling");
++ btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY);
++ return 0;
++ }
++
+ path = btrfs_alloc_path();
+ if (!path)
+ return -ENOMEM;
+
+- extent_root = btrfs_extent_root(fs_info, 0);
+ eb = btrfs_read_lock_root_node(extent_root);
+ level = btrfs_header_level(eb);
+ path->nodes[level] = eb;
+--
+2.51.0
+
--- /dev/null
+From 7288fad173af58d034ccb9b1c34bdb66e892e82c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 23:08:20 +0800
+Subject: can: hi311x: fix null pointer dereference when resuming from sleep
+ before interface was enabled
+
+From: Chen Yufeng <chenyufeng@iie.ac.cn>
+
+[ Upstream commit 6b696808472197b77b888f50bc789a3bae077743 ]
+
+This issue is similar to the vulnerability in the `mcp251x` driver,
+which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from
+sleep before interface was brought up").
+
+In the `hi311x` driver, when the device resumes from sleep, the driver
+schedules `priv->restart_work`. However, if the network interface was
+not previously enabled, the `priv->wq` (workqueue) is not allocated and
+initialized, leading to a null pointer dereference.
+
+To fix this, we move the allocation and initialization of the workqueue
+from the `hi3110_open` function to the `hi3110_can_probe` function.
+This ensures that the workqueue is properly initialized before it is
+used during device resume. And added logic to destroy the workqueue
+in the error handling paths of `hi3110_can_probe` and in the
+`hi3110_can_remove` function to prevent resource leaks.
+
+Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
+Link: https://patch.msgid.link/20250911150820.250-1-chenyufeng@iie.ac.cn
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/spi/hi311x.c | 33 +++++++++++++++++----------------
+ 1 file changed, 17 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
+index 6441ff3b41987..963ea8510dd9b 100644
+--- a/drivers/net/can/spi/hi311x.c
++++ b/drivers/net/can/spi/hi311x.c
+@@ -545,8 +545,6 @@ static int hi3110_stop(struct net_device *net)
+
+ priv->force_quit = 1;
+ free_irq(spi->irq, priv);
+- destroy_workqueue(priv->wq);
+- priv->wq = NULL;
+
+ mutex_lock(&priv->hi3110_lock);
+
+@@ -770,34 +768,23 @@ static int hi3110_open(struct net_device *net)
+ goto out_close;
+ }
+
+- priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
+- 0);
+- if (!priv->wq) {
+- ret = -ENOMEM;
+- goto out_free_irq;
+- }
+- INIT_WORK(&priv->tx_work, hi3110_tx_work_handler);
+- INIT_WORK(&priv->restart_work, hi3110_restart_work_handler);
+-
+ ret = hi3110_hw_reset(spi);
+ if (ret)
+- goto out_free_wq;
++ goto out_free_irq;
+
+ ret = hi3110_setup(net);
+ if (ret)
+- goto out_free_wq;
++ goto out_free_irq;
+
+ ret = hi3110_set_normal_mode(spi);
+ if (ret)
+- goto out_free_wq;
++ goto out_free_irq;
+
+ netif_wake_queue(net);
+ mutex_unlock(&priv->hi3110_lock);
+
+ return 0;
+
+- out_free_wq:
+- destroy_workqueue(priv->wq);
+ out_free_irq:
+ free_irq(spi->irq, priv);
+ hi3110_hw_sleep(spi);
+@@ -909,6 +896,15 @@ static int hi3110_can_probe(struct spi_device *spi)
+ if (ret)
+ goto out_clk;
+
++ priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
++ 0);
++ if (!priv->wq) {
++ ret = -ENOMEM;
++ goto out_clk;
++ }
++ INIT_WORK(&priv->tx_work, hi3110_tx_work_handler);
++ INIT_WORK(&priv->restart_work, hi3110_restart_work_handler);
++
+ priv->spi = spi;
+ mutex_init(&priv->hi3110_lock);
+
+@@ -944,6 +940,8 @@ static int hi3110_can_probe(struct spi_device *spi)
+ return 0;
+
+ error_probe:
++ destroy_workqueue(priv->wq);
++ priv->wq = NULL;
+ hi3110_power_enable(priv->power, 0);
+
+ out_clk:
+@@ -964,6 +962,9 @@ static void hi3110_can_remove(struct spi_device *spi)
+
+ hi3110_power_enable(priv->power, 0);
+
++ destroy_workqueue(priv->wq);
++ priv->wq = NULL;
++
+ clk_disable_unprepare(priv->clk);
+
+ free_candev(net);
+--
+2.51.0
+
--- /dev/null
+From e1413981e0e93e58f436f48fecee0327af939213 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 07:03:45 +0000
+Subject: can: rcar_canfd: Fix controller mode setting
+
+From: Duy Nguyen <duy.nguyen.rh@renesas.com>
+
+[ Upstream commit 5cff263606a10102a0ea19ff579eaa18fd5577ad ]
+
+Driver configures register to choose controller mode before
+setting all channels to reset mode leading to failure.
+The patch corrects operation of mode setting.
+
+Signed-off-by: Duy Nguyen <duy.nguyen.rh@renesas.com>
+Signed-off-by: Tranh Ha <tranh.ha.xb@renesas.com>
+Link: https://patch.msgid.link/TYWPR01MB87434739F83E27EDCD23DF44B416A@TYWPR01MB8743.jpnprd01.prod.outlook.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rcar/rcar_canfd.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
+index 7f10213738e5c..e2ae8d6a9de64 100644
+--- a/drivers/net/can/rcar/rcar_canfd.c
++++ b/drivers/net/can/rcar/rcar_canfd.c
+@@ -870,9 +870,6 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv)
+ /* Reset Global error flags */
+ rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0);
+
+- /* Set the controller into appropriate mode */
+- rcar_canfd_set_mode(gpriv);
+-
+ /* Transition all Channels to reset mode */
+ for_each_set_bit(ch, &gpriv->channels_mask, gpriv->info->max_channels) {
+ rcar_canfd_clear_bit(gpriv->base,
+@@ -892,6 +889,10 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv)
+ return err;
+ }
+ }
++
++ /* Set the controller into appropriate mode */
++ rcar_canfd_set_mode(gpriv);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From fc1773fb232f4152cc253f0cf3b79e4104ddf57c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 15:52:02 +0200
+Subject: dm-integrity: limit MAX_TAG_SIZE to 255
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ]
+
+MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size
+= ic->tag_size" assignment. We need to limit it to 255.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-integrity.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 4395657fa5838..7b1d8f0c62fda 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -133,7 +133,7 @@ struct journal_sector {
+ commit_id_t commit_id;
+ };
+
+-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK]))
++#define MAX_TAG_SIZE 255
+
+ #define METADATA_PADDING_SECTORS 8
+
+--
+2.51.0
+
--- /dev/null
+From e205cfd1ceaa1e17df11fe0db89532d33ae105a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 12:27:05 +0530
+Subject: drm/amdgpu/gfx11: Add Cleaner Shader Support for GFX11.0.1/11.0.4
+ GPUs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit c1b6b8c7706354b73196649c46b5e6d4d61c2f5c ]
+
+Enable the cleaner shader for additional GFX11.0.1/11.0.4 series GPUs to
+ensure data isolation among GPU tasks. The cleaner shader is tasked with
+clearing the Local Data Store (LDS), Vector General Purpose Registers
+(VGPRs), and Scalar General Purpose Registers (SGPRs), which helps avoid
+data leakage and guarantees the accuracy of computational results.
+
+This update extends cleaner shader support to GFX11.0.1/11.0.4 GPUs,
+previously available for GFX11.0.3. It enhances security by clearing GPU
+memory between processes and maintains a consistent GPU state across KGD
+and KFD workloads.
+
+Cc: Wasee Alam <wasee.alam@amd.com>
+Cc: Mario Sopena-Novales <mario.novales@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 0a71ceb27f88a944c2de2808b67b2f46ac75076b)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+index 96566870f079b..199bd9340b3bf 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+@@ -1654,6 +1654,21 @@ static int gfx_v11_0_sw_init(struct amdgpu_ip_block *ip_block)
+ }
+ }
+ break;
++ case IP_VERSION(11, 0, 1):
++ case IP_VERSION(11, 0, 4):
++ adev->gfx.cleaner_shader_ptr = gfx_11_0_3_cleaner_shader_hex;
++ adev->gfx.cleaner_shader_size = sizeof(gfx_11_0_3_cleaner_shader_hex);
++ if (adev->gfx.pfp_fw_version >= 102 &&
++ adev->gfx.mec_fw_version >= 66 &&
++ adev->mes.fw_version[0] >= 128) {
++ adev->gfx.enable_cleaner_shader = true;
++ r = amdgpu_gfx_cleaner_shader_sw_init(adev, adev->gfx.cleaner_shader_size);
++ if (r) {
++ adev->gfx.enable_cleaner_shader = false;
++ dev_err(adev->dev, "Failed to initialize cleaner shader\n");
++ }
++ }
++ break;
+ case IP_VERSION(11, 5, 0):
+ case IP_VERSION(11, 5, 1):
+ adev->gfx.cleaner_shader_ptr = gfx_11_0_3_cleaner_shader_hex;
+--
+2.51.0
+
--- /dev/null
+From cec9fbc2e966be708ebae0bb38db7680f9913d43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 19:58:42 +0200
+Subject: gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-05
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit 3712ce9fa501617cdc4466d30ae3894d50887743 ]
+
+Same issue as G1619-04 in commit 805c74eac8cb ("gpiolib: acpi: Ignore
+touchpad wakeup on GPD G1619-04"), Strix Point lineup uses 05.
+
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Reviewed-by: Mika Westerberg <westeri@kernel.org>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-acpi-quirks.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/gpio/gpiolib-acpi-quirks.c b/drivers/gpio/gpiolib-acpi-quirks.c
+index bfb04e67c4bc8..7b95d1b033614 100644
+--- a/drivers/gpio/gpiolib-acpi-quirks.c
++++ b/drivers/gpio/gpiolib-acpi-quirks.c
+@@ -317,6 +317,18 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] __initconst = {
+ .ignore_wake = "PNP0C50:00@8",
+ },
+ },
++ {
++ /*
++ * Same as G1619-04. New model.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "GPD"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "G1619-05"),
++ },
++ .driver_data = &(struct acpi_gpiolib_dmi_quirk) {
++ .ignore_wake = "PNP0C50:00@8",
++ },
++ },
+ {
+ /*
+ * Spurious wakeups from GPIO 11
+--
+2.51.0
+
--- /dev/null
+From 6f268e492f0d90647bdd8c107be1b565e25ac0fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 15:59:59 -0300
+Subject: iommufd: WARN if an object is aborted with an elevated refcount
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 53d0584eeb2c85a46c83656246d61a89558d74b3 ]
+
+If something holds a refcount then it is at risk of UAFing. For abort
+paths we expect the caller to never share the object with a parallel
+thread and to clean up any refcounts it obtained on its own.
+
+Add the missing dec inside iommufd_hwpt_paging_alloc() during error unwind
+by making iommufd_hw_pagetable_attach/detach() proper pairs.
+
+Link: https://patch.msgid.link/r/2-v1-02cd136829df+31-iommufd_syz_fput_jgg@nvidia.com
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
+Tested-by: Nicolin Chen <nicolinc@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommufd/device.c | 3 ++-
+ drivers/iommu/iommufd/iommufd_private.h | 3 +--
+ drivers/iommu/iommufd/main.c | 4 ++++
+ 3 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iommu/iommufd/device.c b/drivers/iommu/iommufd/device.c
+index 86244403b5320..674f9f244f7b4 100644
+--- a/drivers/iommu/iommufd/device.c
++++ b/drivers/iommu/iommufd/device.c
+@@ -661,6 +661,8 @@ iommufd_hw_pagetable_detach(struct iommufd_device *idev, ioasid_t pasid)
+ iopt_remove_reserved_iova(&hwpt_paging->ioas->iopt, idev->dev);
+ mutex_unlock(&igroup->lock);
+
++ iommufd_hw_pagetable_put(idev->ictx, hwpt);
++
+ /* Caller must destroy hwpt */
+ return hwpt;
+ }
+@@ -1007,7 +1009,6 @@ void iommufd_device_detach(struct iommufd_device *idev, ioasid_t pasid)
+ hwpt = iommufd_hw_pagetable_detach(idev, pasid);
+ if (!hwpt)
+ return;
+- iommufd_hw_pagetable_put(idev->ictx, hwpt);
+ refcount_dec(&idev->obj.users);
+ }
+ EXPORT_SYMBOL_NS_GPL(iommufd_device_detach, "IOMMUFD");
+diff --git a/drivers/iommu/iommufd/iommufd_private.h b/drivers/iommu/iommufd/iommufd_private.h
+index 9ccc83341f321..e68d8d63076a8 100644
+--- a/drivers/iommu/iommufd/iommufd_private.h
++++ b/drivers/iommu/iommufd/iommufd_private.h
+@@ -390,9 +390,8 @@ static inline void iommufd_hw_pagetable_put(struct iommufd_ctx *ictx,
+ if (hwpt->obj.type == IOMMUFD_OBJ_HWPT_PAGING) {
+ struct iommufd_hwpt_paging *hwpt_paging = to_hwpt_paging(hwpt);
+
+- lockdep_assert_not_held(&hwpt_paging->ioas->mutex);
+-
+ if (hwpt_paging->auto_domain) {
++ lockdep_assert_not_held(&hwpt_paging->ioas->mutex);
+ iommufd_object_put_and_try_destroy(ictx, &hwpt->obj);
+ return;
+ }
+diff --git a/drivers/iommu/iommufd/main.c b/drivers/iommu/iommufd/main.c
+index 62a3469bbd37e..2b26747ac2021 100644
+--- a/drivers/iommu/iommufd/main.c
++++ b/drivers/iommu/iommufd/main.c
+@@ -62,6 +62,10 @@ void iommufd_object_abort(struct iommufd_ctx *ictx, struct iommufd_object *obj)
+ old = xas_store(&xas, NULL);
+ xa_unlock(&ictx->objects);
+ WARN_ON(old != XA_ZERO_ENTRY);
++
++ if (WARN_ON(!refcount_dec_and_test(&obj->users)))
++ return;
++
+ kfree(obj);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 4f4fbdab3de0180ff3e27d2ec9a3a0b47996f765 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 09:59:25 +0800
+Subject: netfs: Prevent duplicate unlocking
+
+From: Lizhi Xu <lizhi.xu@windriver.com>
+
+[ Upstream commit 66d938e89e940e512f4c3deac938ecef399c13f9 ]
+
+The filio lock has been released here, so there is no need to jump to
+error_folio_unlock to release it again.
+
+Reported-by: syzbot+b73c7d94a151e2ee1e9b@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=b73c7d94a151e2ee1e9b
+Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
+Acked-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/netfs/buffered_write.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/netfs/buffered_write.c b/fs/netfs/buffered_write.c
+index f27ea5099a681..09394ac2c180d 100644
+--- a/fs/netfs/buffered_write.c
++++ b/fs/netfs/buffered_write.c
+@@ -347,7 +347,7 @@ ssize_t netfs_perform_write(struct kiocb *iocb, struct iov_iter *iter,
+ folio_put(folio);
+ ret = filemap_write_and_wait_range(mapping, fpos, fpos + flen - 1);
+ if (ret < 0)
+- goto error_folio_unlock;
++ goto out;
+ continue;
+
+ copied:
+--
+2.51.0
+
--- /dev/null
+From e67dfae60929ac2409a9904edcbbf48b027b5a2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:16:55 +0800
+Subject: perf subcmd: avoid crash in exclude_cmds when excludes is empty
+
+From: hupu <hupu.gm@gmail.com>
+
+[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ]
+
+When cross-compiling the perf tool for ARM64, `perf help` may crash
+with the following assertion failure:
+
+ help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
+
+This happens when the perf binary is not named exactly "perf" or when
+multiple "perf-*" binaries exist in the same directory. In such cases,
+the `excludes` command list can be empty, which leads to the final
+assertion in exclude_cmds() being triggered.
+
+Add a simple guard at the beginning of exclude_cmds() to return early
+if excludes->cnt is zero, preventing the crash.
+
+Signed-off-by: hupu <hupu.gm@gmail.com>
+Reported-by: Guilherme Amadio <amadio@gentoo.org>
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/subcmd/help.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
+index 9ef569492560e..ddaeb4eb3e249 100644
+--- a/tools/lib/subcmd/help.c
++++ b/tools/lib/subcmd/help.c
+@@ -75,6 +75,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
+ size_t ci, cj, ei;
+ int cmp;
+
++ if (!excludes->cnt)
++ return;
++
+ ci = cj = ei = 0;
+ while (ci < cmds->cnt && ei < excludes->cnt) {
+ cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name);
+--
+2.51.0
+
--- /dev/null
+From 5a19385137607053966860cb8fa56dc99a7f95c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 09:06:11 +0000
+Subject: platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: aprilgrimoire <aprilgrimoire@proton.me>
+
+[ Upstream commit 8822e8be86d40410ddd2ac8ff44f3050c9ecf9c6 ]
+
+The firmware of Mechrevo Yilong15Pro emits a spurious keyboard interrupt on
+events including closing the lid. When a user closes the lid on an already
+suspended system this causes the system to wake up.
+Add Mechrevo Yilong15Pro Series (GM5HG7A) to the list of quirk
+spurious_8042 to work around this issue.
+
+Link: https://lore.kernel.org/linux-pm/6ww4uu6Gl4F5n6VY5dl1ufASfKzs4DhMxAN8BuqUpCoqU3PQukVSVSBCl_lKIzkQ-S8kt1acPd58eyolhkWN32lMLFj4ViI0Tdu2jwhnYZ8=@proton.me/
+Signed-off-by: April Grimoire <aprilgrimoire@proton.me>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/IvSc_IN5Pa0wRXElTk_fEl-cTpMZxg6TCQk_7aRUkTd9vJUp_ZeC0NdXZ0z6Tn7B-XiqqqQvCH65lq6FqhuECBMEYWcHQmWm1Jo7Br8kpeg=@proton.me
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index 18fb44139de25..4d0a38e06f083 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -239,6 +239,14 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"),
+ }
+ },
++ {
++ .ident = "MECHREVO Yilong15Pro Series GM5HG7A",
++ .driver_data = &quirk_spurious_8042,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MECHREVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Yilong15Pro Series GM5HG7A"),
++ }
++ },
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=220116 */
+ {
+ .ident = "PCSpecialist Lafite Pro V 14M",
+--
+2.51.0
+
--- /dev/null
+From 6255496e2436827dcca5b1f95d09a9d63439e568 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 18:46:49 +0200
+Subject: platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042
+ quirks list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christoffer Sandberg <cs@tuxedo.de>
+
+[ Upstream commit 12a3dd4d2cd9232d4e4df3b9a5b3d745db559941 ]
+
+Prevents instant wakeup ~1s after suspend
+
+Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20250916164700.32896-1-wse@tuxedocomputers.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index 4d0a38e06f083..d63aaad7ef599 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -256,6 +256,13 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Lafite Pro V 14M"),
+ }
+ },
++ {
++ .ident = "TUXEDO Stellaris Slim 15 AMD Gen6",
++ .driver_data = &quirk_spurious_8042,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"),
++ }
++ },
+ {
+ .ident = "TUXEDO InfinityBook Pro 14/15 AMD Gen10",
+ .driver_data = &quirk_spurious_8042,
+--
+2.51.0
+
--- /dev/null
+From e3401b16db832fe5d2f5d5ff2790b5e2fd001548 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 14:35:46 +0530
+Subject: platform/x86/amd/pmf: Support new ACPI ID AMDI0108
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 1b09d08866277677d11726116f5e786d5ba00173 ]
+
+Include the ACPI ID AMDI0108, which is used on upcoming AMD platforms, in
+the PMF driver's list of supported devices.
+
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250915090546.2759130-1-Shyam-sundar.S-k@amd.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmf/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/amd/pmf/core.c b/drivers/platform/x86/amd/pmf/core.c
+index ef988605c4da6..bc544a4a5266e 100644
+--- a/drivers/platform/x86/amd/pmf/core.c
++++ b/drivers/platform/x86/amd/pmf/core.c
+@@ -403,6 +403,7 @@ static const struct acpi_device_id amd_pmf_acpi_ids[] = {
+ {"AMDI0103", 0},
+ {"AMDI0105", 0},
+ {"AMDI0107", 0},
++ {"AMDI0108", 0},
+ { }
+ };
+ MODULE_DEVICE_TABLE(acpi, amd_pmf_acpi_ids);
+--
+2.51.0
+
--- /dev/null
+From f15ab63281c302a5ba5bf7a5c5bf3fc2e5c93558 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 15:22:51 +0200
+Subject: platform/x86: oxpec: Add support for OneXPlayer X1Pro EVA-02
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit fba9d5448bd45b0ff7199c47023e9308ea4f1730 ]
+
+It is a special edition of X1Pro with a different color.
+
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Link: https://patch.msgid.link/20250904132252.3041613-1-lkml@antheas.dev
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/oxpec.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/platform/x86/oxpec.c b/drivers/platform/x86/oxpec.c
+index eb076bb4099be..4f540a9932fe1 100644
+--- a/drivers/platform/x86/oxpec.c
++++ b/drivers/platform/x86/oxpec.c
+@@ -306,6 +306,13 @@ static const struct dmi_system_id dmi_table[] = {
+ },
+ .driver_data = (void *)oxp_x1,
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ONE-NETBOOK"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "ONEXPLAYER X1Pro EVA-02"),
++ },
++ .driver_data = (void *)oxp_x1,
++ },
+ {},
+ };
+
+--
+2.51.0
+
drm-amdgpu-enable-mes-lr_compute_wa-by-default.patch
wifi-rtw89-mcc-stop-tx-during-mcc-prepare.patch
wifi-rtw89-fix-use-after-free-in-rtw89_core_tx_kick_off_and_wait.patch
+gpiolib-acpi-ignore-touchpad-wakeup-on-gpd-g1619-05.patch
+asoc-rt712-avoid-skipping-the-blind-write.patch
+asoc-amd-acp-adjust-pdm-gain-value.patch
+dm-integrity-limit-max_tag_size-to-255.patch
+platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch
+platform-x86-oxpec-add-support-for-onexplayer-x1pro-.patch
+perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch
+drm-amdgpu-gfx11-add-cleaner-shader-support-for-gfx1.patch
+platform-x86-amd-pmf-support-new-acpi-id-amdi0108.patch
+asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch
+btrfs-ref-verify-handle-damaged-extent-root-tree.patch
+netfs-prevent-duplicate-unlocking.patch
+iommufd-warn-if-an-object-is-aborted-with-an-elevate.patch
+can-hi311x-fix-null-pointer-dereference-when-resumin.patch
+can-rcar_canfd-fix-controller-mode-setting.patch
+platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch
--- /dev/null
+From c1f1e77f67de5dfb5ff9c934c5c486f1f592ba62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 11:15:47 +0530
+Subject: ASoC: amd: acp: Adjust pdm gain value
+
+From: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+
+[ Upstream commit f1d0260362d72f9f454dc1f9db2eeb80cb801f28 ]
+
+Set pdm gain value by setting PDM_MISC_CTRL_MASK value.
+To avoid low pdm gain value.
+
+Signed-off-by: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20250821054606.1279178-1-venkataprasad.potturu@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp/amd.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/amd/acp/amd.h b/sound/soc/amd/acp/amd.h
+index d6cfae6ec5f74..3f1761755b866 100644
+--- a/sound/soc/amd/acp/amd.h
++++ b/sound/soc/amd/acp/amd.h
+@@ -116,7 +116,7 @@
+ #define PDM_DMA_INTR_MASK 0x10000
+ #define PDM_DEC_64 0x2
+ #define PDM_CLK_FREQ_MASK 0x07
+-#define PDM_MISC_CTRL_MASK 0x10
++#define PDM_MISC_CTRL_MASK 0x18
+ #define PDM_ENABLE 0x01
+ #define PDM_DISABLE 0x00
+ #define DMA_EN_MASK 0x02
+--
+2.51.0
+
--- /dev/null
+From 81a884957971133d646abad29bc8ef2f16d5157a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 08:11:43 +0000
+Subject: ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue
+
+From: Jack Yu <jack.yu@realtek.com>
+
+[ Upstream commit 1dd28fd86c3fa4e395031dd6f2ba920242107010 ]
+
+Adjust register settings for SAR adc button detection mode
+to fix noise issue in headset.
+
+Signed-off-by: Jack Yu <jack.yu@realtek.com>
+Link: https://patch.msgid.link/766cd1d2dd7a403ba65bb4cc44845f71@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682s.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c
+index 92c647d439ec7..89de427c19e79 100644
+--- a/sound/soc/codecs/rt5682s.c
++++ b/sound/soc/codecs/rt5682s.c
+@@ -653,14 +653,15 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode
+ switch (mode) {
+ case SAR_PWR_SAVING:
+ snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_3,
+- RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_DIS);
++ RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_EN);
+ snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1,
+- RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK,
+- RT5682S_CTRL_MB1_REG | RT5682S_CTRL_MB2_REG);
++ RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK |
++ RT5682S_VREF_POW_MASK, RT5682S_CTRL_MB1_FSM |
++ RT5682S_CTRL_MB2_FSM | RT5682S_VREF_POW_FSM);
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK |
+ RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS |
+- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU);
++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU);
+ usleep_range(5000, 5500);
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK, RT5682S_SAR_BUTDET_EN);
+@@ -688,7 +689,7 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK |
+ RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS |
+- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU);
++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU);
+ break;
+ default:
+ dev_err(component->dev, "Invalid SAR Power mode: %d\n", mode);
+@@ -725,7 +726,7 @@ static void rt5682s_disable_push_button_irq(struct snd_soc_component *component)
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK |
+ RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS |
+- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU);
++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU);
+ }
+
+ /**
+@@ -786,7 +787,7 @@ static int rt5682s_headset_detect(struct snd_soc_component *component, int jack_
+ jack_type = SND_JACK_HEADSET;
+ snd_soc_component_write(component, RT5682S_SAR_IL_CMD_3, 0x024c);
+ snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1,
+- RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_EN);
++ RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_DIS);
+ snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_SEL_MB1_2_MASK, val << RT5682S_SAR_SEL_MB1_2_SFT);
+ rt5682s_enable_push_button_irq(component);
+@@ -966,7 +967,7 @@ static int rt5682s_set_jack_detect(struct snd_soc_component *component,
+ RT5682S_EMB_JD_MASK | RT5682S_DET_TYPE |
+ RT5682S_POL_FAST_OFF_MASK | RT5682S_MIC_CAP_MASK,
+ RT5682S_EMB_JD_EN | RT5682S_DET_TYPE |
+- RT5682S_POL_FAST_OFF_HIGH | RT5682S_MIC_CAP_HS);
++ RT5682S_POL_FAST_OFF_LOW | RT5682S_MIC_CAP_HS);
+ regmap_update_bits(rt5682s->regmap, RT5682S_SAR_IL_CMD_1,
+ RT5682S_SAR_POW_MASK, RT5682S_SAR_POW_EN);
+ regmap_update_bits(rt5682s->regmap, RT5682S_GPIO_CTRL_1,
+--
+2.51.0
+
--- /dev/null
+From 841cba80bf7a5ef58a8d142ffc5f4c580b5ac93b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 08:37:47 +0200
+Subject: btrfs: ref-verify: handle damaged extent root tree
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit ed4e6b5d644c4dd2bc2872ffec036b7da0ec2e27 ]
+
+Syzbot hits a problem with enabled ref-verify, ignorebadroots and a
+fuzzed/damaged extent tree. There's no fallback option like in other
+places that can deal with it so disable the whole ref-verify as it is
+just a debugging feature.
+
+Reported-by: syzbot+9c3e0cdfbfe351b0bc0e@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/all/0000000000001b6052062139be1c@google.com/
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ref-verify.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
+index 28ac7995716e0..b8122582d7555 100644
+--- a/fs/btrfs/ref-verify.c
++++ b/fs/btrfs/ref-verify.c
+@@ -990,11 +990,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info)
+ if (!btrfs_test_opt(fs_info, REF_VERIFY))
+ return 0;
+
++ extent_root = btrfs_extent_root(fs_info, 0);
++ /* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */
++ if (IS_ERR(extent_root)) {
++ btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling");
++ btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY);
++ return 0;
++ }
++
+ path = btrfs_alloc_path();
+ if (!path)
+ return -ENOMEM;
+
+- extent_root = btrfs_extent_root(fs_info, 0);
+ eb = btrfs_read_lock_root_node(extent_root);
+ level = btrfs_header_level(eb);
+ path->nodes[level] = eb;
+--
+2.51.0
+
--- /dev/null
+From ecb466533f8933a2742d81c3948787a64adbf97c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 23:08:20 +0800
+Subject: can: hi311x: fix null pointer dereference when resuming from sleep
+ before interface was enabled
+
+From: Chen Yufeng <chenyufeng@iie.ac.cn>
+
+[ Upstream commit 6b696808472197b77b888f50bc789a3bae077743 ]
+
+This issue is similar to the vulnerability in the `mcp251x` driver,
+which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from
+sleep before interface was brought up").
+
+In the `hi311x` driver, when the device resumes from sleep, the driver
+schedules `priv->restart_work`. However, if the network interface was
+not previously enabled, the `priv->wq` (workqueue) is not allocated and
+initialized, leading to a null pointer dereference.
+
+To fix this, we move the allocation and initialization of the workqueue
+from the `hi3110_open` function to the `hi3110_can_probe` function.
+This ensures that the workqueue is properly initialized before it is
+used during device resume. And added logic to destroy the workqueue
+in the error handling paths of `hi3110_can_probe` and in the
+`hi3110_can_remove` function to prevent resource leaks.
+
+Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
+Link: https://patch.msgid.link/20250911150820.250-1-chenyufeng@iie.ac.cn
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/spi/hi311x.c | 33 +++++++++++++++++----------------
+ 1 file changed, 17 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
+index 57ea7dfe8a596..1acd4fc7adc8b 100644
+--- a/drivers/net/can/spi/hi311x.c
++++ b/drivers/net/can/spi/hi311x.c
+@@ -545,8 +545,6 @@ static int hi3110_stop(struct net_device *net)
+
+ priv->force_quit = 1;
+ free_irq(spi->irq, priv);
+- destroy_workqueue(priv->wq);
+- priv->wq = NULL;
+
+ mutex_lock(&priv->hi3110_lock);
+
+@@ -771,34 +769,23 @@ static int hi3110_open(struct net_device *net)
+ goto out_close;
+ }
+
+- priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
+- 0);
+- if (!priv->wq) {
+- ret = -ENOMEM;
+- goto out_free_irq;
+- }
+- INIT_WORK(&priv->tx_work, hi3110_tx_work_handler);
+- INIT_WORK(&priv->restart_work, hi3110_restart_work_handler);
+-
+ ret = hi3110_hw_reset(spi);
+ if (ret)
+- goto out_free_wq;
++ goto out_free_irq;
+
+ ret = hi3110_setup(net);
+ if (ret)
+- goto out_free_wq;
++ goto out_free_irq;
+
+ ret = hi3110_set_normal_mode(spi);
+ if (ret)
+- goto out_free_wq;
++ goto out_free_irq;
+
+ netif_wake_queue(net);
+ mutex_unlock(&priv->hi3110_lock);
+
+ return 0;
+
+- out_free_wq:
+- destroy_workqueue(priv->wq);
+ out_free_irq:
+ free_irq(spi->irq, priv);
+ hi3110_hw_sleep(spi);
+@@ -915,6 +902,15 @@ static int hi3110_can_probe(struct spi_device *spi)
+ if (ret)
+ goto out_clk;
+
++ priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
++ 0);
++ if (!priv->wq) {
++ ret = -ENOMEM;
++ goto out_clk;
++ }
++ INIT_WORK(&priv->tx_work, hi3110_tx_work_handler);
++ INIT_WORK(&priv->restart_work, hi3110_restart_work_handler);
++
+ priv->spi = spi;
+ mutex_init(&priv->hi3110_lock);
+
+@@ -950,6 +946,8 @@ static int hi3110_can_probe(struct spi_device *spi)
+ return 0;
+
+ error_probe:
++ destroy_workqueue(priv->wq);
++ priv->wq = NULL;
+ hi3110_power_enable(priv->power, 0);
+
+ out_clk:
+@@ -970,6 +968,9 @@ static void hi3110_can_remove(struct spi_device *spi)
+
+ hi3110_power_enable(priv->power, 0);
+
++ destroy_workqueue(priv->wq);
++ priv->wq = NULL;
++
+ clk_disable_unprepare(priv->clk);
+
+ free_candev(net);
+--
+2.51.0
+
--- /dev/null
+From 2f822346df8ea0bfc70698d743ec8d7f1c0ddf6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 07:03:45 +0000
+Subject: can: rcar_canfd: Fix controller mode setting
+
+From: Duy Nguyen <duy.nguyen.rh@renesas.com>
+
+[ Upstream commit 5cff263606a10102a0ea19ff579eaa18fd5577ad ]
+
+Driver configures register to choose controller mode before
+setting all channels to reset mode leading to failure.
+The patch corrects operation of mode setting.
+
+Signed-off-by: Duy Nguyen <duy.nguyen.rh@renesas.com>
+Signed-off-by: Tranh Ha <tranh.ha.xb@renesas.com>
+Link: https://patch.msgid.link/TYWPR01MB87434739F83E27EDCD23DF44B416A@TYWPR01MB8743.jpnprd01.prod.outlook.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rcar/rcar_canfd.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
+index e501b55678d1d..ae4ebcee60779 100644
+--- a/drivers/net/can/rcar/rcar_canfd.c
++++ b/drivers/net/can/rcar/rcar_canfd.c
+@@ -738,9 +738,6 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv)
+ /* Reset Global error flags */
+ rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0);
+
+- /* Set the controller into appropriate mode */
+- rcar_canfd_set_mode(gpriv);
+-
+ /* Transition all Channels to reset mode */
+ for_each_set_bit(ch, &gpriv->channels_mask, gpriv->info->max_channels) {
+ rcar_canfd_clear_bit(gpriv->base,
+@@ -760,6 +757,10 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv)
+ return err;
+ }
+ }
++
++ /* Set the controller into appropriate mode */
++ rcar_canfd_set_mode(gpriv);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 68841b727bb143d83cb111340034c046d364109f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 15:52:02 +0200
+Subject: dm-integrity: limit MAX_TAG_SIZE to 255
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ]
+
+MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size
+= ic->tag_size" assignment. We need to limit it to 255.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-integrity.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 0bd76f8d4dc6b..6442d41622eff 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -129,7 +129,7 @@ struct journal_sector {
+ commit_id_t commit_id;
+ };
+
+-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK]))
++#define MAX_TAG_SIZE 255
+
+ #define METADATA_PADDING_SECTORS 8
+
+--
+2.51.0
+
--- /dev/null
+From f964de4e6e7e05fc0484151ca52b5bac479a1c51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 16:16:55 +0800
+Subject: perf subcmd: avoid crash in exclude_cmds when excludes is empty
+
+From: hupu <hupu.gm@gmail.com>
+
+[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ]
+
+When cross-compiling the perf tool for ARM64, `perf help` may crash
+with the following assertion failure:
+
+ help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed.
+
+This happens when the perf binary is not named exactly "perf" or when
+multiple "perf-*" binaries exist in the same directory. In such cases,
+the `excludes` command list can be empty, which leads to the final
+assertion in exclude_cmds() being triggered.
+
+Add a simple guard at the beginning of exclude_cmds() to return early
+if excludes->cnt is zero, preventing the crash.
+
+Signed-off-by: hupu <hupu.gm@gmail.com>
+Reported-by: Guilherme Amadio <amadio@gentoo.org>
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/subcmd/help.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
+index 9ef569492560e..ddaeb4eb3e249 100644
+--- a/tools/lib/subcmd/help.c
++++ b/tools/lib/subcmd/help.c
+@@ -75,6 +75,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
+ size_t ci, cj, ei;
+ int cmp;
+
++ if (!excludes->cnt)
++ return;
++
+ ci = cj = ei = 0;
+ while (ci < cmds->cnt && ei < excludes->cnt) {
+ cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name);
+--
+2.51.0
+
--- /dev/null
+From facfbdabd60399c00d43f3b95544b1c202195017 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 09:06:11 +0000
+Subject: platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: aprilgrimoire <aprilgrimoire@proton.me>
+
+[ Upstream commit 8822e8be86d40410ddd2ac8ff44f3050c9ecf9c6 ]
+
+The firmware of Mechrevo Yilong15Pro emits a spurious keyboard interrupt on
+events including closing the lid. When a user closes the lid on an already
+suspended system this causes the system to wake up.
+Add Mechrevo Yilong15Pro Series (GM5HG7A) to the list of quirk
+spurious_8042 to work around this issue.
+
+Link: https://lore.kernel.org/linux-pm/6ww4uu6Gl4F5n6VY5dl1ufASfKzs4DhMxAN8BuqUpCoqU3PQukVSVSBCl_lKIzkQ-S8kt1acPd58eyolhkWN32lMLFj4ViI0Tdu2jwhnYZ8=@proton.me/
+Signed-off-by: April Grimoire <aprilgrimoire@proton.me>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/IvSc_IN5Pa0wRXElTk_fEl-cTpMZxg6TCQk_7aRUkTd9vJUp_ZeC0NdXZ0z6Tn7B-XiqqqQvCH65lq6FqhuECBMEYWcHQmWm1Jo7Br8kpeg=@proton.me
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index 6f5437d210a61..b872baf35808f 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -233,6 +233,14 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"),
+ }
+ },
++ {
++ .ident = "MECHREVO Yilong15Pro Series GM5HG7A",
++ .driver_data = &quirk_spurious_8042,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MECHREVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Yilong15Pro Series GM5HG7A"),
++ }
++ },
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=220116 */
+ {
+ .ident = "PCSpecialist Lafite Pro V 14M",
+--
+2.51.0
+
--- /dev/null
+From 4e2a77e6f07274c149a7b0a574ac6298e5f688a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 18:46:49 +0200
+Subject: platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042
+ quirks list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christoffer Sandberg <cs@tuxedo.de>
+
+[ Upstream commit 12a3dd4d2cd9232d4e4df3b9a5b3d745db559941 ]
+
+Prevents instant wakeup ~1s after suspend
+
+Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20250916164700.32896-1-wse@tuxedocomputers.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index b872baf35808f..9fd2829ee2ab4 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -250,6 +250,13 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Lafite Pro V 14M"),
+ }
+ },
++ {
++ .ident = "TUXEDO Stellaris Slim 15 AMD Gen6",
++ .driver_data = &quirk_spurious_8042,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"),
++ }
++ },
+ {
+ .ident = "TUXEDO InfinityBook Pro 14/15 AMD Gen10",
+ .driver_data = &quirk_spurious_8042,
+--
+2.51.0
+
media-tunner-xc5000-refactor-firmware-load.patch
media-tuner-xc5000-fix-use-after-free-in-xc5000_release.patch
media-i2c-tc358743-fix-use-after-free-bugs-caused-by-orphan-timer-in-probe.patch
+asoc-amd-acp-adjust-pdm-gain-value.patch
+dm-integrity-limit-max_tag_size-to-255.patch
+platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch
+perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch
+asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch
+btrfs-ref-verify-handle-damaged-extent-root-tree.patch
+can-hi311x-fix-null-pointer-dereference-when-resumin.patch
+can-rcar_canfd-fix-controller-mode-setting.patch
+platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
