--- /dev/null
+From stable+bounces-181948-greg=kroah.com@vger.kernel.org Mon Sep 29 17:51:18 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 11:50:10 -0400
+Subject: drm/ast: Use msleep instead of mdelay for edid read
+To: stable@vger.kernel.org
+Cc: Nirmoy Das <nirmoyd@nvidia.com>, Thomas Zimmermann <tzimmermann@suse.de>, csoto@nvidia.com, KuoHsiang Chou <kuohsiang_chou@aspeedtech.com>, Dave Airlie <airlied@redhat.com>, Jocelyn Falempe <jfalempe@redhat.com>, dri-devel@lists.freedesktop.org, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250929155031.137825-1-sashal@kernel.org>
+
+From: Nirmoy Das <nirmoyd@nvidia.com>
+
+[ Upstream commit c7c31f8dc54aa3c9b2c994b5f1ff7e740a654e97 ]
+
+The busy-waiting in `mdelay()` can cause CPU stalls and kernel timeouts
+during boot.
+
+Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Tested-by: Carol L Soto csoto@nvidia.com<mailto:csoto@nvidia.com>
+Fixes: 594e9c04b586 ("drm/ast: Create the driver for ASPEED proprietory Display-Port")
+Cc: KuoHsiang Chou <kuohsiang_chou@aspeedtech.com>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: Jocelyn Falempe <jfalempe@redhat.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v5.19+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://lore.kernel.org/r/20250917194346.2905522-1-nirmoyd@nvidia.com
+[ Applied change to ast_astdp_read_edid() instead of ast_astdp_read_edid_block() ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/ast/ast_dp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/ast/ast_dp.c
++++ b/drivers/gpu/drm/ast/ast_dp.c
+@@ -62,7 +62,7 @@ int ast_astdp_read_edid(struct drm_devic
+ * of right-click of mouse.
+ * 2. The Delays are often longer a lot when system resume from S3/S4.
+ */
+- mdelay(j+1);
++ msleep(j + 1);
+
+ if (!(ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xD1,
+ ASTDP_MCU_FW_EXECUTING) &&
--- /dev/null
+From stable+bounces-181990-greg=kroah.com@vger.kernel.org Mon Sep 29 20:58:05 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 14:57:56 -0400
+Subject: gpiolib: Extend software-node support to support secondary software-nodes
+To: stable@vger.kernel.org
+Cc: Hans de Goede <hansg@kernel.org>, Dmitry Torokhov <dmitry.torokhov@gmail.com>, Bartosz Golaszewski <bartosz.golaszewski@linaro.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250929185756.284707-1-sashal@kernel.org>
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit c6ccc4dde17676dfe617b9a37bd9ba19a8fc87ee ]
+
+When a software-node gets added to a device which already has another
+fwnode as primary node it will become the secondary fwnode for that
+device.
+
+Currently if a software-node with GPIO properties ends up as the secondary
+fwnode then gpiod_find_by_fwnode() will fail to find the GPIOs.
+
+Add a new gpiod_fwnode_lookup() helper which falls back to calling
+gpiod_find_by_fwnode() with the secondary fwnode if the GPIO was not
+found in the primary fwnode.
+
+Fixes: e7f9ff5dc90c ("gpiolib: add support for software nodes")
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Link: https://lore.kernel.org/r/20250920200955.20403-1-hansg@kernel.org
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpiolib.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -4022,6 +4022,23 @@ static struct gpio_desc *gpiod_find_by_f
+ return desc;
+ }
+
++static struct gpio_desc *gpiod_fwnode_lookup(struct fwnode_handle *fwnode,
++ struct device *consumer,
++ const char *con_id,
++ unsigned int idx,
++ enum gpiod_flags *flags,
++ unsigned long *lookupflags)
++{
++ struct gpio_desc *desc;
++
++ desc = gpiod_find_by_fwnode(fwnode, consumer, con_id, idx, flags, lookupflags);
++ if (gpiod_not_found(desc) && !IS_ERR_OR_NULL(fwnode))
++ desc = gpiod_find_by_fwnode(fwnode->secondary, consumer, con_id,
++ idx, flags, lookupflags);
++
++ return desc;
++}
++
+ struct gpio_desc *gpiod_find_and_request(struct device *consumer,
+ struct fwnode_handle *fwnode,
+ const char *con_id,
+@@ -4034,7 +4051,7 @@ struct gpio_desc *gpiod_find_and_request
+ struct gpio_desc *desc;
+ int ret;
+
+- desc = gpiod_find_by_fwnode(fwnode, consumer, con_id, idx, &flags, &lookupflags);
++ desc = gpiod_fwnode_lookup(fwnode, consumer, con_id, idx, &flags, &lookupflags);
+ if (gpiod_not_found(desc) && platform_lookup_allowed) {
+ /*
+ * Either we are not using DT or ACPI, or their lookup did not
--- /dev/null
+From stable+bounces-181922-greg=kroah.com@vger.kernel.org Mon Sep 29 16:11:36 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 10:11:10 -0400
+Subject: i40e: add validation for ring_len param
+To: stable@vger.kernel.org
+Cc: Lukasz Czapnik <lukasz.czapnik@intel.com>, Aleksandr Loktionov <aleksandr.loktionov@intel.com>, Przemek Kitszel <przemyslaw.kitszel@intel.com>, Simon Horman <horms@kernel.org>, Rafal Romanowski <rafal.romanowski@intel.com>, Tony Nguyen <anthony.l.nguyen@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250929141110.80651-2-sashal@kernel.org>
+
+From: Lukasz Czapnik <lukasz.czapnik@intel.com>
+
+[ Upstream commit 55d225670def06b01af2e7a5e0446fbe946289e8 ]
+
+The `ring_len` parameter provided by the virtual function (VF)
+is assigned directly to the hardware memory context (HMC) without
+any validation.
+
+To address this, introduce an upper boundary check for both Tx and Rx
+queue lengths. The maximum number of descriptors supported by the
+hardware is 8k-32.
+Additionally, enforce alignment constraints: Tx rings must be a multiple
+of 8, and Rx rings must be a multiple of 32.
+
+Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface")
+Cc: stable@vger.kernel.org
+Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -657,6 +657,13 @@ static int i40e_config_vsi_tx_queue(stru
+
+ /* only set the required fields */
+ tx_ctx.base = info->dma_ring_addr / 128;
++
++ /* ring_len has to be multiple of 8 */
++ if (!IS_ALIGNED(info->ring_len, 8) ||
++ info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) {
++ ret = -EINVAL;
++ goto error_context;
++ }
+ tx_ctx.qlen = info->ring_len;
+ tx_ctx.rdylist = le16_to_cpu(vsi->info.qs_handle[0]);
+ tx_ctx.rdylist_act = 0;
+@@ -722,6 +729,13 @@ static int i40e_config_vsi_rx_queue(stru
+
+ /* only set the required fields */
+ rx_ctx.base = info->dma_ring_addr / 128;
++
++ /* ring_len has to be multiple of 32 */
++ if (!IS_ALIGNED(info->ring_len, 32) ||
++ info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) {
++ ret = -EINVAL;
++ goto error_param;
++ }
+ rx_ctx.qlen = info->ring_len;
+
+ if (info->splithdr_enabled) {
--- /dev/null
+From stable+bounces-181921-greg=kroah.com@vger.kernel.org Mon Sep 29 16:11:23 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 10:11:09 -0400
+Subject: i40e: increase max descriptors for XL710
+To: stable@vger.kernel.org
+Cc: Justin Bronder <jsbronder@cold-front.org>, Jacob Keller <jacob.e.keller@intel.com>, Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com>, Tony Nguyen <anthony.l.nguyen@intel.com>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250929141110.80651-1-sashal@kernel.org>
+
+From: Justin Bronder <jsbronder@cold-front.org>
+
+[ Upstream commit aa6908ca3bd1e713fd6cd8d7193a008f060bf7d9 ]
+
+In Tables 8-12 and 8-22 in the X710/XXV710/XL710 datasheet, the QLEN
+description states that the maximum size of the descriptor queue is 8k
+minus 32, or 8160.
+
+Signed-off-by: Justin Bronder <jsbronder@cold-front.org>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://lore.kernel.org/r/20231113231047.548659-2-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 55d225670def ("i40e: add validation for ring_len param")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e.h | 1 +
+ drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 25 +++++++++++++++++++------
+ 2 files changed, 20 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e.h
++++ b/drivers/net/ethernet/intel/i40e/i40e.h
+@@ -23,6 +23,7 @@
+ #define I40E_MAX_VEB 16
+
+ #define I40E_MAX_NUM_DESCRIPTORS 4096
++#define I40E_MAX_NUM_DESCRIPTORS_XL710 8160
+ #define I40E_MAX_CSR_SPACE (4 * 1024 * 1024 - 64 * 1024)
+ #define I40E_DEFAULT_NUM_DESCRIPTORS 512
+ #define I40E_REQ_DESCRIPTOR_MULTIPLE 32
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -2015,6 +2015,18 @@ static void i40e_get_drvinfo(struct net_
+ drvinfo->n_priv_flags += I40E_GL_PRIV_FLAGS_STR_LEN;
+ }
+
++static u32 i40e_get_max_num_descriptors(struct i40e_pf *pf)
++{
++ struct i40e_hw *hw = &pf->hw;
++
++ switch (hw->mac.type) {
++ case I40E_MAC_XL710:
++ return I40E_MAX_NUM_DESCRIPTORS_XL710;
++ default:
++ return I40E_MAX_NUM_DESCRIPTORS;
++ }
++}
++
+ static void i40e_get_ringparam(struct net_device *netdev,
+ struct ethtool_ringparam *ring,
+ struct kernel_ethtool_ringparam *kernel_ring,
+@@ -2024,8 +2036,8 @@ static void i40e_get_ringparam(struct ne
+ struct i40e_pf *pf = np->vsi->back;
+ struct i40e_vsi *vsi = pf->vsi[pf->lan_vsi];
+
+- ring->rx_max_pending = I40E_MAX_NUM_DESCRIPTORS;
+- ring->tx_max_pending = I40E_MAX_NUM_DESCRIPTORS;
++ ring->rx_max_pending = i40e_get_max_num_descriptors(pf);
++ ring->tx_max_pending = i40e_get_max_num_descriptors(pf);
+ ring->rx_mini_max_pending = 0;
+ ring->rx_jumbo_max_pending = 0;
+ ring->rx_pending = vsi->rx_rings[0]->count;
+@@ -2050,12 +2062,12 @@ static int i40e_set_ringparam(struct net
+ struct kernel_ethtool_ringparam *kernel_ring,
+ struct netlink_ext_ack *extack)
+ {
++ u32 new_rx_count, new_tx_count, max_num_descriptors;
+ struct i40e_ring *tx_rings = NULL, *rx_rings = NULL;
+ struct i40e_netdev_priv *np = netdev_priv(netdev);
+ struct i40e_hw *hw = &np->vsi->back->hw;
+ struct i40e_vsi *vsi = np->vsi;
+ struct i40e_pf *pf = vsi->back;
+- u32 new_rx_count, new_tx_count;
+ u16 tx_alloc_queue_pairs;
+ int timeout = 50;
+ int i, err = 0;
+@@ -2063,14 +2075,15 @@ static int i40e_set_ringparam(struct net
+ if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))
+ return -EINVAL;
+
+- if (ring->tx_pending > I40E_MAX_NUM_DESCRIPTORS ||
++ max_num_descriptors = i40e_get_max_num_descriptors(pf);
++ if (ring->tx_pending > max_num_descriptors ||
+ ring->tx_pending < I40E_MIN_NUM_DESCRIPTORS ||
+- ring->rx_pending > I40E_MAX_NUM_DESCRIPTORS ||
++ ring->rx_pending > max_num_descriptors ||
+ ring->rx_pending < I40E_MIN_NUM_DESCRIPTORS) {
+ netdev_info(netdev,
+ "Descriptors requested (Tx: %d / Rx: %d) out of range [%d-%d]\n",
+ ring->tx_pending, ring->rx_pending,
+- I40E_MIN_NUM_DESCRIPTORS, I40E_MAX_NUM_DESCRIPTORS);
++ I40E_MIN_NUM_DESCRIPTORS, max_num_descriptors);
+ return -EINVAL;
+ }
+
--- /dev/null
+From 7e49538288e523427beedd26993d446afef1a6fb Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Fri, 11 Jul 2025 18:32:03 +0200
+Subject: loop: Avoid updating block size under exclusive owner
+
+From: Jan Kara <jack@suse.cz>
+
+commit 7e49538288e523427beedd26993d446afef1a6fb upstream.
+
+Syzbot came up with a reproducer where a loop device block size is
+changed underneath a mounted filesystem. This causes a mismatch between
+the block device block size and the block size stored in the superblock
+causing confusion in various places such as fs/buffer.c. The particular
+issue triggered by syzbot was a warning in __getblk_slow() due to
+requested buffer size not matching block device block size.
+
+Fix the problem by getting exclusive hold of the loop device to change
+its block size. This fails if somebody (such as filesystem) has already
+an exclusive ownership of the block device and thus prevents modifying
+the loop device under some exclusive owner which doesn't expect it.
+
+Reported-by: syzbot+01ef7a8da81a975e1ccd@syzkaller.appspotmail.com
+Signed-off-by: Jan Kara <jack@suse.cz>
+Tested-by: syzbot+01ef7a8da81a975e1ccd@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20250711163202.19623-2-jack@suse.cz
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/loop.c | 40 +++++++++++++++++++++++++++++++---------
+ 1 file changed, 31 insertions(+), 9 deletions(-)
+
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1472,19 +1472,36 @@ static int loop_set_dio(struct loop_devi
+ return error;
+ }
+
+-static int loop_set_block_size(struct loop_device *lo, unsigned long arg)
++static int loop_set_block_size(struct loop_device *lo, blk_mode_t mode,
++ struct block_device *bdev, unsigned long arg)
+ {
+ int err = 0;
+
+- if (lo->lo_state != Lo_bound)
+- return -ENXIO;
++ /*
++ * If we don't hold exclusive handle for the device, upgrade to it
++ * here to avoid changing device under exclusive owner.
++ */
++ if (!(mode & BLK_OPEN_EXCL)) {
++ err = bd_prepare_to_claim(bdev, loop_set_block_size, NULL);
++ if (err)
++ return err;
++ }
++
++ err = mutex_lock_killable(&lo->lo_mutex);
++ if (err)
++ goto abort_claim;
++
++ if (lo->lo_state != Lo_bound) {
++ err = -ENXIO;
++ goto unlock;
++ }
+
+ err = blk_validate_block_size(arg);
+ if (err)
+- return err;
++ goto unlock;
+
+ if (lo->lo_queue->limits.logical_block_size == arg)
+- return 0;
++ goto unlock;
+
+ sync_blockdev(lo->lo_device);
+ invalidate_bdev(lo->lo_device);
+@@ -1496,6 +1513,11 @@ static int loop_set_block_size(struct lo
+ loop_update_dio(lo);
+ blk_mq_unfreeze_queue(lo->lo_queue);
+
++unlock:
++ mutex_unlock(&lo->lo_mutex);
++abort_claim:
++ if (!(mode & BLK_OPEN_EXCL))
++ bd_abort_claiming(bdev, loop_set_block_size);
+ return err;
+ }
+
+@@ -1514,9 +1536,6 @@ static int lo_simple_ioctl(struct loop_d
+ case LOOP_SET_DIRECT_IO:
+ err = loop_set_dio(lo, arg);
+ break;
+- case LOOP_SET_BLOCK_SIZE:
+- err = loop_set_block_size(lo, arg);
+- break;
+ default:
+ err = -EINVAL;
+ }
+@@ -1571,9 +1590,12 @@ static int lo_ioctl(struct block_device
+ break;
+ case LOOP_GET_STATUS64:
+ return loop_get_status64(lo, argp);
++ case LOOP_SET_BLOCK_SIZE:
++ if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN))
++ return -EPERM;
++ return loop_set_block_size(lo, mode, bdev, arg);
+ case LOOP_SET_CAPACITY:
+ case LOOP_SET_DIRECT_IO:
+- case LOOP_SET_BLOCK_SIZE:
+ if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN))
+ return -EPERM;
+ fallthrough;
arm-bcm-select-arm_gic_v3-for-arch_brcmstb.patch
mm-migrate_device-use-more-folio-in-migrate_device_finalize.patch
mm-migrate_device-don-t-add-folio-to-be-freed-to-lru-in-migrate_device_finalize.patch
+loop-avoid-updating-block-size-under-exclusive-owner.patch
+gpiolib-extend-software-node-support-to-support-secondary-software-nodes.patch
+drm-ast-use-msleep-instead-of-mdelay-for-edid-read.patch
+i40e-increase-max-descriptors-for-xl710.patch
+i40e-add-validation-for-ring_len-param.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
