--- /dev/null
+From bcbdd9a84517e1caca3ae248612df8edca5e5cfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:06:39 +0100
+Subject: ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
+ message
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 35fc531a59694f24a2456569cf7d1a9c6436841c ]
+
+The dev_err message is reporting an error about capture streams however
+it is using the incorrect variable num_playback instead of num_capture.
+Fix this by using the correct variable num_capture.
+
+Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-stream.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c
+index 0e09ede922c7a..ea4fe28cbdace 100644
+--- a/sound/soc/sof/intel/hda-stream.c
++++ b/sound/soc/sof/intel/hda-stream.c
+@@ -771,7 +771,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev)
+
+ if (num_capture >= SOF_HDA_CAPTURE_STREAMS) {
+ dev_err(sdev->dev, "error: too many capture streams %d\n",
+- num_playback);
++ num_capture);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 3c88a028f2a8df501c1ed4dbdf24ea701595de1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:38 +0100
+Subject: ASoC: wm8940: Correct typo in control name
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit b4799520dcd6fe1e14495cecbbe9975d847cd482 ]
+
+Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver")
+Reported-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Tested-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8940.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c
+index 016cd8aeef37c..31234ad14e688 100644
+--- a/sound/soc/codecs/wm8940.c
++++ b/sound/soc/codecs/wm8940.c
+@@ -218,7 +218,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = {
+ SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL,
+ 0, 255, 0, wm8940_adc_tlv),
+ SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum),
+- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST,
++ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST,
+ 8, 1, 0, wm8940_capture_boost_vol_tlv),
+ SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL,
+ 0, 63, 0, wm8940_spk_vol_tlv),
+--
+2.51.0
+
--- /dev/null
+From d34bb63507b740b2cd1189244f39cc610f07f2f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:39 +0100
+Subject: ASoC: wm8974: Correct PLL rate rounding
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 9b17d3724df55ecc2bc67978822585f2b023be48 ]
+
+Using a single value of 22500000 for both 48000Hz and 44100Hz audio
+will sometimes result in returning wrong dividers due to rounding.
+Update the code to use the actual value for both.
+
+Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8974.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c
+index 600e93d61a90f..bfc72c2bf90b8 100644
+--- a/sound/soc/codecs/wm8974.c
++++ b/sound/soc/codecs/wm8974.c
+@@ -419,10 +419,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai)
+ fs256 = 256 * priv->fs;
+
+ f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv);
+-
+ if (f != priv->mclk) {
+ /* The PLL performs best around 90MHz */
+- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv);
++ if (fs256 % 8000)
++ f = 22579200;
++ else
++ f = 24576000;
++
++ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv);
+ }
+
+ wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll);
+--
+2.51.0
+
--- /dev/null
+From 0bca3a9ab055629969325e2f0d7ea5931833ad05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:20:59 +0800
+Subject: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ]
+
+Issuing two writes to the same af_alg socket is bogus as the
+data will be interleaved in an unpredictable fashion. Furthermore,
+concurrent writes may create inconsistencies in the internal
+socket state.
+
+Disallow this by adding a new ctx->write field that indiciates
+exclusive ownership for writing.
+
+Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations")
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c | 7 +++++++
+ include/crypto/if_alg.h | 10 ++++++----
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index 755e6caf18d28..25cf2fa3dde75 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -862,6 +862,12 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ }
+
+ lock_sock(sk);
++ if (ctx->write) {
++ release_sock(sk);
++ return -EBUSY;
++ }
++ ctx->write = true;
++
+ if (ctx->init && !ctx->more) {
+ if (ctx->used) {
+ err = -EINVAL;
+@@ -969,6 +975,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+
+ unlock:
+ af_alg_data_wakeup(sk);
++ ctx->write = false;
+ release_sock(sk);
+
+ return copied ?: err;
+diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
+index a406e281ae571..1424200fe88cf 100644
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -136,6 +136,7 @@ struct af_alg_async_req {
+ * SG?
+ * @enc: Cryptographic operation to be performed when
+ * recvmsg is invoked.
++ * @write: True if we are in the middle of a write.
+ * @init: True if metadata has been sent.
+ * @len: Length of memory allocated for this data structure.
+ * @inflight: Non-zero when AIO requests are in flight.
+@@ -151,10 +152,11 @@ struct af_alg_ctx {
+ size_t used;
+ atomic_t rcvused;
+
+- bool more;
+- bool merge;
+- bool enc;
+- bool init;
++ u32 more:1,
++ merge:1,
++ enc:1,
++ write:1,
++ init:1;
+
+ unsigned int len;
+
+--
+2.51.0
+
--- /dev/null
+From 05b59f9c63d8162d6981fd673a6cdda63547628e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 11:44:47 +0800
+Subject: drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
+
+From: Qi Xi <xiqi2@huawei.com>
+
+[ Upstream commit 288dac9fb6084330d968459c750c838fd06e10e6 ]
+
+Add missing mutex unlock before returning from the error path in
+cdns_mhdp_atomic_enable().
+
+Fixes: 935a92a1c400 ("drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qi Xi <xiqi2@huawei.com>
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20250904034447.665427-1-xiqi2@huawei.com
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+index ae99d04f00456..5876589d42b7d 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+@@ -1978,8 +1978,10 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge,
+ mhdp_state = to_cdns_mhdp_bridge_state(new_state);
+
+ mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode);
+- if (!mhdp_state->current_mode)
+- return;
++ if (!mhdp_state->current_mode) {
++ ret = -EINVAL;
++ goto out;
++ }
+
+ drm_mode_set_name(mhdp_state->current_mode);
+
+--
+2.51.0
+
mmc-mvsdio-fix-dma_unmap_sg-nents-value.patch
kvm-svm-sync-tpr-from-lapic-into-vmcb-v_tpr-even-if-avic-is-active.patch
rds-ib-increment-i_fastreg_wrs-before-bailing-out.patch
+asoc-wm8940-correct-typo-in-control-name.patch
+asoc-wm8974-correct-pll-rate-rounding.patch
+asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch
+drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch
+crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch
--- /dev/null
+From 311571c184f79cd353aa25b7aedfd7fb65ff02c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:06:39 +0100
+Subject: ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
+ message
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 35fc531a59694f24a2456569cf7d1a9c6436841c ]
+
+The dev_err message is reporting an error about capture streams however
+it is using the incorrect variable num_playback instead of num_capture.
+Fix this by using the correct variable num_capture.
+
+Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-stream.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c
+index 63c367478f1c9..bf91ac39af1c7 100644
+--- a/sound/soc/sof/intel/hda-stream.c
++++ b/sound/soc/sof/intel/hda-stream.c
+@@ -776,7 +776,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev)
+
+ if (num_capture >= SOF_HDA_CAPTURE_STREAMS) {
+ dev_err(sdev->dev, "error: too many capture streams %d\n",
+- num_playback);
++ num_capture);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c5843a657ee9b6cc04b05055e539b689ae1c62a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:38 +0100
+Subject: ASoC: wm8940: Correct typo in control name
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit b4799520dcd6fe1e14495cecbbe9975d847cd482 ]
+
+Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver")
+Reported-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Tested-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8940.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c
+index 440d048ef0c02..03f5aedab4a54 100644
+--- a/sound/soc/codecs/wm8940.c
++++ b/sound/soc/codecs/wm8940.c
+@@ -218,7 +218,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = {
+ SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL,
+ 0, 255, 0, wm8940_adc_tlv),
+ SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum),
+- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST,
++ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST,
+ 8, 1, 0, wm8940_capture_boost_vol_tlv),
+ SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL,
+ 0, 63, 0, wm8940_spk_vol_tlv),
+--
+2.51.0
+
--- /dev/null
+From 94435845cb37a177ea654eedc10e6edce4b73da0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:39 +0100
+Subject: ASoC: wm8974: Correct PLL rate rounding
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 9b17d3724df55ecc2bc67978822585f2b023be48 ]
+
+Using a single value of 22500000 for both 48000Hz and 44100Hz audio
+will sometimes result in returning wrong dividers due to rounding.
+Update the code to use the actual value for both.
+
+Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8974.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c
+index 9eeac34435664..914b7d04b09ca 100644
+--- a/sound/soc/codecs/wm8974.c
++++ b/sound/soc/codecs/wm8974.c
+@@ -419,10 +419,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai)
+ fs256 = 256 * priv->fs;
+
+ f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv);
+-
+ if (f != priv->mclk) {
+ /* The PLL performs best around 90MHz */
+- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv);
++ if (fs256 % 8000)
++ f = 22579200;
++ else
++ f = 24576000;
++
++ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv);
+ }
+
+ wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll);
+--
+2.51.0
+
--- /dev/null
+From edd879d8cc795165f726a5c776ee2d5c8dc1dbce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:20:59 +0800
+Subject: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ]
+
+Issuing two writes to the same af_alg socket is bogus as the
+data will be interleaved in an unpredictable fashion. Furthermore,
+concurrent writes may create inconsistencies in the internal
+socket state.
+
+Disallow this by adding a new ctx->write field that indiciates
+exclusive ownership for writing.
+
+Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations")
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c | 7 +++++++
+ include/crypto/if_alg.h | 10 ++++++----
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index aa93501e27b95..24c273f53e90a 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -862,6 +862,12 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ }
+
+ lock_sock(sk);
++ if (ctx->write) {
++ release_sock(sk);
++ return -EBUSY;
++ }
++ ctx->write = true;
++
+ if (ctx->init && !ctx->more) {
+ if (ctx->used) {
+ err = -EINVAL;
+@@ -969,6 +975,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+
+ unlock:
+ af_alg_data_wakeup(sk);
++ ctx->write = false;
+ release_sock(sk);
+
+ return copied ?: err;
+diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
+index a406e281ae571..1424200fe88cf 100644
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -136,6 +136,7 @@ struct af_alg_async_req {
+ * SG?
+ * @enc: Cryptographic operation to be performed when
+ * recvmsg is invoked.
++ * @write: True if we are in the middle of a write.
+ * @init: True if metadata has been sent.
+ * @len: Length of memory allocated for this data structure.
+ * @inflight: Non-zero when AIO requests are in flight.
+@@ -151,10 +152,11 @@ struct af_alg_ctx {
+ size_t used;
+ atomic_t rcvused;
+
+- bool more;
+- bool merge;
+- bool enc;
+- bool init;
++ u32 more:1,
++ merge:1,
++ enc:1,
++ write:1,
++ init:1;
+
+ unsigned int len;
+
+--
+2.51.0
+
--- /dev/null
+From b2fdc2a4a6574991c7d5cae7fbc3356f29ac97ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 10:54:38 +0200
+Subject: drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
+
+From: Loic Poulain <loic.poulain@oss.qualcomm.com>
+
+[ Upstream commit a10f910c77f280327b481e77eab909934ec508f0 ]
+
+If the interrupt occurs before resource initialization is complete, the
+interrupt handler/worker may access uninitialized data such as the I2C
+tcpc_client device, potentially leading to NULL pointer dereference.
+
+Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250709085438.56188-1-loic.poulain@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/anx7625.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
+index 257f69b5e1783..4b3b6969da75f 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
+@@ -1822,7 +1822,7 @@ static int anx7625_i2c_probe(struct i2c_client *client,
+ ret = devm_request_threaded_irq(dev, platform->pdata.intp_irq,
+ NULL, anx7625_intr_hpd_isr,
+ IRQF_TRIGGER_FALLING |
+- IRQF_ONESHOT,
++ IRQF_ONESHOT | IRQF_NO_AUTOEN,
+ "anx7625-intp", platform);
+ if (ret) {
+ DRM_DEV_ERROR(dev, "fail to request irq\n");
+@@ -1844,8 +1844,10 @@ static int anx7625_i2c_probe(struct i2c_client *client,
+ }
+
+ /* Add work function */
+- if (platform->pdata.intp_irq)
++ if (platform->pdata.intp_irq) {
++ enable_irq(platform->pdata.intp_irq);
+ queue_work(platform->workqueue, &platform->work);
++ }
+
+ platform->bridge.funcs = &anx7625_bridge_funcs;
+ platform->bridge.of_node = client->dev.of_node;
+--
+2.51.0
+
--- /dev/null
+From 669a86e96c79c65eca05730cf9335eff493b1b8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 11:44:47 +0800
+Subject: drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
+
+From: Qi Xi <xiqi2@huawei.com>
+
+[ Upstream commit 288dac9fb6084330d968459c750c838fd06e10e6 ]
+
+Add missing mutex unlock before returning from the error path in
+cdns_mhdp_atomic_enable().
+
+Fixes: 935a92a1c400 ("drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qi Xi <xiqi2@huawei.com>
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20250904034447.665427-1-xiqi2@huawei.com
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+index c8386311cc704..0d523812afd5a 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+@@ -2040,8 +2040,10 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge,
+ mhdp_state = to_cdns_mhdp_bridge_state(new_state);
+
+ mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode);
+- if (!mhdp_state->current_mode)
+- return;
++ if (!mhdp_state->current_mode) {
++ ret = -EINVAL;
++ goto out;
++ }
+
+ drm_mode_set_name(mhdp_state->current_mode);
+
+--
+2.51.0
+
mmc-mvsdio-fix-dma_unmap_sg-nents-value.patch
kvm-svm-sync-tpr-from-lapic-into-vmcb-v_tpr-even-if-avic-is-active.patch
rds-ib-increment-i_fastreg_wrs-before-bailing-out.patch
+asoc-wm8940-correct-typo-in-control-name.patch
+asoc-wm8974-correct-pll-rate-rounding.patch
+asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch
+drm-bridge-anx7625-fix-null-pointer-dereference-with.patch
+drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch
+crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch
--- /dev/null
+From 7d858eb1d775e942b4d531e8d70255a109d1f2f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:06:39 +0100
+Subject: ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
+ message
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 35fc531a59694f24a2456569cf7d1a9c6436841c ]
+
+The dev_err message is reporting an error about capture streams however
+it is using the incorrect variable num_playback instead of num_capture.
+Fix this by using the correct variable num_capture.
+
+Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-stream.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c
+index 0c11fceb28a7a..d3edc40c7f473 100644
+--- a/sound/soc/sof/intel/hda-stream.c
++++ b/sound/soc/sof/intel/hda-stream.c
+@@ -655,7 +655,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev)
+
+ if (num_capture >= SOF_HDA_CAPTURE_STREAMS) {
+ dev_err(sdev->dev, "error: too many capture streams %d\n",
+- num_playback);
++ num_capture);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a2e856e3e287e5d5191d7534153211a53203c0d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:38 +0100
+Subject: ASoC: wm8940: Correct typo in control name
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit b4799520dcd6fe1e14495cecbbe9975d847cd482 ]
+
+Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver")
+Reported-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Tested-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8940.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c
+index c194fbde8ad6e..a02554b8edf71 100644
+--- a/sound/soc/codecs/wm8940.c
++++ b/sound/soc/codecs/wm8940.c
+@@ -218,7 +218,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = {
+ SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL,
+ 0, 255, 0, wm8940_adc_tlv),
+ SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum),
+- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST,
++ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST,
+ 8, 1, 0, wm8940_capture_boost_vol_tlv),
+ SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL,
+ 0, 63, 0, wm8940_spk_vol_tlv),
+--
+2.51.0
+
--- /dev/null
+From 5c29663b48224d9ce0a4da8cc5ccd07f6cb2350d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:39 +0100
+Subject: ASoC: wm8974: Correct PLL rate rounding
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 9b17d3724df55ecc2bc67978822585f2b023be48 ]
+
+Using a single value of 22500000 for both 48000Hz and 44100Hz audio
+will sometimes result in returning wrong dividers due to rounding.
+Update the code to use the actual value for both.
+
+Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8974.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c
+index dc4fe4f5239d6..f32527ed06fb5 100644
+--- a/sound/soc/codecs/wm8974.c
++++ b/sound/soc/codecs/wm8974.c
+@@ -427,10 +427,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai)
+ fs256 = 256 * priv->fs;
+
+ f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv);
+-
+ if (f != priv->mclk) {
+ /* The PLL performs best around 90MHz */
+- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv);
++ if (fs256 % 8000)
++ f = 22579200;
++ else
++ f = 24576000;
++
++ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv);
+ }
+
+ wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll);
+--
+2.51.0
+
--- /dev/null
+From 7297cc29c3021dc031ea70bfdc30f56227263f99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:20:59 +0800
+Subject: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ]
+
+Issuing two writes to the same af_alg socket is bogus as the
+data will be interleaved in an unpredictable fashion. Furthermore,
+concurrent writes may create inconsistencies in the internal
+socket state.
+
+Disallow this by adding a new ctx->write field that indiciates
+exclusive ownership for writing.
+
+Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations")
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c | 7 +++++++
+ include/crypto/if_alg.h | 10 ++++++----
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index bc96a4b21bec5..66f0d829f46f8 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -852,6 +852,12 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ }
+
+ lock_sock(sk);
++ if (ctx->write) {
++ release_sock(sk);
++ return -EBUSY;
++ }
++ ctx->write = true;
++
+ if (ctx->init && !ctx->more) {
+ if (ctx->used) {
+ err = -EINVAL;
+@@ -959,6 +965,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+
+ unlock:
+ af_alg_data_wakeup(sk);
++ ctx->write = false;
+ release_sock(sk);
+
+ return copied ?: err;
+diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
+index f4ff7ae0128a2..5a5ec21fe147b 100644
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -135,6 +135,7 @@ struct af_alg_async_req {
+ * SG?
+ * @enc: Cryptographic operation to be performed when
+ * recvmsg is invoked.
++ * @write: True if we are in the middle of a write.
+ * @init: True if metadata has been sent.
+ * @len: Length of memory allocated for this data structure.
+ * @inflight: Non-zero when AIO requests are in flight.
+@@ -150,10 +151,11 @@ struct af_alg_ctx {
+ size_t used;
+ atomic_t rcvused;
+
+- bool more;
+- bool merge;
+- bool enc;
+- bool init;
++ u32 more:1,
++ merge:1,
++ enc:1,
++ write:1,
++ init:1;
+
+ unsigned int len;
+
+--
+2.51.0
+
power-supply-bq27xxx-restrict-no-battery-detection-to-bq27000.patch
mmc-mvsdio-fix-dma_unmap_sg-nents-value.patch
rds-ib-increment-i_fastreg_wrs-before-bailing-out.patch
+asoc-wm8940-correct-typo-in-control-name.patch
+asoc-wm8974-correct-pll-rate-rounding.patch
+asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch
+crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch
--- /dev/null
+From c3f05c7a67a1bef17212e3c907fc7e305543b61e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:06:39 +0100
+Subject: ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
+ message
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 35fc531a59694f24a2456569cf7d1a9c6436841c ]
+
+The dev_err message is reporting an error about capture streams however
+it is using the incorrect variable num_playback instead of num_capture.
+Fix this by using the correct variable num_capture.
+
+Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-stream.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c
+index be60e7785da94..fafaf9a8e6c44 100644
+--- a/sound/soc/sof/intel/hda-stream.c
++++ b/sound/soc/sof/intel/hda-stream.c
+@@ -837,7 +837,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev)
+
+ if (num_capture >= SOF_HDA_CAPTURE_STREAMS) {
+ dev_err(sdev->dev, "error: too many capture streams %d\n",
+- num_playback);
++ num_capture);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8ddbe382556252796979850d5b979cff91894a76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:38 +0100
+Subject: ASoC: wm8940: Correct typo in control name
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit b4799520dcd6fe1e14495cecbbe9975d847cd482 ]
+
+Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver")
+Reported-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Tested-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8940.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c
+index 8dac9fd885470..2e70045d5920d 100644
+--- a/sound/soc/codecs/wm8940.c
++++ b/sound/soc/codecs/wm8940.c
+@@ -218,7 +218,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = {
+ SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL,
+ 0, 255, 0, wm8940_adc_tlv),
+ SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum),
+- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST,
++ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST,
+ 8, 1, 0, wm8940_capture_boost_vol_tlv),
+ SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL,
+ 0, 63, 0, wm8940_spk_vol_tlv),
+--
+2.51.0
+
--- /dev/null
+From bd7ce18bece54649b861eee274bb63766e72b903 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:39 +0100
+Subject: ASoC: wm8974: Correct PLL rate rounding
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 9b17d3724df55ecc2bc67978822585f2b023be48 ]
+
+Using a single value of 22500000 for both 48000Hz and 44100Hz audio
+will sometimes result in returning wrong dividers due to rounding.
+Update the code to use the actual value for both.
+
+Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8974.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c
+index 1becbf2c6ffad..587e200913767 100644
+--- a/sound/soc/codecs/wm8974.c
++++ b/sound/soc/codecs/wm8974.c
+@@ -419,10 +419,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai)
+ fs256 = 256 * priv->fs;
+
+ f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv);
+-
+ if (f != priv->mclk) {
+ /* The PLL performs best around 90MHz */
+- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv);
++ if (fs256 % 8000)
++ f = 22579200;
++ else
++ f = 24576000;
++
++ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv);
+ }
+
+ wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll);
+--
+2.51.0
+
--- /dev/null
+From a5206cb3b3e7407a342f33266e71dffd8ad7f13f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:20:59 +0800
+Subject: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ]
+
+Issuing two writes to the same af_alg socket is bogus as the
+data will be interleaved in an unpredictable fashion. Furthermore,
+concurrent writes may create inconsistencies in the internal
+socket state.
+
+Disallow this by adding a new ctx->write field that indiciates
+exclusive ownership for writing.
+
+Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations")
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c | 7 +++++++
+ include/crypto/if_alg.h | 10 ++++++----
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index aca9d72553e8f..316771eb17e27 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -859,6 +859,12 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ }
+
+ lock_sock(sk);
++ if (ctx->write) {
++ release_sock(sk);
++ return -EBUSY;
++ }
++ ctx->write = true;
++
+ if (ctx->init && !ctx->more) {
+ if (ctx->used) {
+ err = -EINVAL;
+@@ -974,6 +980,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+
+ unlock:
+ af_alg_data_wakeup(sk);
++ ctx->write = false;
+ release_sock(sk);
+
+ return copied ?: err;
+diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
+index a406e281ae571..1424200fe88cf 100644
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -136,6 +136,7 @@ struct af_alg_async_req {
+ * SG?
+ * @enc: Cryptographic operation to be performed when
+ * recvmsg is invoked.
++ * @write: True if we are in the middle of a write.
+ * @init: True if metadata has been sent.
+ * @len: Length of memory allocated for this data structure.
+ * @inflight: Non-zero when AIO requests are in flight.
+@@ -151,10 +152,11 @@ struct af_alg_ctx {
+ size_t used;
+ atomic_t rcvused;
+
+- bool more;
+- bool merge;
+- bool enc;
+- bool init;
++ u32 more:1,
++ merge:1,
++ enc:1,
++ write:1,
++ init:1;
+
+ unsigned int len;
+
+--
+2.51.0
+
--- /dev/null
+From 4bfa344fbfd9b550a8727200379871d856389fda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 14:08:53 +0100
+Subject: crypto: af_alg: Indent the loop in af_alg_sendmsg()
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 73d7409cfdad7fd08a9203eb2912c1c77e527776 ]
+
+Put the loop in af_alg_sendmsg() into an if-statement to indent it to make
+the next patch easier to review as that will add another branch to handle
+MSG_SPLICE_PAGES to the if-statement.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Herbert Xu <herbert@gondor.apana.org.au>
+cc: "David S. Miller" <davem@davemloft.net>
+cc: Eric Dumazet <edumazet@google.com>
+cc: Jakub Kicinski <kuba@kernel.org>
+cc: Paolo Abeni <pabeni@redhat.com>
+cc: Jens Axboe <axboe@kernel.dk>
+cc: Matthew Wilcox <willy@infradead.org>
+cc: linux-crypto@vger.kernel.org
+cc: netdev@vger.kernel.org
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: 9574b2330dbd ("crypto: af_alg - Set merge to zero early in af_alg_sendmsg")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c | 51 ++++++++++++++++++++++++++-----------------------
+ 1 file changed, 27 insertions(+), 24 deletions(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index fef69d2a6b183..d5a8368a47c5c 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -927,35 +927,38 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ if (sgl->cur)
+ sg_unmark_end(sg + sgl->cur - 1);
+
+- do {
+- struct page *pg;
+- unsigned int i = sgl->cur;
++ if (1 /* TODO check MSG_SPLICE_PAGES */) {
++ do {
++ struct page *pg;
++ unsigned int i = sgl->cur;
+
+- plen = min_t(size_t, len, PAGE_SIZE);
++ plen = min_t(size_t, len, PAGE_SIZE);
+
+- pg = alloc_page(GFP_KERNEL);
+- if (!pg) {
+- err = -ENOMEM;
+- goto unlock;
+- }
++ pg = alloc_page(GFP_KERNEL);
++ if (!pg) {
++ err = -ENOMEM;
++ goto unlock;
++ }
+
+- sg_assign_page(sg + i, pg);
++ sg_assign_page(sg + i, pg);
+
+- err = memcpy_from_msg(page_address(sg_page(sg + i)),
+- msg, plen);
+- if (err) {
+- __free_page(sg_page(sg + i));
+- sg_assign_page(sg + i, NULL);
+- goto unlock;
+- }
++ err = memcpy_from_msg(
++ page_address(sg_page(sg + i)),
++ msg, plen);
++ if (err) {
++ __free_page(sg_page(sg + i));
++ sg_assign_page(sg + i, NULL);
++ goto unlock;
++ }
+
+- sg[i].length = plen;
+- len -= plen;
+- ctx->used += plen;
+- copied += plen;
+- size -= plen;
+- sgl->cur++;
+- } while (len && sgl->cur < MAX_SGL_ENTS);
++ sg[i].length = plen;
++ len -= plen;
++ ctx->used += plen;
++ copied += plen;
++ size -= plen;
++ sgl->cur++;
++ } while (len && sgl->cur < MAX_SGL_ENTS);
++ }
+
+ if (!size)
+ sg_mark_end(sg + sgl->cur - 1);
+--
+2.51.0
+
--- /dev/null
+From b6d324338b3414cfd0fb4f63baa577b79bcec21c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 15:42:41 +0800
+Subject: crypto: af_alg - Set merge to zero early in af_alg_sendmsg
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 9574b2330dbd2b5459b74d3b5e9619d39299fc6f ]
+
+If an error causes af_alg_sendmsg to abort, ctx->merge may contain
+a garbage value from the previous loop. This may then trigger a
+crash on the next entry into af_alg_sendmsg when it attempts to do
+a merge that can't be done.
+
+Fix this by setting ctx->merge to zero near the start of the loop.
+
+Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations")
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index d5a8368a47c5c..aca9d72553e8f 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -908,6 +908,8 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ continue;
+ }
+
++ ctx->merge = 0;
++
+ if (!af_alg_writable(sk)) {
+ err = af_alg_wait_for_wmem(sk, msg->msg_flags);
+ if (err)
+--
+2.51.0
+
--- /dev/null
+From bdbaa2838adefe71f42f31011b19dd3dc41ffb9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 10:54:38 +0200
+Subject: drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
+
+From: Loic Poulain <loic.poulain@oss.qualcomm.com>
+
+[ Upstream commit a10f910c77f280327b481e77eab909934ec508f0 ]
+
+If the interrupt occurs before resource initialization is complete, the
+interrupt handler/worker may access uninitialized data such as the I2C
+tcpc_client device, potentially leading to NULL pointer dereference.
+
+Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250709085438.56188-1-loic.poulain@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/anx7625.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
+index e14c9fdabe2ba..690a0e7f5f6e2 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
+@@ -2697,7 +2697,7 @@ static int anx7625_i2c_probe(struct i2c_client *client)
+ ret = devm_request_threaded_irq(dev, platform->pdata.intp_irq,
+ NULL, anx7625_intr_hpd_isr,
+ IRQF_TRIGGER_FALLING |
+- IRQF_ONESHOT,
++ IRQF_ONESHOT | IRQF_NO_AUTOEN,
+ "anx7625-intp", platform);
+ if (ret) {
+ DRM_DEV_ERROR(dev, "fail to request irq\n");
+@@ -2767,8 +2767,10 @@ static int anx7625_i2c_probe(struct i2c_client *client)
+ }
+
+ /* Add work function */
+- if (platform->pdata.intp_irq)
++ if (platform->pdata.intp_irq) {
++ enable_irq(platform->pdata.intp_irq);
+ queue_work(platform->workqueue, &platform->work);
++ }
+
+ if (platform->pdata.audio_en)
+ anx7625_register_audio(dev, platform);
+--
+2.51.0
+
--- /dev/null
+From b2ec9a3b8eb1dcf29485ba5ab82c0c2539b6d358 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 11:44:47 +0800
+Subject: drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
+
+From: Qi Xi <xiqi2@huawei.com>
+
+[ Upstream commit 288dac9fb6084330d968459c750c838fd06e10e6 ]
+
+Add missing mutex unlock before returning from the error path in
+cdns_mhdp_atomic_enable().
+
+Fixes: 935a92a1c400 ("drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qi Xi <xiqi2@huawei.com>
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20250904034447.665427-1-xiqi2@huawei.com
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+index 1b7c14d7c5ee3..aaa9f44d27be5 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+@@ -2042,8 +2042,10 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge,
+ mhdp_state = to_cdns_mhdp_bridge_state(new_state);
+
+ mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode);
+- if (!mhdp_state->current_mode)
+- return;
++ if (!mhdp_state->current_mode) {
++ ret = -EINVAL;
++ goto out;
++ }
+
+ drm_mode_set_name(mhdp_state->current_mode);
+
+--
+2.51.0
+
alsa-hda-realtek-fix-mute-led-for-hp-laptop-15-dw4xx.patch
io_uring-backport-io_should_terminate_tw.patch
io_uring-include-dying-ring-in-task_work-should-cancel-state.patch
+asoc-wm8940-correct-typo-in-control-name.patch
+asoc-wm8974-correct-pll-rate-rounding.patch
+asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch
+drm-bridge-anx7625-fix-null-pointer-dereference-with.patch
+drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch
+crypto-af_alg-indent-the-loop-in-af_alg_sendmsg.patch
+crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch
+crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch
+smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch
--- /dev/null
+From bbaa4f608d1843a85e101bdd5bac0197d63e6512 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 03:06:46 +0200
+Subject: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error
+ path
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit daac51c7032036a0ca5f1aa419ad1b0471d1c6e0 ]
+
+During tests of another unrelated patch I was able to trigger this
+error: Objects remaining on __kmem_cache_shutdown()
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: Namjae Jeon <linkinjeon@kernel.org>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smbdirect.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
+index d47eae133a202..b648bb30401d5 100644
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -1084,8 +1084,10 @@ static int smbd_negotiate(struct smbd_connection *info)
+ log_rdma_event(INFO, "smbd_post_recv rc=%d iov.addr=0x%llx iov.length=%u iov.lkey=0x%x\n",
+ rc, response->sge.addr,
+ response->sge.length, response->sge.lkey);
+- if (rc)
++ if (rc) {
++ put_receive_buffer(info, response);
+ return rc;
++ }
+
+ init_completion(&info->negotiate_completion);
+ info->negotiate_done = false;
+--
+2.51.0
+
--- /dev/null
+From 8b5a074dd4f375bbe9b163c56462d0d8e5c17cb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:28:29 +0200
+Subject: ASoC: Intel: catpt: Expose correct bit depth to userspace
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit 690aa09b1845c0d5c3c29dabd50a9d0488c97c48 ]
+
+Currently wrong bit depth is exposed in hw params, causing clipped
+volume during playback. Expose correct parameters.
+
+Fixes: a126750fc865 ("ASoC: Intel: catpt: PCM operations")
+Reported-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Tested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Message-ID: <20250909092829.375953-1-amadeuszx.slawinski@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/catpt/pcm.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/intel/catpt/pcm.c b/sound/soc/intel/catpt/pcm.c
+index 81a2f0339e055..ff1fa01acb85b 100644
+--- a/sound/soc/intel/catpt/pcm.c
++++ b/sound/soc/intel/catpt/pcm.c
+@@ -568,8 +568,9 @@ static const struct snd_pcm_hardware catpt_pcm_hardware = {
+ SNDRV_PCM_INFO_RESUME |
+ SNDRV_PCM_INFO_NO_PERIOD_WAKEUP,
+ .formats = SNDRV_PCM_FMTBIT_S16_LE |
+- SNDRV_PCM_FMTBIT_S24_LE |
+ SNDRV_PCM_FMTBIT_S32_LE,
++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 |
++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX,
+ .period_bytes_min = PAGE_SIZE,
+ .period_bytes_max = CATPT_BUFFER_MAX_SIZE / CATPT_PCM_PERIODS_MIN,
+ .periods_min = CATPT_PCM_PERIODS_MIN,
+@@ -699,14 +700,18 @@ static struct snd_soc_dai_driver dai_drivers[] = {
+ .channels_min = 2,
+ .channels_max = 2,
+ .rates = SNDRV_PCM_RATE_48000,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE,
++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 |
++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX,
+ },
+ .capture = {
+ .stream_name = "Analog Capture",
+ .channels_min = 2,
+ .channels_max = 4,
+ .rates = SNDRV_PCM_RATE_48000,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE,
++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 |
++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX,
+ },
+ },
+ {
+@@ -718,7 +723,9 @@ static struct snd_soc_dai_driver dai_drivers[] = {
+ .channels_min = 2,
+ .channels_max = 2,
+ .rates = SNDRV_PCM_RATE_8000_192000,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE,
++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 |
++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX,
+ },
+ },
+ {
+@@ -730,7 +737,9 @@ static struct snd_soc_dai_driver dai_drivers[] = {
+ .channels_min = 2,
+ .channels_max = 2,
+ .rates = SNDRV_PCM_RATE_8000_192000,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE,
++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 |
++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX,
+ },
+ },
+ {
+@@ -742,7 +751,9 @@ static struct snd_soc_dai_driver dai_drivers[] = {
+ .channels_min = 2,
+ .channels_max = 2,
+ .rates = SNDRV_PCM_RATE_48000,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE,
++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 |
++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX,
+ },
+ },
+ {
+--
+2.51.0
+
--- /dev/null
+From 9558e1b66aa04c74ef73a81ede059494f440c9c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:06:39 +0100
+Subject: ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
+ message
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 35fc531a59694f24a2456569cf7d1a9c6436841c ]
+
+The dev_err message is reporting an error about capture streams however
+it is using the incorrect variable num_playback instead of num_capture.
+Fix this by using the correct variable num_capture.
+
+Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-stream.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c
+index 3ac63ce67ab1c..24f3cc7676142 100644
+--- a/sound/soc/sof/intel/hda-stream.c
++++ b/sound/soc/sof/intel/hda-stream.c
+@@ -864,7 +864,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev)
+
+ if (num_capture >= SOF_HDA_CAPTURE_STREAMS) {
+ dev_err(sdev->dev, "error: too many capture streams %d\n",
+- num_playback);
++ num_capture);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From d8030f7fb1a3a2f23710391e62864375d888039a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:37 +0100
+Subject: ASoC: wm8940: Correct PLL rate rounding
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit d05afb53c683ef7ed1228b593c3360f4d3126c58 ]
+
+Using a single value of 22500000 for both 48000Hz and 44100Hz audio
+will sometimes result in returning wrong dividers due to rounding.
+Update the code to use the actual value for both.
+
+Fixes: 294833fc9eb4 ("ASoC: wm8940: Rewrite code to set proper clocks")
+Reported-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Tested-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Link: https://patch.msgid.link/20250821082639.1301453-2-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8940.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c
+index 8a532f7d750c8..5e8ed8a2c270a 100644
+--- a/sound/soc/codecs/wm8940.c
++++ b/sound/soc/codecs/wm8940.c
+@@ -693,7 +693,12 @@ static int wm8940_update_clocks(struct snd_soc_dai *dai)
+ f = wm8940_get_mclkdiv(priv->mclk, fs256, &mclkdiv);
+ if (f != priv->mclk) {
+ /* The PLL performs best around 90MHz */
+- fpll = wm8940_get_mclkdiv(22500000, fs256, &mclkdiv);
++ if (fs256 % 8000)
++ f = 22579200;
++ else
++ f = 24576000;
++
++ fpll = wm8940_get_mclkdiv(f, fs256, &mclkdiv);
+ }
+
+ wm8940_set_dai_pll(dai, 0, 0, priv->mclk, fpll);
+--
+2.51.0
+
--- /dev/null
+From b07d1e184771bf69902738df7ab8fbb6d70f0031 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:38 +0100
+Subject: ASoC: wm8940: Correct typo in control name
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit b4799520dcd6fe1e14495cecbbe9975d847cd482 ]
+
+Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver")
+Reported-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Tested-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8940.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c
+index 5e8ed8a2c270a..808a4d4b6f80b 100644
+--- a/sound/soc/codecs/wm8940.c
++++ b/sound/soc/codecs/wm8940.c
+@@ -220,7 +220,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = {
+ SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL,
+ 0, 255, 0, wm8940_adc_tlv),
+ SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum),
+- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST,
++ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST,
+ 8, 1, 0, wm8940_capture_boost_vol_tlv),
+ SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL,
+ 0, 63, 0, wm8940_spk_vol_tlv),
+--
+2.51.0
+
--- /dev/null
+From fa516863cbf16c710be42545fbe92a269f856728 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:39 +0100
+Subject: ASoC: wm8974: Correct PLL rate rounding
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 9b17d3724df55ecc2bc67978822585f2b023be48 ]
+
+Using a single value of 22500000 for both 48000Hz and 44100Hz audio
+will sometimes result in returning wrong dividers due to rounding.
+Update the code to use the actual value for both.
+
+Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8974.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c
+index 0ee3655cad01f..c0a8fc867301c 100644
+--- a/sound/soc/codecs/wm8974.c
++++ b/sound/soc/codecs/wm8974.c
+@@ -419,10 +419,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai)
+ fs256 = 256 * priv->fs;
+
+ f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv);
+-
+ if (f != priv->mclk) {
+ /* The PLL performs best around 90MHz */
+- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv);
++ if (fs256 % 8000)
++ f = 22579200;
++ else
++ f = 24576000;
++
++ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv);
+ }
+
+ wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll);
+--
+2.51.0
+
--- /dev/null
+From 5574b2a8895e322ac82b6041385803c1726ed469 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 15:42:41 +0800
+Subject: crypto: af_alg - Set merge to zero early in af_alg_sendmsg
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 9574b2330dbd2b5459b74d3b5e9619d39299fc6f ]
+
+If an error causes af_alg_sendmsg to abort, ctx->merge may contain
+a garbage value from the previous loop. This may then trigger a
+crash on the next entry into af_alg_sendmsg when it attempts to do
+a merge that can't be done.
+
+Fix this by setting ctx->merge to zero near the start of the loop.
+
+Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations")
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index f02c5586a8ab3..ca6fdcc6c54ac 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -1025,6 +1025,8 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ continue;
+ }
+
++ ctx->merge = 0;
++
+ if (!af_alg_writable(sk)) {
+ err = af_alg_wait_for_wmem(sk, msg->msg_flags);
+ if (err)
+@@ -1064,7 +1066,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ ctx->used += plen;
+ copied += plen;
+ size -= plen;
+- ctx->merge = 0;
+ } else {
+ do {
+ struct page *pg;
+--
+2.51.0
+
--- /dev/null
+From ae8f3d05fee3dd17931e6f354db6dc37d227eb94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 10:54:38 +0200
+Subject: drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
+
+From: Loic Poulain <loic.poulain@oss.qualcomm.com>
+
+[ Upstream commit a10f910c77f280327b481e77eab909934ec508f0 ]
+
+If the interrupt occurs before resource initialization is complete, the
+interrupt handler/worker may access uninitialized data such as the I2C
+tcpc_client device, potentially leading to NULL pointer dereference.
+
+Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250709085438.56188-1-loic.poulain@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/anx7625.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
+index c036bbc92ba96..7244c3abb7f99 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
+@@ -2683,7 +2683,7 @@ static int anx7625_i2c_probe(struct i2c_client *client)
+ ret = devm_request_threaded_irq(dev, platform->pdata.intp_irq,
+ NULL, anx7625_intr_hpd_isr,
+ IRQF_TRIGGER_FALLING |
+- IRQF_ONESHOT,
++ IRQF_ONESHOT | IRQF_NO_AUTOEN,
+ "anx7625-intp", platform);
+ if (ret) {
+ DRM_DEV_ERROR(dev, "fail to request irq\n");
+@@ -2753,8 +2753,10 @@ static int anx7625_i2c_probe(struct i2c_client *client)
+ }
+
+ /* Add work function */
+- if (platform->pdata.intp_irq)
++ if (platform->pdata.intp_irq) {
++ enable_irq(platform->pdata.intp_irq);
+ queue_work(platform->workqueue, &platform->work);
++ }
+
+ if (platform->pdata.audio_en)
+ anx7625_register_audio(dev, platform);
+--
+2.51.0
+
--- /dev/null
+From f4e59df258e8feb23497edf31f3dd12138b87c41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 11:44:47 +0800
+Subject: drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
+
+From: Qi Xi <xiqi2@huawei.com>
+
+[ Upstream commit 288dac9fb6084330d968459c750c838fd06e10e6 ]
+
+Add missing mutex unlock before returning from the error path in
+cdns_mhdp_atomic_enable().
+
+Fixes: 935a92a1c400 ("drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qi Xi <xiqi2@huawei.com>
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20250904034447.665427-1-xiqi2@huawei.com
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+index 9ba2a667a1f3a..b18bdb2daddf8 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+@@ -2054,8 +2054,10 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge,
+ mhdp_state = to_cdns_mhdp_bridge_state(new_state);
+
+ mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode);
+- if (!mhdp_state->current_mode)
+- return;
++ if (!mhdp_state->current_mode) {
++ ret = -EINVAL;
++ goto out;
++ }
+
+ drm_mode_set_name(mhdp_state->current_mode);
+
+--
+2.51.0
+
--- /dev/null
+From f484c6af134a9fa31d655884ab4e4c6a3ea9d8b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:53:41 +0300
+Subject: drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit cbc7f3b4f6ca19320e2eacf8fc1403d6f331ce14 ]
+
+The xe_preempt_fence_create() function returns error pointers. It
+never returns NULL. Update the error checking to match.
+
+Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://lore.kernel.org/r/aJTMBdX97cof_009@stanley.mountain
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+(cherry picked from commit 75cc23ffe5b422bc3cbd5cf0956b8b86e4b0e162)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_vm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
+index a4845d4213b00..fc5f0e1351932 100644
+--- a/drivers/gpu/drm/xe/xe_vm.c
++++ b/drivers/gpu/drm/xe/xe_vm.c
+@@ -239,8 +239,8 @@ int xe_vm_add_compute_exec_queue(struct xe_vm *vm, struct xe_exec_queue *q)
+
+ pfence = xe_preempt_fence_create(q, q->lr.context,
+ ++q->lr.seqno);
+- if (!pfence) {
+- err = -ENOMEM;
++ if (IS_ERR(pfence)) {
++ err = PTR_ERR(pfence);
+ goto out_fini;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From d529324448b37499ada46abccf992e38b97a3d74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 15:39:51 +0000
+Subject: drm/xe/tile: Release kobject for the failure path
+
+From: Shuicheng Lin <shuicheng.lin@intel.com>
+
+[ Upstream commit 013e484dbd687a9174acf8f4450217bdb86ad788 ]
+
+Call kobject_put() for the failure path to release the kobject
+
+v2: remove extra newline. (Matt)
+
+Fixes: e3d0839aa501 ("drm/xe/tile: Abort driver load for sysfs creation failure")
+Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
+Link: https://lore.kernel.org/r/20250819153950.2973344-2-shuicheng.lin@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+(cherry picked from commit b98775bca99511cc22ab459a2de646cd2fa7241f)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_tile_sysfs.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_tile_sysfs.c b/drivers/gpu/drm/xe/xe_tile_sysfs.c
+index b804234a65516..9e1236a9ec673 100644
+--- a/drivers/gpu/drm/xe/xe_tile_sysfs.c
++++ b/drivers/gpu/drm/xe/xe_tile_sysfs.c
+@@ -44,16 +44,18 @@ int xe_tile_sysfs_init(struct xe_tile *tile)
+ kt->tile = tile;
+
+ err = kobject_add(&kt->base, &dev->kobj, "tile%d", tile->id);
+- if (err) {
+- kobject_put(&kt->base);
+- return err;
+- }
++ if (err)
++ goto err_object;
+
+ tile->sysfs = &kt->base;
+
+ err = xe_vram_freq_sysfs_init(tile);
+ if (err)
+- return err;
++ goto err_object;
+
+ return devm_add_action_or_reset(xe->drm.dev, tile_sysfs_fini, tile);
++
++err_object:
++ kobject_put(&kt->base);
++ return err;
+ }
+--
+2.51.0
+
--- /dev/null
+From c478eefb96499fbc42bcf99906247f5ee795d546 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 17:03:52 +0800
+Subject: io_uring: fix incorrect io_kiocb reference in io_link_skb
+
+From: Yang Xiuwei <yangxiuwei@kylinos.cn>
+
+[ Upstream commit 2c139a47eff8de24e3350dadb4c9d5e3426db826 ]
+
+In io_link_skb function, there is a bug where prev_notif is incorrectly
+assigned using 'nd' instead of 'prev_nd'. This causes the context
+validation check to compare the current notification with itself instead
+of comparing it with the previous notification.
+
+Fix by using the correct prev_nd parameter when obtaining prev_notif.
+
+Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
+Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
+Fixes: 6fe4220912d19 ("io_uring/notif: implement notification stacking")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/notif.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/io_uring/notif.c b/io_uring/notif.c
+index 28859ae3ee6eb..d4cf5a1328e63 100644
+--- a/io_uring/notif.c
++++ b/io_uring/notif.c
+@@ -85,7 +85,7 @@ static int io_link_skb(struct sk_buff *skb, struct ubuf_info *uarg)
+ return -EEXIST;
+
+ prev_nd = container_of(prev_uarg, struct io_notif_data, uarg);
+- prev_notif = cmd_to_io_kiocb(nd);
++ prev_notif = cmd_to_io_kiocb(prev_nd);
+
+ /* make sure all noifications can be finished in the same task_work */
+ if (unlikely(notif->ctx != prev_notif->ctx ||
+--
+2.51.0
+
io_uring-include-dying-ring-in-task_work-should-cancel-state.patch
io_uring-msg_ring-kill-alloc_cache-for-io_kiocb-allocations.patch
io_uring-kbuf-drop-warn_on_once-from-incremental-length-check.patch
+asoc-wm8940-correct-pll-rate-rounding.patch
+asoc-wm8940-correct-typo-in-control-name.patch
+asoc-wm8974-correct-pll-rate-rounding.patch
+asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch
+asoc-intel-catpt-expose-correct-bit-depth-to-userspa.patch
+drm-xe-tile-release-kobject-for-the-failure-path.patch
+drm-bridge-anx7625-fix-null-pointer-dereference-with.patch
+drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch
+drm-xe-fix-a-null-vs-is_err-in-xe_vm_add_compute_exe.patch
+smb-client-fix-filename-matching-of-deferred-files.patch
+smb-client-let-smbd_destroy-call-disable_work_sync-i.patch
+crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch
+smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch
+io_uring-fix-incorrect-io_kiocb-reference-in-io_link.patch
--- /dev/null
+From 0a6704530fec4892f0dceed8c914147b32a67757 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 16:03:22 -0300
+Subject: smb: client: fix filename matching of deferred files
+
+From: Paulo Alcantara <pc@manguebit.org>
+
+[ Upstream commit 93ed9a2951308db374cba4562533dde97bac70d3 ]
+
+Fix the following case where the client would end up closing both
+deferred files (foo.tmp & foo) after unlink(foo) due to strstr() call
+in cifs_close_deferred_file_under_dentry():
+
+ fd1 = openat(AT_FDCWD, "foo", O_WRONLY|O_CREAT|O_TRUNC, 0666);
+ fd2 = openat(AT_FDCWD, "foo.tmp", O_WRONLY|O_CREAT|O_TRUNC, 0666);
+ close(fd1);
+ close(fd2);
+ unlink("foo");
+
+Fixes: e3fc065682eb ("cifs: Deferred close performance improvements")
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Reviewed-by: Enzo Matsumiya <ematsumiya@suse.de>
+Cc: Frank Sorenson <sorenson@redhat.com>
+Cc: David Howells <dhowells@redhat.com>
+Cc: linux-cifs@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/cifsproto.h | 4 ++--
+ fs/smb/client/inode.c | 6 +++---
+ fs/smb/client/misc.c | 38 ++++++++++++++++----------------------
+ 3 files changed, 21 insertions(+), 27 deletions(-)
+
+diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h
+index fee7bc9848a36..b59647291363b 100644
+--- a/fs/smb/client/cifsproto.h
++++ b/fs/smb/client/cifsproto.h
+@@ -298,8 +298,8 @@ extern void cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode);
+
+ extern void cifs_close_all_deferred_files(struct cifs_tcon *cifs_tcon);
+
+-extern void cifs_close_deferred_file_under_dentry(struct cifs_tcon *cifs_tcon,
+- const char *path);
++void cifs_close_deferred_file_under_dentry(struct cifs_tcon *cifs_tcon,
++ struct dentry *dentry);
+
+ extern void cifs_mark_open_handles_for_deleted_file(struct inode *inode,
+ const char *path);
+diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c
+index c0df2c1841243..e06d02b68c538 100644
+--- a/fs/smb/client/inode.c
++++ b/fs/smb/client/inode.c
+@@ -1958,7 +1958,7 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry)
+ }
+
+ netfs_wait_for_outstanding_io(inode);
+- cifs_close_deferred_file_under_dentry(tcon, full_path);
++ cifs_close_deferred_file_under_dentry(tcon, dentry);
+ #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
+ if (cap_unix(tcon->ses) && (CIFS_UNIX_POSIX_PATH_OPS_CAP &
+ le64_to_cpu(tcon->fsUnixInfo.Capability))) {
+@@ -2489,10 +2489,10 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir,
+ goto cifs_rename_exit;
+ }
+
+- cifs_close_deferred_file_under_dentry(tcon, from_name);
++ cifs_close_deferred_file_under_dentry(tcon, source_dentry);
+ if (d_inode(target_dentry) != NULL) {
+ netfs_wait_for_outstanding_io(d_inode(target_dentry));
+- cifs_close_deferred_file_under_dentry(tcon, to_name);
++ cifs_close_deferred_file_under_dentry(tcon, target_dentry);
+ }
+
+ rc = cifs_do_rename(xid, source_dentry, from_name, target_dentry,
+diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c
+index 57b6b191293ee..499f791df7799 100644
+--- a/fs/smb/client/misc.c
++++ b/fs/smb/client/misc.c
+@@ -829,33 +829,28 @@ cifs_close_all_deferred_files(struct cifs_tcon *tcon)
+ kfree(tmp_list);
+ }
+ }
+-void
+-cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, const char *path)
++
++void cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon,
++ struct dentry *dentry)
+ {
+- struct cifsFileInfo *cfile;
+ struct file_list *tmp_list, *tmp_next_list;
+- void *page;
+- const char *full_path;
++ struct cifsFileInfo *cfile;
+ LIST_HEAD(file_head);
+
+- page = alloc_dentry_path();
+ spin_lock(&tcon->open_file_lock);
+ list_for_each_entry(cfile, &tcon->openFileList, tlist) {
+- full_path = build_path_from_dentry(cfile->dentry, page);
+- if (strstr(full_path, path)) {
+- if (delayed_work_pending(&cfile->deferred)) {
+- if (cancel_delayed_work(&cfile->deferred)) {
+- spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock);
+- cifs_del_deferred_close(cfile);
+- spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock);
+-
+- tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC);
+- if (tmp_list == NULL)
+- break;
+- tmp_list->cfile = cfile;
+- list_add_tail(&tmp_list->list, &file_head);
+- }
+- }
++ if ((cfile->dentry == dentry) &&
++ delayed_work_pending(&cfile->deferred) &&
++ cancel_delayed_work(&cfile->deferred)) {
++ spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock);
++ cifs_del_deferred_close(cfile);
++ spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock);
++
++ tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC);
++ if (tmp_list == NULL)
++ break;
++ tmp_list->cfile = cfile;
++ list_add_tail(&tmp_list->list, &file_head);
+ }
+ }
+ spin_unlock(&tcon->open_file_lock);
+@@ -865,7 +860,6 @@ cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, const char *path)
+ list_del(&tmp_list->list);
+ kfree(tmp_list);
+ }
+- free_dentry_path(page);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 8abbb54cd4d452a0e7516f1f190c5d3de95c5075 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 03:06:46 +0200
+Subject: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error
+ path
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit daac51c7032036a0ca5f1aa419ad1b0471d1c6e0 ]
+
+During tests of another unrelated patch I was able to trigger this
+error: Objects remaining on __kmem_cache_shutdown()
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: Namjae Jeon <linkinjeon@kernel.org>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smbdirect.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
+index 6284252aa4882..b1548269c308a 100644
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -1075,8 +1075,10 @@ static int smbd_negotiate(struct smbd_connection *info)
+ log_rdma_event(INFO, "smbd_post_recv rc=%d iov.addr=0x%llx iov.length=%u iov.lkey=0x%x\n",
+ rc, response->sge.addr,
+ response->sge.length, response->sge.lkey);
+- if (rc)
++ if (rc) {
++ put_receive_buffer(info, response);
+ return rc;
++ }
+
+ init_completion(&info->negotiate_completion);
+ info->negotiate_done = false;
+--
+2.51.0
+
--- /dev/null
+From 889bd068afccf1c30bdf19447c832315000210c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 13:03:19 +0200
+Subject: smb: client: let smbd_destroy() call
+ disable_work_sync(&info->post_send_credits_work)
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit d9dcbbcf9145b68aa85c40947311a6907277e097 ]
+
+In smbd_destroy() we may destroy the memory so we better
+wait until post_send_credits_work is no longer pending
+and will never be started again.
+
+I actually just hit the case using rxe:
+
+WARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe]
+...
+[ 5305.686979] [ T138] smbd_post_recv+0x445/0xc10 [cifs]
+[ 5305.687135] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5305.687149] [ T138] ? __kasan_check_write+0x14/0x30
+[ 5305.687185] [ T138] ? __pfx_smbd_post_recv+0x10/0x10 [cifs]
+[ 5305.687329] [ T138] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
+[ 5305.687356] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5305.687368] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5305.687378] [ T138] ? _raw_spin_unlock_irqrestore+0x11/0x60
+[ 5305.687389] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5305.687399] [ T138] ? get_receive_buffer+0x168/0x210 [cifs]
+[ 5305.687555] [ T138] smbd_post_send_credits+0x382/0x4b0 [cifs]
+[ 5305.687701] [ T138] ? __pfx_smbd_post_send_credits+0x10/0x10 [cifs]
+[ 5305.687855] [ T138] ? __pfx___schedule+0x10/0x10
+[ 5305.687865] [ T138] ? __pfx__raw_spin_lock_irq+0x10/0x10
+[ 5305.687875] [ T138] ? queue_delayed_work_on+0x8e/0xa0
+[ 5305.687889] [ T138] process_one_work+0x629/0xf80
+[ 5305.687908] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5305.687917] [ T138] ? __kasan_check_write+0x14/0x30
+[ 5305.687933] [ T138] worker_thread+0x87f/0x1570
+...
+
+It means rxe_post_recv was called after rdma_destroy_qp().
+This happened because put_receive_buffer() was triggered
+by ib_drain_qp() and called:
+queue_work(info->workqueue, &info->post_send_credits_work);
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: Namjae Jeon <linkinjeon@kernel.org>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smbdirect.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
+index b9bb531717a65..6284252aa4882 100644
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -1308,6 +1308,9 @@ void smbd_destroy(struct TCP_Server_Info *server)
+ sc->status == SMBDIRECT_SOCKET_DISCONNECTED);
+ }
+
++ log_rdma_event(INFO, "cancelling post_send_credits_work\n");
++ disable_work_sync(&info->post_send_credits_work);
++
+ log_rdma_event(INFO, "destroying qp\n");
+ ib_drain_qp(sc->ib.qp);
+ rdma_destroy_qp(sc->rdma.cm_id);
+--
+2.51.0
+
--- /dev/null
+From ac0058399f069b64c0e48b3b2d149cd1fd0ba0bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 15:09:01 +0200
+Subject: ALSA: usb: qcom: Fix false-positive address space check
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 44499ecb4f2817743c37d861bdb3e95f37d3d9cd ]
+
+The sanity check previously added to uaudio_transfer_buffer_setup()
+assumed the allocated buffer being linear-mapped. But the buffer
+allocated via usb_alloc_coherent() isn't always so, rather to be used
+with (SG-)DMA API. This leaded to a false-positive warning and the
+driver failed to work.
+
+Actually uaudio_transfer_buffer_setup() deals only with the DMA-API
+addresses for MEM_XFER_BUF type, while other callers of
+uaudio_iommu_map() are with pages with physical addresses for
+MEM_EVENT_RING and MEM_XFER_RING types. So this patch splits the
+mapping helper function to two different ones, uaudio_iommu_map() for
+the DMA pages and uaudio_iommu_map_pa() for the latter, in order to
+handle mapping differently for each type. Along with it, the
+unnecessary address check that caused probe error is dropped, too.
+
+Fixes: 3335a1bbd624 ("ALSA: qc_audio_offload: try to reduce address space confusion")
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Reported-and-tested-by: Luca Weiss <luca.weiss@fairphone.com>
+Closes: https://lore.kernel.org/DBR2363A95M1.L9XBNC003490@fairphone.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/qcom/qc_audio_offload.c | 92 ++++++++++++++++---------------
+ 1 file changed, 48 insertions(+), 44 deletions(-)
+
+diff --git a/sound/usb/qcom/qc_audio_offload.c b/sound/usb/qcom/qc_audio_offload.c
+index a25c5a5316901..9ad76fff741b8 100644
+--- a/sound/usb/qcom/qc_audio_offload.c
++++ b/sound/usb/qcom/qc_audio_offload.c
+@@ -538,38 +538,33 @@ static void uaudio_iommu_unmap(enum mem_type mtype, unsigned long iova,
+ umap_size, iova, mapped_iova_size);
+ }
+
++static int uaudio_iommu_map_prot(bool dma_coherent)
++{
++ int prot = IOMMU_READ | IOMMU_WRITE;
++
++ if (dma_coherent)
++ prot |= IOMMU_CACHE;
++ return prot;
++}
++
+ /**
+- * uaudio_iommu_map() - maps iommu memory for adsp
++ * uaudio_iommu_map_pa() - maps iommu memory for adsp
+ * @mtype: ring type
+ * @dma_coherent: dma coherent
+ * @pa: physical address for ring/buffer
+ * @size: size of memory region
+- * @sgt: sg table for memory region
+ *
+ * Maps the XHCI related resources to a memory region that is assigned to be
+ * used by the adsp. This will be mapped to the domain, which is created by
+ * the ASoC USB backend driver.
+ *
+ */
+-static unsigned long uaudio_iommu_map(enum mem_type mtype, bool dma_coherent,
+- phys_addr_t pa, size_t size,
+- struct sg_table *sgt)
++static unsigned long uaudio_iommu_map_pa(enum mem_type mtype, bool dma_coherent,
++ phys_addr_t pa, size_t size)
+ {
+- struct scatterlist *sg;
+ unsigned long iova = 0;
+- size_t total_len = 0;
+- unsigned long iova_sg;
+- phys_addr_t pa_sg;
+ bool map = true;
+- size_t sg_len;
+- int prot;
+- int ret;
+- int i;
+-
+- prot = IOMMU_READ | IOMMU_WRITE;
+-
+- if (dma_coherent)
+- prot |= IOMMU_CACHE;
++ int prot = uaudio_iommu_map_prot(dma_coherent);
+
+ switch (mtype) {
+ case MEM_EVENT_RING:
+@@ -583,20 +578,41 @@ static unsigned long uaudio_iommu_map(enum mem_type mtype, bool dma_coherent,
+ &uaudio_qdev->xfer_ring_iova_size,
+ &uaudio_qdev->xfer_ring_list, size);
+ break;
+- case MEM_XFER_BUF:
+- iova = uaudio_get_iova(&uaudio_qdev->curr_xfer_buf_iova,
+- &uaudio_qdev->xfer_buf_iova_size,
+- &uaudio_qdev->xfer_buf_list, size);
+- break;
+ default:
+ dev_err(uaudio_qdev->data->dev, "unknown mem type %d\n", mtype);
+ }
+
+ if (!iova || !map)
+- goto done;
++ return 0;
++
++ iommu_map(uaudio_qdev->data->domain, iova, pa, size, prot, GFP_KERNEL);
+
+- if (!sgt)
+- goto skip_sgt_map;
++ return iova;
++}
++
++static unsigned long uaudio_iommu_map_xfer_buf(bool dma_coherent, size_t size,
++ struct sg_table *sgt)
++{
++ struct scatterlist *sg;
++ unsigned long iova = 0;
++ size_t total_len = 0;
++ unsigned long iova_sg;
++ phys_addr_t pa_sg;
++ size_t sg_len;
++ int prot = uaudio_iommu_map_prot(dma_coherent);
++ int ret;
++ int i;
++
++ prot = IOMMU_READ | IOMMU_WRITE;
++
++ if (dma_coherent)
++ prot |= IOMMU_CACHE;
++
++ iova = uaudio_get_iova(&uaudio_qdev->curr_xfer_buf_iova,
++ &uaudio_qdev->xfer_buf_iova_size,
++ &uaudio_qdev->xfer_buf_list, size);
++ if (!iova)
++ goto done;
+
+ iova_sg = iova;
+ for_each_sg(sgt->sgl, sg, sgt->nents, i) {
+@@ -618,11 +634,6 @@ static unsigned long uaudio_iommu_map(enum mem_type mtype, bool dma_coherent,
+ uaudio_iommu_unmap(MEM_XFER_BUF, iova, size, total_len);
+ iova = 0;
+ }
+- return iova;
+-
+-skip_sgt_map:
+- iommu_map(uaudio_qdev->data->domain, iova, pa, size, prot, GFP_KERNEL);
+-
+ done:
+ return iova;
+ }
+@@ -1020,7 +1031,6 @@ static int uaudio_transfer_buffer_setup(struct snd_usb_substream *subs,
+ struct sg_table xfer_buf_sgt;
+ dma_addr_t xfer_buf_dma;
+ void *xfer_buf;
+- phys_addr_t xfer_buf_pa;
+ u32 len = xfer_buf_len;
+ bool dma_coherent;
+ dma_addr_t xfer_buf_dma_sysdev;
+@@ -1051,18 +1061,12 @@ static int uaudio_transfer_buffer_setup(struct snd_usb_substream *subs,
+ if (!xfer_buf)
+ return -ENOMEM;
+
+- /* Remapping is not possible if xfer_buf is outside of linear map */
+- xfer_buf_pa = virt_to_phys(xfer_buf);
+- if (WARN_ON(!page_is_ram(PFN_DOWN(xfer_buf_pa)))) {
+- ret = -ENXIO;
+- goto unmap_sync;
+- }
+ dma_get_sgtable(subs->dev->bus->sysdev, &xfer_buf_sgt, xfer_buf,
+ xfer_buf_dma, len);
+
+ /* map the physical buffer into sysdev as well */
+- xfer_buf_dma_sysdev = uaudio_iommu_map(MEM_XFER_BUF, dma_coherent,
+- xfer_buf_pa, len, &xfer_buf_sgt);
++ xfer_buf_dma_sysdev = uaudio_iommu_map_xfer_buf(dma_coherent,
++ len, &xfer_buf_sgt);
+ if (!xfer_buf_dma_sysdev) {
+ ret = -ENOMEM;
+ goto unmap_sync;
+@@ -1143,8 +1147,8 @@ uaudio_endpoint_setup(struct snd_usb_substream *subs,
+ sg_free_table(sgt);
+
+ /* data transfer ring */
+- iova = uaudio_iommu_map(MEM_XFER_RING, dma_coherent, tr_pa,
+- PAGE_SIZE, NULL);
++ iova = uaudio_iommu_map_pa(MEM_XFER_RING, dma_coherent, tr_pa,
++ PAGE_SIZE);
+ if (!iova) {
+ ret = -ENOMEM;
+ goto clear_pa;
+@@ -1207,8 +1211,8 @@ static int uaudio_event_ring_setup(struct snd_usb_substream *subs,
+ mem_info->dma = sg_dma_address(sgt->sgl);
+ sg_free_table(sgt);
+
+- iova = uaudio_iommu_map(MEM_EVENT_RING, dma_coherent, er_pa,
+- PAGE_SIZE, NULL);
++ iova = uaudio_iommu_map_pa(MEM_EVENT_RING, dma_coherent, er_pa,
++ PAGE_SIZE);
+ if (!iova) {
+ ret = -ENOMEM;
+ goto clear_pa;
+--
+2.51.0
+
--- /dev/null
+From 2e85a5f3b533f04660553252aaf4cfa18ddbea9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 22:43:59 +0530
+Subject: ASoC: amd: acp: Fix incorrect retrival of acp_chip_info
+
+From: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+
+[ Upstream commit d7871f400cad1da376f1d7724209a1c49226c456 ]
+
+Use dev_get_drvdata(dev->parent) instead of dev_get_platdata(dev)
+to correctly obtain acp_chip_info members in the acp I2S driver.
+Previously, some members were not updated properly due to incorrect
+data access, which could potentially lead to null pointer
+dereferences.
+
+This issue was missed in the earlier commit
+("ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot"),
+which only addressed set_tdm_slot(). This change ensures that all
+relevant functions correctly retrieve acp_chip_info, preventing
+further null pointer dereference issues.
+
+Fixes: e3933683b25e ("ASoC: amd: acp: Remove redundant acp_dev_data structure")
+
+Signed-off-by: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://patch.msgid.link/20250910171419.3682468-1-venkataprasad.potturu@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp/acp-i2s.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/amd/acp/acp-i2s.c b/sound/soc/amd/acp/acp-i2s.c
+index 70fa54d568ef6..4d9589b67099e 100644
+--- a/sound/soc/amd/acp/acp-i2s.c
++++ b/sound/soc/amd/acp/acp-i2s.c
+@@ -72,7 +72,7 @@ static int acp_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
+ unsigned int fmt)
+ {
+ struct device *dev = cpu_dai->component->dev;
+- struct acp_chip_info *chip = dev_get_platdata(dev);
++ struct acp_chip_info *chip = dev_get_drvdata(dev->parent);
+ int mode;
+
+ mode = fmt & SND_SOC_DAIFMT_FORMAT_MASK;
+@@ -196,7 +196,7 @@ static int acp_i2s_hwparams(struct snd_pcm_substream *substream, struct snd_pcm_
+ u32 reg_val, fmt_reg, tdm_fmt;
+ u32 lrclk_div_val, bclk_div_val;
+
+- chip = dev_get_platdata(dev);
++ chip = dev_get_drvdata(dev->parent);
+ rsrc = chip->rsrc;
+
+ /* These values are as per Hardware Spec */
+@@ -383,7 +383,7 @@ static int acp_i2s_trigger(struct snd_pcm_substream *substream, int cmd, struct
+ {
+ struct acp_stream *stream = substream->runtime->private_data;
+ struct device *dev = dai->component->dev;
+- struct acp_chip_info *chip = dev_get_platdata(dev);
++ struct acp_chip_info *chip = dev_get_drvdata(dev->parent);
+ struct acp_resource *rsrc = chip->rsrc;
+ u32 val, period_bytes, reg_val, ier_val, water_val, buf_size, buf_reg;
+
+@@ -513,14 +513,13 @@ static int acp_i2s_trigger(struct snd_pcm_substream *substream, int cmd, struct
+ static int acp_i2s_prepare(struct snd_pcm_substream *substream, struct snd_soc_dai *dai)
+ {
+ struct device *dev = dai->component->dev;
+- struct acp_chip_info *chip = dev_get_platdata(dev);
++ struct acp_chip_info *chip = dev_get_drvdata(dev->parent);
+ struct acp_resource *rsrc = chip->rsrc;
+ struct acp_stream *stream = substream->runtime->private_data;
+ u32 reg_dma_size = 0, reg_fifo_size = 0, reg_fifo_addr = 0;
+ u32 phy_addr = 0, acp_fifo_addr = 0, ext_int_ctrl;
+ unsigned int dir = substream->stream;
+
+- chip = dev_get_platdata(dev);
+ switch (dai->driver->id) {
+ case I2S_SP_INSTANCE:
+ if (dir == SNDRV_PCM_STREAM_PLAYBACK) {
+@@ -629,7 +628,7 @@ static int acp_i2s_startup(struct snd_pcm_substream *substream, struct snd_soc_d
+ {
+ struct acp_stream *stream = substream->runtime->private_data;
+ struct device *dev = dai->component->dev;
+- struct acp_chip_info *chip = dev_get_platdata(dev);
++ struct acp_chip_info *chip = dev_get_drvdata(dev->parent);
+ struct acp_resource *rsrc = chip->rsrc;
+ unsigned int dir = substream->stream;
+ unsigned int irq_bit = 0;
+--
+2.51.0
+
--- /dev/null
+From 8faf0e9aa12a52f235114d529b1aeb1d2a3f237b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 15:57:34 +0300
+Subject: ASoC: codec: sma1307: Fix memory corruption in
+ sma1307_setting_loaded()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 78338108b5a856dc98223a335f147846a8a18c51 ]
+
+The sma1307->set.header_size is how many integers are in the header
+(there are 8 of them) but instead of allocating space of 8 integers
+we allocate 8 bytes. This leads to memory corruption when we copy data
+it on the next line:
+
+ memcpy(sma1307->set.header, data,
+ sma1307->set.header_size * sizeof(int));
+
+Also since we're immediately copying over the memory in ->set.header,
+there is no need to zero it in the allocator. Use devm_kmalloc_array()
+to allocate the memory instead.
+
+Fixes: 576c57e6b4c1 ("ASoC: sma1307: Add driver for Iron Device SMA1307")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://patch.msgid.link/aLGjvjpueVstekXP@stanley.mountain
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/sma1307.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/sma1307.c b/sound/soc/codecs/sma1307.c
+index b3d401ada1760..2d993428f87e3 100644
+--- a/sound/soc/codecs/sma1307.c
++++ b/sound/soc/codecs/sma1307.c
+@@ -1737,9 +1737,10 @@ static void sma1307_setting_loaded(struct sma1307_priv *sma1307, const char *fil
+ sma1307->set.checksum = data[sma1307->set.header_size - 2];
+ sma1307->set.num_mode = data[sma1307->set.header_size - 1];
+ num_mode = sma1307->set.num_mode;
+- sma1307->set.header = devm_kzalloc(sma1307->dev,
+- sma1307->set.header_size,
+- GFP_KERNEL);
++ sma1307->set.header = devm_kmalloc_array(sma1307->dev,
++ sma1307->set.header_size,
++ sizeof(int),
++ GFP_KERNEL);
+ if (!sma1307->set.header) {
+ sma1307->set.status = false;
+ return;
+--
+2.51.0
+
--- /dev/null
+From 15180b3103f848537d3538411750f2bcb34de873 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:28:29 +0200
+Subject: ASoC: Intel: catpt: Expose correct bit depth to userspace
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit 690aa09b1845c0d5c3c29dabd50a9d0488c97c48 ]
+
+Currently wrong bit depth is exposed in hw params, causing clipped
+volume during playback. Expose correct parameters.
+
+Fixes: a126750fc865 ("ASoC: Intel: catpt: PCM operations")
+Reported-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Tested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Message-ID: <20250909092829.375953-1-amadeuszx.slawinski@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/catpt/pcm.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/intel/catpt/pcm.c b/sound/soc/intel/catpt/pcm.c
+index 81a2f0339e055..ff1fa01acb85b 100644
+--- a/sound/soc/intel/catpt/pcm.c
++++ b/sound/soc/intel/catpt/pcm.c
+@@ -568,8 +568,9 @@ static const struct snd_pcm_hardware catpt_pcm_hardware = {
+ SNDRV_PCM_INFO_RESUME |
+ SNDRV_PCM_INFO_NO_PERIOD_WAKEUP,
+ .formats = SNDRV_PCM_FMTBIT_S16_LE |
+- SNDRV_PCM_FMTBIT_S24_LE |
+ SNDRV_PCM_FMTBIT_S32_LE,
++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 |
++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX,
+ .period_bytes_min = PAGE_SIZE,
+ .period_bytes_max = CATPT_BUFFER_MAX_SIZE / CATPT_PCM_PERIODS_MIN,
+ .periods_min = CATPT_PCM_PERIODS_MIN,
+@@ -699,14 +700,18 @@ static struct snd_soc_dai_driver dai_drivers[] = {
+ .channels_min = 2,
+ .channels_max = 2,
+ .rates = SNDRV_PCM_RATE_48000,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE,
++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 |
++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX,
+ },
+ .capture = {
+ .stream_name = "Analog Capture",
+ .channels_min = 2,
+ .channels_max = 4,
+ .rates = SNDRV_PCM_RATE_48000,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE,
++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 |
++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX,
+ },
+ },
+ {
+@@ -718,7 +723,9 @@ static struct snd_soc_dai_driver dai_drivers[] = {
+ .channels_min = 2,
+ .channels_max = 2,
+ .rates = SNDRV_PCM_RATE_8000_192000,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE,
++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 |
++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX,
+ },
+ },
+ {
+@@ -730,7 +737,9 @@ static struct snd_soc_dai_driver dai_drivers[] = {
+ .channels_min = 2,
+ .channels_max = 2,
+ .rates = SNDRV_PCM_RATE_8000_192000,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE,
++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 |
++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX,
+ },
+ },
+ {
+@@ -742,7 +751,9 @@ static struct snd_soc_dai_driver dai_drivers[] = {
+ .channels_min = 2,
+ .channels_max = 2,
+ .rates = SNDRV_PCM_RATE_48000,
+- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE,
++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 |
++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX,
+ },
+ },
+ {
+--
+2.51.0
+
--- /dev/null
+From 1b99db24ce5e12e5d8fcdeb1a6d4cc35934fb4b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 17:37:15 +0100
+Subject: ASoC: SDCA: Fix return value in sdca_regmap_mbq_size()
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit f81e63047600d023cbfda372b6de8f2821ff6839 ]
+
+The MBQ size function returns an integer representing the size of a
+Control. Currently if the Control is not found the function will return
+false which makes little sense. Correct this typo to return -EINVAL.
+
+Fixes: e3f7caf74b79 ("ASoC: SDCA: Add generic regmap SDCA helpers")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Message-ID: <20250820163717.1095846-2-ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sdca/sdca_regmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sdca/sdca_regmap.c b/sound/soc/sdca/sdca_regmap.c
+index c41c67c2204a4..ff1f8fe2a39bb 100644
+--- a/sound/soc/sdca/sdca_regmap.c
++++ b/sound/soc/sdca/sdca_regmap.c
+@@ -196,7 +196,7 @@ int sdca_regmap_mbq_size(struct sdca_function_data *function, unsigned int reg)
+
+ control = function_find_control(function, reg);
+ if (!control)
+- return false;
++ return -EINVAL;
+
+ return clamp_val(control->nbits / BITS_PER_BYTE, sizeof(u8), sizeof(u32));
+ }
+--
+2.51.0
+
--- /dev/null
+From b94bd69cfa18551c1b4bb5474a9d84078d0c44d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:06:39 +0100
+Subject: ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
+ message
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 35fc531a59694f24a2456569cf7d1a9c6436841c ]
+
+The dev_err message is reporting an error about capture streams however
+it is using the incorrect variable num_playback instead of num_capture.
+Fix this by using the correct variable num_capture.
+
+Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-stream.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c
+index aa6b0247d5c99..a34f472ef1751 100644
+--- a/sound/soc/sof/intel/hda-stream.c
++++ b/sound/soc/sof/intel/hda-stream.c
+@@ -890,7 +890,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev)
+
+ if (num_capture >= SOF_HDA_CAPTURE_STREAMS) {
+ dev_err(sdev->dev, "error: too many capture streams %d\n",
+- num_playback);
++ num_capture);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 23ca46d115ed9da5258d26467bc0340cfc620cf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:37 +0100
+Subject: ASoC: wm8940: Correct PLL rate rounding
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit d05afb53c683ef7ed1228b593c3360f4d3126c58 ]
+
+Using a single value of 22500000 for both 48000Hz and 44100Hz audio
+will sometimes result in returning wrong dividers due to rounding.
+Update the code to use the actual value for both.
+
+Fixes: 294833fc9eb4 ("ASoC: wm8940: Rewrite code to set proper clocks")
+Reported-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Tested-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Link: https://patch.msgid.link/20250821082639.1301453-2-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8940.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c
+index 401ee20897b1b..46c16c9bc17a8 100644
+--- a/sound/soc/codecs/wm8940.c
++++ b/sound/soc/codecs/wm8940.c
+@@ -693,7 +693,12 @@ static int wm8940_update_clocks(struct snd_soc_dai *dai)
+ f = wm8940_get_mclkdiv(priv->mclk, fs256, &mclkdiv);
+ if (f != priv->mclk) {
+ /* The PLL performs best around 90MHz */
+- fpll = wm8940_get_mclkdiv(22500000, fs256, &mclkdiv);
++ if (fs256 % 8000)
++ f = 22579200;
++ else
++ f = 24576000;
++
++ fpll = wm8940_get_mclkdiv(f, fs256, &mclkdiv);
+ }
+
+ wm8940_set_dai_pll(dai, 0, 0, priv->mclk, fpll);
+--
+2.51.0
+
--- /dev/null
+From 66df33a01eaf39ffcd06f52bde50c5f5054036d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:38 +0100
+Subject: ASoC: wm8940: Correct typo in control name
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit b4799520dcd6fe1e14495cecbbe9975d847cd482 ]
+
+Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver")
+Reported-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Tested-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8940.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c
+index 46c16c9bc17a8..94873ea630146 100644
+--- a/sound/soc/codecs/wm8940.c
++++ b/sound/soc/codecs/wm8940.c
+@@ -220,7 +220,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = {
+ SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL,
+ 0, 255, 0, wm8940_adc_tlv),
+ SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum),
+- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST,
++ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST,
+ 8, 1, 0, wm8940_capture_boost_vol_tlv),
+ SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL,
+ 0, 63, 0, wm8940_spk_vol_tlv),
+--
+2.51.0
+
--- /dev/null
+From bd4dc5ea38419dba30a25cf141ec4beed418e768 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:39 +0100
+Subject: ASoC: wm8974: Correct PLL rate rounding
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 9b17d3724df55ecc2bc67978822585f2b023be48 ]
+
+Using a single value of 22500000 for both 48000Hz and 44100Hz audio
+will sometimes result in returning wrong dividers due to rounding.
+Update the code to use the actual value for both.
+
+Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8974.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c
+index bdf437a5403fe..db16d893a2351 100644
+--- a/sound/soc/codecs/wm8974.c
++++ b/sound/soc/codecs/wm8974.c
+@@ -419,10 +419,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai)
+ fs256 = 256 * priv->fs;
+
+ f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv);
+-
+ if (f != priv->mclk) {
+ /* The PLL performs best around 90MHz */
+- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv);
++ if (fs256 % 8000)
++ f = 22579200;
++ else
++ f = 24576000;
++
++ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv);
+ }
+
+ wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll);
+--
+2.51.0
+
--- /dev/null
+From 442fc9e8f9001a0afe19b5a942212e273b350338 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 15:42:41 +0800
+Subject: crypto: af_alg - Set merge to zero early in af_alg_sendmsg
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 9574b2330dbd2b5459b74d3b5e9619d39299fc6f ]
+
+If an error causes af_alg_sendmsg to abort, ctx->merge may contain
+a garbage value from the previous loop. This may then trigger a
+crash on the next entry into af_alg_sendmsg when it attempts to do
+a merge that can't be done.
+
+Fix this by setting ctx->merge to zero near the start of the loop.
+
+Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations")
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index f02c5586a8ab3..ca6fdcc6c54ac 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -1025,6 +1025,8 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ continue;
+ }
+
++ ctx->merge = 0;
++
+ if (!af_alg_writable(sk)) {
+ err = af_alg_wait_for_wmem(sk, msg->msg_flags);
+ if (err)
+@@ -1064,7 +1066,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ ctx->used += plen;
+ copied += plen;
+ size -= plen;
+- ctx->merge = 0;
+ } else {
+ do {
+ struct page *pg;
+--
+2.51.0
+
--- /dev/null
+From e3d3409823377d15c5da48ee1ff43775345a4922 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 10:54:38 +0200
+Subject: drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
+
+From: Loic Poulain <loic.poulain@oss.qualcomm.com>
+
+[ Upstream commit a10f910c77f280327b481e77eab909934ec508f0 ]
+
+If the interrupt occurs before resource initialization is complete, the
+interrupt handler/worker may access uninitialized data such as the I2C
+tcpc_client device, potentially leading to NULL pointer dereference.
+
+Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250709085438.56188-1-loic.poulain@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/anx7625.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
+index 8a9079c2ed5c2..8257132a8ee9d 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
+@@ -2678,7 +2678,7 @@ static int anx7625_i2c_probe(struct i2c_client *client)
+ ret = devm_request_threaded_irq(dev, platform->pdata.intp_irq,
+ NULL, anx7625_intr_hpd_isr,
+ IRQF_TRIGGER_FALLING |
+- IRQF_ONESHOT,
++ IRQF_ONESHOT | IRQF_NO_AUTOEN,
+ "anx7625-intp", platform);
+ if (ret) {
+ DRM_DEV_ERROR(dev, "fail to request irq\n");
+@@ -2747,8 +2747,10 @@ static int anx7625_i2c_probe(struct i2c_client *client)
+ }
+
+ /* Add work function */
+- if (platform->pdata.intp_irq)
++ if (platform->pdata.intp_irq) {
++ enable_irq(platform->pdata.intp_irq);
+ queue_work(platform->workqueue, &platform->work);
++ }
+
+ if (platform->pdata.audio_en)
+ anx7625_register_audio(dev, platform);
+--
+2.51.0
+
--- /dev/null
+From 0ebeac4dfce976051ae85ab9bc7c0b635bebb247 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 11:44:47 +0800
+Subject: drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
+
+From: Qi Xi <xiqi2@huawei.com>
+
+[ Upstream commit 288dac9fb6084330d968459c750c838fd06e10e6 ]
+
+Add missing mutex unlock before returning from the error path in
+cdns_mhdp_atomic_enable().
+
+Fixes: 935a92a1c400 ("drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qi Xi <xiqi2@huawei.com>
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20250904034447.665427-1-xiqi2@huawei.com
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+index b431e7efd1f0d..dbef0ca1a22a3 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+@@ -1984,8 +1984,10 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge,
+ mhdp_state = to_cdns_mhdp_bridge_state(new_state);
+
+ mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode);
+- if (!mhdp_state->current_mode)
+- return;
++ if (!mhdp_state->current_mode) {
++ ret = -EINVAL;
++ goto out;
++ }
+
+ drm_mode_set_name(mhdp_state->current_mode);
+
+--
+2.51.0
+
--- /dev/null
+From a416340cd8dba6079da1f0f032b08edc4c4dab17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 18:53:41 +0300
+Subject: drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit cbc7f3b4f6ca19320e2eacf8fc1403d6f331ce14 ]
+
+The xe_preempt_fence_create() function returns error pointers. It
+never returns NULL. Update the error checking to match.
+
+Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://lore.kernel.org/r/aJTMBdX97cof_009@stanley.mountain
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+(cherry picked from commit 75cc23ffe5b422bc3cbd5cf0956b8b86e4b0e162)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_vm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
+index 84052b98002d1..92ce7374a79ce 100644
+--- a/drivers/gpu/drm/xe/xe_vm.c
++++ b/drivers/gpu/drm/xe/xe_vm.c
+@@ -240,8 +240,8 @@ int xe_vm_add_compute_exec_queue(struct xe_vm *vm, struct xe_exec_queue *q)
+
+ pfence = xe_preempt_fence_create(q, q->lr.context,
+ ++q->lr.seqno);
+- if (!pfence) {
+- err = -ENOMEM;
++ if (IS_ERR(pfence)) {
++ err = PTR_ERR(pfence);
+ goto out_fini;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b0139b76266d0450b66ba5aafba99e2daccd917c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 15:12:40 -0700
+Subject: drm/xe: Fix error handling if PXP fails to start
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit ae5fbbda341f92e605a9508a0fb18456155517f0 ]
+
+Since the PXP start comes after __xe_exec_queue_init() has completed,
+we need to cleanup what was done in that function in case of a PXP
+start error.
+__xe_exec_queue_init calls the submission backend init() function,
+so we need to introduce an opposite for that. Unfortunately, while
+we already have a fini() function pointer, it performs other
+operations in addition to cleaning up what was done by the init().
+Therefore, for clarity, the existing fini() has been renamed to
+destroy(), while a new fini() has been added to only clean up what was
+done by the init(), with the latter being called by the former (via
+xe_exec_queue_fini).
+
+Fixes: 72d479601d67 ("drm/xe/pxp/uapi: Add userspace and LRC support for PXP-using queues")
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: John Harrison <John.C.Harrison@Intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: John Harrison <John.C.Harrison@Intel.com>
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Link: https://lore.kernel.org/r/20250909221240.3711023-3-daniele.ceraolospurio@intel.com
+(cherry picked from commit 626667321deb4c7a294725406faa3dd71c3d445d)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_exec_queue.c | 22 ++++++---
+ drivers/gpu/drm/xe/xe_exec_queue_types.h | 8 ++-
+ drivers/gpu/drm/xe/xe_execlist.c | 25 ++++++----
+ drivers/gpu/drm/xe/xe_execlist_types.h | 2 +-
+ drivers/gpu/drm/xe/xe_guc_exec_queue_types.h | 4 +-
+ drivers/gpu/drm/xe/xe_guc_submit.c | 52 ++++++++++++--------
+ 6 files changed, 72 insertions(+), 41 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c
+index fee22358cc09b..e511697596146 100644
+--- a/drivers/gpu/drm/xe/xe_exec_queue.c
++++ b/drivers/gpu/drm/xe/xe_exec_queue.c
+@@ -151,6 +151,16 @@ static int __xe_exec_queue_init(struct xe_exec_queue *q)
+ return err;
+ }
+
++static void __xe_exec_queue_fini(struct xe_exec_queue *q)
++{
++ int i;
++
++ q->ops->fini(q);
++
++ for (i = 0; i < q->width; ++i)
++ xe_lrc_put(q->lrc[i]);
++}
++
+ struct xe_exec_queue *xe_exec_queue_create(struct xe_device *xe, struct xe_vm *vm,
+ u32 logical_mask, u16 width,
+ struct xe_hw_engine *hwe, u32 flags,
+@@ -181,11 +191,13 @@ struct xe_exec_queue *xe_exec_queue_create(struct xe_device *xe, struct xe_vm *v
+ if (xe_exec_queue_uses_pxp(q)) {
+ err = xe_pxp_exec_queue_add(xe->pxp, q);
+ if (err)
+- goto err_post_alloc;
++ goto err_post_init;
+ }
+
+ return q;
+
++err_post_init:
++ __xe_exec_queue_fini(q);
+ err_post_alloc:
+ __xe_exec_queue_free(q);
+ return ERR_PTR(err);
+@@ -283,13 +295,11 @@ void xe_exec_queue_destroy(struct kref *ref)
+ xe_exec_queue_put(eq);
+ }
+
+- q->ops->fini(q);
++ q->ops->destroy(q);
+ }
+
+ void xe_exec_queue_fini(struct xe_exec_queue *q)
+ {
+- int i;
+-
+ /*
+ * Before releasing our ref to lrc and xef, accumulate our run ticks
+ * and wakeup any waiters.
+@@ -298,9 +308,7 @@ void xe_exec_queue_fini(struct xe_exec_queue *q)
+ if (q->xef && atomic_dec_and_test(&q->xef->exec_queue.pending_removal))
+ wake_up_var(&q->xef->exec_queue.pending_removal);
+
+- for (i = 0; i < q->width; ++i)
+- xe_lrc_put(q->lrc[i]);
+-
++ __xe_exec_queue_fini(q);
+ __xe_exec_queue_free(q);
+ }
+
+diff --git a/drivers/gpu/drm/xe/xe_exec_queue_types.h b/drivers/gpu/drm/xe/xe_exec_queue_types.h
+index cc1cffb5c87f1..1c9d03f2a3e5d 100644
+--- a/drivers/gpu/drm/xe/xe_exec_queue_types.h
++++ b/drivers/gpu/drm/xe/xe_exec_queue_types.h
+@@ -166,8 +166,14 @@ struct xe_exec_queue_ops {
+ int (*init)(struct xe_exec_queue *q);
+ /** @kill: Kill inflight submissions for backend */
+ void (*kill)(struct xe_exec_queue *q);
+- /** @fini: Fini exec queue for submission backend */
++ /** @fini: Undoes the init() for submission backend */
+ void (*fini)(struct xe_exec_queue *q);
++ /**
++ * @destroy: Destroy exec queue for submission backend. The backend
++ * function must call xe_exec_queue_fini() (which will in turn call the
++ * fini() backend function) to ensure the queue is properly cleaned up.
++ */
++ void (*destroy)(struct xe_exec_queue *q);
+ /** @set_priority: Set priority for exec queue */
+ int (*set_priority)(struct xe_exec_queue *q,
+ enum xe_exec_queue_priority priority);
+diff --git a/drivers/gpu/drm/xe/xe_execlist.c b/drivers/gpu/drm/xe/xe_execlist.c
+index 788f56b066b6a..f83d421ac9d3d 100644
+--- a/drivers/gpu/drm/xe/xe_execlist.c
++++ b/drivers/gpu/drm/xe/xe_execlist.c
+@@ -385,10 +385,20 @@ static int execlist_exec_queue_init(struct xe_exec_queue *q)
+ return err;
+ }
+
+-static void execlist_exec_queue_fini_async(struct work_struct *w)
++static void execlist_exec_queue_fini(struct xe_exec_queue *q)
++{
++ struct xe_execlist_exec_queue *exl = q->execlist;
++
++ drm_sched_entity_fini(&exl->entity);
++ drm_sched_fini(&exl->sched);
++
++ kfree(exl);
++}
++
++static void execlist_exec_queue_destroy_async(struct work_struct *w)
+ {
+ struct xe_execlist_exec_queue *ee =
+- container_of(w, struct xe_execlist_exec_queue, fini_async);
++ container_of(w, struct xe_execlist_exec_queue, destroy_async);
+ struct xe_exec_queue *q = ee->q;
+ struct xe_execlist_exec_queue *exl = q->execlist;
+ struct xe_device *xe = gt_to_xe(q->gt);
+@@ -401,10 +411,6 @@ static void execlist_exec_queue_fini_async(struct work_struct *w)
+ list_del(&exl->active_link);
+ spin_unlock_irqrestore(&exl->port->lock, flags);
+
+- drm_sched_entity_fini(&exl->entity);
+- drm_sched_fini(&exl->sched);
+- kfree(exl);
+-
+ xe_exec_queue_fini(q);
+ }
+
+@@ -413,10 +419,10 @@ static void execlist_exec_queue_kill(struct xe_exec_queue *q)
+ /* NIY */
+ }
+
+-static void execlist_exec_queue_fini(struct xe_exec_queue *q)
++static void execlist_exec_queue_destroy(struct xe_exec_queue *q)
+ {
+- INIT_WORK(&q->execlist->fini_async, execlist_exec_queue_fini_async);
+- queue_work(system_unbound_wq, &q->execlist->fini_async);
++ INIT_WORK(&q->execlist->destroy_async, execlist_exec_queue_destroy_async);
++ queue_work(system_unbound_wq, &q->execlist->destroy_async);
+ }
+
+ static int execlist_exec_queue_set_priority(struct xe_exec_queue *q,
+@@ -467,6 +473,7 @@ static const struct xe_exec_queue_ops execlist_exec_queue_ops = {
+ .init = execlist_exec_queue_init,
+ .kill = execlist_exec_queue_kill,
+ .fini = execlist_exec_queue_fini,
++ .destroy = execlist_exec_queue_destroy,
+ .set_priority = execlist_exec_queue_set_priority,
+ .set_timeslice = execlist_exec_queue_set_timeslice,
+ .set_preempt_timeout = execlist_exec_queue_set_preempt_timeout,
+diff --git a/drivers/gpu/drm/xe/xe_execlist_types.h b/drivers/gpu/drm/xe/xe_execlist_types.h
+index 415140936f11d..92c4ba52db0cb 100644
+--- a/drivers/gpu/drm/xe/xe_execlist_types.h
++++ b/drivers/gpu/drm/xe/xe_execlist_types.h
+@@ -42,7 +42,7 @@ struct xe_execlist_exec_queue {
+
+ bool has_run;
+
+- struct work_struct fini_async;
++ struct work_struct destroy_async;
+
+ enum xe_exec_queue_priority active_priority;
+ struct list_head active_link;
+diff --git a/drivers/gpu/drm/xe/xe_guc_exec_queue_types.h b/drivers/gpu/drm/xe/xe_guc_exec_queue_types.h
+index a3f421e2adc03..c30c0e3ccbbb9 100644
+--- a/drivers/gpu/drm/xe/xe_guc_exec_queue_types.h
++++ b/drivers/gpu/drm/xe/xe_guc_exec_queue_types.h
+@@ -35,8 +35,8 @@ struct xe_guc_exec_queue {
+ struct xe_sched_msg static_msgs[MAX_STATIC_MSG_TYPE];
+ /** @lr_tdr: long running TDR worker */
+ struct work_struct lr_tdr;
+- /** @fini_async: do final fini async from this worker */
+- struct work_struct fini_async;
++ /** @destroy_async: do final destroy async from this worker */
++ struct work_struct destroy_async;
+ /** @resume_time: time of last resume */
+ u64 resume_time;
+ /** @state: GuC specific state for this xe_exec_queue */
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
+index ef3e9e1588f7c..45a21af126927 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.c
++++ b/drivers/gpu/drm/xe/xe_guc_submit.c
+@@ -1269,48 +1269,57 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job)
+ return DRM_GPU_SCHED_STAT_NOMINAL;
+ }
+
+-static void __guc_exec_queue_fini_async(struct work_struct *w)
++static void guc_exec_queue_fini(struct xe_exec_queue *q)
++{
++ struct xe_guc_exec_queue *ge = q->guc;
++ struct xe_guc *guc = exec_queue_to_guc(q);
++
++ release_guc_id(guc, q);
++ xe_sched_entity_fini(&ge->entity);
++ xe_sched_fini(&ge->sched);
++
++ /*
++ * RCU free due sched being exported via DRM scheduler fences
++ * (timeline name).
++ */
++ kfree_rcu(ge, rcu);
++}
++
++static void __guc_exec_queue_destroy_async(struct work_struct *w)
+ {
+ struct xe_guc_exec_queue *ge =
+- container_of(w, struct xe_guc_exec_queue, fini_async);
++ container_of(w, struct xe_guc_exec_queue, destroy_async);
+ struct xe_exec_queue *q = ge->q;
+ struct xe_guc *guc = exec_queue_to_guc(q);
+
+ xe_pm_runtime_get(guc_to_xe(guc));
+ trace_xe_exec_queue_destroy(q);
+
+- release_guc_id(guc, q);
+ if (xe_exec_queue_is_lr(q))
+ cancel_work_sync(&ge->lr_tdr);
+ /* Confirm no work left behind accessing device structures */
+ cancel_delayed_work_sync(&ge->sched.base.work_tdr);
+- xe_sched_entity_fini(&ge->entity);
+- xe_sched_fini(&ge->sched);
+
+- /*
+- * RCU free due sched being exported via DRM scheduler fences
+- * (timeline name).
+- */
+- kfree_rcu(ge, rcu);
+ xe_exec_queue_fini(q);
++
+ xe_pm_runtime_put(guc_to_xe(guc));
+ }
+
+-static void guc_exec_queue_fini_async(struct xe_exec_queue *q)
++static void guc_exec_queue_destroy_async(struct xe_exec_queue *q)
+ {
+ struct xe_guc *guc = exec_queue_to_guc(q);
+ struct xe_device *xe = guc_to_xe(guc);
+
+- INIT_WORK(&q->guc->fini_async, __guc_exec_queue_fini_async);
++ INIT_WORK(&q->guc->destroy_async, __guc_exec_queue_destroy_async);
+
+ /* We must block on kernel engines so slabs are empty on driver unload */
+ if (q->flags & EXEC_QUEUE_FLAG_PERMANENT || exec_queue_wedged(q))
+- __guc_exec_queue_fini_async(&q->guc->fini_async);
++ __guc_exec_queue_destroy_async(&q->guc->destroy_async);
+ else
+- queue_work(xe->destroy_wq, &q->guc->fini_async);
++ queue_work(xe->destroy_wq, &q->guc->destroy_async);
+ }
+
+-static void __guc_exec_queue_fini(struct xe_guc *guc, struct xe_exec_queue *q)
++static void __guc_exec_queue_destroy(struct xe_guc *guc, struct xe_exec_queue *q)
+ {
+ /*
+ * Might be done from within the GPU scheduler, need to do async as we
+@@ -1319,7 +1328,7 @@ static void __guc_exec_queue_fini(struct xe_guc *guc, struct xe_exec_queue *q)
+ * this we and don't really care when everything is fini'd, just that it
+ * is.
+ */
+- guc_exec_queue_fini_async(q);
++ guc_exec_queue_destroy_async(q);
+ }
+
+ static void __guc_exec_queue_process_msg_cleanup(struct xe_sched_msg *msg)
+@@ -1333,7 +1342,7 @@ static void __guc_exec_queue_process_msg_cleanup(struct xe_sched_msg *msg)
+ if (exec_queue_registered(q))
+ disable_scheduling_deregister(guc, q);
+ else
+- __guc_exec_queue_fini(guc, q);
++ __guc_exec_queue_destroy(guc, q);
+ }
+
+ static bool guc_exec_queue_allowed_to_change_state(struct xe_exec_queue *q)
+@@ -1566,14 +1575,14 @@ static bool guc_exec_queue_try_add_msg(struct xe_exec_queue *q,
+ #define STATIC_MSG_CLEANUP 0
+ #define STATIC_MSG_SUSPEND 1
+ #define STATIC_MSG_RESUME 2
+-static void guc_exec_queue_fini(struct xe_exec_queue *q)
++static void guc_exec_queue_destroy(struct xe_exec_queue *q)
+ {
+ struct xe_sched_msg *msg = q->guc->static_msgs + STATIC_MSG_CLEANUP;
+
+ if (!(q->flags & EXEC_QUEUE_FLAG_PERMANENT) && !exec_queue_wedged(q))
+ guc_exec_queue_add_msg(q, msg, CLEANUP);
+ else
+- __guc_exec_queue_fini(exec_queue_to_guc(q), q);
++ __guc_exec_queue_destroy(exec_queue_to_guc(q), q);
+ }
+
+ static int guc_exec_queue_set_priority(struct xe_exec_queue *q,
+@@ -1703,6 +1712,7 @@ static const struct xe_exec_queue_ops guc_exec_queue_ops = {
+ .init = guc_exec_queue_init,
+ .kill = guc_exec_queue_kill,
+ .fini = guc_exec_queue_fini,
++ .destroy = guc_exec_queue_destroy,
+ .set_priority = guc_exec_queue_set_priority,
+ .set_timeslice = guc_exec_queue_set_timeslice,
+ .set_preempt_timeout = guc_exec_queue_set_preempt_timeout,
+@@ -1724,7 +1734,7 @@ static void guc_exec_queue_stop(struct xe_guc *guc, struct xe_exec_queue *q)
+ if (exec_queue_extra_ref(q) || xe_exec_queue_is_lr(q))
+ xe_exec_queue_put(q);
+ else if (exec_queue_destroyed(q))
+- __guc_exec_queue_fini(guc, q);
++ __guc_exec_queue_destroy(guc, q);
+ }
+ if (q->guc->suspend_pending) {
+ set_exec_queue_suspended(q);
+@@ -1981,7 +1991,7 @@ static void handle_deregister_done(struct xe_guc *guc, struct xe_exec_queue *q)
+ if (exec_queue_extra_ref(q) || xe_exec_queue_is_lr(q))
+ xe_exec_queue_put(q);
+ else
+- __guc_exec_queue_fini(guc, q);
++ __guc_exec_queue_destroy(guc, q);
+ }
+
+ int xe_guc_deregister_done_handler(struct xe_guc *guc, u32 *msg, u32 len)
+--
+2.51.0
+
--- /dev/null
+From 11e953e772c7f292e1596139968c837359f1dab4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jun 2025 13:54:06 -0700
+Subject: drm/xe/guc: Enable extended CAT error reporting
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit a7ffcea8631af91479cab10aa7fbfd0722f01d9a ]
+
+On newer HW (Xe2 onwards + PVC) it is possible to get extra information
+when a CAT error occurs, specifically a dword reporting the error type.
+To enable this extra reporting, we need to opt-in with the GuC, which is
+done via a specific per-VF feature opt-in H2G.
+
+On platforms where the HW does not support the extra reporting, the GuC
+will set the type to 0xdeadbeef, so we can keep the code simple and
+opt-in to the feature on every platform and then just discard the data
+if it is invalid.
+
+Note that on native/PF we're guaranteed that the opt in is available
+because we don't support any GuC old enough to not have it, but if we're
+a VF we might be running on a non-XE PF with an older GuC, so we need to
+handle that case. We can re-use the invalid type above to handle this
+scenario the same way as if the feature was not supported in HW.
+
+Given that this patch is the first user of the guc_buf_cache on native
+and VF, it also extends that feature to non-PF use-cases.
+
+v2: simpler print for the error type (John), rebase
+v3: use guc_buf_cache instead of new alloc, simpler doc (Michal)
+
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Nirmoy Das <nirmoy.das@intel.com>
+Cc: John Harrison <John.C.Harrison@Intel.com>
+Cc: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Reviewed-by: Nirmoy Das <nirmoy.das@intel.com> #v1
+Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Reviewed-by: John Harrison <John.C.Harrison@Intel.com>
+Link: https://lore.kernel.org/r/20250625205405.1653212-3-daniele.ceraolospurio@intel.com
+Stable-dep-of: 26caeae9fb48 ("drm/xe/guc: Set RCS/CCS yield policy")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/abi/guc_actions_abi.h | 4 ++
+ drivers/gpu/drm/xe/abi/guc_klvs_abi.h | 15 +++++++
+ drivers/gpu/drm/xe/xe_guc.c | 56 ++++++++++++++++++++++++
+ drivers/gpu/drm/xe/xe_guc.h | 1 +
+ drivers/gpu/drm/xe/xe_guc_submit.c | 21 +++++++--
+ drivers/gpu/drm/xe/xe_uc.c | 4 ++
+ 6 files changed, 98 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/abi/guc_actions_abi.h b/drivers/gpu/drm/xe/abi/guc_actions_abi.h
+index 448afb86e05c7..b55d4cfb483a1 100644
+--- a/drivers/gpu/drm/xe/abi/guc_actions_abi.h
++++ b/drivers/gpu/drm/xe/abi/guc_actions_abi.h
+@@ -142,6 +142,7 @@ enum xe_guc_action {
+ XE_GUC_ACTION_SET_ENG_UTIL_BUFF = 0x550A,
+ XE_GUC_ACTION_SET_DEVICE_ENGINE_ACTIVITY_BUFFER = 0x550C,
+ XE_GUC_ACTION_SET_FUNCTION_ENGINE_ACTIVITY_BUFFER = 0x550D,
++ XE_GUC_ACTION_OPT_IN_FEATURE_KLV = 0x550E,
+ XE_GUC_ACTION_NOTIFY_MEMORY_CAT_ERROR = 0x6000,
+ XE_GUC_ACTION_REPORT_PAGE_FAULT_REQ_DESC = 0x6002,
+ XE_GUC_ACTION_PAGE_FAULT_RES_DESC = 0x6003,
+@@ -240,4 +241,7 @@ enum xe_guc_g2g_type {
+ #define XE_G2G_DEREGISTER_TILE REG_GENMASK(15, 12)
+ #define XE_G2G_DEREGISTER_TYPE REG_GENMASK(11, 8)
+
++/* invalid type for XE_GUC_ACTION_NOTIFY_MEMORY_CAT_ERROR */
++#define XE_GUC_CAT_ERR_TYPE_INVALID 0xdeadbeef
++
+ #endif
+diff --git a/drivers/gpu/drm/xe/abi/guc_klvs_abi.h b/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
+index 7de8f827281fc..5b2502bec2dcc 100644
+--- a/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
++++ b/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
+@@ -16,6 +16,7 @@
+ * +===+=======+==============================================================+
+ * | 0 | 31:16 | **KEY** - KLV key identifier |
+ * | | | - `GuC Self Config KLVs`_ |
++ * | | | - `GuC Opt In Feature KLVs`_ |
+ * | | | - `GuC VGT Policy KLVs`_ |
+ * | | | - `GuC VF Configuration KLVs`_ |
+ * | | | |
+@@ -124,6 +125,20 @@ enum {
+ GUC_CONTEXT_POLICIES_KLV_NUM_IDS = 5,
+ };
+
++/**
++ * DOC: GuC Opt In Feature KLVs
++ *
++ * `GuC KLV`_ keys available for use with OPT_IN_FEATURE_KLV
++ *
++ * _`GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE` : 0x4001
++ * Adds an extra dword to the XE_GUC_ACTION_NOTIFY_MEMORY_CAT_ERROR G2H
++ * containing the type of the CAT error. On HW that does not support
++ * reporting the CAT error type, the extra dword is set to 0xdeadbeef.
++ */
++
++#define GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE_KEY 0x4001
++#define GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE_LEN 0u
++
+ /**
+ * DOC: GuC VGT Policy KLVs
+ *
+diff --git a/drivers/gpu/drm/xe/xe_guc.c b/drivers/gpu/drm/xe/xe_guc.c
+index bac5471a1a780..2efc0298e1a4c 100644
+--- a/drivers/gpu/drm/xe/xe_guc.c
++++ b/drivers/gpu/drm/xe/xe_guc.c
+@@ -29,6 +29,7 @@
+ #include "xe_guc_db_mgr.h"
+ #include "xe_guc_engine_activity.h"
+ #include "xe_guc_hwconfig.h"
++#include "xe_guc_klv_helpers.h"
+ #include "xe_guc_log.h"
+ #include "xe_guc_pc.h"
+ #include "xe_guc_relay.h"
+@@ -570,6 +571,57 @@ static int guc_g2g_start(struct xe_guc *guc)
+ return err;
+ }
+
++static int __guc_opt_in_features_enable(struct xe_guc *guc, u64 addr, u32 num_dwords)
++{
++ u32 action[] = {
++ XE_GUC_ACTION_OPT_IN_FEATURE_KLV,
++ lower_32_bits(addr),
++ upper_32_bits(addr),
++ num_dwords
++ };
++
++ return xe_guc_ct_send_block(&guc->ct, action, ARRAY_SIZE(action));
++}
++
++#define OPT_IN_MAX_DWORDS 16
++int xe_guc_opt_in_features_enable(struct xe_guc *guc)
++{
++ struct xe_device *xe = guc_to_xe(guc);
++ CLASS(xe_guc_buf, buf)(&guc->buf, OPT_IN_MAX_DWORDS);
++ u32 count = 0;
++ u32 *klvs;
++ int ret;
++
++ if (!xe_guc_buf_is_valid(buf))
++ return -ENOBUFS;
++
++ klvs = xe_guc_buf_cpu_ptr(buf);
++
++ /*
++ * The extra CAT error type opt-in was added in GuC v70.17.0, which maps
++ * to compatibility version v1.7.0.
++ * Note that the GuC allows enabling this KLV even on platforms that do
++ * not support the extra type; in such case the returned type variable
++ * will be set to a known invalid value which we can check against.
++ */
++ if (GUC_SUBMIT_VER(guc) >= MAKE_GUC_VER(1, 7, 0))
++ klvs[count++] = PREP_GUC_KLV_TAG(OPT_IN_FEATURE_EXT_CAT_ERR_TYPE);
++
++ if (count) {
++ xe_assert(xe, count <= OPT_IN_MAX_DWORDS);
++
++ ret = __guc_opt_in_features_enable(guc, xe_guc_buf_flush(buf), count);
++ if (ret < 0) {
++ xe_gt_err(guc_to_gt(guc),
++ "failed to enable GuC opt-in features: %pe\n",
++ ERR_PTR(ret));
++ return ret;
++ }
++ }
++
++ return 0;
++}
++
+ static void guc_fini_hw(void *arg)
+ {
+ struct xe_guc *guc = arg;
+@@ -763,6 +815,10 @@ int xe_guc_post_load_init(struct xe_guc *guc)
+
+ xe_guc_ads_populate_post_load(&guc->ads);
+
++ ret = xe_guc_opt_in_features_enable(guc);
++ if (ret)
++ return ret;
++
+ if (xe_guc_g2g_wanted(guc_to_xe(guc))) {
+ ret = guc_g2g_start(guc);
+ if (ret)
+diff --git a/drivers/gpu/drm/xe/xe_guc.h b/drivers/gpu/drm/xe/xe_guc.h
+index 58338be445585..4a66575f017d2 100644
+--- a/drivers/gpu/drm/xe/xe_guc.h
++++ b/drivers/gpu/drm/xe/xe_guc.h
+@@ -33,6 +33,7 @@ int xe_guc_reset(struct xe_guc *guc);
+ int xe_guc_upload(struct xe_guc *guc);
+ int xe_guc_min_load_for_hwconfig(struct xe_guc *guc);
+ int xe_guc_enable_communication(struct xe_guc *guc);
++int xe_guc_opt_in_features_enable(struct xe_guc *guc);
+ int xe_guc_suspend(struct xe_guc *guc);
+ void xe_guc_notify(struct xe_guc *guc);
+ int xe_guc_auth_huc(struct xe_guc *guc, u32 rsa_addr);
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
+index 45a21af126927..e670dcb0f0932 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.c
++++ b/drivers/gpu/drm/xe/xe_guc_submit.c
+@@ -2088,12 +2088,16 @@ int xe_guc_exec_queue_memory_cat_error_handler(struct xe_guc *guc, u32 *msg,
+ struct xe_gt *gt = guc_to_gt(guc);
+ struct xe_exec_queue *q;
+ u32 guc_id;
++ u32 type = XE_GUC_CAT_ERR_TYPE_INVALID;
+
+- if (unlikely(len < 1))
++ if (unlikely(!len || len > 2))
+ return -EPROTO;
+
+ guc_id = msg[0];
+
++ if (len == 2)
++ type = msg[1];
++
+ if (guc_id == GUC_ID_UNKNOWN) {
+ /*
+ * GuC uses GUC_ID_UNKNOWN if it can not map the CAT fault to any PF/VF
+@@ -2107,8 +2111,19 @@ int xe_guc_exec_queue_memory_cat_error_handler(struct xe_guc *guc, u32 *msg,
+ if (unlikely(!q))
+ return -EPROTO;
+
+- xe_gt_dbg(gt, "Engine memory cat error: engine_class=%s, logical_mask: 0x%x, guc_id=%d",
+- xe_hw_engine_class_to_str(q->class), q->logical_mask, guc_id);
++ /*
++ * The type is HW-defined and changes based on platform, so we don't
++ * decode it in the kernel and only check if it is valid.
++ * See bspec 54047 and 72187 for details.
++ */
++ if (type != XE_GUC_CAT_ERR_TYPE_INVALID)
++ xe_gt_dbg(gt,
++ "Engine memory CAT error [%u]: class=%s, logical_mask: 0x%x, guc_id=%d",
++ type, xe_hw_engine_class_to_str(q->class), q->logical_mask, guc_id);
++ else
++ xe_gt_dbg(gt,
++ "Engine memory CAT error: class=%s, logical_mask: 0x%x, guc_id=%d",
++ xe_hw_engine_class_to_str(q->class), q->logical_mask, guc_id);
+
+ trace_xe_exec_queue_memory_cat_error(q);
+
+diff --git a/drivers/gpu/drm/xe/xe_uc.c b/drivers/gpu/drm/xe/xe_uc.c
+index 3a8751a8b92dd..5c45b0f072a4c 100644
+--- a/drivers/gpu/drm/xe/xe_uc.c
++++ b/drivers/gpu/drm/xe/xe_uc.c
+@@ -165,6 +165,10 @@ static int vf_uc_init_hw(struct xe_uc *uc)
+
+ uc->guc.submission_state.enabled = true;
+
++ err = xe_guc_opt_in_features_enable(&uc->guc);
++ if (err)
++ return err;
++
+ err = xe_gt_record_default_lrcs(uc_to_gt(uc));
+ if (err)
+ return err;
+--
+2.51.0
+
--- /dev/null
+From ebd6c8a7f2fe15afc288dc8eeb7605b2313995f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 16:56:33 -0700
+Subject: drm/xe/guc: Set RCS/CCS yield policy
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit 26caeae9fb482ec443753b4e3307e5122b60b850 ]
+
+All recent platforms (including all the ones officially supported by the
+Xe driver) do not allow concurrent execution of RCS and CCS workloads
+from different address spaces, with the HW blocking the context switch
+when it detects such a scenario.
+The DUAL_QUEUE flag helps with this, by causing the GuC to not submit a
+context it knows will not be able to execute. This, however, causes a new
+problem: if RCS and CCS queues have pending workloads from different
+address spaces, the GuC needs to choose from which of the 2 queues to
+pick the next workload to execute. By default, the GuC prioritizes RCS
+submissions over CCS ones, which can lead to CCS workloads being
+significantly (or completely) starved of execution time.
+The driver can tune this by setting a dedicated scheduling policy KLV;
+this KLV allows the driver to specify a quantum (in ms) and a ratio
+(percentage value between 0 and 100), and the GuC will prioritize the CCS
+for that percentage of each quantum.
+Given that we want to guarantee enough RCS throughput to avoid missing
+frames, we set the yield policy to 20% of each 80ms interval.
+
+v2: updated quantum and ratio, improved comment, use xe_guc_submit_disable
+in gt_sanitize
+
+Fixes: d9a1ae0d17bd ("drm/xe/guc: Enable WA_DUAL_QUEUE for newer platforms")
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: John Harrison <John.C.Harrison@Intel.com>
+Cc: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
+Reviewed-by: John Harrison <John.C.Harrison@Intel.com>
+Tested-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
+Link: https://lore.kernel.org/r/20250905235632.3333247-2-daniele.ceraolospurio@intel.com
+(cherry picked from commit 88434448438e4302e272b2a2b810b42e05ea024b)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+[Rodrigo added #include "xe_guc_submit.h" while backporting]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/abi/guc_actions_abi.h | 1 +
+ drivers/gpu/drm/xe/abi/guc_klvs_abi.h | 25 +++++++++
+ drivers/gpu/drm/xe/xe_gt.c | 3 +-
+ drivers/gpu/drm/xe/xe_guc.c | 6 +--
+ drivers/gpu/drm/xe/xe_guc_submit.c | 66 ++++++++++++++++++++++++
+ drivers/gpu/drm/xe/xe_guc_submit.h | 2 +
+ 6 files changed, 98 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/abi/guc_actions_abi.h b/drivers/gpu/drm/xe/abi/guc_actions_abi.h
+index b55d4cfb483a1..4d9896e14649c 100644
+--- a/drivers/gpu/drm/xe/abi/guc_actions_abi.h
++++ b/drivers/gpu/drm/xe/abi/guc_actions_abi.h
+@@ -117,6 +117,7 @@ enum xe_guc_action {
+ XE_GUC_ACTION_ENTER_S_STATE = 0x501,
+ XE_GUC_ACTION_EXIT_S_STATE = 0x502,
+ XE_GUC_ACTION_GLOBAL_SCHED_POLICY_CHANGE = 0x506,
++ XE_GUC_ACTION_UPDATE_SCHEDULING_POLICIES_KLV = 0x509,
+ XE_GUC_ACTION_SCHED_CONTEXT = 0x1000,
+ XE_GUC_ACTION_SCHED_CONTEXT_MODE_SET = 0x1001,
+ XE_GUC_ACTION_SCHED_CONTEXT_MODE_DONE = 0x1002,
+diff --git a/drivers/gpu/drm/xe/abi/guc_klvs_abi.h b/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
+index 5b2502bec2dcc..89034bc97ec5a 100644
+--- a/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
++++ b/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
+@@ -17,6 +17,7 @@
+ * | 0 | 31:16 | **KEY** - KLV key identifier |
+ * | | | - `GuC Self Config KLVs`_ |
+ * | | | - `GuC Opt In Feature KLVs`_ |
++ * | | | - `GuC Scheduling Policies KLVs`_ |
+ * | | | - `GuC VGT Policy KLVs`_ |
+ * | | | - `GuC VF Configuration KLVs`_ |
+ * | | | |
+@@ -139,6 +140,30 @@ enum {
+ #define GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE_KEY 0x4001
+ #define GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE_LEN 0u
+
++/**
++ * DOC: GuC Scheduling Policies KLVs
++ *
++ * `GuC KLV`_ keys available for use with UPDATE_SCHEDULING_POLICIES_KLV.
++ *
++ * _`GUC_KLV_SCHEDULING_POLICIES_RENDER_COMPUTE_YIELD` : 0x1001
++ * Some platforms do not allow concurrent execution of RCS and CCS
++ * workloads from different address spaces. By default, the GuC prioritizes
++ * RCS submissions over CCS ones, which can lead to CCS workloads being
++ * significantly (or completely) starved of execution time. This KLV allows
++ * the driver to specify a quantum (in ms) and a ratio (percentage value
++ * between 0 and 100), and the GuC will prioritize the CCS for that
++ * percentage of each quantum. For example, specifying 100ms and 30% will
++ * make the GuC prioritize the CCS for 30ms of every 100ms.
++ * Note that this does not necessarly mean that RCS and CCS engines will
++ * only be active for their percentage of the quantum, as the restriction
++ * only kicks in if both classes are fully busy with non-compatible address
++ * spaces; i.e., if one engine is idle or running the same address space,
++ * a pending job on the other engine will still be submitted to the HW no
++ * matter what the ratio is
++ */
++#define GUC_KLV_SCHEDULING_POLICIES_RENDER_COMPUTE_YIELD_KEY 0x1001
++#define GUC_KLV_SCHEDULING_POLICIES_RENDER_COMPUTE_YIELD_LEN 2u
++
+ /**
+ * DOC: GuC VGT Policy KLVs
+ *
+diff --git a/drivers/gpu/drm/xe/xe_gt.c b/drivers/gpu/drm/xe/xe_gt.c
+index e3517ce2e18c1..eaf7569a7c1d1 100644
+--- a/drivers/gpu/drm/xe/xe_gt.c
++++ b/drivers/gpu/drm/xe/xe_gt.c
+@@ -41,6 +41,7 @@
+ #include "xe_gt_topology.h"
+ #include "xe_guc_exec_queue_types.h"
+ #include "xe_guc_pc.h"
++#include "xe_guc_submit.h"
+ #include "xe_hw_fence.h"
+ #include "xe_hw_engine_class_sysfs.h"
+ #include "xe_irq.h"
+@@ -97,7 +98,7 @@ void xe_gt_sanitize(struct xe_gt *gt)
+ * FIXME: if xe_uc_sanitize is called here, on TGL driver will not
+ * reload
+ */
+- gt->uc.guc.submission_state.enabled = false;
++ xe_guc_submit_disable(>->uc.guc);
+ }
+
+ static void xe_gt_enable_host_l2_vram(struct xe_gt *gt)
+diff --git a/drivers/gpu/drm/xe/xe_guc.c b/drivers/gpu/drm/xe/xe_guc.c
+index 2efc0298e1a4c..b9d21fdaad48b 100644
+--- a/drivers/gpu/drm/xe/xe_guc.c
++++ b/drivers/gpu/drm/xe/xe_guc.c
+@@ -825,9 +825,7 @@ int xe_guc_post_load_init(struct xe_guc *guc)
+ return ret;
+ }
+
+- guc->submission_state.enabled = true;
+-
+- return 0;
++ return xe_guc_submit_enable(guc);
+ }
+
+ int xe_guc_reset(struct xe_guc *guc)
+@@ -1521,7 +1519,7 @@ void xe_guc_sanitize(struct xe_guc *guc)
+ {
+ xe_uc_fw_sanitize(&guc->fw);
+ xe_guc_ct_disable(&guc->ct);
+- guc->submission_state.enabled = false;
++ xe_guc_submit_disable(guc);
+ }
+
+ int xe_guc_reset_prepare(struct xe_guc *guc)
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
+index e670dcb0f0932..18ddbb7b98a15 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.c
++++ b/drivers/gpu/drm/xe/xe_guc_submit.c
+@@ -32,6 +32,7 @@
+ #include "xe_guc_ct.h"
+ #include "xe_guc_exec_queue_types.h"
+ #include "xe_guc_id_mgr.h"
++#include "xe_guc_klv_helpers.h"
+ #include "xe_guc_submit_types.h"
+ #include "xe_hw_engine.h"
+ #include "xe_hw_fence.h"
+@@ -316,6 +317,71 @@ int xe_guc_submit_init(struct xe_guc *guc, unsigned int num_ids)
+ return drmm_add_action_or_reset(&xe->drm, guc_submit_fini, guc);
+ }
+
++/*
++ * Given that we want to guarantee enough RCS throughput to avoid missing
++ * frames, we set the yield policy to 20% of each 80ms interval.
++ */
++#define RC_YIELD_DURATION 80 /* in ms */
++#define RC_YIELD_RATIO 20 /* in percent */
++static u32 *emit_render_compute_yield_klv(u32 *emit)
++{
++ *emit++ = PREP_GUC_KLV_TAG(SCHEDULING_POLICIES_RENDER_COMPUTE_YIELD);
++ *emit++ = RC_YIELD_DURATION;
++ *emit++ = RC_YIELD_RATIO;
++
++ return emit;
++}
++
++#define SCHEDULING_POLICY_MAX_DWORDS 16
++static int guc_init_global_schedule_policy(struct xe_guc *guc)
++{
++ u32 data[SCHEDULING_POLICY_MAX_DWORDS];
++ u32 *emit = data;
++ u32 count = 0;
++ int ret;
++
++ if (GUC_SUBMIT_VER(guc) < MAKE_GUC_VER(1, 1, 0))
++ return 0;
++
++ *emit++ = XE_GUC_ACTION_UPDATE_SCHEDULING_POLICIES_KLV;
++
++ if (CCS_MASK(guc_to_gt(guc)))
++ emit = emit_render_compute_yield_klv(emit);
++
++ count = emit - data;
++ if (count > 1) {
++ xe_assert(guc_to_xe(guc), count <= SCHEDULING_POLICY_MAX_DWORDS);
++
++ ret = xe_guc_ct_send_block(&guc->ct, data, count);
++ if (ret < 0) {
++ xe_gt_err(guc_to_gt(guc),
++ "failed to enable GuC sheduling policies: %pe\n",
++ ERR_PTR(ret));
++ return ret;
++ }
++ }
++
++ return 0;
++}
++
++int xe_guc_submit_enable(struct xe_guc *guc)
++{
++ int ret;
++
++ ret = guc_init_global_schedule_policy(guc);
++ if (ret)
++ return ret;
++
++ guc->submission_state.enabled = true;
++
++ return 0;
++}
++
++void xe_guc_submit_disable(struct xe_guc *guc)
++{
++ guc->submission_state.enabled = false;
++}
++
+ static void __release_guc_id(struct xe_guc *guc, struct xe_exec_queue *q, u32 xa_count)
+ {
+ int i;
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.h b/drivers/gpu/drm/xe/xe_guc_submit.h
+index 9b71a986c6ca6..0d126b807c104 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.h
++++ b/drivers/gpu/drm/xe/xe_guc_submit.h
+@@ -13,6 +13,8 @@ struct xe_exec_queue;
+ struct xe_guc;
+
+ int xe_guc_submit_init(struct xe_guc *guc, unsigned int num_ids);
++int xe_guc_submit_enable(struct xe_guc *guc);
++void xe_guc_submit_disable(struct xe_guc *guc);
+
+ int xe_guc_submit_reset_prepare(struct xe_guc *guc);
+ void xe_guc_submit_reset_wait(struct xe_guc *guc);
+--
+2.51.0
+
--- /dev/null
+From eb10855cd510017edf0b74aa552001478495df70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 00:24:39 +0200
+Subject: drm/xe/pf: Drop rounddown_pow_of_two fair LMEM limitation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Wajdeczko <michal.wajdeczko@intel.com>
+
+[ Upstream commit fef8b64e48e836344574b85132a1c317f4260022 ]
+
+This effectively reverts commit 4c3fe5eae46b ("drm/xe/pf: Limit
+fair VF LMEM provisioning") since we don't need it any more after
+non-contig VRAM allocations were fixed. This allows larger LMEM
+auto-provisioning for VFs, so instead:
+
+ [ ] GT0: PF: LMEM available(14096M) fair(1 x 8192M)
+ [ ] GT0: PF: VF1 provisioned with 8589934592 (8.00 GiB) LMEM
+or
+ [ ] GT0: PF: LMEM available(14096M) fair(2 x 4096M)
+ [ ] GT0: PF: VF1..VF2 provisioned with 4294967296 (4.00 GiB) LMEM
+
+we may get:
+
+ [ ] GT0: PF: LMEM available(14096M) fair(1 x 14096M)
+ [ ] GT0: PF: VF1 provisioned with 14780727296 (13.8 GiB) LMEM
+and
+ [ ] GT0: PF: LMEM available(14096M) fair(2 x 7048M)
+ [ ] GT0: PF: VF1..VF2 provisioned with 7390363648 (6.88 GiB) LMEM
+
+Fixes: 1e32ffbc9dc8 ("drm/xe/sriov: support non-contig VRAM provisioning")
+Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com>
+Link: https://lore.kernel.org/r/20250910222439.32869-1-michal.wajdeczko@intel.com
+(cherry picked from commit 95c1cfa306087142989bff34ea0e05dcd95ddc58)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c b/drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c
+index 53a44702c04af..c15dc600dcae7 100644
+--- a/drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c
++++ b/drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c
+@@ -1600,7 +1600,6 @@ static u64 pf_estimate_fair_lmem(struct xe_gt *gt, unsigned int num_vfs)
+ u64 fair;
+
+ fair = div_u64(available, num_vfs);
+- fair = rounddown_pow_of_two(fair); /* XXX: ttm_vram_mgr & drm_buddy limitation */
+ fair = ALIGN_DOWN(fair, alignment);
+ #ifdef MAX_FAIR_LMEM
+ fair = min_t(u64, MAX_FAIR_LMEM, fair);
+--
+2.51.0
+
--- /dev/null
+From c0e395158d9150e16770441f4ec31926892b93e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 15:39:51 +0000
+Subject: drm/xe/tile: Release kobject for the failure path
+
+From: Shuicheng Lin <shuicheng.lin@intel.com>
+
+[ Upstream commit 013e484dbd687a9174acf8f4450217bdb86ad788 ]
+
+Call kobject_put() for the failure path to release the kobject
+
+v2: remove extra newline. (Matt)
+
+Fixes: e3d0839aa501 ("drm/xe/tile: Abort driver load for sysfs creation failure")
+Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
+Link: https://lore.kernel.org/r/20250819153950.2973344-2-shuicheng.lin@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+(cherry picked from commit b98775bca99511cc22ab459a2de646cd2fa7241f)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_tile_sysfs.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_tile_sysfs.c b/drivers/gpu/drm/xe/xe_tile_sysfs.c
+index b804234a65516..9e1236a9ec673 100644
+--- a/drivers/gpu/drm/xe/xe_tile_sysfs.c
++++ b/drivers/gpu/drm/xe/xe_tile_sysfs.c
+@@ -44,16 +44,18 @@ int xe_tile_sysfs_init(struct xe_tile *tile)
+ kt->tile = tile;
+
+ err = kobject_add(&kt->base, &dev->kobj, "tile%d", tile->id);
+- if (err) {
+- kobject_put(&kt->base);
+- return err;
+- }
++ if (err)
++ goto err_object;
+
+ tile->sysfs = &kt->base;
+
+ err = xe_vram_freq_sysfs_init(tile);
+ if (err)
+- return err;
++ goto err_object;
+
+ return devm_add_action_or_reset(xe->drm.dev, tile_sysfs_fini, tile);
++
++err_object:
++ kobject_put(&kt->base);
++ return err;
+ }
+--
+2.51.0
+
--- /dev/null
+From ac18da7c0fea070d6416cd383d1d59034232dde2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 17:03:52 +0800
+Subject: io_uring: fix incorrect io_kiocb reference in io_link_skb
+
+From: Yang Xiuwei <yangxiuwei@kylinos.cn>
+
+[ Upstream commit 2c139a47eff8de24e3350dadb4c9d5e3426db826 ]
+
+In io_link_skb function, there is a bug where prev_notif is incorrectly
+assigned using 'nd' instead of 'prev_nd'. This causes the context
+validation check to compare the current notification with itself instead
+of comparing it with the previous notification.
+
+Fix by using the correct prev_nd parameter when obtaining prev_notif.
+
+Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
+Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
+Fixes: 6fe4220912d19 ("io_uring/notif: implement notification stacking")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/notif.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/io_uring/notif.c b/io_uring/notif.c
+index 9a6f6e92d7424..ea9c0116cec2d 100644
+--- a/io_uring/notif.c
++++ b/io_uring/notif.c
+@@ -85,7 +85,7 @@ static int io_link_skb(struct sk_buff *skb, struct ubuf_info *uarg)
+ return -EEXIST;
+
+ prev_nd = container_of(prev_uarg, struct io_notif_data, uarg);
+- prev_notif = cmd_to_io_kiocb(nd);
++ prev_notif = cmd_to_io_kiocb(prev_nd);
+
+ /* make sure all noifications can be finished in the same task_work */
+ if (unlikely(notif->ctx != prev_notif->ctx ||
+--
+2.51.0
+
--- /dev/null
+From f7a63be0a3dfac03f847cc0911a2f7dadd0d3940 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 13:59:15 -0600
+Subject: io_uring/msg_ring: kill alloc_cache for io_kiocb allocations
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit df8922afc37aa2111ca79a216653a629146763ad ]
+
+A recent commit:
+
+fc582cd26e88 ("io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU")
+
+fixed an issue with not deferring freeing of io_kiocb structs that
+msg_ring allocates to after the current RCU grace period. But this only
+covers requests that don't end up in the allocation cache. If a request
+goes into the alloc cache, it can get reused before it is sane to do so.
+A recent syzbot report would seem to indicate that there's something
+there, however it may very well just be because of the KASAN poisoning
+that the alloc_cache handles manually.
+
+Rather than attempt to make the alloc_cache sane for that use case, just
+drop the usage of the alloc_cache for msg_ring request payload data.
+
+Fixes: 50cf5f3842af ("io_uring/msg_ring: add an alloc cache for io_kiocb entries")
+Link: https://lore.kernel.org/io-uring/68cc2687.050a0220.139b6.0005.GAE@google.com/
+Reported-by: syzbot+baa2e0f4e02df602583e@syzkaller.appspotmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/io_uring_types.h | 3 ---
+ io_uring/io_uring.c | 4 ----
+ io_uring/msg_ring.c | 24 ++----------------------
+ 3 files changed, 2 insertions(+), 29 deletions(-)
+
+diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h
+index a7efcec2e3d08..215ff20affa33 100644
+--- a/include/linux/io_uring_types.h
++++ b/include/linux/io_uring_types.h
+@@ -418,9 +418,6 @@ struct io_ring_ctx {
+ struct list_head defer_list;
+ unsigned nr_drained;
+
+- struct io_alloc_cache msg_cache;
+- spinlock_t msg_lock;
+-
+ #ifdef CONFIG_NET_RX_BUSY_POLL
+ struct list_head napi_list; /* track busy poll napi_id */
+ spinlock_t napi_lock; /* napi_list lock */
+diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
+index aa8787777f29a..eaa5410e5a70a 100644
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -290,7 +290,6 @@ static void io_free_alloc_caches(struct io_ring_ctx *ctx)
+ io_alloc_cache_free(&ctx->netmsg_cache, io_netmsg_cache_free);
+ io_alloc_cache_free(&ctx->rw_cache, io_rw_cache_free);
+ io_alloc_cache_free(&ctx->cmd_cache, io_cmd_cache_free);
+- io_alloc_cache_free(&ctx->msg_cache, kfree);
+ io_futex_cache_free(ctx);
+ io_rsrc_cache_free(ctx);
+ }
+@@ -337,9 +336,6 @@ static __cold struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p)
+ ret |= io_alloc_cache_init(&ctx->cmd_cache, IO_ALLOC_CACHE_MAX,
+ sizeof(struct io_async_cmd),
+ sizeof(struct io_async_cmd));
+- spin_lock_init(&ctx->msg_lock);
+- ret |= io_alloc_cache_init(&ctx->msg_cache, IO_ALLOC_CACHE_MAX,
+- sizeof(struct io_kiocb), 0);
+ ret |= io_futex_cache_init(ctx);
+ ret |= io_rsrc_cache_init(ctx);
+ if (ret)
+diff --git a/io_uring/msg_ring.c b/io_uring/msg_ring.c
+index 4c2578f2efcb0..5e5b94236d720 100644
+--- a/io_uring/msg_ring.c
++++ b/io_uring/msg_ring.c
+@@ -11,7 +11,6 @@
+ #include "io_uring.h"
+ #include "rsrc.h"
+ #include "filetable.h"
+-#include "alloc_cache.h"
+ #include "msg_ring.h"
+
+ /* All valid masks for MSG_RING */
+@@ -76,13 +75,7 @@ static void io_msg_tw_complete(struct io_kiocb *req, io_tw_token_t tw)
+ struct io_ring_ctx *ctx = req->ctx;
+
+ io_add_aux_cqe(ctx, req->cqe.user_data, req->cqe.res, req->cqe.flags);
+- if (spin_trylock(&ctx->msg_lock)) {
+- if (io_alloc_cache_put(&ctx->msg_cache, req))
+- req = NULL;
+- spin_unlock(&ctx->msg_lock);
+- }
+- if (req)
+- kfree_rcu(req, rcu_head);
++ kfree_rcu(req, rcu_head);
+ percpu_ref_put(&ctx->refs);
+ }
+
+@@ -104,26 +97,13 @@ static int io_msg_remote_post(struct io_ring_ctx *ctx, struct io_kiocb *req,
+ return 0;
+ }
+
+-static struct io_kiocb *io_msg_get_kiocb(struct io_ring_ctx *ctx)
+-{
+- struct io_kiocb *req = NULL;
+-
+- if (spin_trylock(&ctx->msg_lock)) {
+- req = io_alloc_cache_get(&ctx->msg_cache);
+- spin_unlock(&ctx->msg_lock);
+- if (req)
+- return req;
+- }
+- return kmem_cache_alloc(req_cachep, GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO);
+-}
+-
+ static int io_msg_data_remote(struct io_ring_ctx *target_ctx,
+ struct io_msg *msg)
+ {
+ struct io_kiocb *target;
+ u32 flags = 0;
+
+- target = io_msg_get_kiocb(target_ctx);
++ target = kmem_cache_alloc(req_cachep, GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO) ;
+ if (unlikely(!target))
+ return -ENOMEM;
+
+--
+2.51.0
+
--- /dev/null
+From 781766b15707033b5f2ac055810de8c862d3dd34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 13:14:06 +0000
+Subject: iommu/amd: Fix alias device DTE setting
+
+From: Vasant Hegde <vasant.hegde@amd.com>
+
+[ Upstream commit a0c17ed907ac3326cf3c9d6007ea222a746f5cc2 ]
+
+Commit 7bea695ada0 restructured DTE flag handling but inadvertently changed
+the alias device configuration logic. This may cause incorrect DTE settings
+for certain devices.
+
+Add alias flag check before calling set_dev_entry_from_acpi(). Also move the
+device iteration loop inside the alias check to restrict execution to cases
+where alias devices are present.
+
+Fixes: 7bea695ada0 ("iommu/amd: Introduce struct ivhd_dte_flags to store persistent DTE flags")
+Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/init.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index 3a97cc667943f..eef55aa4143c1 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -1450,12 +1450,12 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu,
+ PCI_FUNC(e->devid));
+
+ devid = e->devid;
+- for (dev_i = devid_start; dev_i <= devid; ++dev_i) {
+- if (alias)
++ if (alias) {
++ for (dev_i = devid_start; dev_i <= devid; ++dev_i)
+ pci_seg->alias_table[dev_i] = devid_to;
++ set_dev_entry_from_acpi(iommu, devid_to, flags, ext_flags);
+ }
+ set_dev_entry_from_acpi_range(iommu, devid_start, devid, flags, ext_flags);
+- set_dev_entry_from_acpi(iommu, devid_to, flags, ext_flags);
+ break;
+ case IVHD_DEV_SPECIAL: {
+ u8 handle, type;
+--
+2.51.0
+
selftests-mptcp-connect-catch-io-errors-on-listen-side.patch
selftests-mptcp-avoid-spurious-errors-on-tcp-disconnect.patch
alsa-hda-realtek-fix-mute-led-for-hp-laptop-15-dw4xx.patch
+asoc-wm8940-correct-pll-rate-rounding.patch
+asoc-wm8940-correct-typo-in-control-name.patch
+asoc-wm8974-correct-pll-rate-rounding.patch
+asoc-codec-sma1307-fix-memory-corruption-in-sma1307_.patch
+asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch
+asoc-sdca-fix-return-value-in-sdca_regmap_mbq_size.patch
+asoc-intel-catpt-expose-correct-bit-depth-to-userspa.patch
+iommu-amd-fix-alias-device-dte-setting.patch
+asoc-amd-acp-fix-incorrect-retrival-of-acp_chip_info.patch
+drm-xe-tile-release-kobject-for-the-failure-path.patch
+drm-xe-pf-drop-rounddown_pow_of_two-fair-lmem-limita.patch
+drm-bridge-anx7625-fix-null-pointer-dereference-with.patch
+drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch
+drm-xe-fix-a-null-vs-is_err-in-xe_vm_add_compute_exe.patch
+alsa-usb-qcom-fix-false-positive-address-space-check.patch
+drm-xe-fix-error-handling-if-pxp-fails-to-start.patch
+drm-xe-guc-enable-extended-cat-error-reporting.patch
+drm-xe-guc-set-rcs-ccs-yield-policy.patch
+smb-smbdirect-introduce-smbdirect_socket.recv_io.exp.patch
+smb-client-make-use-of-smbdirect_socket-recv_io.expe.patch
+smb-smbdirect-introduce-struct-smbdirect_recv_io.patch
+smb-client-make-use-of-struct-smbdirect_recv_io.patch
+smb-client-let-recv_done-verify-data_offset-data_len.patch
+smb-client-fix-filename-matching-of-deferred-files.patch
+smb-client-use-disable-_delayed-_work_sync-in-smbdir.patch
+smb-client-let-smbd_destroy-call-disable_work_sync-i.patch
+crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch
+io_uring-msg_ring-kill-alloc_cache-for-io_kiocb-allo.patch
+smb-client-fix-file-open-check-in-__cifs_unlink.patch
+smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch
+io_uring-fix-incorrect-io_kiocb-reference-in-io_link.patch
--- /dev/null
+From 4eea563d962dbf31e423fa0edf25636ece174472 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 12:30:32 -0300
+Subject: smb: client: fix file open check in __cifs_unlink()
+
+From: Paulo Alcantara <pc@manguebit.org>
+
+[ Upstream commit 251090e2c2c1be60607d1c521af2c993f04d4f61 ]
+
+Fix the file open check to decide whether or not silly-rename the file
+in SMB2+.
+
+Fixes: c5ea3065586d ("smb: client: fix data loss due to broken rename(2)")
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Cc: Frank Sorenson <sorenson@redhat.com>
+Reviewed-by: David Howells <dhowells@redhat.com>
+Cc: linux-cifs@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/inode.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c
+index 1703f1285d36d..0f0d2dae6283a 100644
+--- a/fs/smb/client/inode.c
++++ b/fs/smb/client/inode.c
+@@ -2003,8 +2003,21 @@ static int __cifs_unlink(struct inode *dir, struct dentry *dentry, bool sillyren
+ goto psx_del_no_retry;
+ }
+
+- if (sillyrename || (server->vals->protocol_id > SMB10_PROT_ID &&
+- d_is_positive(dentry) && d_count(dentry) > 2))
++ /* For SMB2+, if the file is open, we always perform a silly rename.
++ *
++ * We check for d_count() right after calling
++ * cifs_close_deferred_file_under_dentry() to make sure that the
++ * dentry's refcount gets dropped in case the file had any deferred
++ * close.
++ */
++ if (!sillyrename && server->vals->protocol_id > SMB10_PROT_ID) {
++ spin_lock(&dentry->d_lock);
++ if (d_count(dentry) > 1)
++ sillyrename = true;
++ spin_unlock(&dentry->d_lock);
++ }
++
++ if (sillyrename)
+ rc = -EBUSY;
+ else
+ rc = server->ops->unlink(xid, tcon, full_path, cifs_sb, dentry);
+--
+2.51.0
+
--- /dev/null
+From 7f18145b22aff861112d024ed8805ccdb8d0772e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 16:03:22 -0300
+Subject: smb: client: fix filename matching of deferred files
+
+From: Paulo Alcantara <pc@manguebit.org>
+
+[ Upstream commit 93ed9a2951308db374cba4562533dde97bac70d3 ]
+
+Fix the following case where the client would end up closing both
+deferred files (foo.tmp & foo) after unlink(foo) due to strstr() call
+in cifs_close_deferred_file_under_dentry():
+
+ fd1 = openat(AT_FDCWD, "foo", O_WRONLY|O_CREAT|O_TRUNC, 0666);
+ fd2 = openat(AT_FDCWD, "foo.tmp", O_WRONLY|O_CREAT|O_TRUNC, 0666);
+ close(fd1);
+ close(fd2);
+ unlink("foo");
+
+Fixes: e3fc065682eb ("cifs: Deferred close performance improvements")
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Reviewed-by: Enzo Matsumiya <ematsumiya@suse.de>
+Cc: Frank Sorenson <sorenson@redhat.com>
+Cc: David Howells <dhowells@redhat.com>
+Cc: linux-cifs@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/cifsproto.h | 4 ++--
+ fs/smb/client/inode.c | 6 +++---
+ fs/smb/client/misc.c | 38 ++++++++++++++++----------------------
+ 3 files changed, 21 insertions(+), 27 deletions(-)
+
+diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h
+index 045227ed4efc9..0dcea9acca544 100644
+--- a/fs/smb/client/cifsproto.h
++++ b/fs/smb/client/cifsproto.h
+@@ -297,8 +297,8 @@ extern void cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode);
+
+ extern void cifs_close_all_deferred_files(struct cifs_tcon *cifs_tcon);
+
+-extern void cifs_close_deferred_file_under_dentry(struct cifs_tcon *cifs_tcon,
+- const char *path);
++void cifs_close_deferred_file_under_dentry(struct cifs_tcon *cifs_tcon,
++ struct dentry *dentry);
+
+ extern void cifs_mark_open_handles_for_deleted_file(struct inode *inode,
+ const char *path);
+diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c
+index 11d442e8b3d62..1703f1285d36d 100644
+--- a/fs/smb/client/inode.c
++++ b/fs/smb/client/inode.c
+@@ -1984,7 +1984,7 @@ static int __cifs_unlink(struct inode *dir, struct dentry *dentry, bool sillyren
+ }
+
+ netfs_wait_for_outstanding_io(inode);
+- cifs_close_deferred_file_under_dentry(tcon, full_path);
++ cifs_close_deferred_file_under_dentry(tcon, dentry);
+ #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
+ if (cap_unix(tcon->ses) && (CIFS_UNIX_POSIX_PATH_OPS_CAP &
+ le64_to_cpu(tcon->fsUnixInfo.Capability))) {
+@@ -2538,10 +2538,10 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir,
+ goto cifs_rename_exit;
+ }
+
+- cifs_close_deferred_file_under_dentry(tcon, from_name);
++ cifs_close_deferred_file_under_dentry(tcon, source_dentry);
+ if (d_inode(target_dentry) != NULL) {
+ netfs_wait_for_outstanding_io(d_inode(target_dentry));
+- cifs_close_deferred_file_under_dentry(tcon, to_name);
++ cifs_close_deferred_file_under_dentry(tcon, target_dentry);
+ }
+
+ rc = cifs_do_rename(xid, source_dentry, from_name, target_dentry,
+diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c
+index da23cc12a52ca..dda6dece802ad 100644
+--- a/fs/smb/client/misc.c
++++ b/fs/smb/client/misc.c
+@@ -832,33 +832,28 @@ cifs_close_all_deferred_files(struct cifs_tcon *tcon)
+ kfree(tmp_list);
+ }
+ }
+-void
+-cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, const char *path)
++
++void cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon,
++ struct dentry *dentry)
+ {
+- struct cifsFileInfo *cfile;
+ struct file_list *tmp_list, *tmp_next_list;
+- void *page;
+- const char *full_path;
++ struct cifsFileInfo *cfile;
+ LIST_HEAD(file_head);
+
+- page = alloc_dentry_path();
+ spin_lock(&tcon->open_file_lock);
+ list_for_each_entry(cfile, &tcon->openFileList, tlist) {
+- full_path = build_path_from_dentry(cfile->dentry, page);
+- if (strstr(full_path, path)) {
+- if (delayed_work_pending(&cfile->deferred)) {
+- if (cancel_delayed_work(&cfile->deferred)) {
+- spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock);
+- cifs_del_deferred_close(cfile);
+- spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock);
+-
+- tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC);
+- if (tmp_list == NULL)
+- break;
+- tmp_list->cfile = cfile;
+- list_add_tail(&tmp_list->list, &file_head);
+- }
+- }
++ if ((cfile->dentry == dentry) &&
++ delayed_work_pending(&cfile->deferred) &&
++ cancel_delayed_work(&cfile->deferred)) {
++ spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock);
++ cifs_del_deferred_close(cfile);
++ spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock);
++
++ tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC);
++ if (tmp_list == NULL)
++ break;
++ tmp_list->cfile = cfile;
++ list_add_tail(&tmp_list->list, &file_head);
+ }
+ }
+ spin_unlock(&tcon->open_file_lock);
+@@ -868,7 +863,6 @@ cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, const char *path)
+ list_del(&tmp_list->list);
+ kfree(tmp_list);
+ }
+- free_dentry_path(page);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From d172afc896e8b3707a55b520c4f23dae608b22d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 03:06:46 +0200
+Subject: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error
+ path
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit daac51c7032036a0ca5f1aa419ad1b0471d1c6e0 ]
+
+During tests of another unrelated patch I was able to trigger this
+error: Objects remaining on __kmem_cache_shutdown()
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: Namjae Jeon <linkinjeon@kernel.org>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smbdirect.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
+index 8b920410cd2fe..6dd2a1c66df3d 100644
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -1101,8 +1101,10 @@ static int smbd_negotiate(struct smbd_connection *info)
+ log_rdma_event(INFO, "smbd_post_recv rc=%d iov.addr=0x%llx iov.length=%u iov.lkey=0x%x\n",
+ rc, response->sge.addr,
+ response->sge.length, response->sge.lkey);
+- if (rc)
++ if (rc) {
++ put_receive_buffer(info, response);
+ return rc;
++ }
+
+ init_completion(&info->negotiate_completion);
+ info->negotiate_done = false;
+--
+2.51.0
+
--- /dev/null
+From 2c3f3d2caa6324d781d9e4ce2f2cf5c72a478094 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 11:49:05 +0200
+Subject: smb: client: let recv_done verify data_offset, data_length and
+ remaining_data_length
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit f57e53ea252363234f86674db475839e5b87102e ]
+
+This is inspired by the related server fixes.
+
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
+Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smbdirect.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
+index 18702c67c8484..65175ac3d8418 100644
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -446,9 +446,12 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ struct smbdirect_recv_io *response =
+ container_of(wc->wr_cqe, struct smbdirect_recv_io, cqe);
+ struct smbdirect_socket *sc = response->socket;
++ struct smbdirect_socket_parameters *sp = &sc->parameters;
+ struct smbd_connection *info =
+ container_of(sc, struct smbd_connection, socket);
+- int data_length = 0;
++ u32 data_offset = 0;
++ u32 data_length = 0;
++ u32 remaining_data_length = 0;
+
+ log_rdma_recv(INFO, "response=0x%p type=%d wc status=%d wc opcode %d byte_len=%d pkey_index=%u\n",
+ response, sc->recv_io.expected, wc->status, wc->opcode,
+@@ -480,7 +483,22 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ /* SMBD data transfer packet */
+ case SMBDIRECT_EXPECT_DATA_TRANSFER:
+ data_transfer = smbdirect_recv_io_payload(response);
++
++ if (wc->byte_len <
++ offsetof(struct smbdirect_data_transfer, padding))
++ goto error;
++
++ remaining_data_length = le32_to_cpu(data_transfer->remaining_data_length);
++ data_offset = le32_to_cpu(data_transfer->data_offset);
+ data_length = le32_to_cpu(data_transfer->data_length);
++ if (wc->byte_len < data_offset ||
++ (u64)wc->byte_len < (u64)data_offset + data_length)
++ goto error;
++
++ if (remaining_data_length > sp->max_fragmented_recv_size ||
++ data_length > sp->max_fragmented_recv_size ||
++ (u64)remaining_data_length + (u64)data_length > (u64)sp->max_fragmented_recv_size)
++ goto error;
+
+ if (data_length) {
+ if (info->full_packet_received)
+--
+2.51.0
+
--- /dev/null
+From 7705468b9b2dc2323c6a7cbbbfeba7312013f6b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 13:03:19 +0200
+Subject: smb: client: let smbd_destroy() call
+ disable_work_sync(&info->post_send_credits_work)
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit d9dcbbcf9145b68aa85c40947311a6907277e097 ]
+
+In smbd_destroy() we may destroy the memory so we better
+wait until post_send_credits_work is no longer pending
+and will never be started again.
+
+I actually just hit the case using rxe:
+
+WARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe]
+...
+[ 5305.686979] [ T138] smbd_post_recv+0x445/0xc10 [cifs]
+[ 5305.687135] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5305.687149] [ T138] ? __kasan_check_write+0x14/0x30
+[ 5305.687185] [ T138] ? __pfx_smbd_post_recv+0x10/0x10 [cifs]
+[ 5305.687329] [ T138] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
+[ 5305.687356] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5305.687368] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5305.687378] [ T138] ? _raw_spin_unlock_irqrestore+0x11/0x60
+[ 5305.687389] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5305.687399] [ T138] ? get_receive_buffer+0x168/0x210 [cifs]
+[ 5305.687555] [ T138] smbd_post_send_credits+0x382/0x4b0 [cifs]
+[ 5305.687701] [ T138] ? __pfx_smbd_post_send_credits+0x10/0x10 [cifs]
+[ 5305.687855] [ T138] ? __pfx___schedule+0x10/0x10
+[ 5305.687865] [ T138] ? __pfx__raw_spin_lock_irq+0x10/0x10
+[ 5305.687875] [ T138] ? queue_delayed_work_on+0x8e/0xa0
+[ 5305.687889] [ T138] process_one_work+0x629/0xf80
+[ 5305.687908] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5305.687917] [ T138] ? __kasan_check_write+0x14/0x30
+[ 5305.687933] [ T138] worker_thread+0x87f/0x1570
+...
+
+It means rxe_post_recv was called after rdma_destroy_qp().
+This happened because put_receive_buffer() was triggered
+by ib_drain_qp() and called:
+queue_work(info->workqueue, &info->post_send_credits_work);
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: Namjae Jeon <linkinjeon@kernel.org>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smbdirect.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
+index 8c6e766078e14..8b920410cd2fe 100644
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -1335,6 +1335,9 @@ void smbd_destroy(struct TCP_Server_Info *server)
+ sc->status == SMBDIRECT_SOCKET_DISCONNECTED);
+ }
+
++ log_rdma_event(INFO, "cancelling post_send_credits_work\n");
++ disable_work_sync(&info->post_send_credits_work);
++
+ log_rdma_event(INFO, "destroying qp\n");
+ ib_drain_qp(sc->ib.qp);
+ rdma_destroy_qp(sc->rdma.cm_id);
+--
+2.51.0
+
--- /dev/null
+From 793bcf95683f1c4bef17adc4d8df87a65db09fb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 18:11:31 +0200
+Subject: smb: client: make use of smbdirect_socket->recv_io.expected
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit bbdbd9ae47155da65aa0c1641698a44d85c2faa2 ]
+
+The expected incoming message type can be per connection.
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Stable-dep-of: f57e53ea2523 ("smb: client: let recv_done verify data_offset, data_length and remaining_data_length")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smbdirect.c | 22 ++++++++++++++--------
+ fs/smb/client/smbdirect.h | 7 -------
+ 2 files changed, 14 insertions(+), 15 deletions(-)
+
+diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
+index b9bb531717a65..a6aa2c609dc3b 100644
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -383,6 +383,7 @@ static bool process_negotiation_response(
+ info->max_frmr_depth * PAGE_SIZE);
+ info->max_frmr_depth = sp->max_read_write_size / PAGE_SIZE;
+
++ sc->recv_io.expected = SMBDIRECT_EXPECT_DATA_TRANSFER;
+ return true;
+ }
+
+@@ -408,7 +409,6 @@ static void smbd_post_send_credits(struct work_struct *work)
+ if (!response)
+ break;
+
+- response->type = SMBD_TRANSFER_DATA;
+ response->first_segment = false;
+ rc = smbd_post_recv(info, response);
+ if (rc) {
+@@ -445,10 +445,11 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ struct smbd_response *response =
+ container_of(wc->wr_cqe, struct smbd_response, cqe);
+ struct smbd_connection *info = response->info;
++ struct smbdirect_socket *sc = &info->socket;
+ int data_length = 0;
+
+ log_rdma_recv(INFO, "response=0x%p type=%d wc status=%d wc opcode %d byte_len=%d pkey_index=%u\n",
+- response, response->type, wc->status, wc->opcode,
++ response, sc->recv_io.expected, wc->status, wc->opcode,
+ wc->byte_len, wc->pkey_index);
+
+ if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_RECV) {
+@@ -463,9 +464,9 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ response->sge.length,
+ DMA_FROM_DEVICE);
+
+- switch (response->type) {
++ switch (sc->recv_io.expected) {
+ /* SMBD negotiation response */
+- case SMBD_NEGOTIATE_RESP:
++ case SMBDIRECT_EXPECT_NEGOTIATE_REP:
+ dump_smbdirect_negotiate_resp(smbd_response_payload(response));
+ info->full_packet_received = true;
+ info->negotiate_done =
+@@ -475,7 +476,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ return;
+
+ /* SMBD data transfer packet */
+- case SMBD_TRANSFER_DATA:
++ case SMBDIRECT_EXPECT_DATA_TRANSFER:
+ data_transfer = smbd_response_payload(response);
+ data_length = le32_to_cpu(data_transfer->data_length);
+
+@@ -526,13 +527,17 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ put_receive_buffer(info, response);
+
+ return;
++
++ case SMBDIRECT_EXPECT_NEGOTIATE_REQ:
++ /* Only server... */
++ break;
+ }
+
+ /*
+ * This is an internal error!
+ */
+- log_rdma_recv(ERR, "unexpected response type=%d\n", response->type);
+- WARN_ON_ONCE(response->type != SMBD_TRANSFER_DATA);
++ log_rdma_recv(ERR, "unexpected response type=%d\n", sc->recv_io.expected);
++ WARN_ON_ONCE(sc->recv_io.expected != SMBDIRECT_EXPECT_DATA_TRANSFER);
+ error:
+ put_receive_buffer(info, response);
+ smbd_disconnect_rdma_connection(info);
+@@ -1067,10 +1072,11 @@ static int smbd_post_recv(
+ /* Perform SMBD negotiate according to [MS-SMBD] 3.1.5.2 */
+ static int smbd_negotiate(struct smbd_connection *info)
+ {
++ struct smbdirect_socket *sc = &info->socket;
+ int rc;
+ struct smbd_response *response = get_receive_buffer(info);
+
+- response->type = SMBD_NEGOTIATE_RESP;
++ sc->recv_io.expected = SMBDIRECT_EXPECT_NEGOTIATE_REP;
+ rc = smbd_post_recv(info, response);
+ log_rdma_event(INFO, "smbd_post_recv rc=%d iov.addr=0x%llx iov.length=%u iov.lkey=0x%x\n",
+ rc, response->sge.addr,
+diff --git a/fs/smb/client/smbdirect.h b/fs/smb/client/smbdirect.h
+index ea04ce8a9763a..bf50544eaf02d 100644
+--- a/fs/smb/client/smbdirect.h
++++ b/fs/smb/client/smbdirect.h
+@@ -157,11 +157,6 @@ struct smbd_connection {
+ unsigned int count_send_empty;
+ };
+
+-enum smbd_message_type {
+- SMBD_NEGOTIATE_RESP,
+- SMBD_TRANSFER_DATA,
+-};
+-
+ /* Maximum number of SGEs used by smbdirect.c in any send work request */
+ #define SMBDIRECT_MAX_SEND_SGE 6
+
+@@ -187,8 +182,6 @@ struct smbd_response {
+ struct ib_cqe cqe;
+ struct ib_sge sge;
+
+- enum smbd_message_type type;
+-
+ /* Link to receive queue or reassembly queue */
+ struct list_head list;
+
+--
+2.51.0
+
--- /dev/null
+From 1232a1f85dd88d3a1f1bbc52827d27b0f27f6549 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 18:11:33 +0200
+Subject: smb: client: make use of struct smbdirect_recv_io
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit 5dddf0497445d247e995306daf3b76dd0633831c ]
+
+This is the shared structure that will be used in
+the server too and will allow us to move helper functions
+into common code soon.
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Stable-dep-of: f57e53ea2523 ("smb: client: let recv_done verify data_offset, data_length and remaining_data_length")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smbdirect.c | 79 ++++++++++++++++++++-------------------
+ fs/smb/client/smbdirect.h | 16 --------
+ 2 files changed, 41 insertions(+), 54 deletions(-)
+
+diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
+index a6aa2c609dc3b..18702c67c8484 100644
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -13,23 +13,23 @@
+ #include "cifsproto.h"
+ #include "smb2proto.h"
+
+-static struct smbd_response *get_receive_buffer(
++static struct smbdirect_recv_io *get_receive_buffer(
+ struct smbd_connection *info);
+ static void put_receive_buffer(
+ struct smbd_connection *info,
+- struct smbd_response *response);
++ struct smbdirect_recv_io *response);
+ static int allocate_receive_buffers(struct smbd_connection *info, int num_buf);
+ static void destroy_receive_buffers(struct smbd_connection *info);
+
+ static void enqueue_reassembly(
+ struct smbd_connection *info,
+- struct smbd_response *response, int data_length);
+-static struct smbd_response *_get_first_reassembly(
++ struct smbdirect_recv_io *response, int data_length);
++static struct smbdirect_recv_io *_get_first_reassembly(
+ struct smbd_connection *info);
+
+ static int smbd_post_recv(
+ struct smbd_connection *info,
+- struct smbd_response *response);
++ struct smbdirect_recv_io *response);
+
+ static int smbd_post_send_empty(struct smbd_connection *info);
+
+@@ -260,7 +260,7 @@ static inline void *smbd_request_payload(struct smbd_request *request)
+ return (void *)request->packet;
+ }
+
+-static inline void *smbd_response_payload(struct smbd_response *response)
++static inline void *smbdirect_recv_io_payload(struct smbdirect_recv_io *response)
+ {
+ return (void *)response->packet;
+ }
+@@ -315,12 +315,13 @@ static void dump_smbdirect_negotiate_resp(struct smbdirect_negotiate_resp *resp)
+ * return value: true if negotiation is a success, false if failed
+ */
+ static bool process_negotiation_response(
+- struct smbd_response *response, int packet_length)
++ struct smbdirect_recv_io *response, int packet_length)
+ {
+- struct smbd_connection *info = response->info;
+- struct smbdirect_socket *sc = &info->socket;
++ struct smbdirect_socket *sc = response->socket;
++ struct smbd_connection *info =
++ container_of(sc, struct smbd_connection, socket);
+ struct smbdirect_socket_parameters *sp = &sc->parameters;
+- struct smbdirect_negotiate_resp *packet = smbd_response_payload(response);
++ struct smbdirect_negotiate_resp *packet = smbdirect_recv_io_payload(response);
+
+ if (packet_length < sizeof(struct smbdirect_negotiate_resp)) {
+ log_rdma_event(ERR,
+@@ -391,7 +392,7 @@ static void smbd_post_send_credits(struct work_struct *work)
+ {
+ int ret = 0;
+ int rc;
+- struct smbd_response *response;
++ struct smbdirect_recv_io *response;
+ struct smbd_connection *info =
+ container_of(work, struct smbd_connection,
+ post_send_credits_work);
+@@ -442,10 +443,11 @@ static void smbd_post_send_credits(struct work_struct *work)
+ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ {
+ struct smbdirect_data_transfer *data_transfer;
+- struct smbd_response *response =
+- container_of(wc->wr_cqe, struct smbd_response, cqe);
+- struct smbd_connection *info = response->info;
+- struct smbdirect_socket *sc = &info->socket;
++ struct smbdirect_recv_io *response =
++ container_of(wc->wr_cqe, struct smbdirect_recv_io, cqe);
++ struct smbdirect_socket *sc = response->socket;
++ struct smbd_connection *info =
++ container_of(sc, struct smbd_connection, socket);
+ int data_length = 0;
+
+ log_rdma_recv(INFO, "response=0x%p type=%d wc status=%d wc opcode %d byte_len=%d pkey_index=%u\n",
+@@ -467,7 +469,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ switch (sc->recv_io.expected) {
+ /* SMBD negotiation response */
+ case SMBDIRECT_EXPECT_NEGOTIATE_REP:
+- dump_smbdirect_negotiate_resp(smbd_response_payload(response));
++ dump_smbdirect_negotiate_resp(smbdirect_recv_io_payload(response));
+ info->full_packet_received = true;
+ info->negotiate_done =
+ process_negotiation_response(response, wc->byte_len);
+@@ -477,7 +479,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
+
+ /* SMBD data transfer packet */
+ case SMBDIRECT_EXPECT_DATA_TRANSFER:
+- data_transfer = smbd_response_payload(response);
++ data_transfer = smbdirect_recv_io_payload(response);
+ data_length = le32_to_cpu(data_transfer->data_length);
+
+ if (data_length) {
+@@ -1034,7 +1036,7 @@ static int smbd_post_send_full_iter(struct smbd_connection *info,
+ * The interaction is controlled by send/receive credit system
+ */
+ static int smbd_post_recv(
+- struct smbd_connection *info, struct smbd_response *response)
++ struct smbd_connection *info, struct smbdirect_recv_io *response)
+ {
+ struct smbdirect_socket *sc = &info->socket;
+ struct smbdirect_socket_parameters *sp = &sc->parameters;
+@@ -1074,7 +1076,7 @@ static int smbd_negotiate(struct smbd_connection *info)
+ {
+ struct smbdirect_socket *sc = &info->socket;
+ int rc;
+- struct smbd_response *response = get_receive_buffer(info);
++ struct smbdirect_recv_io *response = get_receive_buffer(info);
+
+ sc->recv_io.expected = SMBDIRECT_EXPECT_NEGOTIATE_REP;
+ rc = smbd_post_recv(info, response);
+@@ -1119,7 +1121,7 @@ static int smbd_negotiate(struct smbd_connection *info)
+ */
+ static void enqueue_reassembly(
+ struct smbd_connection *info,
+- struct smbd_response *response,
++ struct smbdirect_recv_io *response,
+ int data_length)
+ {
+ spin_lock(&info->reassembly_queue_lock);
+@@ -1143,14 +1145,14 @@ static void enqueue_reassembly(
+ * Caller is responsible for locking
+ * return value: the first entry if any, NULL if queue is empty
+ */
+-static struct smbd_response *_get_first_reassembly(struct smbd_connection *info)
++static struct smbdirect_recv_io *_get_first_reassembly(struct smbd_connection *info)
+ {
+- struct smbd_response *ret = NULL;
++ struct smbdirect_recv_io *ret = NULL;
+
+ if (!list_empty(&info->reassembly_queue)) {
+ ret = list_first_entry(
+ &info->reassembly_queue,
+- struct smbd_response, list);
++ struct smbdirect_recv_io, list);
+ }
+ return ret;
+ }
+@@ -1161,16 +1163,16 @@ static struct smbd_response *_get_first_reassembly(struct smbd_connection *info)
+ * pre-allocated in advance.
+ * return value: the receive buffer, NULL if none is available
+ */
+-static struct smbd_response *get_receive_buffer(struct smbd_connection *info)
++static struct smbdirect_recv_io *get_receive_buffer(struct smbd_connection *info)
+ {
+- struct smbd_response *ret = NULL;
++ struct smbdirect_recv_io *ret = NULL;
+ unsigned long flags;
+
+ spin_lock_irqsave(&info->receive_queue_lock, flags);
+ if (!list_empty(&info->receive_queue)) {
+ ret = list_first_entry(
+ &info->receive_queue,
+- struct smbd_response, list);
++ struct smbdirect_recv_io, list);
+ list_del(&ret->list);
+ info->count_receive_queue--;
+ info->count_get_receive_buffer++;
+@@ -1187,7 +1189,7 @@ static struct smbd_response *get_receive_buffer(struct smbd_connection *info)
+ * receive buffer is returned.
+ */
+ static void put_receive_buffer(
+- struct smbd_connection *info, struct smbd_response *response)
++ struct smbd_connection *info, struct smbdirect_recv_io *response)
+ {
+ struct smbdirect_socket *sc = &info->socket;
+ unsigned long flags;
+@@ -1212,8 +1214,9 @@ static void put_receive_buffer(
+ /* Preallocate all receive buffer on transport establishment */
+ static int allocate_receive_buffers(struct smbd_connection *info, int num_buf)
+ {
++ struct smbdirect_socket *sc = &info->socket;
++ struct smbdirect_recv_io *response;
+ int i;
+- struct smbd_response *response;
+
+ INIT_LIST_HEAD(&info->reassembly_queue);
+ spin_lock_init(&info->reassembly_queue_lock);
+@@ -1231,7 +1234,7 @@ static int allocate_receive_buffers(struct smbd_connection *info, int num_buf)
+ if (!response)
+ goto allocate_failed;
+
+- response->info = info;
++ response->socket = sc;
+ response->sge.length = 0;
+ list_add_tail(&response->list, &info->receive_queue);
+ info->count_receive_queue++;
+@@ -1243,7 +1246,7 @@ static int allocate_receive_buffers(struct smbd_connection *info, int num_buf)
+ while (!list_empty(&info->receive_queue)) {
+ response = list_first_entry(
+ &info->receive_queue,
+- struct smbd_response, list);
++ struct smbdirect_recv_io, list);
+ list_del(&response->list);
+ info->count_receive_queue--;
+
+@@ -1254,7 +1257,7 @@ static int allocate_receive_buffers(struct smbd_connection *info, int num_buf)
+
+ static void destroy_receive_buffers(struct smbd_connection *info)
+ {
+- struct smbd_response *response;
++ struct smbdirect_recv_io *response;
+
+ while ((response = get_receive_buffer(info)))
+ mempool_free(response, info->response_mempool);
+@@ -1295,7 +1298,7 @@ void smbd_destroy(struct TCP_Server_Info *server)
+ struct smbd_connection *info = server->smbd_conn;
+ struct smbdirect_socket *sc;
+ struct smbdirect_socket_parameters *sp;
+- struct smbd_response *response;
++ struct smbdirect_recv_io *response;
+ unsigned long flags;
+
+ if (!info) {
+@@ -1452,17 +1455,17 @@ static int allocate_caches_and_workqueue(struct smbd_connection *info)
+ if (!info->request_mempool)
+ goto out1;
+
+- scnprintf(name, MAX_NAME_LEN, "smbd_response_%p", info);
++ scnprintf(name, MAX_NAME_LEN, "smbdirect_recv_io_%p", info);
+
+ struct kmem_cache_args response_args = {
+- .align = __alignof__(struct smbd_response),
+- .useroffset = (offsetof(struct smbd_response, packet) +
++ .align = __alignof__(struct smbdirect_recv_io),
++ .useroffset = (offsetof(struct smbdirect_recv_io, packet) +
+ sizeof(struct smbdirect_data_transfer)),
+ .usersize = sp->max_recv_size - sizeof(struct smbdirect_data_transfer),
+ };
+ info->response_cache =
+ kmem_cache_create(name,
+- sizeof(struct smbd_response) + sp->max_recv_size,
++ sizeof(struct smbdirect_recv_io) + sp->max_recv_size,
+ &response_args, SLAB_HWCACHE_ALIGN);
+ if (!info->response_cache)
+ goto out2;
+@@ -1753,7 +1756,7 @@ struct smbd_connection *smbd_get_connection(
+ int smbd_recv(struct smbd_connection *info, struct msghdr *msg)
+ {
+ struct smbdirect_socket *sc = &info->socket;
+- struct smbd_response *response;
++ struct smbdirect_recv_io *response;
+ struct smbdirect_data_transfer *data_transfer;
+ size_t size = iov_iter_count(&msg->msg_iter);
+ int to_copy, to_read, data_read, offset;
+@@ -1789,7 +1792,7 @@ int smbd_recv(struct smbd_connection *info, struct msghdr *msg)
+ offset = info->first_entry_offset;
+ while (data_read < size) {
+ response = _get_first_reassembly(info);
+- data_transfer = smbd_response_payload(response);
++ data_transfer = smbdirect_recv_io_payload(response);
+ data_length = le32_to_cpu(data_transfer->data_length);
+ remaining_data_length =
+ le32_to_cpu(
+diff --git a/fs/smb/client/smbdirect.h b/fs/smb/client/smbdirect.h
+index bf50544eaf02d..d60e445da2256 100644
+--- a/fs/smb/client/smbdirect.h
++++ b/fs/smb/client/smbdirect.h
+@@ -176,22 +176,6 @@ struct smbd_request {
+ /* Maximum number of SGEs used by smbdirect.c in any receive work request */
+ #define SMBDIRECT_MAX_RECV_SGE 1
+
+-/* The context for a SMBD response */
+-struct smbd_response {
+- struct smbd_connection *info;
+- struct ib_cqe cqe;
+- struct ib_sge sge;
+-
+- /* Link to receive queue or reassembly queue */
+- struct list_head list;
+-
+- /* Indicate if this is the 1st packet of a payload */
+- bool first_segment;
+-
+- /* SMBD packet header and payload follows this structure */
+- u8 packet[];
+-};
+-
+ /* Create a SMBDirect session */
+ struct smbd_connection *smbd_get_connection(
+ struct TCP_Server_Info *server, struct sockaddr *dstaddr);
+--
+2.51.0
+
--- /dev/null
+From fa51146113a8cf5d599716959423afa87a7dafd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 12:58:21 +0200
+Subject: smb: client: use disable[_delayed]_work_sync in smbdirect.c
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit bac28f604c7699727b2fecf14c3a54668bbe458e ]
+
+This makes it safer during the disconnect and avoids
+requeueing.
+
+It's ok to call disable[delayed_]work[_sync]() more than once.
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: Namjae Jeon <linkinjeon@kernel.org>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Fixes: 050b8c374019 ("smbd: Make upper layer decide when to destroy the transport")
+Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection")
+Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smbdirect.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
+index 65175ac3d8418..8c6e766078e14 100644
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -1341,7 +1341,7 @@ void smbd_destroy(struct TCP_Server_Info *server)
+ sc->ib.qp = NULL;
+
+ log_rdma_event(INFO, "cancelling idle timer\n");
+- cancel_delayed_work_sync(&info->idle_timer_work);
++ disable_delayed_work_sync(&info->idle_timer_work);
+
+ /* It's not possible for upper layer to get to reassembly */
+ log_rdma_event(INFO, "drain the reassembly queue\n");
+@@ -1713,7 +1713,7 @@ static struct smbd_connection *_smbd_get_connection(
+ return NULL;
+
+ negotiation_failed:
+- cancel_delayed_work_sync(&info->idle_timer_work);
++ disable_delayed_work_sync(&info->idle_timer_work);
+ destroy_caches_and_workqueue(info);
+ sc->status = SMBDIRECT_SOCKET_NEGOTIATE_FAILED;
+ rdma_disconnect(sc->rdma.cm_id);
+@@ -2072,7 +2072,7 @@ static void destroy_mr_list(struct smbd_connection *info)
+ struct smbdirect_socket *sc = &info->socket;
+ struct smbd_mr *mr, *tmp;
+
+- cancel_work_sync(&info->mr_recovery_work);
++ disable_work_sync(&info->mr_recovery_work);
+ list_for_each_entry_safe(mr, tmp, &info->mr_list, list) {
+ if (mr->state == MR_INVALIDATED)
+ ib_dma_unmap_sg(sc->ib.dev, mr->sgt.sgl,
+--
+2.51.0
+
--- /dev/null
+From 8d1290adc3051be1a50aeba98780205c23f627ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 18:11:30 +0200
+Subject: smb: smbdirect: introduce smbdirect_socket.recv_io.expected
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit 33dd53a90e3419ea260e9ff2b4aa107385cdf7fa ]
+
+The expected message type can be global as they never change
+during the after negotiation process.
+
+This will replace smbd_response->type and smb_direct_recvmsg->type
+in future.
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: Namjae Jeon <linkinjeon@kernel.org>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Stable-dep-of: f57e53ea2523 ("smb: client: let recv_done verify data_offset, data_length and remaining_data_length")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/common/smbdirect/smbdirect_socket.h | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/fs/smb/common/smbdirect/smbdirect_socket.h b/fs/smb/common/smbdirect/smbdirect_socket.h
+index e5b15cc44a7ba..5db7815b614f8 100644
+--- a/fs/smb/common/smbdirect/smbdirect_socket.h
++++ b/fs/smb/common/smbdirect/smbdirect_socket.h
+@@ -38,6 +38,20 @@ struct smbdirect_socket {
+ } ib;
+
+ struct smbdirect_socket_parameters parameters;
++
++ /*
++ * The state for posted receive buffers
++ */
++ struct {
++ /*
++ * The type of PDU we are expecting
++ */
++ enum {
++ SMBDIRECT_EXPECT_NEGOTIATE_REQ = 1,
++ SMBDIRECT_EXPECT_NEGOTIATE_REP = 2,
++ SMBDIRECT_EXPECT_DATA_TRANSFER = 3,
++ } expected;
++ } recv_io;
+ };
+
+ #endif /* __FS_SMB_COMMON_SMBDIRECT_SMBDIRECT_SOCKET_H__ */
+--
+2.51.0
+
--- /dev/null
+From 63ea292785da87bbcf4b76331f68fc4ba8201614 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 18:11:32 +0200
+Subject: smb: smbdirect: introduce struct smbdirect_recv_io
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit 60812d20da82606f0620904c281579a9af0ab452 ]
+
+This will be used in client and server soon
+in order to replace smbd_response/smb_direct_recvmsg.
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: Namjae Jeon <linkinjeon@kernel.org>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Stable-dep-of: f57e53ea2523 ("smb: client: let recv_done verify data_offset, data_length and remaining_data_length")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/common/smbdirect/smbdirect_socket.h | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/fs/smb/common/smbdirect/smbdirect_socket.h b/fs/smb/common/smbdirect/smbdirect_socket.h
+index 5db7815b614f8..a7ad31c471a7b 100644
+--- a/fs/smb/common/smbdirect/smbdirect_socket.h
++++ b/fs/smb/common/smbdirect/smbdirect_socket.h
+@@ -54,4 +54,19 @@ struct smbdirect_socket {
+ } recv_io;
+ };
+
++struct smbdirect_recv_io {
++ struct smbdirect_socket *socket;
++ struct ib_cqe cqe;
++ struct ib_sge sge;
++
++ /* Link to free or reassembly list */
++ struct list_head list;
++
++ /* Indicate if this is the 1st packet of a payload */
++ bool first_segment;
++
++ /* SMBD packet header and payload follows this structure */
++ u8 packet[];
++};
++
+ #endif /* __FS_SMB_COMMON_SMBDIRECT_SMBDIRECT_SOCKET_H__ */
+--
+2.51.0
+
--- /dev/null
+From 2308d770e5d4bdcaaf69ac6aff82810a51c7262e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:06:39 +0100
+Subject: ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error
+ message
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 35fc531a59694f24a2456569cf7d1a9c6436841c ]
+
+The dev_err message is reporting an error about capture streams however
+it is using the incorrect variable num_playback instead of num_capture.
+Fix this by using the correct variable num_capture.
+
+Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-stream.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c
+index 0b0087abcc50e..3bb743cb167a5 100644
+--- a/sound/soc/sof/intel/hda-stream.c
++++ b/sound/soc/sof/intel/hda-stream.c
+@@ -842,7 +842,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev)
+
+ if (num_capture >= SOF_HDA_CAPTURE_STREAMS) {
+ dev_err(sdev->dev, "error: too many capture streams %d\n",
+- num_playback);
++ num_capture);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a32a8da31e013fb03bd9267ca12d40cd30ff225f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:37 +0100
+Subject: ASoC: wm8940: Correct PLL rate rounding
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit d05afb53c683ef7ed1228b593c3360f4d3126c58 ]
+
+Using a single value of 22500000 for both 48000Hz and 44100Hz audio
+will sometimes result in returning wrong dividers due to rounding.
+Update the code to use the actual value for both.
+
+Fixes: 294833fc9eb4 ("ASoC: wm8940: Rewrite code to set proper clocks")
+Reported-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Tested-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Link: https://patch.msgid.link/20250821082639.1301453-2-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8940.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c
+index b9432f8b64e5b..eff7d1369d01a 100644
+--- a/sound/soc/codecs/wm8940.c
++++ b/sound/soc/codecs/wm8940.c
+@@ -693,7 +693,12 @@ static int wm8940_update_clocks(struct snd_soc_dai *dai)
+ f = wm8940_get_mclkdiv(priv->mclk, fs256, &mclkdiv);
+ if (f != priv->mclk) {
+ /* The PLL performs best around 90MHz */
+- fpll = wm8940_get_mclkdiv(22500000, fs256, &mclkdiv);
++ if (fs256 % 8000)
++ f = 22579200;
++ else
++ f = 24576000;
++
++ fpll = wm8940_get_mclkdiv(f, fs256, &mclkdiv);
+ }
+
+ wm8940_set_dai_pll(dai, 0, 0, priv->mclk, fpll);
+--
+2.51.0
+
--- /dev/null
+From cf0f8da50adbf1c047ee969c1bd15aaa8be34c04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:38 +0100
+Subject: ASoC: wm8940: Correct typo in control name
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit b4799520dcd6fe1e14495cecbbe9975d847cd482 ]
+
+Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver")
+Reported-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Tested-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8940.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c
+index eff7d1369d01a..39d2c8e85d9db 100644
+--- a/sound/soc/codecs/wm8940.c
++++ b/sound/soc/codecs/wm8940.c
+@@ -220,7 +220,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = {
+ SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL,
+ 0, 255, 0, wm8940_adc_tlv),
+ SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum),
+- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST,
++ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST,
+ 8, 1, 0, wm8940_capture_boost_vol_tlv),
+ SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL,
+ 0, 63, 0, wm8940_spk_vol_tlv),
+--
+2.51.0
+
--- /dev/null
+From 2862ba2ec0bc3627caf3b01d29082d56d5b7187a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 09:26:39 +0100
+Subject: ASoC: wm8974: Correct PLL rate rounding
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 9b17d3724df55ecc2bc67978822585f2b023be48 ]
+
+Using a single value of 22500000 for both 48000Hz and 44100Hz audio
+will sometimes result in returning wrong dividers due to rounding.
+Update the code to use the actual value for both.
+
+Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8974.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c
+index 260bac695b20a..2aaa1cbe68b71 100644
+--- a/sound/soc/codecs/wm8974.c
++++ b/sound/soc/codecs/wm8974.c
+@@ -419,10 +419,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai)
+ fs256 = 256 * priv->fs;
+
+ f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv);
+-
+ if (f != priv->mclk) {
+ /* The PLL performs best around 90MHz */
+- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv);
++ if (fs256 % 8000)
++ f = 22579200;
++ else
++ f = 24576000;
++
++ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv);
+ }
+
+ wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll);
+--
+2.51.0
+
--- /dev/null
+From aaa33ca0fd83d32224c8fa2e70db3f3d7fb56075 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 15:42:41 +0800
+Subject: crypto: af_alg - Set merge to zero early in af_alg_sendmsg
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 9574b2330dbd2b5459b74d3b5e9619d39299fc6f ]
+
+If an error causes af_alg_sendmsg to abort, ctx->merge may contain
+a garbage value from the previous loop. This may then trigger a
+crash on the next entry into af_alg_sendmsg when it attempts to do
+a merge that can't be done.
+
+Fix this by setting ctx->merge to zero near the start of the loop.
+
+Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations")
+Reported-by: Muhammad Alifa Ramdhan <ramdhan@starlabs.sg>
+Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index dbddcf52b9920..886eccb97b041 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -1024,6 +1024,8 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ continue;
+ }
+
++ ctx->merge = 0;
++
+ if (!af_alg_writable(sk)) {
+ err = af_alg_wait_for_wmem(sk, msg->msg_flags);
+ if (err)
+@@ -1063,7 +1065,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ ctx->used += plen;
+ copied += plen;
+ size -= plen;
+- ctx->merge = 0;
+ } else {
+ do {
+ struct page *pg;
+--
+2.51.0
+
--- /dev/null
+From c47441a6d52f8b2ab3df006a51b60a08f626d82e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 10:54:38 +0200
+Subject: drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
+
+From: Loic Poulain <loic.poulain@oss.qualcomm.com>
+
+[ Upstream commit a10f910c77f280327b481e77eab909934ec508f0 ]
+
+If the interrupt occurs before resource initialization is complete, the
+interrupt handler/worker may access uninitialized data such as the I2C
+tcpc_client device, potentially leading to NULL pointer dereference.
+
+Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250709085438.56188-1-loic.poulain@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/anx7625.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
+index ddf944651c55a..08885a5ba826e 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
+@@ -2705,7 +2705,7 @@ static int anx7625_i2c_probe(struct i2c_client *client)
+ ret = devm_request_threaded_irq(dev, platform->pdata.intp_irq,
+ NULL, anx7625_intr_hpd_isr,
+ IRQF_TRIGGER_FALLING |
+- IRQF_ONESHOT,
++ IRQF_ONESHOT | IRQF_NO_AUTOEN,
+ "anx7625-intp", platform);
+ if (ret) {
+ DRM_DEV_ERROR(dev, "fail to request irq\n");
+@@ -2775,8 +2775,10 @@ static int anx7625_i2c_probe(struct i2c_client *client)
+ }
+
+ /* Add work function */
+- if (platform->pdata.intp_irq)
++ if (platform->pdata.intp_irq) {
++ enable_irq(platform->pdata.intp_irq);
+ queue_work(platform->workqueue, &platform->work);
++ }
+
+ if (platform->pdata.audio_en)
+ anx7625_register_audio(dev, platform);
+--
+2.51.0
+
--- /dev/null
+From 08f56f0a156485e7d5ccad528554d4569aec8dde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 11:44:47 +0800
+Subject: drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
+
+From: Qi Xi <xiqi2@huawei.com>
+
+[ Upstream commit 288dac9fb6084330d968459c750c838fd06e10e6 ]
+
+Add missing mutex unlock before returning from the error path in
+cdns_mhdp_atomic_enable().
+
+Fixes: 935a92a1c400 ("drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qi Xi <xiqi2@huawei.com>
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20250904034447.665427-1-xiqi2@huawei.com
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+index 858f5b6508491..bdb9fc00c776b 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c
+@@ -2057,8 +2057,10 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge,
+ mhdp_state = to_cdns_mhdp_bridge_state(new_state);
+
+ mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode);
+- if (!mhdp_state->current_mode)
+- return;
++ if (!mhdp_state->current_mode) {
++ ret = -EINVAL;
++ goto out;
++ }
+
+ drm_mode_set_name(mhdp_state->current_mode);
+
+--
+2.51.0
+
alsa-hda-realtek-fix-mute-led-for-hp-laptop-15-dw4xx.patch
io_uring-backport-io_should_terminate_tw.patch
io_uring-include-dying-ring-in-task_work-should-cancel-state.patch
+asoc-wm8940-correct-pll-rate-rounding.patch
+asoc-wm8940-correct-typo-in-control-name.patch
+asoc-wm8974-correct-pll-rate-rounding.patch
+asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch
+drm-bridge-anx7625-fix-null-pointer-dereference-with.patch
+drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch
+crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch
+smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch
--- /dev/null
+From 645f7b937a7cb13ab6d249f5cd981494567d085d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 03:06:46 +0200
+Subject: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error
+ path
+
+From: Stefan Metzmacher <metze@samba.org>
+
+[ Upstream commit daac51c7032036a0ca5f1aa419ad1b0471d1c6e0 ]
+
+During tests of another unrelated patch I was able to trigger this
+error: Objects remaining on __kmem_cache_shutdown()
+
+Cc: Steve French <smfrench@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: Namjae Jeon <linkinjeon@kernel.org>
+Cc: linux-cifs@vger.kernel.org
+Cc: samba-technical@lists.samba.org
+Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection")
+Signed-off-by: Stefan Metzmacher <metze@samba.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smbdirect.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
+index 713bd1dcd39cc..be9be8f363319 100644
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -1064,8 +1064,10 @@ static int smbd_negotiate(struct smbd_connection *info)
+ log_rdma_event(INFO, "smbd_post_recv rc=%d iov.addr=0x%llx iov.length=%u iov.lkey=0x%x\n",
+ rc, response->sge.addr,
+ response->sge.length, response->sge.lkey);
+- if (rc)
++ if (rc) {
++ put_receive_buffer(info, response);
+ return rc;
++ }
+
+ init_completion(&info->negotiate_completion);
+ info->negotiate_done = false;
+--
+2.51.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
