--- /dev/null
+From 8d70503068510e6080c2c649cccb154f16de26c9 Mon Sep 17 00:00:00 2001
+From: Ed Burcher <git@edburcher.com>
+Date: Mon, 19 May 2025 23:49:07 +0100
+Subject: ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10
+
+From: Ed Burcher <git@edburcher.com>
+
+commit 8d70503068510e6080c2c649cccb154f16de26c9 upstream.
+
+Lenovo Yoga Pro 7 (gen 10) with Realtek ALC3306 and combined CS35L56
+amplifiers need quirk ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN to
+enable bass
+
+Signed-off-by: Ed Burcher <git@edburcher.com>
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20250519224907.31265-2-git@edburcher.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -11182,6 +11182,7 @@ static const struct hda_quirk alc269_fix
+ SND_PCI_QUIRK(0x17aa, 0x38fa, "Thinkbook 16P Gen5", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD),
+ SND_PCI_QUIRK(0x17aa, 0x38fd, "ThinkBook plus Gen5 Hybrid", ALC287_FIXUP_TAS2781_I2C),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
++ SND_PCI_QUIRK(0x17aa, 0x390d, "Lenovo Yoga Pro 7 14ASP10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
+ SND_PCI_QUIRK(0x17aa, 0x3913, "Lenovo 145", ALC236_FIXUP_LENOVO_INV_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x391f, "Yoga S990-16 pro Quad YC Quad", ALC287_FIXUP_TAS2781_I2C),
+ SND_PCI_QUIRK(0x17aa, 0x3920, "Yoga S990-16 pro Quad VECO Quad", ALC287_FIXUP_TAS2781_I2C),
--- /dev/null
+From 93a81ca0657758b607c3f4ba889ae806be9beb73 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 16 May 2025 10:08:16 +0200
+Subject: ALSA: pcm: Fix race of buffer access at PCM OSS layer
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 93a81ca0657758b607c3f4ba889ae806be9beb73 upstream.
+
+The PCM OSS layer tries to clear the buffer with the silence data at
+initialization (or reconfiguration) of a stream with the explicit call
+of snd_pcm_format_set_silence() with runtime->dma_area. But this may
+lead to a UAF because the accessed runtime->dma_area might be freed
+concurrently, as it's performed outside the PCM ops.
+
+For avoiding it, move the code into the PCM core and perform it inside
+the buffer access lock, so that it won't be changed during the
+operation.
+
+Reported-by: syzbot+32d4647f551007595173@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/sound/pcm.h | 2 ++
+ sound/core/oss/pcm_oss.c | 3 +--
+ sound/core/pcm_native.c | 11 +++++++++++
+ 3 files changed, 14 insertions(+), 2 deletions(-)
+
+--- a/include/sound/pcm.h
++++ b/include/sound/pcm.h
+@@ -1428,6 +1428,8 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc
+ #define snd_pcm_lib_mmap_iomem NULL
+ #endif
+
++void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime);
++
+ /**
+ * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer
+ * @dma: DMA number
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -1074,8 +1074,7 @@ static int snd_pcm_oss_change_params_loc
+ runtime->oss.params = 0;
+ runtime->oss.prepare = 1;
+ runtime->oss.buffer_used = 0;
+- if (runtime->dma_area)
+- snd_pcm_format_set_silence(runtime->format, runtime->dma_area, bytes_to_samples(runtime, runtime->dma_bytes));
++ snd_pcm_runtime_buffer_set_silence(runtime);
+
+ runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size);
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -723,6 +723,17 @@ static void snd_pcm_buffer_access_unlock
+ atomic_inc(&runtime->buffer_accessing);
+ }
+
++/* fill the PCM buffer with the current silence format; called from pcm_oss.c */
++void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime)
++{
++ snd_pcm_buffer_access_lock(runtime);
++ if (runtime->dma_area)
++ snd_pcm_format_set_silence(runtime->format, runtime->dma_area,
++ bytes_to_samples(runtime, runtime->dma_bytes));
++ snd_pcm_buffer_access_unlock(runtime);
++}
++EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence);
++
+ #if IS_ENABLED(CONFIG_SND_PCM_OSS)
+ #define is_oss_stream(substream) ((substream)->oss.oss)
+ #else
--- /dev/null
+From 4e7010826e96702d7fad13dbe85de4e94052f833 Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Date: Fri, 9 May 2025 11:13:08 +0300
+Subject: ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+commit 4e7010826e96702d7fad13dbe85de4e94052f833 upstream.
+
+Keep using the PIO mode for commands on ACE2+ platforms, similarly how
+the legacy stack is configured.
+
+Fixes: 05cf17f1bf6d ("ASoC: SOF: Intel: hda-bus: Use PIO mode for Lunar Lake")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250509081308.13784-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sof/intel/hda-bus.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/hda-bus.c b/sound/soc/sof/intel/hda-bus.c
+index b1be03011d7e..6492e1cefbfb 100644
+--- a/sound/soc/sof/intel/hda-bus.c
++++ b/sound/soc/sof/intel/hda-bus.c
+@@ -76,7 +76,7 @@ void sof_hda_bus_init(struct snd_sof_dev *sdev, struct device *dev)
+
+ snd_hdac_ext_bus_init(bus, dev, &bus_core_ops, sof_hda_ext_ops);
+
+- if (chip && chip->hw_ip_version == SOF_INTEL_ACE_2_0)
++ if (chip && chip->hw_ip_version >= SOF_INTEL_ACE_2_0)
+ bus->use_pio_for_commands = true;
+ #else
+ snd_hdac_ext_bus_init(bus, dev, NULL, NULL);
+--
+2.49.0
+
--- /dev/null
+From 4d14b1069e9e672dbe1adab52594076da6f4a62d Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Date: Fri, 9 May 2025 11:56:33 +0300
+Subject: ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+commit 4d14b1069e9e672dbe1adab52594076da6f4a62d upstream.
+
+The header.numid is set to scontrol->comp_id in bytes_ext_get and it is
+ignored during bytes_ext_put.
+The use of comp_id is not quite great as it is kernel internal
+identification number.
+
+Set the header.numid to SOF_CTRL_CMD_BINARY during get and validate the
+numid during put to provide consistent and compatible identification
+number as IPC3.
+
+For IPC4 existing tooling also ignored the numid but with the use of
+SOF_CTRL_CMD_BINARY the different handling of the blobs can be dropped,
+providing better user experience.
+
+Reported-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
+Closes: https://github.com/thesofproject/linux/issues/5282
+Fixes: a062c8899fed ("ASoC: SOF: ipc4-control: Add support for bytes control get and put")
+Cc: stable@vger.kernel.org
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Link: https://patch.msgid.link/20250509085633.14930-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sof/ipc4-control.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/sof/ipc4-control.c
++++ b/sound/soc/sof/ipc4-control.c
+@@ -531,6 +531,14 @@ static int sof_ipc4_bytes_ext_put(struct
+ return -EINVAL;
+ }
+
++ /* Check header id */
++ if (header.numid != SOF_CTRL_CMD_BINARY) {
++ dev_err_ratelimited(scomp->dev,
++ "Incorrect numid for bytes put %d\n",
++ header.numid);
++ return -EINVAL;
++ }
++
+ /* Verify the ABI header first */
+ if (copy_from_user(&abi_hdr, tlvd->tlv, sizeof(abi_hdr)))
+ return -EFAULT;
+@@ -613,7 +621,8 @@ static int _sof_ipc4_bytes_ext_get(struc
+ if (data_size > size)
+ return -ENOSPC;
+
+- header.numid = scontrol->comp_id;
++ /* Set header id and length */
++ header.numid = SOF_CTRL_CMD_BINARY;
+ header.length = data_size;
+
+ if (copy_to_user(tlvd, &header, sizeof(struct snd_ctl_tlv)))
--- /dev/null
+From 98db16f314b3a0d6e5acd94708ea69751436467f Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Date: Fri, 9 May 2025 11:59:51 +0300
+Subject: ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+commit 98db16f314b3a0d6e5acd94708ea69751436467f upstream.
+
+The firmware does not provide any information for capture streams via the
+shared pipeline registers.
+
+To avoid reporting invalid delay value for capture streams to user space
+we need to disable it.
+
+Fixes: af74dbd0dbcf ("ASoC: SOF: ipc4-pcm: allocate time info for pcm delay feature")
+Cc: stable@vger.kernel.org
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Link: https://patch.msgid.link/20250509085951.15696-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sof/ipc4-pcm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/sof/ipc4-pcm.c
++++ b/sound/soc/sof/ipc4-pcm.c
+@@ -794,7 +794,8 @@ static int sof_ipc4_pcm_setup(struct snd
+
+ spcm->stream[stream].private = stream_priv;
+
+- if (!support_info)
++ /* Delay reporting is only supported on playback */
++ if (!support_info || stream == SNDRV_PCM_STREAM_CAPTURE)
+ continue;
+
+ time_info = kzalloc(sizeof(*time_info), GFP_KERNEL);
--- /dev/null
+From 6052f05254b4fe7b16bbd8224779af52fba98b71 Mon Sep 17 00:00:00 2001
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Date: Fri, 9 May 2025 11:53:18 +0300
+Subject: ASoc: SOF: topology: connect DAI to a single DAI link
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+commit 6052f05254b4fe7b16bbd8224779af52fba98b71 upstream.
+
+The partial matching of DAI widget to link names, can cause problems if
+one of the widget names is a substring of another. E.g. with names
+"Foo1" and Foo10", it's not possible to correctly link up "Foo1".
+
+Modify the logic so that if multiple DAI links match the widget stream
+name, prioritize a full match if one is found.
+
+Fixes: fe88788779fc ("ASoC: SOF: topology: Use partial match for connecting DAI link and DAI widget")
+Link: https://github.com/thesofproject/linux/issues/5308
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20250509085318.13936-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sof/topology.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/sof/topology.c
++++ b/sound/soc/sof/topology.c
+@@ -1059,7 +1059,7 @@ static int sof_connect_dai_widget(struct
+ struct snd_sof_dai *dai)
+ {
+ struct snd_soc_card *card = scomp->card;
+- struct snd_soc_pcm_runtime *rtd;
++ struct snd_soc_pcm_runtime *rtd, *full, *partial;
+ struct snd_soc_dai *cpu_dai;
+ int stream;
+ int i;
+@@ -1076,12 +1076,22 @@ static int sof_connect_dai_widget(struct
+ else
+ goto end;
+
++ full = NULL;
++ partial = NULL;
+ list_for_each_entry(rtd, &card->rtd_list, list) {
+ /* does stream match DAI link ? */
+- if (!rtd->dai_link->stream_name ||
+- !strstr(rtd->dai_link->stream_name, w->sname))
+- continue;
++ if (rtd->dai_link->stream_name) {
++ if (!strcmp(rtd->dai_link->stream_name, w->sname)) {
++ full = rtd;
++ break;
++ } else if (strstr(rtd->dai_link->stream_name, w->sname)) {
++ partial = rtd;
++ }
++ }
++ }
+
++ rtd = full ? full : partial;
++ if (rtd) {
+ for_each_rtd_cpu_dais(rtd, i, cpu_dai) {
+ /*
+ * Please create DAI widget in the right order
--- /dev/null
+From 6d820b81c4dc4a4023e45c3cd6707a07dd838649 Mon Sep 17 00:00:00 2001
+From: Axel Forsman <axfo@kvaser.com>
+Date: Tue, 20 May 2025 13:43:32 +0200
+Subject: can: kvaser_pciefd: Continue parsing DMA buf after dropped RX
+
+From: Axel Forsman <axfo@kvaser.com>
+
+commit 6d820b81c4dc4a4023e45c3cd6707a07dd838649 upstream.
+
+Going bus-off on a channel doing RX could result in dropped packets.
+
+As netif_running() gets cleared before the channel abort procedure,
+the handling of any last RDATA packets would see netif_rx() return
+non-zero to signal a dropped packet. kvaser_pciefd_read_buffer() dealt
+with this "error" by breaking out of processing the remaining DMA RX
+buffer.
+
+Only return an error from kvaser_pciefd_read_buffer() due to packet
+corruption, otherwise handle it internally.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Axel Forsman <axfo@kvaser.com>
+Tested-by: Jimmy Assarsson <extja@kvaser.com>
+Reviewed-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://patch.msgid.link/20250520114332.8961-4-axfo@kvaser.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/kvaser_pciefd.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/can/kvaser_pciefd.c
++++ b/drivers/net/can/kvaser_pciefd.c
+@@ -1200,7 +1200,7 @@ static int kvaser_pciefd_handle_data_pac
+ skb = alloc_canfd_skb(priv->dev, &cf);
+ if (!skb) {
+ priv->dev->stats.rx_dropped++;
+- return -ENOMEM;
++ return 0;
+ }
+
+ cf->len = can_fd_dlc2len(dlc);
+@@ -1212,7 +1212,7 @@ static int kvaser_pciefd_handle_data_pac
+ skb = alloc_can_skb(priv->dev, (struct can_frame **)&cf);
+ if (!skb) {
+ priv->dev->stats.rx_dropped++;
+- return -ENOMEM;
++ return 0;
+ }
+ can_frame_set_cc_len((struct can_frame *)cf, dlc, priv->ctrlmode);
+ }
+@@ -1230,7 +1230,9 @@ static int kvaser_pciefd_handle_data_pac
+ priv->dev->stats.rx_packets++;
+ kvaser_pciefd_set_skb_timestamp(pcie, skb, p->timestamp);
+
+- return netif_rx(skb);
++ netif_rx(skb);
++
++ return 0;
+ }
+
+ static void kvaser_pciefd_change_state(struct kvaser_pciefd_can *can,
--- /dev/null
+From 8256e0ca601051933e9395746817f3801fa9a6bf Mon Sep 17 00:00:00 2001
+From: Axel Forsman <axfo@kvaser.com>
+Date: Tue, 20 May 2025 13:43:31 +0200
+Subject: can: kvaser_pciefd: Fix echo_skb race
+
+From: Axel Forsman <axfo@kvaser.com>
+
+commit 8256e0ca601051933e9395746817f3801fa9a6bf upstream.
+
+The functions kvaser_pciefd_start_xmit() and
+kvaser_pciefd_handle_ack_packet() raced to stop/wake TX queues and
+get/put echo skbs, as kvaser_pciefd_can->echo_lock was only ever taken
+when transmitting and KCAN_TX_NR_PACKETS_CURRENT gets decremented
+prior to handling of ACKs. E.g., this caused the following error:
+
+ can_put_echo_skb: BUG! echo_skb 5 is occupied!
+
+Instead, use the synchronization helpers in netdev_queues.h. As those
+piggyback on BQL barriers, start updating in-flight packets and bytes
+counts as well.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Axel Forsman <axfo@kvaser.com>
+Tested-by: Jimmy Assarsson <extja@kvaser.com>
+Reviewed-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://patch.msgid.link/20250520114332.8961-3-axfo@kvaser.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/kvaser_pciefd.c | 93 +++++++++++++++++++++++++---------------
+ 1 file changed, 59 insertions(+), 34 deletions(-)
+
+--- a/drivers/net/can/kvaser_pciefd.c
++++ b/drivers/net/can/kvaser_pciefd.c
+@@ -16,6 +16,7 @@
+ #include <linux/netdevice.h>
+ #include <linux/pci.h>
+ #include <linux/timer.h>
++#include <net/netdev_queues.h>
+
+ MODULE_LICENSE("Dual BSD/GPL");
+ MODULE_AUTHOR("Kvaser AB <support@kvaser.com>");
+@@ -410,10 +411,13 @@ struct kvaser_pciefd_can {
+ void __iomem *reg_base;
+ struct can_berr_counter bec;
+ u8 cmd_seq;
++ u8 tx_max_count;
++ u8 tx_idx;
++ u8 ack_idx;
+ int err_rep_cnt;
+- int echo_idx;
++ unsigned int completed_tx_pkts;
++ unsigned int completed_tx_bytes;
+ spinlock_t lock; /* Locks sensitive registers (e.g. MODE) */
+- spinlock_t echo_lock; /* Locks the message echo buffer */
+ struct timer_list bec_poll_timer;
+ struct completion start_comp, flush_comp;
+ };
+@@ -714,6 +718,9 @@ static int kvaser_pciefd_open(struct net
+ int ret;
+ struct kvaser_pciefd_can *can = netdev_priv(netdev);
+
++ can->tx_idx = 0;
++ can->ack_idx = 0;
++
+ ret = open_candev(netdev);
+ if (ret)
+ return ret;
+@@ -745,21 +752,26 @@ static int kvaser_pciefd_stop(struct net
+ del_timer(&can->bec_poll_timer);
+ }
+ can->can.state = CAN_STATE_STOPPED;
++ netdev_reset_queue(netdev);
+ close_candev(netdev);
+
+ return ret;
+ }
+
++static unsigned int kvaser_pciefd_tx_avail(const struct kvaser_pciefd_can *can)
++{
++ return can->tx_max_count - (READ_ONCE(can->tx_idx) - READ_ONCE(can->ack_idx));
++}
++
+ static int kvaser_pciefd_prepare_tx_packet(struct kvaser_pciefd_tx_packet *p,
+- struct kvaser_pciefd_can *can,
++ struct can_priv *can, u8 seq,
+ struct sk_buff *skb)
+ {
+ struct canfd_frame *cf = (struct canfd_frame *)skb->data;
+ int packet_size;
+- int seq = can->echo_idx;
+
+ memset(p, 0, sizeof(*p));
+- if (can->can.ctrlmode & CAN_CTRLMODE_ONE_SHOT)
++ if (can->ctrlmode & CAN_CTRLMODE_ONE_SHOT)
+ p->header[1] |= KVASER_PCIEFD_TPACKET_SMS;
+
+ if (cf->can_id & CAN_RTR_FLAG)
+@@ -782,7 +794,7 @@ static int kvaser_pciefd_prepare_tx_pack
+ } else {
+ p->header[1] |=
+ FIELD_PREP(KVASER_PCIEFD_RPACKET_DLC_MASK,
+- can_get_cc_dlc((struct can_frame *)cf, can->can.ctrlmode));
++ can_get_cc_dlc((struct can_frame *)cf, can->ctrlmode));
+ }
+
+ p->header[1] |= FIELD_PREP(KVASER_PCIEFD_PACKET_SEQ_MASK, seq);
+@@ -797,22 +809,24 @@ static netdev_tx_t kvaser_pciefd_start_x
+ struct net_device *netdev)
+ {
+ struct kvaser_pciefd_can *can = netdev_priv(netdev);
+- unsigned long irq_flags;
+ struct kvaser_pciefd_tx_packet packet;
++ unsigned int seq = can->tx_idx & (can->can.echo_skb_max - 1);
++ unsigned int frame_len;
+ int nr_words;
+- u8 count;
+
+ if (can_dev_dropped_skb(netdev, skb))
+ return NETDEV_TX_OK;
++ if (!netif_subqueue_maybe_stop(netdev, 0, kvaser_pciefd_tx_avail(can), 1, 1))
++ return NETDEV_TX_BUSY;
+
+- nr_words = kvaser_pciefd_prepare_tx_packet(&packet, can, skb);
++ nr_words = kvaser_pciefd_prepare_tx_packet(&packet, &can->can, seq, skb);
+
+- spin_lock_irqsave(&can->echo_lock, irq_flags);
+ /* Prepare and save echo skb in internal slot */
+- can_put_echo_skb(skb, netdev, can->echo_idx, 0);
+-
+- /* Move echo index to the next slot */
+- can->echo_idx = (can->echo_idx + 1) % can->can.echo_skb_max;
++ WRITE_ONCE(can->can.echo_skb[seq], NULL);
++ frame_len = can_skb_get_frame_len(skb);
++ can_put_echo_skb(skb, netdev, seq, frame_len);
++ netdev_sent_queue(netdev, frame_len);
++ WRITE_ONCE(can->tx_idx, can->tx_idx + 1);
+
+ /* Write header to fifo */
+ iowrite32(packet.header[0],
+@@ -836,14 +850,7 @@ static netdev_tx_t kvaser_pciefd_start_x
+ KVASER_PCIEFD_KCAN_FIFO_LAST_REG);
+ }
+
+- count = FIELD_GET(KVASER_PCIEFD_KCAN_TX_NR_PACKETS_CURRENT_MASK,
+- ioread32(can->reg_base + KVASER_PCIEFD_KCAN_TX_NR_PACKETS_REG));
+- /* No room for a new message, stop the queue until at least one
+- * successful transmit
+- */
+- if (count >= can->can.echo_skb_max || can->can.echo_skb[can->echo_idx])
+- netif_stop_queue(netdev);
+- spin_unlock_irqrestore(&can->echo_lock, irq_flags);
++ netif_subqueue_maybe_stop(netdev, 0, kvaser_pciefd_tx_avail(can), 1, 1);
+
+ return NETDEV_TX_OK;
+ }
+@@ -970,6 +977,8 @@ static int kvaser_pciefd_setup_can_ctrls
+ can->kv_pcie = pcie;
+ can->cmd_seq = 0;
+ can->err_rep_cnt = 0;
++ can->completed_tx_pkts = 0;
++ can->completed_tx_bytes = 0;
+ can->bec.txerr = 0;
+ can->bec.rxerr = 0;
+
+@@ -983,11 +992,10 @@ static int kvaser_pciefd_setup_can_ctrls
+ tx_nr_packets_max =
+ FIELD_GET(KVASER_PCIEFD_KCAN_TX_NR_PACKETS_MAX_MASK,
+ ioread32(can->reg_base + KVASER_PCIEFD_KCAN_TX_NR_PACKETS_REG));
++ can->tx_max_count = min(KVASER_PCIEFD_CAN_TX_MAX_COUNT, tx_nr_packets_max - 1);
+
+ can->can.clock.freq = pcie->freq;
+- can->can.echo_skb_max = min(KVASER_PCIEFD_CAN_TX_MAX_COUNT, tx_nr_packets_max - 1);
+- can->echo_idx = 0;
+- spin_lock_init(&can->echo_lock);
++ can->can.echo_skb_max = roundup_pow_of_two(can->tx_max_count);
+ spin_lock_init(&can->lock);
+
+ can->can.bittiming_const = &kvaser_pciefd_bittiming_const;
+@@ -1509,19 +1517,21 @@ static int kvaser_pciefd_handle_ack_pack
+ netdev_dbg(can->can.dev, "Packet was flushed\n");
+ } else {
+ int echo_idx = FIELD_GET(KVASER_PCIEFD_PACKET_SEQ_MASK, p->header[0]);
+- int len;
+- u8 count;
++ unsigned int len, frame_len = 0;
+ struct sk_buff *skb;
+
++ if (echo_idx != (can->ack_idx & (can->can.echo_skb_max - 1)))
++ return 0;
+ skb = can->can.echo_skb[echo_idx];
+- if (skb)
+- kvaser_pciefd_set_skb_timestamp(pcie, skb, p->timestamp);
+- len = can_get_echo_skb(can->can.dev, echo_idx, NULL);
+- count = FIELD_GET(KVASER_PCIEFD_KCAN_TX_NR_PACKETS_CURRENT_MASK,
+- ioread32(can->reg_base + KVASER_PCIEFD_KCAN_TX_NR_PACKETS_REG));
++ if (!skb)
++ return 0;
++ kvaser_pciefd_set_skb_timestamp(pcie, skb, p->timestamp);
++ len = can_get_echo_skb(can->can.dev, echo_idx, &frame_len);
+
+- if (count < can->can.echo_skb_max && netif_queue_stopped(can->can.dev))
+- netif_wake_queue(can->can.dev);
++ /* Pairs with barrier in kvaser_pciefd_start_xmit() */
++ smp_store_release(&can->ack_idx, can->ack_idx + 1);
++ can->completed_tx_pkts++;
++ can->completed_tx_bytes += frame_len;
+
+ if (!one_shot_fail) {
+ can->can.dev->stats.tx_bytes += len;
+@@ -1637,11 +1647,26 @@ static int kvaser_pciefd_read_buffer(str
+ {
+ int pos = 0;
+ int res = 0;
++ unsigned int i;
+
+ do {
+ res = kvaser_pciefd_read_packet(pcie, &pos, dma_buf);
+ } while (!res && pos > 0 && pos < KVASER_PCIEFD_DMA_SIZE);
+
++ /* Report ACKs in this buffer to BQL en masse for correct periods */
++ for (i = 0; i < pcie->nr_channels; ++i) {
++ struct kvaser_pciefd_can *can = pcie->can[i];
++
++ if (!can->completed_tx_pkts)
++ continue;
++ netif_subqueue_completed_wake(can->can.dev, 0,
++ can->completed_tx_pkts,
++ can->completed_tx_bytes,
++ kvaser_pciefd_tx_avail(can), 1);
++ can->completed_tx_pkts = 0;
++ can->completed_tx_bytes = 0;
++ }
++
+ return res;
+ }
+
--- /dev/null
+From 239af1970bcb039a1551d2c438d113df0010c149 Mon Sep 17 00:00:00 2001
+From: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
+Date: Thu, 15 May 2025 12:20:15 +0000
+Subject: llc: fix data loss when reading from a socket in llc_ui_recvmsg()
+
+From: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
+
+commit 239af1970bcb039a1551d2c438d113df0010c149 upstream.
+
+For SOCK_STREAM sockets, if user buffer size (len) is less
+than skb size (skb->len), the remaining data from skb
+will be lost after calling kfree_skb().
+
+To fix this, move the statement for partial reading
+above skb deletion.
+
+Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org)
+
+Fixes: 30a584d944fb ("[LLX]: SOCK_DGRAM interface fixes")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/llc/af_llc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -887,15 +887,15 @@ static int llc_ui_recvmsg(struct socket
+ if (sk->sk_type != SOCK_STREAM)
+ goto copy_uaddr;
+
++ /* Partial read */
++ if (used + offset < skb_len)
++ continue;
++
+ if (!(flags & MSG_PEEK)) {
+ skb_unlink(skb, &sk->sk_receive_queue);
+ kfree_skb(skb);
+ *seq = 0;
+ }
+-
+- /* Partial read */
+- if (used + offset < skb_len)
+- continue;
+ } while (len > 0);
+
+ out:
--- /dev/null
+From 08f959759e1e6e9c4b898c51a7d387ac3480630b Mon Sep 17 00:00:00 2001
+From: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Date: Wed, 23 Apr 2025 09:53:32 +0200
+Subject: mmc: sdhci-of-dwcmshc: add PD workaround on RK3576
+
+From: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+
+commit 08f959759e1e6e9c4b898c51a7d387ac3480630b upstream.
+
+RK3576's power domains have a peculiar design where the PD_NVM power
+domain, of which the sdhci controller is a part, seemingly does not have
+idempotent runtime disable/enable. The end effect is that if PD_NVM gets
+turned off by the generic power domain logic because all the devices
+depending on it are suspended, then the next time the sdhci device is
+unsuspended, it'll hang the SoC as soon as it tries accessing the CQHCI
+registers.
+
+RK3576's UFS support needed a new dev_pm_genpd_rpm_always_on function
+added to the generic power domains API to handle what appears to be a
+similar hardware design.
+
+Use this new function to ask for the same treatment in the sdhci
+controller by giving rk3576 its own platform data with its own postinit
+function. The benefit of doing this instead of marking the power domains
+always on in the power domain core is that we only do this if we know
+the platform we're running on actually uses the sdhci controller. For
+others, keeping PD_NVM always on would be a waste, as they won't run
+into this specific issue. The only other IP in PD_NVM that could be
+affected is FSPI0. If it gets a mainline driver, it will probably want
+to do the same thing.
+
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
+Fixes: cfee1b507758 ("pmdomain: rockchip: Add support for RK3576 SoC")
+Cc: <stable@vger.kernel.org> # v6.15+
+Link: https://lore.kernel.org/r/20250423-rk3576-emmc-fix-v3-1-0bf80e29967f@collabora.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-of-dwcmshc.c | 40 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 40 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-of-dwcmshc.c
++++ b/drivers/mmc/host/sdhci-of-dwcmshc.c
+@@ -17,6 +17,7 @@
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
++#include <linux/pm_domain.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/reset.h>
+ #include <linux/sizes.h>
+@@ -787,6 +788,29 @@ static void dwcmshc_rk35xx_postinit(stru
+ }
+ }
+
++static void dwcmshc_rk3576_postinit(struct sdhci_host *host, struct dwcmshc_priv *dwc_priv)
++{
++ struct device *dev = mmc_dev(host->mmc);
++ int ret;
++
++ /*
++ * This works around the design of the RK3576's power domains, which
++ * makes the PD_NVM power domain, which the sdhci controller on the
++ * RK3576 is in, never come back the same way once it's run-time
++ * suspended once. This can happen during early kernel boot if no driver
++ * is using either PD_NVM or its child power domain PD_SDGMAC for a
++ * short moment, leading to it being turned off to save power. By
++ * keeping it on, sdhci suspending won't lead to PD_NVM becoming a
++ * candidate for getting turned off.
++ */
++ ret = dev_pm_genpd_rpm_always_on(dev, true);
++ if (ret && ret != -EOPNOTSUPP)
++ dev_warn(dev, "failed to set PD rpm always on, SoC may hang later: %pe\n",
++ ERR_PTR(ret));
++
++ dwcmshc_rk35xx_postinit(host, dwc_priv);
++}
++
+ static int th1520_execute_tuning(struct sdhci_host *host, u32 opcode)
+ {
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+@@ -1218,6 +1242,18 @@ static const struct dwcmshc_pltfm_data s
+ .postinit = dwcmshc_rk35xx_postinit,
+ };
+
++static const struct dwcmshc_pltfm_data sdhci_dwcmshc_rk3576_pdata = {
++ .pdata = {
++ .ops = &sdhci_dwcmshc_rk35xx_ops,
++ .quirks = SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN |
++ SDHCI_QUIRK_BROKEN_TIMEOUT_VAL,
++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
++ SDHCI_QUIRK2_CLOCK_DIV_ZERO_BROKEN,
++ },
++ .init = dwcmshc_rk35xx_init,
++ .postinit = dwcmshc_rk3576_postinit,
++};
++
+ static const struct dwcmshc_pltfm_data sdhci_dwcmshc_th1520_pdata = {
+ .pdata = {
+ .ops = &sdhci_dwcmshc_th1520_ops,
+@@ -1317,6 +1353,10 @@ static const struct of_device_id sdhci_d
+ .data = &sdhci_dwcmshc_rk35xx_pdata,
+ },
+ {
++ .compatible = "rockchip,rk3576-dwcmshc",
++ .data = &sdhci_dwcmshc_rk3576_pdata,
++ },
++ {
+ .compatible = "rockchip,rk3568-dwcmshc",
+ .data = &sdhci_dwcmshc_rk35xx_pdata,
+ },
--- /dev/null
+From ba54bce747fa9e07896c1abd9b48545f7b4b31d2 Mon Sep 17 00:00:00 2001
+From: Jakob Unterwurzacher <jakobunt@gmail.com>
+Date: Thu, 15 May 2025 09:29:19 +0200
+Subject: net: dsa: microchip: linearize skb for tail-tagging switches
+
+From: Jakob Unterwurzacher <jakobunt@gmail.com>
+
+commit ba54bce747fa9e07896c1abd9b48545f7b4b31d2 upstream.
+
+The pointer arithmentic for accessing the tail tag only works
+for linear skbs.
+
+For nonlinear skbs, it reads uninitialized memory inside the
+skb headroom, essentially randomizing the tag. I have observed
+it gets set to 6 most of the time.
+
+Example where ksz9477_rcv thinks that the packet from port 1 comes from port 6
+(which does not exist for the ksz9896 that's in use), dropping the packet.
+Debug prints added by me (not included in this patch):
+
+ [ 256.645337] ksz9477_rcv:323 tag0=6
+ [ 256.645349] skb len=47 headroom=78 headlen=0 tailroom=0
+ mac=(64,14) mac_len=14 net=(78,0) trans=78
+ shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0))
+ csum(0x0 start=0 offset=0 ip_summed=0 complete_sw=0 valid=0 level=0)
+ hash(0x0 sw=0 l4=0) proto=0x00f8 pkttype=1 iif=3
+ priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0
+ encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0)
+ [ 256.645377] dev name=end1 feat=0x0002e10200114bb3
+ [ 256.645386] skb headroom: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ [ 256.645395] skb headroom: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ [ 256.645403] skb headroom: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ [ 256.645411] skb headroom: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ [ 256.645420] skb headroom: 00000040: ff ff ff ff ff ff 00 1c 19 f2 e2 db 08 06
+ [ 256.645428] skb frag: 00000000: 00 01 08 00 06 04 00 01 00 1c 19 f2 e2 db 0a 02
+ [ 256.645436] skb frag: 00000010: 00 83 00 00 00 00 00 00 0a 02 a0 2f 00 00 00 00
+ [ 256.645444] skb frag: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
+ [ 256.645452] ksz_common_rcv:92 dsa_conduit_find_user returned NULL
+
+Call skb_linearize before trying to access the tag.
+
+This patch fixes ksz9477_rcv which is used by the ksz9896 I have at
+hand, and also applies the same fix to ksz8795_rcv which seems to have
+the same problem.
+
+Signed-off-by: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de>
+CC: stable@vger.kernel.org
+Fixes: 016e43a26bab ("net: dsa: ksz: Add KSZ8795 tag code")
+Fixes: 8b8010fb7876 ("dsa: add support for Microchip KSZ tail tagging")
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://patch.msgid.link/20250515072920.2313014-1-jakob.unterwurzacher@cherry.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dsa/tag_ksz.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/net/dsa/tag_ksz.c
++++ b/net/dsa/tag_ksz.c
+@@ -140,7 +140,12 @@ static struct sk_buff *ksz8795_xmit(stru
+
+ static struct sk_buff *ksz8795_rcv(struct sk_buff *skb, struct net_device *dev)
+ {
+- u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
++ u8 *tag;
++
++ if (skb_linearize(skb))
++ return NULL;
++
++ tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
+
+ return ksz_common_rcv(skb, dev, tag[0] & KSZ8795_TAIL_TAG_EG_PORT_M,
+ KSZ_EGRESS_TAG_LEN);
+@@ -311,10 +316,16 @@ static struct sk_buff *ksz9477_xmit(stru
+
+ static struct sk_buff *ksz9477_rcv(struct sk_buff *skb, struct net_device *dev)
+ {
+- /* Tag decoding */
+- u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
+- unsigned int port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M;
+ unsigned int len = KSZ_EGRESS_TAG_LEN;
++ unsigned int port;
++ u8 *tag;
++
++ if (skb_linearize(skb))
++ return NULL;
++
++ /* Tag decoding */
++ tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
++ port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M;
+
+ /* Extra 4-bytes PTP timestamp */
+ if (tag[0] & KSZ9477_PTP_TAG_INDICATION) {
--- /dev/null
+From 0f5757667ec0aaf2456c3b76fcf0c6c3ea3591fe Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@linaro.org>
+Date: Thu, 8 May 2025 09:29:23 +0300
+Subject: pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+commit 0f5757667ec0aaf2456c3b76fcf0c6c3ea3591fe upstream.
+
+The error checking for of_count_phandle_with_args() does not handle
+negative error codes correctly. The problem is that "index" is a u32 so
+in the condition "if (index >= num_domains)" negative error codes stored
+in "num_domains" are type promoted to very high positive values and
+"index" is always going to be valid.
+
+Test for negative error codes first and then test if "index" is valid.
+
+Fixes: 3ccf3f0cd197 ("PM / Domains: Enable genpd_dev_pm_attach_by_id|name() for single PM domain")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/aBxPQ8AI8N5v-7rL@stanley.mountain
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pmdomain/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pmdomain/core.c
++++ b/drivers/pmdomain/core.c
+@@ -3043,7 +3043,7 @@ struct device *genpd_dev_pm_attach_by_id
+ /* Verify that the index is within a valid range. */
+ num_domains = of_count_phandle_with_args(dev->of_node, "power-domains",
+ "#power-domain-cells");
+- if (index >= num_domains)
++ if (num_domains < 0 || index >= num_domains)
+ return NULL;
+
+ /* Allocate and register device on the genpd bus. */
--- /dev/null
+From 13a6d4265665201a795a2ff5a3e6e4d183fc9c33 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 28 Apr 2025 13:47:52 +0200
+Subject: pmdomain: renesas: rcar: Remove obsolete nullify checks
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 13a6d4265665201a795a2ff5a3e6e4d183fc9c33 upstream.
+
+All nullify users and helpers were removed, but the R-Car SYSC drivers
+still checked for nullified domains. Remove the obsolete checks.
+
+Fixes: c8d87704444a8ac7 ("pmdomain: renesas: rcar-sysc: Remove rcar_sysc_nullify() helper")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/107f2bf9f13b29f0f623d2959a5347ec151fb089.1745840768.git.geert+renesas@glider.be
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pmdomain/renesas/rcar-gen4-sysc.c | 5 -----
+ drivers/pmdomain/renesas/rcar-sysc.c | 5 -----
+ 2 files changed, 10 deletions(-)
+
+diff --git a/drivers/pmdomain/renesas/rcar-gen4-sysc.c b/drivers/pmdomain/renesas/rcar-gen4-sysc.c
+index 66409cff2083..e001b5c25bed 100644
+--- a/drivers/pmdomain/renesas/rcar-gen4-sysc.c
++++ b/drivers/pmdomain/renesas/rcar-gen4-sysc.c
+@@ -338,11 +338,6 @@ static int __init rcar_gen4_sysc_pd_init(void)
+ struct rcar_gen4_sysc_pd *pd;
+ size_t n;
+
+- if (!area->name) {
+- /* Skip NULLified area */
+- continue;
+- }
+-
+ n = strlen(area->name) + 1;
+ pd = kzalloc(sizeof(*pd) + n, GFP_KERNEL);
+ if (!pd) {
+diff --git a/drivers/pmdomain/renesas/rcar-sysc.c b/drivers/pmdomain/renesas/rcar-sysc.c
+index dce1a6d37e80..047495f54e8a 100644
+--- a/drivers/pmdomain/renesas/rcar-sysc.c
++++ b/drivers/pmdomain/renesas/rcar-sysc.c
+@@ -396,11 +396,6 @@ static int __init rcar_sysc_pd_init(void)
+ struct rcar_sysc_pd *pd;
+ size_t n;
+
+- if (!area->name) {
+- /* Skip NULLified area */
+- continue;
+- }
+-
+ n = strlen(area->name) + 1;
+ pd = kzalloc(sizeof(*pd) + n, GFP_KERNEL);
+ if (!pd) {
+--
+2.49.0
+
can-slcan-allow-reception-of-short-error-messages.patch
can-bcm-add-locking-for-bcm_op-runtime-updates.patch
can-bcm-add-missing-rcu-read-protection-for-procfs-content.patch
+asoc-sof-ipc4-control-use-sof_ctrl_cmd_binary-as-numid-for-bytes_ext.patch
+asoc-sof-intel-hda-bus-use-pio-mode-on-ace2-platforms.patch
+asoc-sof-topology-connect-dai-to-a-single-dai-link.patch
+asoc-sof-ipc4-pcm-delay-reporting-is-only-supported-for-playback-direction.patch
+alsa-pcm-fix-race-of-buffer-access-at-pcm-oss-layer.patch
+alsa-hda-realtek-add-quirk-for-lenovo-yoga-pro-7-14asp10.patch
+llc-fix-data-loss-when-reading-from-a-socket-in-llc_ui_recvmsg.patch
+can-kvaser_pciefd-continue-parsing-dma-buf-after-dropped-rx.patch
+can-kvaser_pciefd-fix-echo_skb-race.patch
+net-dsa-microchip-linearize-skb-for-tail-tagging-switches.patch
+vmxnet3-update-mtu-after-device-quiesce.patch
+mmc-sdhci-of-dwcmshc-add-pd-workaround-on-rk3576.patch
+pmdomain-renesas-rcar-remove-obsolete-nullify-checks.patch
+pmdomain-core-fix-error-checking-in-genpd_dev_pm_attach_by_id.patch
--- /dev/null
+From 43f0999af011fba646e015f0bb08b6c3002a0170 Mon Sep 17 00:00:00 2001
+From: Ronak Doshi <ronak.doshi@broadcom.com>
+Date: Thu, 15 May 2025 19:04:56 +0000
+Subject: vmxnet3: update MTU after device quiesce
+
+From: Ronak Doshi <ronak.doshi@broadcom.com>
+
+commit 43f0999af011fba646e015f0bb08b6c3002a0170 upstream.
+
+Currently, when device mtu is updated, vmxnet3 updates netdev mtu, quiesces
+the device and then reactivates it for the ESXi to know about the new mtu.
+So, technically the OS stack can start using the new mtu before ESXi knows
+about the new mtu.
+
+This can lead to issues for TSO packets which use mss as per the new mtu
+configured. This patch fixes this issue by moving the mtu write after
+device quiesce.
+
+Cc: stable@vger.kernel.org
+Fixes: d1a890fa37f2 ("net: VMware virtual Ethernet NIC driver: vmxnet3")
+Signed-off-by: Ronak Doshi <ronak.doshi@broadcom.com>
+Acked-by: Guolin Yang <guolin.yang@broadcom.com>
+Changes v1-> v2:
+ Moved MTU write after destroy of rx rings
+Link: https://patch.msgid.link/20250515190457.8597-1-ronak.doshi@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/vmxnet3/vmxnet3_drv.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -3599,8 +3599,6 @@ vmxnet3_change_mtu(struct net_device *ne
+ struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+ int err = 0;
+
+- WRITE_ONCE(netdev->mtu, new_mtu);
+-
+ /*
+ * Reset_work may be in the middle of resetting the device, wait for its
+ * completion.
+@@ -3614,6 +3612,7 @@ vmxnet3_change_mtu(struct net_device *ne
+
+ /* we need to re-create the rx queue based on the new mtu */
+ vmxnet3_rq_destroy_all(adapter);
++ WRITE_ONCE(netdev->mtu, new_mtu);
+ vmxnet3_adjust_rx_ring_size(adapter);
+ err = vmxnet3_rq_create_all(adapter);
+ if (err) {
+@@ -3630,6 +3629,8 @@ vmxnet3_change_mtu(struct net_device *ne
+ "Closing it\n", err);
+ goto out;
+ }
++ } else {
++ WRITE_ONCE(netdev->mtu, new_mtu);
+ }
+
+ out:
projects / thirdparty / kernel / stable-queue.git / commitdiff
