--- /dev/null
+From 8765429279e7d3d68d39ace5f84af2815174bb1e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 31 Dec 2024 15:53:58 +0100
+Subject: ALSA: seq: Check UMP support for midi_version change
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 8765429279e7d3d68d39ace5f84af2815174bb1e upstream.
+
+When the kernel is built without UMP support but a user-space app
+requires the midi_version > 0, the kernel should return an error.
+Otherwise user-space assumes as if it were possible to deal,
+eventually hitting serious errors later.
+
+Fixes: 46397622a3fa ("ALSA: seq: Add UMP support")
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20241231145358.21946-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/seq/seq_clientmgr.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1329,10 +1329,16 @@ static int snd_seq_ioctl_set_client_info
+ if (client->type != client_info->type)
+ return -EINVAL;
+
+- /* check validity of midi_version field */
+- if (client->user_pversion >= SNDRV_PROTOCOL_VERSION(1, 0, 3) &&
+- client_info->midi_version > SNDRV_SEQ_CLIENT_UMP_MIDI_2_0)
+- return -EINVAL;
++ if (client->user_pversion >= SNDRV_PROTOCOL_VERSION(1, 0, 3)) {
++ /* check validity of midi_version field */
++ if (client_info->midi_version > SNDRV_SEQ_CLIENT_UMP_MIDI_2_0)
++ return -EINVAL;
++
++ /* check if UMP is supported in kernel */
++ if (!IS_ENABLED(CONFIG_SND_SEQ_UMP) &&
++ client_info->midi_version > 0)
++ return -EINVAL;
++ }
+
+ /* fill the info fields */
+ if (client_info->name[0])
--- /dev/null
+From 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 Mon Sep 17 00:00:00 2001
+From: HyeongJun An <sammiee5311@gmail.com>
+Date: Wed, 24 Jun 2026 08:38:40 +0900
+Subject: ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
+
+From: HyeongJun An <sammiee5311@gmail.com>
+
+commit 435990e25bf1f4af3e6df12a6fbfd1f7ba4a97d4 upstream.
+
+snd_seq_event_dup() copies an incoming event into a pool cell and, in
+the UMP-enabled build, clears the trailing cell->ump.raw.extra word that
+the memcpy() did not cover. The guard deciding whether to clear it
+compares the copied size against sizeof(cell->event):
+
+ memcpy(&cell->ump, event, size);
+ if (size < sizeof(cell->event))
+ cell->ump.raw.extra = 0;
+
+For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) ==
+sizeof(cell->event), so the condition is false and the extra word keeps
+stale data. The cell pool is allocated with kvmalloc() (not zeroed) and
+cells are reused via a free list, so that word holds uninitialised heap
+or leftover event data.
+
+When such a cell is delivered to a UMP client (client->midi_version > 0)
+that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it
+unconverted -- snd_seq_read() reads it out as the larger struct
+snd_seq_ump_event and copies the stale word to user space, a 4-byte
+kernel heap infoleak to an unprivileged /dev/snd/seq client.
+
+Compare against sizeof(cell->ump) instead, so the trailing word is zeroed
+for every event shorter than the UMP cell.
+
+Fixes: 46397622a3fa ("ALSA: seq: Add UMP support")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
+Link: https://patch.msgid.link/20260623233841.853326-1-sammiee5311@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/seq/seq_memory.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -309,7 +309,7 @@ int snd_seq_event_dup(struct snd_seq_poo
+ size = snd_seq_event_packet_size(event);
+ memcpy(&cell->ump, event, size);
+ #if IS_ENABLED(CONFIG_SND_SEQ_UMP)
+- if (size < sizeof(cell->event))
++ if (size < sizeof(cell->ump))
+ cell->ump.raw.extra = 0;
+ #endif
+
--- /dev/null
+From 32108c22ac619c32dd6db594319e259b63bfb387 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 19 Aug 2024 10:41:53 +0200
+Subject: ALSA: seq: Skip event type filtering for UMP events
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 32108c22ac619c32dd6db594319e259b63bfb387 upstream.
+
+UMP events don't use the event type field, hence it's invalid to apply
+the filter, which may drop the events unexpectedly.
+Skip the event filtering for UMP events, instead.
+
+Fixes: 46397622a3fa ("ALSA: seq: Add UMP support")
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20240819084156.10286-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/seq/seq_clientmgr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -528,6 +528,9 @@ static struct snd_seq_client *get_event_
+ return NULL;
+ if (! dest->accept_input)
+ goto __not_avail;
++ if (snd_seq_ev_is_ump(event))
++ return dest; /* ok - no filter checks */
++
+ if ((dest->filter & SNDRV_SEQ_FILTER_USE_EVENT) &&
+ ! test_bit(event->type, dest->event_filter))
+ goto __not_avail;
--- /dev/null
+From 1cc18c2ab2e8c54c355ea7c0423a636e415a0c23 Mon Sep 17 00:00:00 2001
+From: Pavel Skripkin <paskripkin@gmail.com>
+Date: Thu, 20 Jun 2024 22:27:47 +0300
+Subject: bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+commit 1cc18c2ab2e8c54c355ea7c0423a636e415a0c23 upstream.
+
+Syzbot hit warning in hci_conn_del() caused by freeing handle that was
+not allocated using ida allocator.
+
+This is caused by handle bigger than HCI_CONN_HANDLE_MAX passed by
+hci_le_big_sync_established_evt(), which makes code think it's unset
+connection.
+
+Add same check for handle upper bound as in hci_conn_set_handle() to
+prevent warning.
+
+Link: https://syzkaller.appspot.com/bug?extid=b2545b087a01a7319474
+Reported-by: syzbot+b2545b087a01a7319474@syzkaller.appspotmail.com
+Fixes: 181a42edddf5 ("Bluetooth: Make handle of hci_conn be unique")
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/hci_conn.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -988,8 +988,8 @@ static int hci_conn_hash_alloc_unset(str
+ U16_MAX, GFP_ATOMIC);
+ }
+
+-struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
+- u8 role, u16 handle)
++static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
++ u8 role, u16 handle)
+ {
+ struct hci_conn *conn;
+
+@@ -1096,7 +1096,16 @@ struct hci_conn *hci_conn_add_unset(stru
+ if (unlikely(handle < 0))
+ return NULL;
+
+- return hci_conn_add(hdev, type, dst, role, handle);
++ return __hci_conn_add(hdev, type, dst, role, handle);
++}
++
++struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
++ u8 role, u16 handle)
++{
++ if (handle > HCI_CONN_HANDLE_MAX)
++ return ERR_PTR(-EINVAL);
++
++ return __hci_conn_add(hdev, type, dst, role, handle);
+ }
+
+ static bool hci_conn_unlink(struct hci_conn *conn)
--- /dev/null
+From 015d79c96d62cd8a4a359fcf5be40d58088c936b Mon Sep 17 00:00:00 2001
+From: Edward Adam Davis <eadavis@qq.com>
+Date: Mon, 17 Jun 2024 19:09:37 +0800
+Subject: Bluetooth: Ignore too large handle values in BIG
+
+From: Edward Adam Davis <eadavis@qq.com>
+
+commit 015d79c96d62cd8a4a359fcf5be40d58088c936b upstream.
+
+hci_le_big_sync_established_evt is necessary to filter out cases where the
+handle value is belonging to ida id range, otherwise ida will be erroneously
+released in hci_conn_cleanup.
+
+Fixes: 181a42edddf5 ("Bluetooth: Make handle of hci_conn be unique")
+Reported-by: syzbot+b2545b087a01a7319474@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=b2545b087a01a7319474
+Signed-off-by: Edward Adam Davis <eadavis@qq.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/hci_event.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -6951,6 +6951,10 @@ static void hci_le_big_sync_established_
+
+ bis = hci_conn_hash_lookup_handle(hdev, handle);
+ if (!bis) {
++ if (handle > HCI_CONN_HANDLE_MAX) {
++ bt_dev_dbg(hdev, "ignore too large handle %u", handle);
++ continue;
++ }
+ bis = hci_conn_add(hdev, ISO_LINK, BDADDR_ANY,
+ HCI_ROLE_SLAVE, handle);
+ if (!bis)
--- /dev/null
+From 5eef12c4e3230f2025dc46ad8c4a3bc19978e5d7 Mon Sep 17 00:00:00 2001
+From: Shyam Prasad N <sprasad@microsoft.com>
+Date: Tue, 14 Nov 2023 04:58:23 +0000
+Subject: cifs: fix lock ordering while disabling multichannel
+
+From: Shyam Prasad N <sprasad@microsoft.com>
+
+commit 5eef12c4e3230f2025dc46ad8c4a3bc19978e5d7 upstream.
+
+The code to handle the case of server disabling multichannel
+was picking iface_lock with chan_lock held. This goes against
+the lock ordering rules, as iface_lock is a higher order lock
+(even if it isn't so obvious).
+
+This change fixes the lock ordering by doing the following in
+that order for each secondary channel:
+1. store iface and server pointers in local variable
+2. remove references to iface and server in channels
+3. unlock chan_lock
+4. lock iface_lock
+5. dec ref count for iface
+6. unlock iface_lock
+7. dec ref count for server
+8. lock chan_lock again
+
+Since this function can only be called in smb2_reconnect, and
+that cannot be called by two parallel processes, we should not
+have races due to dropping chan_lock between steps 3 and 8.
+
+Fixes: ee1d21794e55 ("cifs: handle when server stops supporting multichannel")
+Reported-by: Paulo Alcantara <pc@manguebit.com>
+Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/sess.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+--- a/fs/smb/client/sess.c
++++ b/fs/smb/client/sess.c
+@@ -303,28 +303,32 @@ cifs_disable_secondary_channels(struct c
+ iface = ses->chans[i].iface;
+ server = ses->chans[i].server;
+
++ /*
++ * remove these references first, since we need to unlock
++ * the chan_lock here, since iface_lock is a higher lock
++ */
++ ses->chans[i].iface = NULL;
++ ses->chans[i].server = NULL;
++ spin_unlock(&ses->chan_lock);
++
+ if (iface) {
+ spin_lock(&ses->iface_lock);
+ kref_put(&iface->refcount, release_iface);
+- ses->chans[i].iface = NULL;
+ iface->num_channels--;
+ if (iface->weight_fulfilled)
+ iface->weight_fulfilled--;
+ spin_unlock(&ses->iface_lock);
+ }
+
+- spin_unlock(&ses->chan_lock);
+- if (server && !server->terminate) {
+- server->terminate = true;
+- cifs_signal_cifsd_for_reconnect(server, false);
+- }
+- spin_lock(&ses->chan_lock);
+-
+ if (server) {
+- ses->chans[i].server = NULL;
++ if (!server->terminate) {
++ server->terminate = true;
++ cifs_signal_cifsd_for_reconnect(server, false);
++ }
+ cifs_put_tcp_session(server, false);
+ }
+
++ spin_lock(&ses->chan_lock);
+ }
+
+ done:
--- /dev/null
+From 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 Mon Sep 17 00:00:00 2001
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Date: Tue, 23 Jun 2026 16:22:15 +0200
+Subject: iio: imu: inv_icm42600: fix timestamp clock period by using lower value
+
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+
+commit 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 upstream.
+
+Clock period value is used for computing periods of sampling. There is
+no need for it to be higher than the maximum odr, otherwise we are
+losing precision in the computation for nothing.
+
+Switch clock period value to maximum odr period (8kHz).
+
+Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 ++--
+ drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+@@ -720,10 +720,10 @@ struct iio_dev *inv_icm42600_accel_init(
+ return ERR_PTR(-ENOMEM);
+
+ /*
+- * clock period is 32kHz (31250ns)
++ * clock period is 8kHz (125000ns)
+ * jitter is +/- 2% (20 per mille)
+ */
+- ts_chip.clock_period = 31250;
++ ts_chip.clock_period = 125000;
+ ts_chip.jitter = 20;
+ ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr);
+ ts = iio_priv(indio_dev);
+--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+@@ -731,10 +731,10 @@ struct iio_dev *inv_icm42600_gyro_init(s
+ return ERR_PTR(-ENOMEM);
+
+ /*
+- * clock period is 32kHz (31250ns)
++ * clock period is 8kHz (125000ns)
+ * jitter is +/- 2% (20 per mille)
+ */
+- ts_chip.clock_period = 31250;
++ ts_chip.clock_period = 125000;
+ ts_chip.jitter = 20;
+ ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr);
+ ts = iio_priv(indio_dev);
--- /dev/null
+From daec424cc57b33a28f8621eb7ac85f8bd327bd6b Mon Sep 17 00:00:00 2001
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Date: Mon, 19 Feb 2024 15:47:41 +0000
+Subject: iio: imu: inv_mpu6050: fix frequency setting when chip is off
+
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+
+commit daec424cc57b33a28f8621eb7ac85f8bd327bd6b upstream.
+
+Track correctly FIFO state and apply ODR change before starting
+the chip. Without the fix, you cannot change ODR more than 1 time
+when data buffering is off. This restriction on a single pending ODR
+change should only apply when the FIFO is on.
+
+Fixes: 111e1abd0045 ("iio: imu: inv_mpu6050: use the common inv_sensors timestamp module")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Link: https://lore.kernel.org/r/20240219154741.90601-1-inv.git-commit@tdk.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
+@@ -111,6 +111,7 @@ int inv_mpu6050_prepare_fifo(struct inv_
+ if (enable) {
+ /* reset timestamping */
+ inv_sensors_timestamp_reset(&st->timestamp);
++ inv_sensors_timestamp_apply_odr(&st->timestamp, 0, 0, 0);
+ /* reset FIFO */
+ d = st->chip_config.user_ctrl | INV_MPU6050_BIT_FIFO_RST;
+ ret = regmap_write(st->map, st->reg->user_ctrl, d);
+@@ -184,6 +185,10 @@ static int inv_mpu6050_set_enable(struct
+ if (result)
+ goto error_power_off;
+ } else {
++ st->chip_config.gyro_fifo_enable = 0;
++ st->chip_config.accl_fifo_enable = 0;
++ st->chip_config.temp_fifo_enable = 0;
++ st->chip_config.magn_fifo_enable = 0;
+ result = inv_mpu6050_prepare_fifo(st, false);
+ if (result)
+ goto error_power_off;
--- /dev/null
+From 95444b9eeb8c5c0330563931d70c61ca3b101548 Mon Sep 17 00:00:00 2001
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Date: Fri, 24 May 2024 12:48:51 +0000
+Subject: iio: invensense: fix odr switching to same value
+
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+
+commit 95444b9eeb8c5c0330563931d70c61ca3b101548 upstream.
+
+ODR switching happens in 2 steps, update to store the new value and then
+apply when the ODR change flag is received in the data. When switching to
+the same ODR value, the ODR change flag is never happening, and frequency
+switching is blocked waiting for the never coming apply.
+
+Fix the issue by preventing update to happen when switching to same ODR
+value.
+
+Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Link: https://lore.kernel.org/r/20240524124851.567485-1-inv.git-commit@tdk.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
++++ b/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
+@@ -60,11 +60,15 @@ EXPORT_SYMBOL_NS_GPL(inv_sensors_timesta
+ int inv_sensors_timestamp_update_odr(struct inv_sensors_timestamp *ts,
+ uint32_t period, bool fifo)
+ {
++ uint32_t mult;
++
+ /* when FIFO is on, prevent odr change if one is already pending */
+ if (fifo && ts->new_mult != 0)
+ return -EAGAIN;
+
+- ts->new_mult = period / ts->chip.clock_period;
++ mult = period / ts->chip.clock_period;
++ if (mult != ts->mult)
++ ts->new_mult = mult;
+
+ return 0;
+ }
driver-core-fix-missing-jiffies-conversion-in-deferred_probe_extend_timeout.patch
driver-core-guard-deferred-probe-timeout-extension-with-delayed_work_pending.patch
alsa-seq-avoid-confusion-of-aligned-read-size.patch
+tools-virtio-add-dma-sync-api-for-virtio-test.patch
+cifs-fix-lock-ordering-while-disabling-multichannel.patch
+virtio_ring-fix-syncs-dma-memory-with-different-direction.patch
+iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch
+iio-invensense-fix-odr-switching-to-same-value.patch
+bluetooth-ignore-too-large-handle-values-in-big.patch
+bluetooth-hci-disallow-setting-handle-bigger-than-hci_conn_handle_max.patch
+alsa-seq-skip-event-type-filtering-for-ump-events.patch
+alsa-seq-check-ump-support-for-midi_version-change.patch
+iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch
+alsa-seq-fix-uninitialised-heap-leak-in-snd_seq_event_dup.patch
--- /dev/null
+From e07744b43d3ad10b040f0ec464b6323ca96903d6 Mon Sep 17 00:00:00 2001
+From: Liming Wu <liming.wu@jaguarmicro.com>
+Date: Sun, 8 Oct 2023 11:17:33 +0800
+Subject: tools/virtio: Add dma sync api for virtio test
+
+From: Liming Wu <liming.wu@jaguarmicro.com>
+
+commit e07744b43d3ad10b040f0ec464b6323ca96903d6 upstream.
+
+Fixes: 8bd2f71054bd ("virtio_ring: introduce dma sync api for virtqueue")
+also add dma sync api for virtio test.
+
+Signed-off-by: Liming Wu <liming.wu@jaguarmicro.com>
+Message-Id: <20231008031734.1095-1-liming.wu@jaguarmicro.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/virtio/linux/dma-mapping.h | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/tools/virtio/linux/dma-mapping.h
++++ b/tools/virtio/linux/dma-mapping.h
+@@ -24,11 +24,23 @@ enum dma_data_direction {
+ #define dma_map_page(d, p, o, s, dir) (page_to_phys(p) + (o))
+
+ #define dma_map_single(d, p, s, dir) (virt_to_phys(p))
++#define dma_map_single_attrs(d, p, s, dir, a) (virt_to_phys(p))
+ #define dma_mapping_error(...) (0)
+
+ #define dma_unmap_single(d, a, s, r) do { (void)(d); (void)(a); (void)(s); (void)(r); } while (0)
+ #define dma_unmap_page(d, a, s, r) do { (void)(d); (void)(a); (void)(s); (void)(r); } while (0)
+
++#define sg_dma_address(sg) (0)
++#define dma_need_sync(v, a) (0)
++#define dma_unmap_single_attrs(d, a, s, r, t) do { \
++ (void)(d); (void)(a); (void)(s); (void)(r); (void)(t); \
++} while (0)
++#define dma_sync_single_range_for_cpu(d, a, o, s, r) do { \
++ (void)(d); (void)(a); (void)(o); (void)(s); (void)(r); \
++} while (0)
++#define dma_sync_single_range_for_device(d, a, o, s, r) do { \
++ (void)(d); (void)(a); (void)(o); (void)(s); (void)(r); \
++} while (0)
+ #define dma_max_mapping_size(...) SIZE_MAX
+
+ #endif
--- /dev/null
+From 1f475cd572ea77ae6474a17e693a96bca927efe9 Mon Sep 17 00:00:00 2001
+From: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Date: Fri, 1 Dec 2023 11:33:03 +0800
+Subject: virtio_ring: fix syncs DMA memory with different direction
+
+From: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+
+commit 1f475cd572ea77ae6474a17e693a96bca927efe9 upstream.
+
+Now the APIs virtqueue_dma_sync_single_range_for_{cpu,device} ignore
+the parameter 'dir', that is a mistake.
+
+[ 6.101666] ------------[ cut here ]------------
+[ 6.102079] DMA-API: virtio-pci 0000:00:04.0: device driver syncs DMA memory with different direction [device address=0x00000000ae010000] [size=32752 bytes] [mapped with DMA_FROM_DEVICE] [synced with DMA_BIDIRECTIONAL]
+[ 6.103630] WARNING: CPU: 6 PID: 0 at kernel/dma/debug.c:1125 check_sync+0x53e/0x6c0
+[ 6.107420] CPU: 6 PID: 0 Comm: swapper/6 Tainted: G E 6.6.0+ #290
+[ 6.108030] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
+[ 6.108936] RIP: 0010:check_sync+0x53e/0x6c0
+[ 6.109289] Code: 24 10 e8 f5 d9 74 00 4c 8b 4c 24 10 4c 8b 44 24 18 48 8b 4c 24 20 48 89 c6 41 56 4c 89 ea 48 c7 c7 b0 f1 50 82 e8 32 fc f3 ff <0f> 0b 48 c7 c7 48 4b 4a 82 e8 74 d9 fc ff 8b 73 4c 48 8d 7b 50 31
+[ 6.110750] RSP: 0018:ffffc90000180cd8 EFLAGS: 00010092
+[ 6.111178] RAX: 00000000000000ce RBX: ffff888100aa5900 RCX: 0000000000000000
+[ 6.111744] RDX: 0000000000000104 RSI: ffffffff824c3208 RDI: 00000000ffffffff
+[ 6.112316] RBP: ffffc90000180d40 R08: 0000000000000000 R09: 00000000fffeffff
+[ 6.112893] R10: ffffc90000180b98 R11: ffffffff82f63308 R12: ffffffff83d5af00
+[ 6.113460] R13: ffff888100998200 R14: ffffffff824a4b5f R15: 0000000000000286
+[ 6.114027] FS: 0000000000000000(0000) GS:ffff88842fd80000(0000) knlGS:0000000000000000
+[ 6.114665] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 6.115128] CR2: 00007f10f1e03030 CR3: 0000000108272004 CR4: 0000000000770ee0
+[ 6.115701] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 6.116272] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 6.116842] PKRU: 55555554
+[ 6.117069] Call Trace:
+[ 6.117275] <IRQ>
+[ 6.117452] ? __warn+0x84/0x140
+[ 6.117727] ? check_sync+0x53e/0x6c0
+[ 6.118034] ? __report_bug+0xea/0x100
+[ 6.118353] ? check_sync+0x53e/0x6c0
+[ 6.118653] ? report_bug+0x41/0xc0
+[ 6.118944] ? handle_bug+0x3c/0x70
+[ 6.119237] ? exc_invalid_op+0x18/0x70
+[ 6.119551] ? asm_exc_invalid_op+0x1a/0x20
+[ 6.119900] ? check_sync+0x53e/0x6c0
+[ 6.120199] ? check_sync+0x53e/0x6c0
+[ 6.120499] debug_dma_sync_single_for_cpu+0x5c/0x70
+[ 6.120906] ? dma_sync_single_for_cpu+0xb7/0x100
+[ 6.121291] virtnet_rq_unmap+0x158/0x170 [virtio_net]
+[ 6.121716] virtnet_receive+0x196/0x220 [virtio_net]
+[ 6.122135] virtnet_poll+0x48/0x1b0 [virtio_net]
+[ 6.122524] __napi_poll+0x29/0x1b0
+[ 6.123083] net_rx_action+0x282/0x360
+[ 6.123612] __do_softirq+0xf3/0x2fb
+[ 6.124138] __irq_exit_rcu+0x8e/0xf0
+[ 6.124663] common_interrupt+0xbc/0xe0
+[ 6.125202] </IRQ>
+
+We need to enable CONFIG_DMA_API_DEBUG and work with need sync mode(such
+as swiotlb) to reproduce this warn.
+
+Fixes: 8bd2f71054bd ("virtio_ring: introduce dma sync api for virtqueue")
+Reported-by: "Ning, Hongyu" <hongyu.ning@linux.intel.com>
+Closes: https://lore.kernel.org/all/f37cb55a-6fc8-4e21-8789-46d468325eea@linux.intel.com/
+Suggested-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Message-Id: <20231201033303.25141-1-xuanzhuo@linux.alibaba.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Parav Pandit <parav@nvidia.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Tested-by: Hongyu Ning <hongyu.ning@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/virtio/virtio_ring.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -3039,8 +3039,7 @@ void virtqueue_dma_sync_single_range_for
+ if (!vq->use_dma_api)
+ return;
+
+- dma_sync_single_range_for_cpu(dev, addr, offset, size,
+- DMA_BIDIRECTIONAL);
++ dma_sync_single_range_for_cpu(dev, addr, offset, size, dir);
+ }
+ EXPORT_SYMBOL_GPL(virtqueue_dma_sync_single_range_for_cpu);
+
+@@ -3066,8 +3065,7 @@ void virtqueue_dma_sync_single_range_for
+ if (!vq->use_dma_api)
+ return;
+
+- dma_sync_single_range_for_device(dev, addr, offset, size,
+- DMA_BIDIRECTIONAL);
++ dma_sync_single_range_for_device(dev, addr, offset, size, dir);
+ }
+ EXPORT_SYMBOL_GPL(virtqueue_dma_sync_single_range_for_device);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
