--- /dev/null
+From 3cae906e1a6184cdc9e4d260e4dbdf9a118d94ad Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 4 Jun 2025 13:38:26 +0000
+Subject: calipso: unlock rcu before returning -EAFNOSUPPORT
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 3cae906e1a6184cdc9e4d260e4dbdf9a118d94ad upstream.
+
+syzbot reported that a recent patch forgot to unlock rcu
+in the error path.
+
+Adopt the convention that netlbl_conn_setattr() is already using.
+
+Fixes: 6e9f2df1c550 ("calipso: Don't call calipso functions for AF_INET sk.")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Kuniyuki Iwashima <kuniyu@amazon.com>
+Acked-by: Paul Moore <paul@paul-moore.com>
+Link: https://patch.msgid.link/20250604133826.1667664-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netlabel/netlabel_kapi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/netlabel/netlabel_kapi.c
++++ b/net/netlabel/netlabel_kapi.c
+@@ -1140,8 +1140,10 @@ int netlbl_conn_setattr(struct sock *sk,
+ break;
+ #if IS_ENABLED(CONFIG_IPV6)
+ case AF_INET6:
+- if (sk->sk_family != AF_INET6)
+- return -EAFNOSUPPORT;
++ if (sk->sk_family != AF_INET6) {
++ ret_val = -EAFNOSUPPORT;
++ goto conn_setattr_return;
++ }
+
+ addr6 = (struct sockaddr_in6 *)addr;
+ entry = netlbl_domhsh_getentry_af6(secattr->domain,
--- /dev/null
+From eb0851e14432f3b87c77b704c835ac376deda03a Mon Sep 17 00:00:00 2001
+From: I Hsin Cheng <richard120310@gmail.com>
+Date: Tue, 6 May 2025 02:43:38 +0800
+Subject: drm/meson: Use 1000ULL when operating with mode->clock
+
+From: I Hsin Cheng <richard120310@gmail.com>
+
+commit eb0851e14432f3b87c77b704c835ac376deda03a upstream.
+
+Coverity scan reported the usage of "mode->clock * 1000" may lead to
+integer overflow. Use "1000ULL" instead of "1000"
+when utilizing it to avoid potential integer overflow issue.
+
+Link: https://scan5.scan.coverity.com/#/project-view/10074/10063?selectedIssue=1646759
+Signed-off-by: I Hsin Cheng <richard120310@gmail.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Fixes: 1017560164b6 ("drm/meson: use unsigned long long / Hz for frequency types")
+Link: https://lore.kernel.org/r/20250505184338.678540-1-richard120310@gmail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/meson/meson_encoder_hdmi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/meson/meson_encoder_hdmi.c
++++ b/drivers/gpu/drm/meson/meson_encoder_hdmi.c
+@@ -75,7 +75,7 @@ static void meson_encoder_hdmi_set_vclk(
+ unsigned long long venc_freq;
+ unsigned long long hdmi_freq;
+
+- vclk_freq = mode->clock * 1000;
++ vclk_freq = mode->clock * 1000ULL;
+
+ /* For 420, pixel clock is half unlike venc clock */
+ if (encoder_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYYVYY8_0_5X24)
+@@ -123,7 +123,7 @@ static enum drm_mode_status meson_encode
+ struct meson_encoder_hdmi *encoder_hdmi = bridge_to_meson_encoder_hdmi(bridge);
+ struct meson_drm *priv = encoder_hdmi->priv;
+ bool is_hdmi2_sink = display_info->hdmi.scdc.supported;
+- unsigned long long clock = mode->clock * 1000;
++ unsigned long long clock = mode->clock * 1000ULL;
+ unsigned long long phy_freq;
+ unsigned long long vclk_freq;
+ unsigned long long venc_freq;
--- /dev/null
+From d3faab9b5a6a0477d69c38bd11c43aa5e936f929 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Wed, 28 May 2025 13:03:54 +0200
+Subject: net: usb: aqc111: debug info before sanitation
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit d3faab9b5a6a0477d69c38bd11c43aa5e936f929 upstream.
+
+If we sanitize error returns, the debug statements need
+to come before that so that we don't lose information.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Fixes: 405b0d610745 ("net: usb: aqc111: fix error handling of usbnet read calls")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/aqc111.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/usb/aqc111.c
++++ b/drivers/net/usb/aqc111.c
+@@ -31,11 +31,11 @@ static int aqc111_read_cmd_nopm(struct u
+ USB_RECIP_DEVICE, value, index, data, size);
+
+ if (unlikely(ret < size)) {
+- ret = ret < 0 ? ret : -ENODATA;
+-
+ netdev_warn(dev->net,
+ "Failed to read(0x%x) reg index 0x%04x: %d\n",
+ cmd, index, ret);
++
++ ret = ret < 0 ? ret : -ENODATA;
+ }
+
+ return ret;
+@@ -50,11 +50,11 @@ static int aqc111_read_cmd(struct usbnet
+ USB_RECIP_DEVICE, value, index, data, size);
+
+ if (unlikely(ret < size)) {
+- ret = ret < 0 ? ret : -ENODATA;
+-
+ netdev_warn(dev->net,
+ "Failed to read(0x%x) reg index 0x%04x: %d\n",
+ cmd, index, ret);
++
++ ret = ret < 0 ? ret : -ENODATA;
+ }
+
+ return ret;
--- /dev/null
+From 9cfdd7752ba5f8cc9b8191e8c9aeeec246241fa4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?N=C3=ADcolas=20F=2E=20R=2E=20A=2E=20Prado?=
+ <nfraprado@collabora.com>
+Date: Wed, 14 May 2025 08:36:06 -0400
+Subject: regulator: dt-bindings: mt6357: Drop fixed compatible requirement
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+commit 9cfdd7752ba5f8cc9b8191e8c9aeeec246241fa4 upstream.
+
+Some of the regulators on the MT6357 PMIC currently reference the
+fixed-regulator dt-binding, which enforces the presence of a
+regulator-fixed compatible. However since all regulators on the MT6357
+PMIC are handled by a single mt6357-regulator driver, probed through
+MFD, the compatibles don't serve any purpose. In fact they cause
+failures in the DT kselftest since they aren't probed by the fixed
+regulator driver as would be expected. Furthermore this is the only
+dt-binding in this family like this: mt6359-regulator and
+mt6358-regulator don't require those compatibles.
+
+Commit d77e89b7b03f ("arm64: dts: mediatek: mt6357: Drop regulator-fixed
+compatibles") removed the compatibles from Devicetree, but missed
+updating the binding, which still requires them, introducing dt-binding
+errors. Remove the compatible requirement by referencing the plain
+regulator dt-binding instead to fix the dt-binding errors.
+
+Fixes: d77e89b7b03f ("arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles")
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Link: https://patch.msgid.link/20250514-mt6357-regulator-fixed-compatibles-removal-bindings-v1-1-2421e9cc6cc7@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/regulator/mediatek,mt6357-regulator.yaml | 12 ----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+--- a/Documentation/devicetree/bindings/regulator/mediatek,mt6357-regulator.yaml
++++ b/Documentation/devicetree/bindings/regulator/mediatek,mt6357-regulator.yaml
+@@ -33,7 +33,7 @@ patternProperties:
+
+ "^ldo-v(camio18|aud28|aux18|io18|io28|rf12|rf18|cn18|cn28|fe28)$":
+ type: object
+- $ref: fixed-regulator.yaml#
++ $ref: regulator.yaml#
+ unevaluatedProperties: false
+ description:
+ Properties for single fixed LDO regulator.
+@@ -112,7 +112,6 @@ examples:
+ regulator-enable-ramp-delay = <220>;
+ };
+ mt6357_vfe28_reg: ldo-vfe28 {
+- compatible = "regulator-fixed";
+ regulator-name = "vfe28";
+ regulator-min-microvolt = <2800000>;
+ regulator-max-microvolt = <2800000>;
+@@ -125,14 +124,12 @@ examples:
+ regulator-enable-ramp-delay = <110>;
+ };
+ mt6357_vrf18_reg: ldo-vrf18 {
+- compatible = "regulator-fixed";
+ regulator-name = "vrf18";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ regulator-enable-ramp-delay = <110>;
+ };
+ mt6357_vrf12_reg: ldo-vrf12 {
+- compatible = "regulator-fixed";
+ regulator-name = "vrf12";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <1200000>;
+@@ -157,14 +154,12 @@ examples:
+ regulator-enable-ramp-delay = <264>;
+ };
+ mt6357_vcn28_reg: ldo-vcn28 {
+- compatible = "regulator-fixed";
+ regulator-name = "vcn28";
+ regulator-min-microvolt = <2800000>;
+ regulator-max-microvolt = <2800000>;
+ regulator-enable-ramp-delay = <264>;
+ };
+ mt6357_vcn18_reg: ldo-vcn18 {
+- compatible = "regulator-fixed";
+ regulator-name = "vcn18";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+@@ -183,7 +178,6 @@ examples:
+ regulator-enable-ramp-delay = <264>;
+ };
+ mt6357_vcamio_reg: ldo-vcamio18 {
+- compatible = "regulator-fixed";
+ regulator-name = "vcamio";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+@@ -212,28 +206,24 @@ examples:
+ regulator-always-on;
+ };
+ mt6357_vaux18_reg: ldo-vaux18 {
+- compatible = "regulator-fixed";
+ regulator-name = "vaux18";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ regulator-enable-ramp-delay = <264>;
+ };
+ mt6357_vaud28_reg: ldo-vaud28 {
+- compatible = "regulator-fixed";
+ regulator-name = "vaud28";
+ regulator-min-microvolt = <2800000>;
+ regulator-max-microvolt = <2800000>;
+ regulator-enable-ramp-delay = <264>;
+ };
+ mt6357_vio28_reg: ldo-vio28 {
+- compatible = "regulator-fixed";
+ regulator-name = "vio28";
+ regulator-min-microvolt = <2800000>;
+ regulator-max-microvolt = <2800000>;
+ regulator-enable-ramp-delay = <264>;
+ };
+ mt6357_vio18_reg: ldo-vio18 {
+- compatible = "regulator-fixed";
+ regulator-name = "vio18";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+++ /dev/null
-From 124c1b6097fb77fa32c2202976d004cf8d9269a1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 11 Jun 2025 08:05:52 +0300
-Subject: serial: sh-sci: Increment the runtime usage counter for the earlycon
- device
-
-From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
-
-commit 651dee03696e1dfde6d9a7e8664bbdcd9a10ea7f upstream.
-
-In the sh-sci driver, serial ports are mapped to the sci_ports[] array,
-with earlycon mapped at index zero.
-
-The uart_add_one_port() function eventually calls __device_attach(),
-which, in turn, calls pm_request_idle(). The identified code path is as
-follows:
-
-uart_add_one_port() ->
- serial_ctrl_register_port() ->
- serial_core_register_port() ->
- serial_core_port_device_add() ->
- serial_base_port_add() ->
- device_add() ->
- bus_probe_device() ->
- device_initial_probe() ->
- __device_attach() ->
- // ...
- if (dev->p->dead) {
- // ...
- } else if (dev->driver) {
- // ...
- } else {
- // ...
- pm_request_idle(dev);
- // ...
- }
-
-The earlycon device clocks are enabled by the bootloader. However, the
-pm_request_idle() call in __device_attach() disables the SCI port clocks
-while earlycon is still active.
-
-The earlycon write function, serial_console_write(), calls
-sci_poll_put_char() via serial_console_putchar(). If the SCI port clocks
-are disabled, writing to earlycon may sometimes cause the SR.TDFE bit to
-remain unset indefinitely, causing the while loop in sci_poll_put_char()
-to never exit. On single-core SoCs, this can result in the system being
-blocked during boot when this issue occurs.
-
-To resolve this, increment the runtime PM usage counter for the earlycon
-SCI device before registering the UART port.
-
-Fixes: 0b0cced19ab1 ("serial: sh-sci: Add CONFIG_SERIAL_EARLYCON support")
-Cc: stable@vger.kernel.org
-Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
-Link: https://lore.kernel.org/r/20250116182249.3828577-6-claudiu.beznea.uj@bp.renesas.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/tty/serial/sh-sci.c | 16 ++++++++++++++++
- 1 file changed, 16 insertions(+)
-
-diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
-index be7e57e1d1e36..dab5658d9d54a 100644
---- a/drivers/tty/serial/sh-sci.c
-+++ b/drivers/tty/serial/sh-sci.c
-@@ -3424,6 +3424,22 @@ static int sci_probe_single(struct platform_device *dev,
- }
-
- if (sci_uart_earlycon && sci_ports[0].port.mapbase == sci_res->start) {
-+ /*
-+ * In case:
-+ * - this is the earlycon port (mapped on index 0 in sci_ports[]) and
-+ * - it now maps to an alias other than zero and
-+ * - the earlycon is still alive (e.g., "earlycon keep_bootcon" is
-+ * available in bootargs)
-+ *
-+ * we need to avoid disabling clocks and PM domains through the runtime
-+ * PM APIs called in __device_attach(). For this, increment the runtime
-+ * PM reference counter (the clocks and PM domains were already enabled
-+ * by the bootloader). Otherwise the earlycon may access the HW when it
-+ * has no clocks enabled leading to failures (infinite loop in
-+ * sci_poll_put_char()).
-+ */
-+ pm_runtime_get_noresume(&dev->dev);
-+
- /*
- * Skip cleanup the sci_port[0] in early_console_exit(), this
- * port is the same as the earlycon one.
---
-2.39.5
-
serial-sh-sci-check-if-tx-data-was-written-to-device.patch
serial-sh-sci-move-runtime-pm-enable-to-sci_probe_si.patch
serial-sh-sci-clean-sci_ports-0-after-at-earlycon-ex.patch
-serial-sh-sci-increment-the-runtime-usage-counter-fo.patch
scsi-core-ufs-fix-a-hang-in-the-error-handler.patch
bluetooth-hci_core-fix-list_for_each_entry_rcu-usage.patch
bluetooth-mgmt-fix-uaf-on-mgmt_remove_adv_monitor_co.patch
usb-typec-tcpm-tcpci_maxim-fix-bounds-check-in-process_rx.patch
xen-arm-call-uaccess_ttbr0_enable-for-dm_op-hypercall.patch
x86-iopl-cure-tif_io_bitmap-inconsistencies.patch
+calipso-unlock-rcu-before-returning-eafnosupport.patch
+regulator-dt-bindings-mt6357-drop-fixed-compatible-requirement.patch
+net-usb-aqc111-debug-info-before-sanitation.patch
+drm-meson-use-1000ull-when-operating-with-mode-clock.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
