]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
6.1-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 22 Sep 2025 05:51:38 +0000 (07:51 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 22 Sep 2025 05:51:38 +0000 (07:51 +0200)
added patches:
asoc-q6apm-lpass-dai-close-graph-on-prepare-errors.patch
asoc-qcom-q6apm-lpass-dai-close-graphs-before-opening-a-new-one.patch
asoc-qcom-q6apm-lpass-dais-fix-null-pointer-dereference-if-source-graph-failed.patch
mptcp-propagate-shutdown-to-subflows-when-possible.patch
net-rfkill-gpio-add-dt-support.patch
net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch
selftests-mptcp-connect-catch-io-errors-on-listen-side.patch

queue-6.1/asoc-q6apm-lpass-dai-close-graph-on-prepare-errors.patch [new file with mode: 0644]
queue-6.1/asoc-qcom-q6apm-lpass-dai-close-graphs-before-opening-a-new-one.patch [new file with mode: 0644]
queue-6.1/asoc-qcom-q6apm-lpass-dais-fix-null-pointer-dereference-if-source-graph-failed.patch [new file with mode: 0644]
queue-6.1/mptcp-propagate-shutdown-to-subflows-when-possible.patch [new file with mode: 0644]
queue-6.1/net-rfkill-gpio-add-dt-support.patch [new file with mode: 0644]
queue-6.1/net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch [new file with mode: 0644]
queue-6.1/selftests-mptcp-connect-catch-io-errors-on-listen-side.patch [new file with mode: 0644]
queue-6.1/series

diff --git a/queue-6.1/asoc-q6apm-lpass-dai-close-graph-on-prepare-errors.patch b/queue-6.1/asoc-q6apm-lpass-dai-close-graph-on-prepare-errors.patch
new file mode 100644 (file)
index 0000000..65217b0
--- /dev/null
@@ -0,0 +1,109 @@
+From stable+bounces-180847-greg=kroah.com@vger.kernel.org Mon Sep 22 01:16:22 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 19:16:10 -0400
+Subject: ASoC: q6apm-lpass-dai: close graph on prepare errors
+To: stable@vger.kernel.org
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>, Dmitry Baryshkov <dmitry.baryshkov@linaro.org>, Mark Brown <broonie@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250921231611.3032852-2-sashal@kernel.org>
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit be1fae62cf253a5b67526cee9fbc07689b97c125 ]
+
+There is an issue around with error handling and graph management with
+the exising code, none of the error paths close the graph, which result in
+leaving the loaded graph in dsp, however the driver thinks otherwise.
+
+This can have a nasty side effect specially when we try to load the same
+graph to dsp, dsp returns error which leaves the board with no sound and
+requires restart.
+
+Fix this by properly closing the graph when we hit errors between
+open and close.
+
+Fixes: 30ad723b93ad ("ASoC: qdsp6: audioreach: add q6apm lpass dai support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> # X13s
+Link: https://lore.kernel.org/r/20240613-q6apm-fixes-v1-1-d88953675ab3@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 68f27f7c7708 ("ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/qcom/qdsp6/q6apm-lpass-dais.c |   32 ++++++++++++++++++++------------
+ 1 file changed, 20 insertions(+), 12 deletions(-)
+
+--- a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c
++++ b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c
+@@ -109,14 +109,17 @@ static void q6apm_lpass_dai_shutdown(str
+       struct q6apm_lpass_dai_data *dai_data = dev_get_drvdata(dai->dev);
+       int rc;
+-      if (!dai_data->is_port_started[dai->id])
+-              return;
+-      rc = q6apm_graph_stop(dai_data->graph[dai->id]);
+-      if (rc < 0)
+-              dev_err(dai->dev, "fail to close APM port (%d)\n", rc);
++      if (dai_data->is_port_started[dai->id]) {
++              rc = q6apm_graph_stop(dai_data->graph[dai->id]);
++              dai_data->is_port_started[dai->id] = false;
++              if (rc < 0)
++                      dev_err(dai->dev, "fail to close APM port (%d)\n", rc);
++      }
+-      q6apm_graph_close(dai_data->graph[dai->id]);
+-      dai_data->is_port_started[dai->id] = false;
++      if (dai_data->graph[dai->id]) {
++              q6apm_graph_close(dai_data->graph[dai->id]);
++              dai_data->graph[dai->id] = NULL;
++      }
+ }
+ static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct snd_soc_dai *dai)
+@@ -131,8 +134,10 @@ static int q6apm_lpass_dai_prepare(struc
+               q6apm_graph_stop(dai_data->graph[dai->id]);
+               dai_data->is_port_started[dai->id] = false;
+-              if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
++              if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+                       q6apm_graph_close(dai_data->graph[dai->id]);
++                      dai_data->graph[dai->id] = NULL;
++              }
+       }
+       /**
+@@ -151,26 +156,29 @@ static int q6apm_lpass_dai_prepare(struc
+       cfg->direction = substream->stream;
+       rc = q6apm_graph_media_format_pcm(dai_data->graph[dai->id], cfg);
+-
+       if (rc) {
+               dev_err(dai->dev, "Failed to set media format %d\n", rc);
+-              return rc;
++              goto err;
+       }
+       rc = q6apm_graph_prepare(dai_data->graph[dai->id]);
+       if (rc) {
+               dev_err(dai->dev, "Failed to prepare Graph %d\n", rc);
+-              return rc;
++              goto err;
+       }
+       rc = q6apm_graph_start(dai_data->graph[dai->id]);
+       if (rc < 0) {
+               dev_err(dai->dev, "fail to start APM port %x\n", dai->id);
+-              return rc;
++              goto err;
+       }
+       dai_data->is_port_started[dai->id] = true;
+       return 0;
++err:
++      q6apm_graph_close(dai_data->graph[dai->id]);
++      dai_data->graph[dai->id] = NULL;
++      return rc;
+ }
+ static int q6apm_lpass_dai_startup(struct snd_pcm_substream *substream, struct snd_soc_dai *dai)
diff --git a/queue-6.1/asoc-qcom-q6apm-lpass-dai-close-graphs-before-opening-a-new-one.patch b/queue-6.1/asoc-qcom-q6apm-lpass-dai-close-graphs-before-opening-a-new-one.patch
new file mode 100644 (file)
index 0000000..80e21f9
--- /dev/null
@@ -0,0 +1,39 @@
+From stable+bounces-180846-greg=kroah.com@vger.kernel.org Mon Sep 22 01:16:20 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 19:16:09 -0400
+Subject: ASoC: qcom: q6apm-lpass-dai: close graphs before opening a new one
+To: stable@vger.kernel.org
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>, Mark Brown <broonie@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250921231611.3032852-1-sashal@kernel.org>
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit c52615e494f17f44b076ac8ae5a53cfc0041a0dd ]
+
+On multiple prepare calls, its possible that the playback graphs are
+not unloaded from the DSP, which can have some wierd side-effects,
+one of them is that the data not consumed without any errors.
+
+Fixes: c2ac3aec474d("ASoC: qcom: q6apm-lpass-dai: unprepare stream if its already prepared")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230323164403.6654-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 68f27f7c7708 ("ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/qcom/qdsp6/q6apm-lpass-dais.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c
++++ b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c
+@@ -130,6 +130,9 @@ static int q6apm_lpass_dai_prepare(struc
+       if (dai_data->is_port_started[dai->id]) {
+               q6apm_graph_stop(dai_data->graph[dai->id]);
+               dai_data->is_port_started[dai->id] = false;
++
++              if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
++                      q6apm_graph_close(dai_data->graph[dai->id]);
+       }
+       /**
diff --git a/queue-6.1/asoc-qcom-q6apm-lpass-dais-fix-null-pointer-dereference-if-source-graph-failed.patch b/queue-6.1/asoc-qcom-q6apm-lpass-dais-fix-null-pointer-dereference-if-source-graph-failed.patch
new file mode 100644 (file)
index 0000000..d002c28
--- /dev/null
@@ -0,0 +1,59 @@
+From stable+bounces-180848-greg=kroah.com@vger.kernel.org Mon Sep 22 01:16:21 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 19:16:11 -0400
+Subject: ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed
+To: stable@vger.kernel.org
+Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>, Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>, Mark Brown <broonie@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250921231611.3032852-3-sashal@kernel.org>
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 68f27f7c7708183e7873c585ded2f1b057ac5b97 ]
+
+If earlier opening of source graph fails (e.g. ADSP rejects due to
+incorrect audioreach topology), the graph is closed and
+"dai_data->graph[dai->id]" is assigned NULL.  Preparing the DAI for sink
+graph continues though and next call to q6apm_lpass_dai_prepare()
+receives dai_data->graph[dai->id]=NULL leading to NULL pointer
+exception:
+
+  qcom-apm gprsvc:service:2:1: Error (1) Processing 0x01001002 cmd
+  qcom-apm gprsvc:service:2:1: DSP returned error[1001002] 1
+  q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: fail to start APM port 78
+  q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: ASoC: error at snd_soc_pcm_dai_prepare on TX_CODEC_DMA_TX_3: -22
+  Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a8
+  ...
+  Call trace:
+   q6apm_graph_media_format_pcm+0x48/0x120 (P)
+   q6apm_lpass_dai_prepare+0x110/0x1b4
+   snd_soc_pcm_dai_prepare+0x74/0x108
+   __soc_pcm_prepare+0x44/0x160
+   dpcm_be_dai_prepare+0x124/0x1c0
+
+Fixes: 30ad723b93ad ("ASoC: qdsp6: audioreach: add q6apm lpass dai support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+Message-ID: <20250904101849.121503-2-krzysztof.kozlowski@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/qcom/qdsp6/q6apm-lpass-dais.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c
++++ b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c
+@@ -176,8 +176,10 @@ static int q6apm_lpass_dai_prepare(struc
+       return 0;
+ err:
+-      q6apm_graph_close(dai_data->graph[dai->id]);
+-      dai_data->graph[dai->id] = NULL;
++      if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
++              q6apm_graph_close(dai_data->graph[dai->id]);
++              dai_data->graph[dai->id] = NULL;
++      }
+       return rc;
+ }
diff --git a/queue-6.1/mptcp-propagate-shutdown-to-subflows-when-possible.patch b/queue-6.1/mptcp-propagate-shutdown-to-subflows-when-possible.patch
new file mode 100644 (file)
index 0000000..de0817e
--- /dev/null
@@ -0,0 +1,83 @@
+From stable+bounces-180864-greg=kroah.com@vger.kernel.org Mon Sep 22 02:44:14 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 20:44:04 -0400
+Subject: mptcp: propagate shutdown to subflows when possible
+To: stable@vger.kernel.org
+Cc: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Mat Martineau <martineau@kernel.org>, Geliang Tang <geliang@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250922004404.3108078-1-sashal@kernel.org>
+
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+
+[ Upstream commit f755be0b1ff429a2ecf709beeb1bcd7abc111c2b ]
+
+When the MPTCP DATA FIN have been ACKed, there is no more MPTCP related
+metadata to exchange, and all subflows can be safely shutdown.
+
+Before this patch, the subflows were actually terminated at 'close()'
+time. That's certainly fine most of the time, but not when the userspace
+'shutdown()' a connection, without close()ing it. When doing so, the
+subflows were staying in LAST_ACK state on one side -- and consequently
+in FIN_WAIT2 on the other side -- until the 'close()' of the MPTCP
+socket.
+
+Now, when the DATA FIN have been ACKed, all subflows are shutdown. A
+consequence of this is that the TCP 'FIN' flag can be set earlier now,
+but the end result is the same. This affects the packetdrill tests
+looking at the end of the MPTCP connections, but for a good reason.
+
+Note that tcp_shutdown() will check the subflow state, so no need to do
+that again before calling it.
+
+Fixes: 3721b9b64676 ("mptcp: Track received DATA_FIN sequence number and add related helpers")
+Cc: stable@vger.kernel.org
+Fixes: 16a9a9da1723 ("mptcp: Add helper to process acks of DATA_FIN")
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20250912-net-mptcp-fix-sft-connect-v1-1-d40e77cbbf02@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c |   15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -425,6 +425,19 @@ static void mptcp_close_wake_up(struct s
+               sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
+ }
++static void mptcp_shutdown_subflows(struct mptcp_sock *msk)
++{
++      struct mptcp_subflow_context *subflow;
++
++      mptcp_for_each_subflow(msk, subflow) {
++              struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
++              bool slow;
++
++              slow = lock_sock_fast(ssk);
++              tcp_shutdown(ssk, SEND_SHUTDOWN);
++              unlock_sock_fast(ssk, slow);
++      }
++}
+ static bool mptcp_pending_data_fin_ack(struct sock *sk)
+ {
+       struct mptcp_sock *msk = mptcp_sk(sk);
+@@ -448,6 +461,7 @@ static void mptcp_check_data_fin_ack(str
+                       break;
+               case TCP_CLOSING:
+               case TCP_LAST_ACK:
++                      mptcp_shutdown_subflows(msk);
+                       inet_sk_state_store(sk, TCP_CLOSE);
+                       break;
+               }
+@@ -615,6 +629,7 @@ static bool mptcp_check_data_fin(struct
+                       inet_sk_state_store(sk, TCP_CLOSING);
+                       break;
+               case TCP_FIN_WAIT2:
++                      mptcp_shutdown_subflows(msk);
+                       inet_sk_state_store(sk, TCP_CLOSE);
+                       break;
+               default:
diff --git a/queue-6.1/net-rfkill-gpio-add-dt-support.patch b/queue-6.1/net-rfkill-gpio-add-dt-support.patch
new file mode 100644 (file)
index 0000000..4758067
--- /dev/null
@@ -0,0 +1,77 @@
+From stable+bounces-180851-greg=kroah.com@vger.kernel.org Mon Sep 22 01:30:15 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 19:29:57 -0400
+Subject: net: rfkill: gpio: add DT support
+To: stable@vger.kernel.org
+Cc: Philipp Zabel <p.zabel@pengutronix.de>, Johannes Berg <johannes.berg@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250921232958.3084822-1-sashal@kernel.org>
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit d64c732dfc9edcd57feb693c23162117737e426b ]
+
+Allow probing rfkill-gpio via device tree. This hooks up the already
+existing support that was started in commit 262c91ee5e52 ("net:
+rfkill: gpio: prepare for DT and ACPI support") via the "rfkill-gpio"
+compatible, with the "name" and "type" properties renamed to "label"
+and "radio-type", respectively, in the device tree case.
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Link: https://lore.kernel.org/r/20230102-rfkill-gpio-dt-v2-2-d1b83758c16d@pengutronix.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Stable-dep-of: b6f56a44e4c1 ("net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rfkill/rfkill-gpio.c |   20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+--- a/net/rfkill/rfkill-gpio.c
++++ b/net/rfkill/rfkill-gpio.c
+@@ -79,6 +79,8 @@ static int rfkill_gpio_probe(struct plat
+ {
+       struct rfkill_gpio_data *rfkill;
+       struct gpio_desc *gpio;
++      const char *name_property;
++      const char *type_property;
+       const char *type_name;
+       int ret;
+@@ -86,8 +88,15 @@ static int rfkill_gpio_probe(struct plat
+       if (!rfkill)
+               return -ENOMEM;
+-      device_property_read_string(&pdev->dev, "name", &rfkill->name);
+-      device_property_read_string(&pdev->dev, "type", &type_name);
++      if (dev_of_node(&pdev->dev)) {
++              name_property = "label";
++              type_property = "radio-type";
++      } else {
++              name_property = "name";
++              type_property = "type";
++      }
++      device_property_read_string(&pdev->dev, name_property, &rfkill->name);
++      device_property_read_string(&pdev->dev, type_property, &type_name);
+       if (!rfkill->name)
+               rfkill->name = dev_name(&pdev->dev);
+@@ -169,12 +178,19 @@ static const struct acpi_device_id rfkil
+ MODULE_DEVICE_TABLE(acpi, rfkill_acpi_match);
+ #endif
++static const struct of_device_id rfkill_of_match[] __maybe_unused = {
++      { .compatible = "rfkill-gpio", },
++      { },
++};
++MODULE_DEVICE_TABLE(of, rfkill_of_match);
++
+ static struct platform_driver rfkill_gpio_driver = {
+       .probe = rfkill_gpio_probe,
+       .remove = rfkill_gpio_remove,
+       .driver = {
+               .name = "rfkill_gpio",
+               .acpi_match_table = ACPI_PTR(rfkill_acpi_match),
++              .of_match_table = of_match_ptr(rfkill_of_match),
+       },
+ };
diff --git a/queue-6.1/net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch b/queue-6.1/net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch
new file mode 100644 (file)
index 0000000..91ca6f5
--- /dev/null
@@ -0,0 +1,60 @@
+From stable+bounces-180852-greg=kroah.com@vger.kernel.org Mon Sep 22 01:30:07 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 19:29:58 -0400
+Subject: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
+To: stable@vger.kernel.org
+Cc: Hans de Goede <hansg@kernel.org>, Heikki Krogerus <heikki.krogerus@linux.intel.com>, Johannes Berg <johannes.berg@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250921232958.3084822-2-sashal@kernel.org>
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit b6f56a44e4c1014b08859dcf04ed246500e310e5 ]
+
+Since commit 7d5e9737efda ("net: rfkill: gpio: get the name and type from
+device property") rfkill_find_type() gets called with the possibly
+uninitialized "const char *type_name;" local variable.
+
+On x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752"
+acpi_device, the rfkill->type is set based on the ACPI acpi_device_id:
+
+        rfkill->type = (unsigned)id->driver_data;
+
+and there is no "type" property so device_property_read_string() will fail
+and leave type_name uninitialized, leading to a potential crash.
+
+rfkill_find_type() does accept a NULL pointer, fix the potential crash
+by initializing type_name to NULL.
+
+Note likely sofar this has not been caught because:
+
+1. Not many x86 machines actually have a "BCM4752"/"LNV4752" acpi_device
+2. The stack happened to contain NULL where type_name is stored
+
+Fixes: 7d5e9737efda ("net: rfkill: gpio: get the name and type from device property")
+Cc: stable@vger.kernel.org
+Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://patch.msgid.link/20250913113515.21698-1-hansg@kernel.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rfkill/rfkill-gpio.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/rfkill/rfkill-gpio.c
++++ b/net/rfkill/rfkill-gpio.c
+@@ -78,10 +78,10 @@ static int rfkill_gpio_acpi_probe(struct
+ static int rfkill_gpio_probe(struct platform_device *pdev)
+ {
+       struct rfkill_gpio_data *rfkill;
+-      struct gpio_desc *gpio;
++      const char *type_name = NULL;
+       const char *name_property;
+       const char *type_property;
+-      const char *type_name;
++      struct gpio_desc *gpio;
+       int ret;
+       rfkill = devm_kzalloc(&pdev->dev, sizeof(*rfkill), GFP_KERNEL);
diff --git a/queue-6.1/selftests-mptcp-connect-catch-io-errors-on-listen-side.patch b/queue-6.1/selftests-mptcp-connect-catch-io-errors-on-listen-side.patch
new file mode 100644 (file)
index 0000000..d451a91
--- /dev/null
@@ -0,0 +1,75 @@
+From stable+bounces-180863-greg=kroah.com@vger.kernel.org Mon Sep 22 02:43:13 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Sep 2025 20:43:04 -0400
+Subject: selftests: mptcp: connect: catch IO errors on listen side
+To: stable@vger.kernel.org
+Cc: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>, Mat Martineau <martineau@kernel.org>, Geliang Tang <geliang@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250922004304.3106590-1-sashal@kernel.org>
+
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+
+[ Upstream commit 14e22b43df25dbd4301351b882486ea38892ae4f ]
+
+IO errors were correctly printed to stderr, and propagated up to the
+main loop for the server side, but the returned value was ignored. As a
+consequence, the program for the listener side was no longer exiting
+with an error code in case of IO issues.
+
+Because of that, some issues might not have been seen. But very likely,
+most issues either had an effect on the client side, or the file
+transfer was not the expected one, e.g. the connection got reset before
+the end. Still, it is better to fix this.
+
+The main consequence of this issue is the error that was reported by the
+selftests: the received and sent files were different, and the MIB
+counters were not printed. Also, when such errors happened during the
+'disconnect' tests, the program tried to continue until the timeout.
+
+Now when an IO error is detected, the program exits directly with an
+error.
+
+Fixes: 05be5e273c84 ("selftests: mptcp: add disconnect tests")
+Cc: stable@vger.kernel.org
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20250912-net-mptcp-fix-sft-connect-v1-2-d40e77cbbf02@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_connect.c |    7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
++++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
+@@ -1005,6 +1005,7 @@ int main_loop_s(int listensock)
+       struct pollfd polls;
+       socklen_t salen;
+       int remotesock;
++      int err = 0;
+       int fd = 0;
+ again:
+@@ -1036,7 +1037,7 @@ again:
+               SOCK_TEST_TCPULP(remotesock, 0);
+-              copyfd_io(fd, remotesock, 1, true);
++              err = copyfd_io(fd, remotesock, 1, true, &winfo);
+       } else {
+               perror("accept");
+               return 1;
+@@ -1045,10 +1046,10 @@ again:
+       if (cfg_input)
+               close(fd);
+-      if (--cfg_repeat > 0)
++      if (!err && --cfg_repeat > 0)
+               goto again;
+-      return 0;
++      return err;
+ }
+ static void init_rng(void)
index 5cb586ec3e265d16cf1cec964ba64e4225b238ef..e42a6d30f21ca1cac621807bdc48bf182e98c1ff 100644 (file)
@@ -50,3 +50,10 @@ phy-use-device_get_match_data.patch
 phy-ti-omap-usb2-fix-device-leak-at-unbind.patch
 xhci-dbc-decouple-endpoint-allocation-from-initialization.patch
 xhci-dbc-fix-full-dbc-transfer-ring-after-several-reconnects.patch
+mptcp-propagate-shutdown-to-subflows-when-possible.patch
+selftests-mptcp-connect-catch-io-errors-on-listen-side.patch
+net-rfkill-gpio-add-dt-support.patch
+net-rfkill-gpio-fix-crash-due-to-dereferencering-uninitialized-pointer.patch
+asoc-qcom-q6apm-lpass-dai-close-graphs-before-opening-a-new-one.patch
+asoc-q6apm-lpass-dai-close-graph-on-prepare-errors.patch
+asoc-qcom-q6apm-lpass-dais-fix-null-pointer-dereference-if-source-graph-failed.patch