--- /dev/null
+From 1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1 Mon Sep 17 00:00:00 2001
+From: Jeremy Linton <jeremy.linton@arm.com>
+Date: Mon, 1 Jun 2026 18:58:08 -0500
+Subject: ACPI: CPPC: Suppress UBSAN warning caused by field misuse
+
+From: Jeremy Linton <jeremy.linton@arm.com>
+
+commit 1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1 upstream.
+
+The definition of reg->access_width changes depending on the
+reg->space_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses
+access_width to indicate the PCC region, which can result in a UBSAN
+if the value is greater than 4.
+
+For example:
+
+ UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9
+ shift exponent 32 is too large for 32-bit type 'int'
+ CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy)
+ Hardware name: To be filled by O.E.M.
+ Call trace:
+ ...(trimming)
+ ubsan_epilogue+0x10/0x48
+ __ubsan_handle_shift_out_of_bounds+0xdc/0x1e0
+ cpc_write+0x4d0/0x670
+ cppc_set_perf+0x18c/0x490
+ cppc_cpufreq_cpu_init+0x1c8/0x380 [cppc_cpufreq]
+ ... (trimming)
+
+Lets fix this by validating the region type, as well as whether
+access_width has a value. Then since we are returning bit_width
+directly for ACPI_ADR_SPACE_PLATFORM_COMM, drop the code correcting
+the size.
+
+Fixes: 2f4a4d63a193 ("ACPI: CPPC: Use access_width over bit_width for system memory accesses")
+Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
+Tested-by: Jarred White <jarredwhite@linux.microsoft.com>
+Reviewed-by: Jarred White <jarredwhite@linux.microsoft.com>
+Reviewed-by: Easwar Hariharan <easwar.hariharan@linux.microsoft.com>
+Cc: All applicable <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20260601235808.1113137-1-jeremy.linton@arm.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/cppc_acpi.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -185,8 +185,13 @@ show_cppc_data(cppc_get_perf_caps, cppc_
+
+ show_cppc_data(cppc_get_perf_ctrs, cppc_perf_fb_ctrs, wraparound_time);
+
+-/* Check for valid access_width, otherwise, fallback to using bit_width */
+-#define GET_BIT_WIDTH(reg) ((reg)->access_width ? (8 << ((reg)->access_width - 1)) : (reg)->bit_width)
++/*
++ * PCC reuses the access_width field as the subspace id, so only decode access
++ * size for non-PCC registers. Otherwise, use the bit_width.
++ */
++#define GET_BIT_WIDTH(reg) (((reg)->access_width && \
++ (reg)->space_id != ACPI_ADR_SPACE_PLATFORM_COMM) ? \
++ (8 << ((reg)->access_width - 1)) : (reg)->bit_width)
+
+ /* Shift and apply the mask for CPC reads/writes */
+ #define MASK_VAL_READ(reg, val) (((val) >> (reg)->bit_offset) & \
+@@ -1045,7 +1050,6 @@ static int cpc_read(int cpu, struct cpc_
+ * by the bit width field; the access size is used to indicate
+ * the PCC subspace id.
+ */
+- size = reg->bit_width;
+ vaddr = GET_PCC_VADDR(reg->address, pcc_ss_id);
+ }
+ else if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
+@@ -1118,7 +1122,6 @@ static int cpc_write(int cpu, struct cpc
+ * by the bit width field; the access size is used to indicate
+ * the PCC subspace id.
+ */
+- size = reg->bit_width;
+ vaddr = GET_PCC_VADDR(reg->address, pcc_ss_id);
+ }
+ else if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
--- /dev/null
+From 38bf27511ef41bffebd157ec3eba41fc89ba59cd Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Wed, 3 Jun 2026 19:57:02 +0200
+Subject: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 38bf27511ef41bffebd157ec3eba41fc89ba59cd upstream.
+
+If acpi_nfit_init() fails after adding the acpi_desc object to the
+acpi_descs list, that object is never removed from that list because
+the acpi_nfit_shutdown() devm action is not added for the NFIT device
+in that case. Next, the acpi_nfit_init() failure causes
+acpi_nfit_probe() to fail, the acpi_desc object is freed, and a
+dangling pointer is left behind in the acpi_descs. Any subsequent
+ACPI Machine Check Exception will trigger nfit_handle_mce() which
+iterates over acpi_descs and so a use-after-free will occur.
+
+Moreover, if acpi_nfit_probe() returns 0 after installing a notify
+handler for the NFIT device and without allocating the acpi_desc
+object and setting the NFIT device's driver data pointer, the
+acpi_desc object will be allocated by acpi_nfit_update_notify()
+and acpi_nfit_init() will be called to initialize it. Regardless
+of whether or not acpi_nfit_init() fails in that case, the
+acpi_nfit_shutdown() devm action is not added for the NFIT device
+and acpi_desc is never removed from the acpi_descs list. If the
+acpi_desc object is freed subsequently on driver removal, any
+subsequent ACPI MCE will lead to a use-after-free like in the
+previous case.
+
+To address the first issue mentioned above, make acpi_nfit_probe()
+call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and
+to address the other one, add a remove callback to the driver and
+make it call acpi_nfit_shutdown(). Also, since it is now possible to
+pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it
+may not have been initialized, add checks against NULL for acpi_desc and
+its nvdimm_bus field to that function and make acpi_nfit_unregister()
+clear the latter after unregistering the NVDIMM bus.
+
+Fixes: a61fe6f7902e ("nfit, tools/testing/nvdimm: unify common init for acpi_nfit_desc")
+Fixes: fbabd829fe76 ("acpi, nfit: fix module unload vs workqueue shutdown race")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: All applicable <stable@vger.kernel.org>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://patch.msgid.link/1963615.tdWV9SEqCh@rafael.j.wysocki
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/nfit/core.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -3069,6 +3069,8 @@ static void acpi_nfit_unregister(void *d
+ struct acpi_nfit_desc *acpi_desc = data;
+
+ nvdimm_bus_unregister(acpi_desc->nvdimm_bus);
++ /* The nvdimm_bus object may have been freed, so clear the pointer. */
++ acpi_desc->nvdimm_bus = NULL;
+ }
+
+ int acpi_nfit_init(struct acpi_nfit_desc *acpi_desc, void *data, acpi_size sz)
+@@ -3309,7 +3311,10 @@ static void acpi_nfit_remove_notify_hand
+ void acpi_nfit_shutdown(void *data)
+ {
+ struct acpi_nfit_desc *acpi_desc = data;
+- struct device *bus_dev = to_nvdimm_bus_dev(acpi_desc->nvdimm_bus);
++ struct device *bus_dev;
++
++ if (!acpi_desc || !acpi_desc->nvdimm_bus)
++ return;
+
+ /*
+ * Destruct under acpi_desc_lock so that nfit_handle_mce does not
+@@ -3324,6 +3329,7 @@ void acpi_nfit_shutdown(void *data)
+ mutex_unlock(&acpi_desc->init_mutex);
+ cancel_delayed_work_sync(&acpi_desc->dwork);
+
++ bus_dev = to_nvdimm_bus_dev(acpi_desc->nvdimm_bus);
+ /*
+ * Bounce the nvdimm bus lock to make sure any in-flight
+ * acpi_nfit_ars_rescan() submissions have had a chance to
+@@ -3406,9 +3412,14 @@ static int acpi_nfit_probe(struct platfo
+ sz - sizeof(struct acpi_table_nfit));
+
+ if (rc)
+- return rc;
++ acpi_nfit_shutdown(acpi_desc);
+
+- return devm_add_action_or_reset(dev, acpi_nfit_shutdown, acpi_desc);
++ return rc;
++}
++
++static void acpi_nfit_remove(struct platform_device *pdev)
++{
++ acpi_nfit_shutdown(platform_get_drvdata(pdev));
+ }
+
+ static void acpi_nfit_update_notify(struct device *dev, acpi_handle handle)
+@@ -3492,6 +3503,7 @@ MODULE_DEVICE_TABLE(acpi, acpi_nfit_ids)
+
+ static struct platform_driver acpi_nfit_driver = {
+ .probe = acpi_nfit_probe,
++ .remove = acpi_nfit_remove,
+ .driver = {
+ .name = "acpi-nfit",
+ .acpi_match_table = acpi_nfit_ids,
--- /dev/null
+From 027e128abb82788189d6d45b68e3e8e7329b67be Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Wed, 3 Jun 2026 19:56:21 +0200
+Subject: ACPI: NFIT: core: Fix possible NULL pointer dereference
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 027e128abb82788189d6d45b68e3e8e7329b67be upstream.
+
+After commit 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before
+getting NFIT table"), acpi_nfit_probe() installs an ACPI notify handler
+for the NFIT device before checking the presence of the NFIT table. If
+that table is not there, 0 is returned without allocating the acpi_desc
+object and setting the driver data pointer of the NFIT device. If the
+platform firmware triggers an NFIT_NOTIFY_UC_MEMORY_ERROR notification
+on the NFIT device at that point, acpi_nfit_uc_error_notify() will
+dereference a NULL pointer.
+
+Prevent that from occurring by adding an acpi_desc check against NULL
+to acpi_nfit_uc_error_notify().
+
+Fixes: 9b311b7313d6 ("ACPI: NFIT: Install Notify() handler before getting NFIT table")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: All applicable <stable@vger.kernel.org>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://patch.msgid.link/2418508.ElGaqSPkdT@rafael.j.wysocki
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/nfit/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -3460,6 +3460,9 @@ static void acpi_nfit_uc_error_notify(st
+ {
+ struct acpi_nfit_desc *acpi_desc = dev_get_drvdata(dev);
+
++ if (!acpi_desc)
++ return;
++
+ if (acpi_desc->scrub_mode == HW_ERROR_SCRUB_ON)
+ acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_LONG);
+ else
--- /dev/null
+From 6061e65f95713b01f4313cda6637dfe3aa5412b4 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhuacai@loongson.cn>
+Date: Thu, 25 Jun 2026 13:03:47 +0800
+Subject: LoongArch: Add PIO for early access before ACPI PCI root register
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+commit 6061e65f95713b01f4313cda6637dfe3aa5412b4 upstream.
+
+For ACPI system we suppose the ISA/LPC PIO range is registered together
+with PCI root bridge. But the fact is there may be some early access to
+the ISA/LPC PIO range before ACPI PCI root register (most of them are
+due to abnormal BIOS). Unconditionally register the ISA/LPC PIO range
+usually causes ACPI PCI root register fail because of the address range
+confliction. So we add a pair of helpers: acpi_add_early_pio() to add
+PIO for early access, and acpi_remove_early_pio() to remove PIO before
+PCI root register. Since acpi_remove_early_pio() may be called multiple
+times, we add an acpi_pio flag to ensure PIO be removed only once.
+
+Cc: <stable@vger.kernel.org>
+Tested-by: Yuanzhen Gan <elysia-best@simplelinux.cn.eu.org>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/include/asm/acpi.h | 2 ++
+ arch/loongarch/kernel/acpi.c | 28 ++++++++++++++++++++++++++++
+ arch/loongarch/kernel/setup.c | 2 ++
+ arch/loongarch/pci/acpi.c | 2 ++
+ 4 files changed, 34 insertions(+)
+
+--- a/arch/loongarch/include/asm/acpi.h
++++ b/arch/loongarch/include/asm/acpi.h
+@@ -38,6 +38,8 @@ static inline bool acpi_has_cpu_in_madt(
+ extern struct list_head acpi_wakeup_device_list;
+ extern struct acpi_madt_core_pic acpi_core_pic[MAX_CORE_PIC];
+
++extern void acpi_add_early_pio(void);
++extern void acpi_remove_early_pio(void);
+ extern int __init parse_acpi_topology(void);
+
+ #endif /* !CONFIG_ACPI */
+--- a/arch/loongarch/kernel/acpi.c
++++ b/arch/loongarch/kernel/acpi.c
+@@ -16,6 +16,7 @@
+ #include <linux/memblock.h>
+ #include <linux/of_fdt.h>
+ #include <linux/serial_core.h>
++#include <linux/vmalloc.h>
+ #include <asm/io.h>
+ #include <asm/numa.h>
+ #include <asm/loongson.h>
+@@ -59,6 +60,33 @@ void __iomem *acpi_os_ioremap(acpi_physi
+ return ioremap_cache(phys, size);
+ }
+
++#define PIO_BASE (unsigned long)PCI_IOBASE
++#define PIO_SIZE ALIGN(ISA_IOSIZE, PAGE_SIZE)
++
++static bool acpi_pio;
++
++/* Add PIO for early access */
++void acpi_add_early_pio(void)
++{
++ if (!acpi_disabled) {
++ acpi_pio = true;
++ vmap_page_range(PIO_BASE, PIO_BASE + PIO_SIZE,
++ LOONGSON_LIO_BASE, pgprot_device(PAGE_KERNEL));
++ }
++}
++
++/* Remove PIO for PCI register */
++void acpi_remove_early_pio(void)
++{
++ if (!acpi_pio)
++ return;
++
++ if (!acpi_disabled) {
++ acpi_pio = false;
++ vunmap_range(PIO_BASE, PIO_BASE + PIO_SIZE);
++ }
++}
++
+ #ifdef CONFIG_SMP
+ static int set_processor_mask(u32 id, u32 pass)
+ {
+--- a/arch/loongarch/kernel/setup.c
++++ b/arch/loongarch/kernel/setup.c
+@@ -502,6 +502,8 @@ static __init int arch_reserve_pio_range
+ {
+ struct device_node *np;
+
++ acpi_add_early_pio();
++
+ for_each_node_by_name(np, "isa") {
+ struct of_range range;
+ struct of_range_parser parser;
+--- a/arch/loongarch/pci/acpi.c
++++ b/arch/loongarch/pci/acpi.c
+@@ -65,6 +65,8 @@ static int acpi_prepare_root_resources(s
+ struct resource_entry *entry, *tmp;
+ struct acpi_device *device = ci->bridge;
+
++ acpi_remove_early_pio();
++
+ status = acpi_pci_probe_root_resources(ci);
+ if (status > 0) {
+ acpi_evaluate_integer(device->handle, "PCIH", NULL, &pci_h);
--- /dev/null
+From c085d82613d5618814b84406c8b2d64f1bc305e7 Mon Sep 17 00:00:00 2001
+From: HyeongJun An <sammiee5311@gmail.com>
+Date: Sat, 6 Jun 2026 02:49:05 +0900
+Subject: platform/x86: intel-hid: Protect ACPI notify handler against recursion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: HyeongJun An <sammiee5311@gmail.com>
+
+commit c085d82613d5618814b84406c8b2d64f1bc305e7 upstream.
+
+Since commit e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on
+all CPUs") ACPI notify handlers like the intel-hid notify_handler() may
+run on multiple CPU cores racing with themselves.
+
+On convertibles and detachables (matched by DMI chassis-type 31 and 32 in
+dmi_auto_add_switch[]) the SW_TABLET_MODE input device is registered
+lazily from notify_handler() on the first tablet-mode event, via
+intel_hid_switches_setup(). When two such events race on different CPUs
+both can pass the !priv->switches check and register the priv->switches
+input device twice, resulting in a duplicate sysfs entry and a subsequent
+NULL pointer dereference.
+
+This is the same class of bug fixed by commit e075c3b13a0a ("platform/x86:
+intel-vbtn: Protect ACPI notify handler against recursion") for the
+sibling intel-vbtn driver.
+
+Protect intel-hid notify_handler() from racing with itself with a mutex
+to fix this.
+
+Fixes: e2ffcda16290 ("ACPI: OSL: Allow Notify () handlers to run on all CPUs")
+Cc: stable@vger.kernel.org
+Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
+Link: https://patch.msgid.link/20260605174905.131095-1-sammiee5311@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/intel/hid.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/platform/x86/intel/hid.c
++++ b/drivers/platform/x86/intel/hid.c
+@@ -7,11 +7,13 @@
+ */
+
+ #include <linux/acpi.h>
++#include <linux/cleanup.h>
+ #include <linux/dmi.h>
+ #include <linux/input.h>
+ #include <linux/input/sparse-keymap.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
++#include <linux/mutex.h>
+ #include <linux/platform_device.h>
+ #include <linux/string_choices.h>
+ #include <linux/suspend.h>
+@@ -230,6 +232,7 @@ static const struct dmi_system_id dmi_au
+ };
+
+ struct intel_hid_priv {
++ struct mutex mutex; /* Avoid notify_handler() racing with itself */
+ struct input_dev *input_dev;
+ struct input_dev *array;
+ struct input_dev *switches;
+@@ -565,6 +568,8 @@ static void notify_handler(acpi_handle h
+ struct key_entry *ke;
+ int err;
+
++ guard(mutex)(&priv->mutex);
++
+ /*
+ * Some convertible have unreliable VGBS return which could cause incorrect
+ * SW_TABLET_MODE report, in these cases we enable support when receiving
+@@ -720,6 +725,10 @@ static int intel_hid_probe(struct platfo
+ return -ENOMEM;
+ dev_set_drvdata(&device->dev, priv);
+
++ err = devm_mutex_init(&device->dev, &priv->mutex);
++ if (err)
++ return err;
++
+ /* See dual_accel_detect.h for more info on the dual_accel check. */
+ if (enable_sw_tablet_mode == TABLET_SW_AUTO) {
+ if (dmi_check_system(dmi_vgbs_allow_list))
--- /dev/null
+From 2957771379fa335103a4b539db57bb2271e12142 Mon Sep 17 00:00:00 2001
+From: Haoze Xie <royenheart@gmail.com>
+Date: Sat, 30 May 2026 14:11:54 +0800
+Subject: rust: block: fix GenDisk cleanup paths
+
+From: Haoze Xie <royenheart@gmail.com>
+
+commit 2957771379fa335103a4b539db57bb2271e12142 upstream.
+
+GenDiskBuilder::build() still has fallible work after
+__blk_mq_alloc_disk(), but its error path only recovers the
+foreign queue data. That leaks the temporary gendisk and
+request_queue until later teardown. If the caller moved the last
+Arc<TagSet<T>> into build(), the leaked queue can retain blk-mq
+state after the tag set is dropped.
+
+Fix the pre-registration failure path by dropping the temporary
+gendisk reference with put_disk() before recovering queue_data,
+so disk_release() can tear down the owned queue.
+
+Also pair GenDisk::drop() with put_disk() after del_gendisk().
+Once a Rust GenDisk has been added with device_add_disk(),
+del_gendisk() only unregisters it; the final gendisk reference
+still has to be dropped to complete the release path.
+
+Fixes: 3253aba3408a ("rust: block: introduce `kernel::block::mq` module")
+Cc: stable@kernel.org
+Reported-by: Yuan Tan <yuantan098@gmail.com>
+Reported-by: Xin Liu <bird@lzu.edu.cn>
+Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org>
+Signed-off-by: Haoze Xie <royenheart@gmail.com>
+Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
+Link: https://patch.msgid.link/b70aff9a920cc42110fe5cf454c3099561863519.1780063368.git.royenheart@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ rust/kernel/block/mq/gen_disk.rs | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/rust/kernel/block/mq/gen_disk.rs
++++ b/rust/kernel/block/mq/gen_disk.rs
+@@ -150,6 +150,19 @@ impl GenDiskBuilder {
+ // SAFETY: `gendisk` is a valid pointer as we initialized it above
+ unsafe { (*gendisk).fops = &TABLE };
+
++ let cleanup_failure = ScopeGuard::new_with_data((gendisk, data), |(gendisk, data)| {
++ // SAFETY: `gendisk` came from `__blk_mq_alloc_disk()` above and
++ // has not been added to the VFS on this cleanup path.
++ unsafe { bindings::put_disk(gendisk) };
++ // SAFETY: `data` came from `into_foreign()` above and has not been
++ // converted back on this cleanup path.
++ drop(unsafe { T::QueueData::from_foreign(data) });
++ });
++
++ // The failure guard now owns both pieces of cleanup; the early guard
++ // must not run on this path anymore.
++ recover_data.dismiss();
++
+ let mut writer = NullTerminatedFormatter::new(
+ // SAFETY: `gendisk` points to a valid and initialized instance. We
+ // have exclusive access, since the disk is not added to the VFS
+@@ -172,7 +185,7 @@ impl GenDiskBuilder {
+ },
+ )?;
+
+- recover_data.dismiss();
++ cleanup_failure.dismiss();
+
+ // INVARIANT: `gendisk` was initialized above.
+ // INVARIANT: `gendisk` was added to the VFS via `device_add_disk` above.
+@@ -215,6 +228,11 @@ impl<T: Operations> Drop for GenDisk<T>
+ // to the VFS.
+ unsafe { bindings::del_gendisk(self.gendisk) };
+
++ // SAFETY: By type invariant, `self.gendisk` was added to the VFS, so
++ // `put_disk()` must follow `del_gendisk()` to drop the final gendisk
++ // reference and trigger the remaining release path.
++ unsafe { bindings::put_disk(self.gendisk) };
++
+ // SAFETY: `queue.queuedata` was created by `GenDiskBuilder::build` with
+ // a call to `ForeignOwnable::into_foreign` to create `queuedata`.
+ // `ForeignOwnable::from_foreign` is only called here.
--- /dev/null
+From 3473e0a219fdb2cb013da0a5d917e66fef052325 Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <ojeda@kernel.org>
+Date: Sat, 30 May 2026 11:58:09 +0200
+Subject: rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+commit 3473e0a219fdb2cb013da0a5d917e66fef052325 upstream.
+
+Starting with Rust 1.98.0 (expected 2026-08-20), Clippy is likely
+introducing a new lint `clippy::map_or_identity` [1][2], which currently
+triggers in a single case:
+
+ warning: expression can be simplified using `Result::unwrap_or()`
+ --> rust/kernel/cpufreq.rs:1326:60
+ |
+ 1326 | PolicyCpu::from_cpu(cpu_id).map_or(0, |mut policy| T::get(&mut policy).map_or(0, |f| f))
+ | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+ |
+ = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#map_or_identity
+ = note: `-W clippy::map-or-identity` implied by `-W clippy::all`
+ = help: to override `-W clippy::all` add `#[allow(clippy::map_or_identity)]`
+ help: consider using `unwrap_or`
+ |
+ 1326 - PolicyCpu::from_cpu(cpu_id).map_or(0, |mut policy| T::get(&mut policy).map_or(0, |f| f))
+ 1326 + PolicyCpu::from_cpu(cpu_id).map_or(0, |mut policy| T::get(&mut policy).unwrap_or(0))
+ |
+
+The suggestion is valid, thus clean it up.
+
+Cc: stable@vger.kernel.org # Needed in 6.18.y and later.
+Link: https://github.com/rust-lang/rust-clippy/issues/15801 [1]
+Link: https://github.com/rust-lang/rust-clippy/pull/16052 [2]
+Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
+Reviewed-by: Gary Guo <gary@garyguo.net>
+Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Link: https://patch.msgid.link/20260530095809.213611-1-ojeda@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ rust/kernel/cpufreq.rs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/rust/kernel/cpufreq.rs
++++ b/rust/kernel/cpufreq.rs
+@@ -1323,7 +1323,7 @@ impl<T: Driver> Registration<T> {
+ // SAFETY: The C API guarantees that `cpu` refers to a valid CPU number.
+ let cpu_id = unsafe { CpuId::from_u32_unchecked(cpu) };
+
+- PolicyCpu::from_cpu(cpu_id).map_or(0, |mut policy| T::get(&mut policy).map_or(0, |f| f))
++ PolicyCpu::from_cpu(cpu_id).map_or(0, |mut policy| T::get(&mut policy).unwrap_or(0))
+ }
+
+ /// Driver's `update_limit` callback.
--- /dev/null
+From ac4d1caa82d487e7ed46d0597da1adc9c1a51c70 Mon Sep 17 00:00:00 2001
+From: Gary Guo <gary@garyguo.net>
+Date: Tue, 16 Jun 2026 14:25:56 +0100
+Subject: rust: doctest: fix incorrect pattern in replacement
+
+From: Gary Guo <gary@garyguo.net>
+
+commit ac4d1caa82d487e7ed46d0597da1adc9c1a51c70 upstream.
+
+The `-> Result<(), impl core::fmt::Debug>` string is generated by rustdoc
+and by adding "::" into the string it no longer finds anything, making
+the line useless.
+
+Remove the "::" in the pattern. Omit it in the replacement too, for
+consistency with upstream rustdoc.
+
+Fixes: de7cd3e4d638 ("rust: use absolute paths in macros referencing core and kernel")
+Signed-off-by: Gary Guo <gary@garyguo.net>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260616132559.2245814-1-gary@kernel.org
+[ Added link in code comment to `rustdoc`'s 1.87 PR that fully qualified
+ it for context. Improved comments for consistency. Reworded to drop
+ changelog and to fix typo. - Miguel ]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/rustdoc_test_builder.rs | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/scripts/rustdoc_test_builder.rs
++++ b/scripts/rustdoc_test_builder.rs
+@@ -28,7 +28,7 @@ fn main() {
+ //
+ // ```
+ // fn main() { #[allow(non_snake_case)] fn _doctest_main_rust_kernel_file_rs_28_0() {
+- // fn main() { #[allow(non_snake_case)] fn _doctest_main_rust_kernel_file_rs_37_0() -> Result<(), impl ::core::fmt::Debug> {
++ // fn main() { #[allow(non_snake_case)] fn _doctest_main_rust_kernel_file_rs_37_0() -> Result<(), impl core::fmt::Debug> {
+ // ```
+ //
+ // It should be unlikely that doctest code matches such lines (when code is formatted properly).
+@@ -47,12 +47,16 @@ fn main() {
+ })
+ .expect("No test function found in `rustdoc`'s output.");
+
+- // Qualify `Result` to avoid the collision with our own `Result` coming from the prelude.
++ // Replicate `rustdoc` 1.87+ behaviour [1] by fully qualifying `Result` to avoid the collision
++ // with our own `Result` coming from the prelude.
++ //
++ // [1]: https://github.com/rust-lang/rust/pull/137807
++ //
++ // TODO: Remove this when MSRV is bumped above 1.87.
+ let body = body.replace(
+- &format!("{rustdoc_function_name}() -> Result<(), impl ::core::fmt::Debug> {{"),
+- &format!(
+- "{rustdoc_function_name}() -> ::core::result::Result<(), impl ::core::fmt::Debug> {{"
+- ),
++ &format!("{rustdoc_function_name}() -> Result<(), impl core::fmt::Debug> {{"),
++ // This intentionally does not use absolute paths to match `rustdoc` 1.87 behaviour.
++ &format!("{rustdoc_function_name}() -> core::result::Result<(), impl core::fmt::Debug> {{"),
+ );
+
+ // For tests that get generated with `Result`, like above, `rustdoc` generates an `unwrap()` on
--- /dev/null
+From 5b271543d0f08e9733d4732721e960e285f6448f Mon Sep 17 00:00:00 2001
+From: Alice Ryhl <aliceryhl@google.com>
+Date: Wed, 8 Apr 2026 08:32:16 +0000
+Subject: rust: kasan: KASAN+RUST requires clang
+
+From: Alice Ryhl <aliceryhl@google.com>
+
+commit 5b271543d0f08e9733d4732721e960e285f6448f upstream.
+
+Kernel KASAN involves passing various llvm/gcc specific arguments to
+the C and Rust compiler. Since these arguments differ between llvm and
+gcc, it's not safe to mix an llvm-based rustc with a gcc build when
+kasan is enabled.
+
+Signed-off-by: Alice Ryhl <aliceryhl@google.com>
+Reviewed-by: Gary Guo <gary@garyguo.net>
+Cc: stable@vger.kernel.org
+Fixes: e3117404b411 ("kbuild: rust: Enable KASAN support")
+Link: https://patch.msgid.link/20260408-kasan-rust-sw-tags-v3-1-e07964d14363@google.com
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ init/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -2198,6 +2198,7 @@ config RUST
+ depends on !DEBUG_INFO_BTF || (PAHOLE_HAS_LANG_EXCLUDE && !LTO)
+ depends on !CFI || HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC
+ select CFI_ICALL_NORMALIZE_INTEGERS if CFI
++ depends on !KASAN || CC_IS_CLANG
+ depends on !KASAN_SW_TAGS
+ help
+ Enables Rust support in the kernel.
--- /dev/null
+From 191f49f1e38b1c10eb44b0f967c6175c884ef7db Mon Sep 17 00:00:00 2001
+From: Alice Ryhl <aliceryhl@google.com>
+Date: Tue, 16 Jun 2026 12:30:38 +0000
+Subject: rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
+
+From: Alice Ryhl <aliceryhl@google.com>
+
+commit 191f49f1e38b1c10eb44b0f967c6175c884ef7db upstream.
+
+Due to a rustc bug, the -Cforce-frame-pointers=y flag only emits the
+frame-pointer annotation for functions, but not for the module. This
+means that functions generated by the LLVM backend such as
+'asan.module_ctor' do not receive the frame-pointer annotation.
+
+This is likely to lead to broken backtraces and may also cause issues
+with ftrace if these features are used with functions generated by the
+LLVM backend.
+
+Thus, use -Zllvm_module_flag to work around this rustc bug if using a
+rustc without the fix.
+
+[ The fix [1] has landed for Rust 1.98.0 (expected release on
+ 2026-08-20). - Miguel ]
+
+Cc: stable@vger.kernel.org # 6.12.y and later (flag not available in pinned Rust in older LTSs).
+Fixes: 2f7ab1267dc9 ("Kbuild: add Rust support")
+Link: https://github.com/rust-lang/rust/pull/156980 [1]
+Signed-off-by: Alice Ryhl <aliceryhl@google.com>
+Link: https://patch.msgid.link/20260616-frame-ptr-fix-v1-1-dc6b29a631d9@google.com
+[ - Adjusted Cc: stable@ as discussed.
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+ - Added comment with link to the PR, similar to what we did in commit
+ ac35b5580ace ("rust: arm64: set uwtable llvm module flag for
+ CONFIG_UNWIND_TABLES").
+
+ - Miguel ]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+---
+ Makefile | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/Makefile
++++ b/Makefile
+@@ -959,6 +959,9 @@ KBUILD_CFLAGS += $(stackp-flags-y)
+ ifdef CONFIG_FRAME_POINTER
+ KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls
+ KBUILD_RUSTFLAGS += -Cforce-frame-pointers=y
++# Work around rustc bug on compilers without
++# https://github.com/rust-lang/rust/pull/156980.
++KBUILD_RUSTFLAGS += $(if $(call rustc-min-version,109800),,-Zllvm_module_flag=frame-pointer:u32:2:max)
+ else
+ # Some targets (ARM with Thumb2, for example), can't be built with frame
+ # pointers. For those, we don't have FUNCTION_TRACER automatically
--- /dev/null
+From e566a9e17f3774c962b6d2522750f227f027edc6 Mon Sep 17 00:00:00 2001
+From: Danilo Krummrich <dakr@kernel.org>
+Date: Mon, 25 May 2026 22:20:48 +0200
+Subject: rust: pci: use 'static lifetime for PCI BAR resource names
+
+From: Danilo Krummrich <dakr@kernel.org>
+
+commit e566a9e17f3774c962b6d2522750f227f027edc6 upstream.
+
+pci_request_region() stores the name pointer directly in struct
+resource; use &'static CStr to ensure the pointer remains valid even if
+the Bar is leaked.
+
+Cc: stable@vger.kernel.org
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Closes: https://lore.kernel.org/all/20260522004943.CDA7C1F000E9@smtp.kernel.org/
+Fixes: 3c2e31d717ac ("rust: pci: move I/O infrastructure to separate file")
+Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
+Reviewed-by: Eliot Courtney <ecourtney@nvidia.com>
+Reviewed-by: Gary Guo <gary@garyguo.net>
+Link: https://patch.msgid.link/20260525202921.124698-2-dakr@kernel.org
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ rust/kernel/pci/io.rs | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/rust/kernel/pci/io.rs b/rust/kernel/pci/io.rs
+index ae78676c927f..3ce21482b079 100644
+--- a/rust/kernel/pci/io.rs
++++ b/rust/kernel/pci/io.rs
+@@ -153,7 +153,7 @@ pub struct Bar<const SIZE: usize = 0> {
+ }
+
+ impl<const SIZE: usize> Bar<SIZE> {
+- pub(super) fn new(pdev: &Device, num: u32, name: &CStr) -> Result<Self> {
++ pub(super) fn new(pdev: &Device, num: u32, name: &'static CStr) -> Result<Self> {
+ let len = pdev.resource_len(num)?;
+ if len == 0 {
+ return Err(ENOMEM);
+@@ -252,7 +252,7 @@ impl Device<device::Bound> {
+ pub fn iomap_region_sized<'a, const SIZE: usize>(
+ &'a self,
+ bar: u32,
+- name: &'a CStr,
++ name: &'static CStr,
+ ) -> impl PinInit<Devres<Bar<SIZE>>, Error> + 'a {
+ Devres::new(self.as_ref(), Bar::<SIZE>::new(self, bar, name))
+ }
+@@ -261,7 +261,7 @@ pub fn iomap_region_sized<'a, const SIZE: usize>(
+ pub fn iomap_region<'a>(
+ &'a self,
+ bar: u32,
+- name: &'a CStr,
++ name: &'static CStr,
+ ) -> impl PinInit<Devres<Bar>, Error> + 'a {
+ self.iomap_region_sized::<0>(bar, name)
+ }
+--
+2.55.0
+
kvm-x86-move-update_cr8_intercept-to-lapic.c.patch
kvm-vmx-grab-vmcs12-on-cr8-interception-update-iff-vcpu-is-in-guest-mode.patch
kvm-x86-unconditionally-recompute-cr8-intercept-on-ppr-update.patch
+acpi-cppc-suppress-ubsan-warning-caused-by-field-misuse.patch
+acpi-nfit-core-fix-possible-null-pointer-dereference.patch
+acpi-nfit-core-fix-acpi_nfit_init-error-cleanup.patch
+platform-x86-intel-hid-protect-acpi-notify-handler-against-recursion.patch
+loongarch-add-pio-for-early-access-before-acpi-pci-root-register.patch
+rust-cpufreq-clean-new-clippy-map_or_identity-lint-for-rust-1.98.0.patch
+rust-kasan-kasan-rust-requires-clang.patch
+rust-pci-use-static-lifetime-for-pci-bar-resource-names.patch
+rust-block-fix-gendisk-cleanup-paths.patch
+rust-doctest-fix-incorrect-pattern-in-replacement.patch
+rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
