From: Greg Kroah-Hartman Date: Mon, 21 Jul 2025 11:08:31 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v6.1.147~74 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0fbc330b9ccab52a72f19278c46c04b5bf36a380;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: af_packet-fix-soft-lockup-issue-caused-by-tpacket_snd.patch af_packet-fix-the-so_sndtimeo-constraint-not-effective-on-tpacked_snd.patch alsa-hda-realtek-add-quirk-for-asus-rog-strix-g712lws.patch arm64-dts-freescale-imx8mm-verdin-keep-ldo5-always-on.patch arm64-dts-imx8mp-venice-gw74xx-fix-tpm-spi-frequency.patch arm64-dts-rockchip-use-cs-gpios-for-spi1-on-ringneck.patch dmaengine-nbpfaxi-fix-memory-corruption-in-probe.patch drm-amdgpu-gfx8-reset-compute-ring-wptr-on-the-gpu-on-resume.patch io_uring-poll-fix-pollerr-handling.patch isofs-verify-inode-mode-when-loading-from-disk.patch memstick-core-zero-initialize-id_reg-in-h_memstick_read_dev_id.patch mmc-bcm2835-fix-dma_unmap_sg-nents-value.patch mmc-sdhci-pci-quirk-for-broken-command-queuing-on-intel-glk-based-positivo-models.patch mmc-sdhci_am654-workaround-for-errata-i2312.patch mptcp-reset-fallback-status-gracefully-at-disconnect-time.patch net-libwx-fix-the-using-of-rx-buffer-dma.patch net-libwx-properly-reset-rx-ring-descriptor.patch net-libwx-remove-duplicate-page_pool_put_full_page.patch net-mlx5-update-the-list-of-the-pci-supported-devices.patch phonet-pep-move-call-to-pn_skb_get_dst_sockaddr-earlier-in-pep_sock_accept.patch --- diff --git a/queue-6.6/af_packet-fix-soft-lockup-issue-caused-by-tpacket_snd.patch b/queue-6.6/af_packet-fix-soft-lockup-issue-caused-by-tpacket_snd.patch new file mode 100644 index 0000000000..27852eaee7 --- /dev/null +++ b/queue-6.6/af_packet-fix-soft-lockup-issue-caused-by-tpacket_snd.patch @@ -0,0 +1,103 @@ +From 55f0bfc0370539213202f4ce1a07615327ac4713 Mon Sep 17 00:00:00 2001 +From: Yun Lu +Date: Fri, 11 Jul 2025 17:33:00 +0800 +Subject: af_packet: fix soft lockup issue caused by tpacket_snd() + +From: Yun Lu + +commit 55f0bfc0370539213202f4ce1a07615327ac4713 upstream. + +When MSG_DONTWAIT is not set, the tpacket_snd operation will wait for +pending_refcnt to decrement to zero before returning. The pending_refcnt +is decremented by 1 when the skb->destructor function is called, +indicating that the skb has been successfully sent and needs to be +destroyed. + +If an error occurs during this process, the tpacket_snd() function will +exit and return error, but pending_refcnt may not yet have decremented to +zero. Assuming the next send operation is executed immediately, but there +are no available frames to be sent in tx_ring (i.e., packet_current_frame +returns NULL), and skb is also NULL, the function will not execute +wait_for_completion_interruptible_timeout() to yield the CPU. Instead, it +will enter a do-while loop, waiting for pending_refcnt to be zero. Even +if the previous skb has completed transmission, the skb->destructor +function can only be invoked in the ksoftirqd thread (assuming NAPI +threading is enabled). When both the ksoftirqd thread and the tpacket_snd +operation happen to run on the same CPU, and the CPU trapped in the +do-while loop without yielding, the ksoftirqd thread will not get +scheduled to run. As a result, pending_refcnt will never be reduced to +zero, and the do-while loop cannot exit, eventually leading to a CPU soft +lockup issue. + +In fact, skb is true for all but the first iterations of that loop, and +as long as pending_refcnt is not zero, even if incremented by a previous +call, wait_for_completion_interruptible_timeout() should be executed to +yield the CPU, allowing the ksoftirqd thread to be scheduled. Therefore, +the execution condition of this function should be modified to check if +pending_refcnt is not zero, instead of check skb. + +- if (need_wait && skb) { ++ if (need_wait && packet_read_pending(&po->tx_ring)) { + +As a result, the judgment conditions are duplicated with the end code of +the while loop, and packet_read_pending() is a very expensive function. +Actually, this loop can only exit when ph is NULL, so the loop condition +can be changed to while (1), and in the "ph = NULL" branch, if the +subsequent condition of if is not met, the loop can break directly. Now, +the loop logic remains the same as origin but is clearer and more obvious. + +Fixes: 89ed5b519004 ("af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET") +Cc: stable@kernel.org +Suggested-by: LongJun Tang +Signed-off-by: Yun Lu +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/packet/af_packet.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2852,15 +2852,21 @@ static int tpacket_snd(struct packet_soc + ph = packet_current_frame(po, &po->tx_ring, + TP_STATUS_SEND_REQUEST); + if (unlikely(ph == NULL)) { +- if (need_wait && skb) { ++ /* Note: packet_read_pending() might be slow if we ++ * have to call it as it's per_cpu variable, but in ++ * fast-path we don't have to call it, only when ph ++ * is NULL, we need to check the pending_refcnt. ++ */ ++ if (need_wait && packet_read_pending(&po->tx_ring)) { + timeo = wait_for_completion_interruptible_timeout(&po->skb_completion, timeo); + if (timeo <= 0) { + err = !timeo ? -ETIMEDOUT : -ERESTARTSYS; + goto out_put; + } +- } +- /* check for additional frames */ +- continue; ++ /* check for additional frames */ ++ continue; ++ } else ++ break; + } + + skb = NULL; +@@ -2949,14 +2955,7 @@ tpacket_error: + } + packet_increment_head(&po->tx_ring); + len_sum += tp_len; +- } while (likely((ph != NULL) || +- /* Note: packet_read_pending() might be slow if we have +- * to call it as it's per_cpu variable, but in fast-path +- * we already short-circuit the loop with the first +- * condition, and luckily don't have to go that path +- * anyway. +- */ +- (need_wait && packet_read_pending(&po->tx_ring)))); ++ } while (1); + + err = len_sum; + goto out_put; diff --git a/queue-6.6/af_packet-fix-the-so_sndtimeo-constraint-not-effective-on-tpacked_snd.patch b/queue-6.6/af_packet-fix-the-so_sndtimeo-constraint-not-effective-on-tpacked_snd.patch new file mode 100644 index 0000000000..881dc79fa2 --- /dev/null +++ b/queue-6.6/af_packet-fix-the-so_sndtimeo-constraint-not-effective-on-tpacked_snd.patch @@ -0,0 +1,59 @@ +From c1ba3c0cbdb5e53a8ec5d708e99cd4c497028a13 Mon Sep 17 00:00:00 2001 +From: Yun Lu +Date: Fri, 11 Jul 2025 17:32:59 +0800 +Subject: af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() + +From: Yun Lu + +commit c1ba3c0cbdb5e53a8ec5d708e99cd4c497028a13 upstream. + +Due to the changes in commit 581073f626e3 ("af_packet: do not call +packet_read_pending() from tpacket_destruct_skb()"), every time +tpacket_destruct_skb() is executed, the skb_completion is marked as +completed. When wait_for_completion_interruptible_timeout() returns +completed, the pending_refcnt has not yet been reduced to zero. +Therefore, when ph is NULL, the wait function may need to be called +multiple times until packet_read_pending() finally returns zero. + +We should call sock_sndtimeo() only once, otherwise the SO_SNDTIMEO +constraint could be way off. + +Fixes: 581073f626e3 ("af_packet: do not call packet_read_pending() from tpacket_destruct_skb()") +Cc: stable@kernel.org +Suggested-by: Eric Dumazet +Signed-off-by: Yun Lu +Reviewed-by: Eric Dumazet +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/packet/af_packet.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2791,7 +2791,7 @@ static int tpacket_snd(struct packet_soc + int len_sum = 0; + int status = TP_STATUS_AVAILABLE; + int hlen, tlen, copylen = 0; +- long timeo = 0; ++ long timeo; + + mutex_lock(&po->pg_vec_lock); + +@@ -2845,6 +2845,7 @@ static int tpacket_snd(struct packet_soc + if ((size_max > dev->mtu + reserve + VLAN_HLEN) && !vnet_hdr_sz) + size_max = dev->mtu + reserve + VLAN_HLEN; + ++ timeo = sock_sndtimeo(&po->sk, msg->msg_flags & MSG_DONTWAIT); + reinit_completion(&po->skb_completion); + + do { +@@ -2852,7 +2853,6 @@ static int tpacket_snd(struct packet_soc + TP_STATUS_SEND_REQUEST); + if (unlikely(ph == NULL)) { + if (need_wait && skb) { +- timeo = sock_sndtimeo(&po->sk, msg->msg_flags & MSG_DONTWAIT); + timeo = wait_for_completion_interruptible_timeout(&po->skb_completion, timeo); + if (timeo <= 0) { + err = !timeo ? -ETIMEDOUT : -ERESTARTSYS; diff --git a/queue-6.6/alsa-hda-realtek-add-quirk-for-asus-rog-strix-g712lws.patch b/queue-6.6/alsa-hda-realtek-add-quirk-for-asus-rog-strix-g712lws.patch new file mode 100644 index 0000000000..67f7163d08 --- /dev/null +++ b/queue-6.6/alsa-hda-realtek-add-quirk-for-asus-rog-strix-g712lws.patch @@ -0,0 +1,32 @@ +From e201c19ddeed6b37f05617e529d8efa079657ed7 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 15 Jul 2025 08:29:04 +0200 +Subject: ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS + +From: Takashi Iwai + +commit e201c19ddeed6b37f05617e529d8efa079657ed7 upstream. + +ASUS ROG Strix G712LWS (PCI SSID 1043:1a83) requires the quirk for +ALC294 headset mode in order to make the speaker and headset I/O +working properly. + +Cc: +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220334 +Link: https://patch.msgid.link/20250715062906.11857-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10303,6 +10303,7 @@ static const struct hda_quirk alc269_fix + SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), + SND_PCI_QUIRK(0x1043, 0x1a63, "ASUS UX3405MA", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1a83, "ASUS UM5302LA", ALC294_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x1043, 0x1a8e, "ASUS G712LWS", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x1043, 0x1a8f, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1b11, "ASUS UX431DA", ALC294_FIXUP_ASUS_COEF_1B), + SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC), diff --git a/queue-6.6/arm64-dts-freescale-imx8mm-verdin-keep-ldo5-always-on.patch b/queue-6.6/arm64-dts-freescale-imx8mm-verdin-keep-ldo5-always-on.patch new file mode 100644 index 0000000000..2e89c5deab --- /dev/null +++ b/queue-6.6/arm64-dts-freescale-imx8mm-verdin-keep-ldo5-always-on.patch @@ -0,0 +1,45 @@ +From fbe94be09fa81343d623a86ec64a742759b669b3 Mon Sep 17 00:00:00 2001 +From: Francesco Dolcini +Date: Mon, 23 Jun 2025 15:25:45 +0200 +Subject: arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on + +From: Francesco Dolcini + +commit fbe94be09fa81343d623a86ec64a742759b669b3 upstream. + +LDO5 regulator is used to power the i.MX8MM NVCC_SD2 I/O supply, that is +used for the SD2 card interface and also for some GPIOs. + +When the SD card interface is not enabled the regulator subsystem could +turn off this supply, since it is not used anywhere else, however this +will also remove the power to some other GPIOs, for example one I/O that +is used to power the ethernet phy, leading to a non working ethernet +interface. + +[ 31.820515] On-module +V3.3_1.8_SD (LDO5): disabling +[ 31.821761] PMIC_USDHC_VSELECT: disabling +[ 32.764949] fec 30be0000.ethernet end0: Link is Down + +Fix this keeping the LDO5 supply always on. + +Cc: stable@vger.kernel.org +Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") +Fixes: f5aab0438ef1 ("regulator: pca9450: Fix enable register for LDO5") +Signed-off-by: Francesco Dolcini +Reviewed-by: Frank Li +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +@@ -470,6 +470,7 @@ + }; + + reg_nvcc_sd: LDO5 { ++ regulator-always-on; + regulator-max-microvolt = <3300000>; + regulator-min-microvolt = <1800000>; + regulator-name = "On-module +V3.3_1.8_SD (LDO5)"; diff --git a/queue-6.6/arm64-dts-imx8mp-venice-gw74xx-fix-tpm-spi-frequency.patch b/queue-6.6/arm64-dts-imx8mp-venice-gw74xx-fix-tpm-spi-frequency.patch new file mode 100644 index 0000000000..25d5e240b0 --- /dev/null +++ b/queue-6.6/arm64-dts-imx8mp-venice-gw74xx-fix-tpm-spi-frequency.patch @@ -0,0 +1,37 @@ +From 0bdaca0922175478ddeadf8e515faa5269f6fae6 Mon Sep 17 00:00:00 2001 +From: Tim Harvey +Date: Wed, 4 Jun 2025 15:56:30 -0700 +Subject: arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency + +From: Tim Harvey + +commit 0bdaca0922175478ddeadf8e515faa5269f6fae6 upstream. + +The IMX8MPDS Table 37 [1] shows that the max SPI master read frequency +depends on the pins the interface is muxed behind with ECSPI2 +muxed behind ECSPI2 supporting up to 25MHz. + +Adjust the spi-max-frequency based on these findings. + +[1] https://www.nxp.com/webapp/Download?colCode=IMX8MPIEC + +Fixes: 531936b218d8 ("arm64: dts: imx8mp-venice-gw74xx: update to revB PCB") +Cc: stable@vger.kernel.org +Signed-off-by: Tim Harvey +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts +@@ -185,7 +185,7 @@ + #address-cells = <0x1>; + #size-cells = <0x1>; + reg = <0x0>; +- spi-max-frequency = <36000000>; ++ spi-max-frequency = <25000000>; + }; + }; + diff --git a/queue-6.6/arm64-dts-rockchip-use-cs-gpios-for-spi1-on-ringneck.patch b/queue-6.6/arm64-dts-rockchip-use-cs-gpios-for-spi1-on-ringneck.patch new file mode 100644 index 0000000000..d45f733c6d --- /dev/null +++ b/queue-6.6/arm64-dts-rockchip-use-cs-gpios-for-spi1-on-ringneck.patch @@ -0,0 +1,92 @@ +From 53b6445ad08f07b6f4a84f1434f543196009ed89 Mon Sep 17 00:00:00 2001 +From: Jakob Unterwurzacher +Date: Fri, 27 Jun 2025 15:17:12 +0200 +Subject: arm64: dts: rockchip: use cs-gpios for spi1 on ringneck +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jakob Unterwurzacher + +commit 53b6445ad08f07b6f4a84f1434f543196009ed89 upstream. + +Hardware CS has a very slow rise time of about 6us, +causing transmission errors when CS does not reach +high between transaction. + +It looks like it's not driven actively when transitioning +from low to high but switched to input, so only the CPU +pull-up pulls it high, slowly. Transitions from high to low +are fast. On the oscilloscope, CS looks like an irregular sawtooth +pattern like this: + _____ + ^ / | + ^ /| / | + /| / | / | + / | / | / | +___/ |___/ |_____/ |___ + +With cs-gpios we have a CS rise time of about 20ns, as it should be, +and CS looks rectangular. + +This fixes the data errors when running a flashcp loop against a +m25p40 spi flash. + +With the Rockchip 6.1 kernel we see the same slow rise time, but +for some reason CS is always high for long enough to reach a solid +high. + +The RK3399 and RK3588 SoCs use the same SPI driver, so we also +checked our "Puma" (RK3399) and "Tiger" (RK3588) boards. +They do not have this problem. Hardware CS rise time is good. + +Fixes: c484cf93f61b ("arm64: dts: rockchip: add PX30-µQ7 (Ringneck) SoM with Haikou baseboard") +Cc: stable@vger.kernel.org +Reviewed-by: Quentin Schulz +Signed-off-by: Jakob Unterwurzacher +Link: https://lore.kernel.org/r/20250627131715.1074308-1-jakob.unterwurzacher@cherry.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +--- a/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi ++++ b/arch/arm64/boot/dts/rockchip/px30-ringneck.dtsi +@@ -344,6 +344,18 @@ + <0 RK_PA7 RK_FUNC_GPIO &pcfg_pull_up>; + }; + }; ++ ++ spi1 { ++ spi1_csn0_gpio_pin: spi1-csn0-gpio-pin { ++ rockchip,pins = ++ <3 RK_PB1 RK_FUNC_GPIO &pcfg_pull_up_4ma>; ++ }; ++ ++ spi1_csn1_gpio_pin: spi1-csn1-gpio-pin { ++ rockchip,pins = ++ <3 RK_PB2 RK_FUNC_GPIO &pcfg_pull_up_4ma>; ++ }; ++ }; + }; + + &saradc { +@@ -355,6 +367,17 @@ + vqmmc-supply = <&vccio_sd>; + }; + ++&spi1 { ++ /* ++ * Hardware CS has a very slow rise time of about 6us, ++ * causing transmission errors. ++ * With cs-gpios we have a rise time of about 20ns. ++ */ ++ cs-gpios = <&gpio3 RK_PB1 GPIO_ACTIVE_LOW>, <&gpio3 RK_PB2 GPIO_ACTIVE_LOW>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&spi1_clk &spi1_csn0_gpio_pin &spi1_csn1_gpio_pin &spi1_miso &spi1_mosi>; ++}; ++ + &tsadc { + status = "okay"; + }; diff --git a/queue-6.6/dmaengine-nbpfaxi-fix-memory-corruption-in-probe.patch b/queue-6.6/dmaengine-nbpfaxi-fix-memory-corruption-in-probe.patch new file mode 100644 index 0000000000..f2c2d27060 --- /dev/null +++ b/queue-6.6/dmaengine-nbpfaxi-fix-memory-corruption-in-probe.patch @@ -0,0 +1,77 @@ +From 188c6ba1dd925849c5d94885c8bbdeb0b3dcf510 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 1 Jul 2025 17:31:40 -0500 +Subject: dmaengine: nbpfaxi: Fix memory corruption in probe() + +From: Dan Carpenter + +commit 188c6ba1dd925849c5d94885c8bbdeb0b3dcf510 upstream. + +The nbpf->chan[] array is allocated earlier in the nbpf_probe() function +and it has "num_channels" elements. These three loops iterate one +element farther than they should and corrupt memory. + +The changes to the second loop are more involved. In this case, we're +copying data from the irqbuf[] array into the nbpf->chan[] array. If +the data in irqbuf[i] is the error IRQ then we skip it, so the iterators +are not in sync. I added a check to ensure that we don't go beyond the +end of the irqbuf[] array. I'm pretty sure this can't happen, but it +seemed harmless to add a check. + +On the other hand, after the loop has ended there is a check to ensure +that the "chan" iterator is where we expect it to be. In the original +code we went one element beyond the end of the array so the iterator +wasn't in the correct place and it would always return -EINVAL. However, +now it will always be in the correct place. I deleted the check since +we know the result. + +Cc: stable@vger.kernel.org +Fixes: b45b262cefd5 ("dmaengine: add a driver for AMBA AXI NBPF DMAC IP cores") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/b13c5225-7eff-448c-badc-a2c98e9bcaca@sabinyo.mountain +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/nbpfaxi.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/dma/nbpfaxi.c ++++ b/drivers/dma/nbpfaxi.c +@@ -1351,7 +1351,7 @@ static int nbpf_probe(struct platform_de + if (irqs == 1) { + eirq = irqbuf[0]; + +- for (i = 0; i <= num_channels; i++) ++ for (i = 0; i < num_channels; i++) + nbpf->chan[i].irq = irqbuf[0]; + } else { + eirq = platform_get_irq_byname(pdev, "error"); +@@ -1361,16 +1361,15 @@ static int nbpf_probe(struct platform_de + if (irqs == num_channels + 1) { + struct nbpf_channel *chan; + +- for (i = 0, chan = nbpf->chan; i <= num_channels; ++ for (i = 0, chan = nbpf->chan; i < num_channels; + i++, chan++) { + /* Skip the error IRQ */ + if (irqbuf[i] == eirq) + i++; ++ if (i >= ARRAY_SIZE(irqbuf)) ++ return -EINVAL; + chan->irq = irqbuf[i]; + } +- +- if (chan != nbpf->chan + num_channels) +- return -EINVAL; + } else { + /* 2 IRQs and more than one channel */ + if (irqbuf[0] == eirq) +@@ -1378,7 +1377,7 @@ static int nbpf_probe(struct platform_de + else + irq = irqbuf[0]; + +- for (i = 0; i <= num_channels; i++) ++ for (i = 0; i < num_channels; i++) + nbpf->chan[i].irq = irq; + } + } diff --git a/queue-6.6/drm-amdgpu-gfx8-reset-compute-ring-wptr-on-the-gpu-on-resume.patch b/queue-6.6/drm-amdgpu-gfx8-reset-compute-ring-wptr-on-the-gpu-on-resume.patch new file mode 100644 index 0000000000..7305370497 --- /dev/null +++ b/queue-6.6/drm-amdgpu-gfx8-reset-compute-ring-wptr-on-the-gpu-on-resume.patch @@ -0,0 +1,36 @@ +From 83261934015c434fabb980a3e613b01d9976e877 Mon Sep 17 00:00:00 2001 +From: Eeli Haapalainen +Date: Mon, 14 Jul 2025 08:13:09 +0300 +Subject: drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume + +From: Eeli Haapalainen + +commit 83261934015c434fabb980a3e613b01d9976e877 upstream. + +Commit 42cdf6f687da ("drm/amdgpu/gfx8: always restore kcq MQDs") made the +ring pointer always to be reset on resume from suspend. This caused compute +rings to fail since the reset was done without also resetting it for the +firmware. Reset wptr on the GPU to avoid a disconnect between the driver +and firmware wptr. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3911 +Fixes: 42cdf6f687da ("drm/amdgpu/gfx8: always restore kcq MQDs") +Signed-off-by: Eeli Haapalainen +Signed-off-by: Alex Deucher +(cherry picked from commit 2becafc319db3d96205320f31cc0de4ee5a93747) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +@@ -4656,6 +4656,7 @@ static int gfx_v8_0_kcq_init_queue(struc + memcpy(mqd, adev->gfx.mec.mqd_backup[mqd_idx], sizeof(struct vi_mqd_allocation)); + /* reset ring buffer */ + ring->wptr = 0; ++ atomic64_set((atomic64_t *)ring->wptr_cpu_addr, 0); + amdgpu_ring_clear_ring(ring); + } + return 0; diff --git a/queue-6.6/io_uring-poll-fix-pollerr-handling.patch b/queue-6.6/io_uring-poll-fix-pollerr-handling.patch new file mode 100644 index 0000000000..56cb84bdbf --- /dev/null +++ b/queue-6.6/io_uring-poll-fix-pollerr-handling.patch @@ -0,0 +1,71 @@ +From c7cafd5b81cc07fb402e3068d134c21e60ea688c Mon Sep 17 00:00:00 2001 +From: Pavel Begunkov +Date: Wed, 16 Jul 2025 17:20:17 +0100 +Subject: io_uring/poll: fix POLLERR handling + +From: Pavel Begunkov + +commit c7cafd5b81cc07fb402e3068d134c21e60ea688c upstream. + +8c8492ca64e7 ("io_uring/net: don't retry connect operation on EPOLLERR") +is a little dirty hack that +1) wrongfully assumes that POLLERR equals to a failed request, which +breaks all POLLERR users, e.g. all error queue recv interfaces. +2) deviates the connection request behaviour from connect(2), and +3) racy and solved at a wrong level. + +Nothing can be done with 2) now, and 3) is beyond the scope of the +patch. At least solve 1) by moving the hack out of generic poll handling +into io_connect(). + +Cc: stable@vger.kernel.org +Fixes: 8c8492ca64e79 ("io_uring/net: don't retry connect operation on EPOLLERR") +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/3dc89036388d602ebd84c28e5042e457bdfc952b.1752682444.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/net.c | 12 ++++++++---- + io_uring/poll.c | 2 -- + 2 files changed, 8 insertions(+), 6 deletions(-) + +--- a/io_uring/net.c ++++ b/io_uring/net.c +@@ -1537,9 +1537,11 @@ int io_connect(struct io_kiocb *req, uns + io = &__io; + } + +- if (unlikely(req->flags & REQ_F_FAIL)) { +- ret = -ECONNRESET; +- goto out; ++ if (connect->in_progress) { ++ struct poll_table_struct pt = { ._key = EPOLLERR }; ++ ++ if (vfs_poll(req->file, &pt) & EPOLLERR) ++ goto get_sock_err; + } + + file_flags = force_nonblock ? O_NONBLOCK : 0; +@@ -1571,8 +1573,10 @@ int io_connect(struct io_kiocb *req, uns + * which means the previous result is good. For both of these, + * grab the sock_error() and use that for the completion. + */ +- if (ret == -EBADFD || ret == -EISCONN) ++ if (ret == -EBADFD || ret == -EISCONN) { ++get_sock_err: + ret = sock_error(sock_from_file(req->file)->sk); ++ } + } + if (ret == -ERESTARTSYS) + ret = -EINTR; +--- a/io_uring/poll.c ++++ b/io_uring/poll.c +@@ -308,8 +308,6 @@ static int io_poll_check_events(struct i + return IOU_POLL_REISSUE; + } + } +- if (unlikely(req->cqe.res & EPOLLERR)) +- req_set_fail(req); + if (req->apoll_events & EPOLLONESHOT) + return IOU_POLL_DONE; + diff --git a/queue-6.6/isofs-verify-inode-mode-when-loading-from-disk.patch b/queue-6.6/isofs-verify-inode-mode-when-loading-from-disk.patch new file mode 100644 index 0000000000..98ec1b058d --- /dev/null +++ b/queue-6.6/isofs-verify-inode-mode-when-loading-from-disk.patch @@ -0,0 +1,43 @@ +From 0a9e7405131380b57e155f10242b2e25d2e51852 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 9 Jul 2025 11:55:46 +0200 +Subject: isofs: Verify inode mode when loading from disk + +From: Jan Kara + +commit 0a9e7405131380b57e155f10242b2e25d2e51852 upstream. + +Verify that the inode mode is sane when loading it from the disk to +avoid complaints from VFS about setting up invalid inodes. + +Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com +CC: stable@vger.kernel.org +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/20250709095545.31062-2-jack@suse.cz +Acked-by: Christian Brauner +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman +--- + fs/isofs/inode.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/fs/isofs/inode.c ++++ b/fs/isofs/inode.c +@@ -1486,9 +1486,16 @@ static int isofs_read_inode(struct inode + inode->i_op = &page_symlink_inode_operations; + inode_nohighmem(inode); + inode->i_data.a_ops = &isofs_symlink_aops; +- } else ++ } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) || ++ S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) { + /* XXX - parse_rock_ridge_inode() had already set i_rdev. */ + init_special_inode(inode, inode->i_mode, inode->i_rdev); ++ } else { ++ printk(KERN_DEBUG "ISOFS: Invalid file type 0%04o for inode %lu.\n", ++ inode->i_mode, inode->i_ino); ++ ret = -EIO; ++ goto fail; ++ } + + ret = 0; + out: diff --git a/queue-6.6/memstick-core-zero-initialize-id_reg-in-h_memstick_read_dev_id.patch b/queue-6.6/memstick-core-zero-initialize-id_reg-in-h_memstick_read_dev_id.patch new file mode 100644 index 0000000000..1d5c38893d --- /dev/null +++ b/queue-6.6/memstick-core-zero-initialize-id_reg-in-h_memstick_read_dev_id.patch @@ -0,0 +1,47 @@ +From 21b34a3a204ed616373a12ec17dc127ebe51eab3 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Tue, 15 Jul 2025 15:56:05 -0700 +Subject: memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() + +From: Nathan Chancellor + +commit 21b34a3a204ed616373a12ec17dc127ebe51eab3 upstream. + +A new warning in clang [1] points out that id_reg is uninitialized then +passed to memstick_init_req() as a const pointer: + + drivers/memstick/core/memstick.c:330:59: error: variable 'id_reg' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] + 330 | memstick_init_req(&card->current_mrq, MS_TPC_READ_REG, &id_reg, + | ^~~~~~ + +Commit de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull +warning") intentionally passed this variable uninitialized to avoid an +-Wnonnull warning from a NULL value that was previously there because +id_reg is never read from the call to memstick_init_req() in +h_memstick_read_dev_id(). Just zero initialize id_reg to avoid the +warning, which is likely happening in the majority of builds using +modern compilers that support '-ftrivial-auto-var-init=zero'. + +Cc: stable@vger.kernel.org +Fixes: de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull warning") +Link: https://github.com/llvm/llvm-project/commit/00dacf8c22f065cb52efb14cd091d441f19b319e [1] +Closes: https://github.com/ClangBuiltLinux/linux/issues/2105 +Signed-off-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20250715-memstick-fix-uninit-const-pointer-v1-1-f6753829c27a@kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/memstick/core/memstick.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/memstick/core/memstick.c ++++ b/drivers/memstick/core/memstick.c +@@ -323,7 +323,7 @@ EXPORT_SYMBOL(memstick_init_req); + static int h_memstick_read_dev_id(struct memstick_dev *card, + struct memstick_request **mrq) + { +- struct ms_id_register id_reg; ++ struct ms_id_register id_reg = {}; + + if (!(*mrq)) { + memstick_init_req(&card->current_mrq, MS_TPC_READ_REG, &id_reg, diff --git a/queue-6.6/mmc-bcm2835-fix-dma_unmap_sg-nents-value.patch b/queue-6.6/mmc-bcm2835-fix-dma_unmap_sg-nents-value.patch new file mode 100644 index 0000000000..f5fe4a33cf --- /dev/null +++ b/queue-6.6/mmc-bcm2835-fix-dma_unmap_sg-nents-value.patch @@ -0,0 +1,34 @@ +From ff09b71bf9daeca4f21d6e5e449641c9fad75b53 Mon Sep 17 00:00:00 2001 +From: Thomas Fourier +Date: Mon, 30 Jun 2025 11:35:07 +0200 +Subject: mmc: bcm2835: Fix dma_unmap_sg() nents value + +From: Thomas Fourier + +commit ff09b71bf9daeca4f21d6e5e449641c9fad75b53 upstream. + +The dma_unmap_sg() functions should be called with the same nents as the +dma_map_sg(), not the value the map function returned. + +Fixes: 2f5da678351f ("mmc: bcm2835: Properly handle dmaengine_prep_slave_sg") +Signed-off-by: Thomas Fourier +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250630093510.82871-2-fourier.thomas@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/bcm2835.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/bcm2835.c ++++ b/drivers/mmc/host/bcm2835.c +@@ -502,7 +502,8 @@ void bcm2835_prepare_dma(struct bcm2835_ + DMA_PREP_INTERRUPT | DMA_CTRL_ACK); + + if (!desc) { +- dma_unmap_sg(dma_chan->device->dev, data->sg, sg_len, dir_data); ++ dma_unmap_sg(dma_chan->device->dev, data->sg, data->sg_len, ++ dir_data); + return; + } + diff --git a/queue-6.6/mmc-sdhci-pci-quirk-for-broken-command-queuing-on-intel-glk-based-positivo-models.patch b/queue-6.6/mmc-sdhci-pci-quirk-for-broken-command-queuing-on-intel-glk-based-positivo-models.patch new file mode 100644 index 0000000000..2015e3a217 --- /dev/null +++ b/queue-6.6/mmc-sdhci-pci-quirk-for-broken-command-queuing-on-intel-glk-based-positivo-models.patch @@ -0,0 +1,38 @@ +From 50c78f398e92fafa1cbba3469c95fe04b2e4206d Mon Sep 17 00:00:00 2001 +From: Edson Juliano Drosdeck +Date: Thu, 26 Jun 2025 08:24:42 -0300 +Subject: mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models + +From: Edson Juliano Drosdeck + +commit 50c78f398e92fafa1cbba3469c95fe04b2e4206d upstream. + +Disable command queuing on Intel GLK-based Positivo models. + +Without this quirk, CQE (Command Queuing Engine) causes instability +or I/O errors during operation. Disabling it ensures stable +operation on affected devices. + +Signed-off-by: Edson Juliano Drosdeck +Fixes: bedf9fc01ff1 ("mmc: sdhci: Workaround broken command queuing on Intel GLK") +Cc: stable@vger.kernel.org +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20250626112442.9791-1-edson.drosdeck@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-pci-core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -911,7 +911,8 @@ static bool glk_broken_cqhci(struct sdhc + { + return slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_GLK_EMMC && + (dmi_match(DMI_BIOS_VENDOR, "LENOVO") || +- dmi_match(DMI_SYS_VENDOR, "IRBIS")); ++ dmi_match(DMI_SYS_VENDOR, "IRBIS") || ++ dmi_match(DMI_SYS_VENDOR, "Positivo Tecnologia SA")); + } + + static bool jsl_broken_hs400es(struct sdhci_pci_slot *slot) diff --git a/queue-6.6/mmc-sdhci_am654-workaround-for-errata-i2312.patch b/queue-6.6/mmc-sdhci_am654-workaround-for-errata-i2312.patch new file mode 100644 index 0000000000..2a765ca928 --- /dev/null +++ b/queue-6.6/mmc-sdhci_am654-workaround-for-errata-i2312.patch @@ -0,0 +1,62 @@ +From 6d0b1c01847fedd7c85a5cdf59b8cfc7d14512e6 Mon Sep 17 00:00:00 2001 +From: Judith Mendez +Date: Thu, 26 Jun 2025 18:14:52 -0500 +Subject: mmc: sdhci_am654: Workaround for Errata i2312 + +From: Judith Mendez + +commit 6d0b1c01847fedd7c85a5cdf59b8cfc7d14512e6 upstream. + +Errata i2312 [0] for K3 silicon mentions the maximum obtainable +timeout through MMC host controller is 700ms. And for commands taking +longer than 700ms, hardware timeout should be disabled and software +timeout should be used. + +The workaround for Errata i2312 can be achieved by adding +SDHCI_QUIRK2_DISABLE_HW_TIMEOUT quirk in sdhci_am654. + +[0] https://www.ti.com/lit/pdf/sprz487 + +Signed-off-by: Judith Mendez +Acked-by: Adrian Hunter +Fixes: 41fd4caeb00b ("mmc: sdhci_am654: Add Initial Support for AM654 SDHCI driver") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250626231452.3460987-1-jm@ti.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci_am654.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/mmc/host/sdhci_am654.c ++++ b/drivers/mmc/host/sdhci_am654.c +@@ -559,7 +559,8 @@ static struct sdhci_ops sdhci_am654_ops + static const struct sdhci_pltfm_data sdhci_am654_pdata = { + .ops = &sdhci_am654_ops, + .quirks = SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12, +- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN | ++ SDHCI_QUIRK2_DISABLE_HW_TIMEOUT, + }; + + static const struct sdhci_am654_driver_data sdhci_am654_sr1_drvdata = { +@@ -589,7 +590,8 @@ static struct sdhci_ops sdhci_j721e_8bit + static const struct sdhci_pltfm_data sdhci_j721e_8bit_pdata = { + .ops = &sdhci_j721e_8bit_ops, + .quirks = SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12, +- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN | ++ SDHCI_QUIRK2_DISABLE_HW_TIMEOUT, + }; + + static const struct sdhci_am654_driver_data sdhci_j721e_8bit_drvdata = { +@@ -613,7 +615,8 @@ static struct sdhci_ops sdhci_j721e_4bit + static const struct sdhci_pltfm_data sdhci_j721e_4bit_pdata = { + .ops = &sdhci_j721e_4bit_ops, + .quirks = SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12, +- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN | ++ SDHCI_QUIRK2_DISABLE_HW_TIMEOUT, + }; + + static const struct sdhci_am654_driver_data sdhci_j721e_4bit_drvdata = { diff --git a/queue-6.6/mptcp-reset-fallback-status-gracefully-at-disconnect-time.patch b/queue-6.6/mptcp-reset-fallback-status-gracefully-at-disconnect-time.patch new file mode 100644 index 0000000000..3eecd5e297 --- /dev/null +++ b/queue-6.6/mptcp-reset-fallback-status-gracefully-at-disconnect-time.patch @@ -0,0 +1,50 @@ +From da9b2fc7b73d147d88abe1922de5ab72d72d7756 Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Mon, 14 Jul 2025 18:41:46 +0200 +Subject: mptcp: reset fallback status gracefully at disconnect() time + +From: Paolo Abeni + +commit da9b2fc7b73d147d88abe1922de5ab72d72d7756 upstream. + +mptcp_disconnect() clears the fallback bit unconditionally, without +touching the associated flags. + +The bit clear is safe, as no fallback operation can race with that -- +all subflow are already in TCP_CLOSE status thanks to the previous +FASTCLOSE -- but we need to consistently reset all the fallback related +status. + +Also acquire the relevant lock, to avoid fouling static analyzers. + +Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation") +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Abeni +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20250714-net-mptcp-fallback-races-v1-3-391aff963322@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -3183,7 +3183,16 @@ static int mptcp_disconnect(struct sock + * subflow + */ + mptcp_destroy_common(msk, MPTCP_CF_FASTCLOSE); ++ ++ /* The first subflow is already in TCP_CLOSE status, the following ++ * can't overlap with a fallback anymore ++ */ ++ spin_lock_bh(&msk->fallback_lock); ++ msk->allow_subflows = true; ++ msk->allow_infinite_fallback = true; + WRITE_ONCE(msk->flags, 0); ++ spin_unlock_bh(&msk->fallback_lock); ++ + msk->cb_flags = 0; + msk->recovery = false; + msk->can_ack = false; diff --git a/queue-6.6/net-libwx-fix-the-using-of-rx-buffer-dma.patch b/queue-6.6/net-libwx-fix-the-using-of-rx-buffer-dma.patch new file mode 100644 index 0000000000..cdbc94a881 --- /dev/null +++ b/queue-6.6/net-libwx-fix-the-using-of-rx-buffer-dma.patch @@ -0,0 +1,60 @@ +From 5fd77cc6bd9b368431a815a780e407b7781bcca0 Mon Sep 17 00:00:00 2001 +From: Jiawen Wu +Date: Mon, 14 Jul 2025 10:47:54 +0800 +Subject: net: libwx: fix the using of Rx buffer DMA + +From: Jiawen Wu + +commit 5fd77cc6bd9b368431a815a780e407b7781bcca0 upstream. + +The wx_rx_buffer structure contained two DMA address fields: 'dma' and +'page_dma'. However, only 'page_dma' was actually initialized and used +to program the Rx descriptor. But 'dma' was uninitialized and used in +some paths. + +This could lead to undefined behavior, including DMA errors or +use-after-free, if the uninitialized 'dma' was used. Althrough such +error has not yet occurred, it is worth fixing in the code. + +Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI") +Cc: stable@vger.kernel.org +Signed-off-by: Jiawen Wu +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250714024755.17512-3-jiawenwu@trustnetic.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/wangxun/libwx/wx_lib.c | 4 ++-- + drivers/net/ethernet/wangxun/libwx/wx_type.h | 1 - + 2 files changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c ++++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c +@@ -307,7 +307,7 @@ static bool wx_alloc_mapped_page(struct + return false; + dma = page_pool_get_dma_addr(page); + +- bi->page_dma = dma; ++ bi->dma = dma; + bi->page = page; + bi->page_offset = 0; + +@@ -344,7 +344,7 @@ void wx_alloc_rx_buffers(struct wx_ring + DMA_FROM_DEVICE); + + rx_desc->read.pkt_addr = +- cpu_to_le64(bi->page_dma + bi->page_offset); ++ cpu_to_le64(bi->dma + bi->page_offset); + + rx_desc++; + bi++; +--- a/drivers/net/ethernet/wangxun/libwx/wx_type.h ++++ b/drivers/net/ethernet/wangxun/libwx/wx_type.h +@@ -755,7 +755,6 @@ struct wx_tx_buffer { + struct wx_rx_buffer { + struct sk_buff *skb; + dma_addr_t dma; +- dma_addr_t page_dma; + struct page *page; + unsigned int page_offset; + }; diff --git a/queue-6.6/net-libwx-properly-reset-rx-ring-descriptor.patch b/queue-6.6/net-libwx-properly-reset-rx-ring-descriptor.patch new file mode 100644 index 0000000000..02d6e1b857 --- /dev/null +++ b/queue-6.6/net-libwx-properly-reset-rx-ring-descriptor.patch @@ -0,0 +1,124 @@ +From d992ed7e1b687ad7df0763d3e015a5358646210b Mon Sep 17 00:00:00 2001 +From: Jiawen Wu +Date: Mon, 14 Jul 2025 10:47:55 +0800 +Subject: net: libwx: properly reset Rx ring descriptor + +From: Jiawen Wu + +commit d992ed7e1b687ad7df0763d3e015a5358646210b upstream. + +When device reset is triggered by feature changes such as toggling Rx +VLAN offload, wx->do_reset() is called to reinitialize Rx rings. The +hardware descriptor ring may retain stale values from previous sessions. +And only set the length to 0 in rx_desc[0] would result in building +malformed SKBs. Fix it to ensure a clean slate after device reset. + +[ 549.186435] [ C16] ------------[ cut here ]------------ +[ 549.186457] [ C16] kernel BUG at net/core/skbuff.c:2814! +[ 549.186468] [ C16] Oops: invalid opcode: 0000 [#1] SMP NOPTI +[ 549.186472] [ C16] CPU: 16 UID: 0 PID: 0 Comm: swapper/16 Kdump: loaded Not tainted 6.16.0-rc4+ #23 PREEMPT(voluntary) +[ 549.186476] [ C16] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024 +[ 549.186478] [ C16] RIP: 0010:__pskb_pull_tail+0x3ff/0x510 +[ 549.186484] [ C16] Code: 06 f0 ff 4f 34 74 7b 4d 8b 8c 24 c8 00 00 00 45 8b 84 24 c0 00 00 00 e9 c8 fd ff ff 48 c7 44 24 08 00 00 00 00 e9 5e fe ff ff <0f> 0b 31 c0 e9 23 90 5b ff 41 f7 c6 ff 0f 00 00 75 bf 49 8b 06 a8 +[ 549.186487] [ C16] RSP: 0018:ffffb391c0640d70 EFLAGS: 00010282 +[ 549.186490] [ C16] RAX: 00000000fffffff2 RBX: ffff8fe7e4d40200 RCX: 00000000fffffff2 +[ 549.186492] [ C16] RDX: ffff8fe7c3a4bf8e RSI: 0000000000000180 RDI: ffff8fe7c3a4bf40 +[ 549.186494] [ C16] RBP: ffffb391c0640da8 R08: ffff8fe7c3a4c0c0 R09: 000000000000000e +[ 549.186496] [ C16] R10: ffffb391c0640d88 R11: 000000000000000e R12: ffff8fe7e4d40200 +[ 549.186497] [ C16] R13: 00000000fffffff2 R14: ffff8fe7fa01a000 R15: 00000000fffffff2 +[ 549.186499] [ C16] FS: 0000000000000000(0000) GS:ffff8fef5ae40000(0000) knlGS:0000000000000000 +[ 549.186502] [ C16] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 549.186503] [ C16] CR2: 00007f77d81d6000 CR3: 000000051a032000 CR4: 0000000000750ef0 +[ 549.186505] [ C16] PKRU: 55555554 +[ 549.186507] [ C16] Call Trace: +[ 549.186510] [ C16] +[ 549.186513] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 549.186517] [ C16] __skb_pad+0xc7/0xf0 +[ 549.186523] [ C16] wx_clean_rx_irq+0x355/0x3b0 [libwx] +[ 549.186533] [ C16] wx_poll+0x92/0x120 [libwx] +[ 549.186540] [ C16] __napi_poll+0x28/0x190 +[ 549.186544] [ C16] net_rx_action+0x301/0x3f0 +[ 549.186548] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 549.186551] [ C16] ? __raw_spin_lock_irqsave+0x1e/0x50 +[ 549.186554] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 549.186557] [ C16] ? wake_up_nohz_cpu+0x35/0x160 +[ 549.186559] [ C16] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 549.186563] [ C16] handle_softirqs+0xf9/0x2c0 +[ 549.186568] [ C16] __irq_exit_rcu+0xc7/0x130 +[ 549.186572] [ C16] common_interrupt+0xb8/0xd0 +[ 549.186576] [ C16] +[ 549.186577] [ C16] +[ 549.186579] [ C16] asm_common_interrupt+0x22/0x40 +[ 549.186582] [ C16] RIP: 0010:cpuidle_enter_state+0xc2/0x420 +[ 549.186585] [ C16] Code: 00 00 e8 11 0e 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 0d ed 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d +[ 549.186587] [ C16] RSP: 0018:ffffb391c0277e78 EFLAGS: 00000246 +[ 549.186590] [ C16] RAX: ffff8fef5ae40000 RBX: 0000000000000003 RCX: 0000000000000000 +[ 549.186591] [ C16] RDX: 0000007fde0faac5 RSI: ffffffff826e53f6 RDI: ffffffff826fa9b3 +[ 549.186593] [ C16] RBP: ffff8fe7c3a20800 R08: 0000000000000002 R09: 0000000000000000 +[ 549.186595] [ C16] R10: 0000000000000000 R11: 000000000000ffff R12: ffffffff82ed7a40 +[ 549.186596] [ C16] R13: 0000007fde0faac5 R14: 0000000000000003 R15: 0000000000000000 +[ 549.186601] [ C16] ? cpuidle_enter_state+0xb3/0x420 +[ 549.186605] [ C16] cpuidle_enter+0x29/0x40 +[ 549.186609] [ C16] cpuidle_idle_call+0xfd/0x170 +[ 549.186613] [ C16] do_idle+0x7a/0xc0 +[ 549.186616] [ C16] cpu_startup_entry+0x25/0x30 +[ 549.186618] [ C16] start_secondary+0x117/0x140 +[ 549.186623] [ C16] common_startup_64+0x13e/0x148 +[ 549.186628] [ C16] + +Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI") +Cc: stable@vger.kernel.org +Signed-off-by: Jiawen Wu +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250714024755.17512-4-jiawenwu@trustnetic.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/wangxun/libwx/wx_hw.c | 7 +++---- + drivers/net/ethernet/wangxun/libwx/wx_lib.c | 5 +++++ + 2 files changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/wangxun/libwx/wx_hw.c ++++ b/drivers/net/ethernet/wangxun/libwx/wx_hw.c +@@ -1348,7 +1348,6 @@ static void wx_configure_rx_ring(struct + struct wx_ring *ring) + { + u16 reg_idx = ring->reg_idx; +- union wx_rx_desc *rx_desc; + u64 rdba = ring->dma; + u32 rxdctl; + +@@ -1378,9 +1377,9 @@ static void wx_configure_rx_ring(struct + memset(ring->rx_buffer_info, 0, + sizeof(struct wx_rx_buffer) * ring->count); + +- /* initialize Rx descriptor 0 */ +- rx_desc = WX_RX_DESC(ring, 0); +- rx_desc->wb.upper.length = 0; ++ /* reset ntu and ntc to place SW in sync with hardware */ ++ ring->next_to_clean = 0; ++ ring->next_to_use = 0; + + /* enable receive descriptor ring */ + wr32m(wx, WX_PX_RR_CFG(reg_idx), +--- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c ++++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c +@@ -357,6 +357,8 @@ void wx_alloc_rx_buffers(struct wx_ring + + /* clear the status bits for the next_to_use descriptor */ + rx_desc->wb.upper.status_error = 0; ++ /* clear the length for the next_to_use descriptor */ ++ rx_desc->wb.upper.length = 0; + + cleaned_count--; + } while (cleaned_count); +@@ -2173,6 +2175,9 @@ static void wx_clean_rx_ring(struct wx_r + } + } + ++ /* Zero out the descriptor ring */ ++ memset(rx_ring->desc, 0, rx_ring->size); ++ + rx_ring->next_to_alloc = 0; + rx_ring->next_to_clean = 0; + rx_ring->next_to_use = 0; diff --git a/queue-6.6/net-libwx-remove-duplicate-page_pool_put_full_page.patch b/queue-6.6/net-libwx-remove-duplicate-page_pool_put_full_page.patch new file mode 100644 index 0000000000..2a2a5464d8 --- /dev/null +++ b/queue-6.6/net-libwx-remove-duplicate-page_pool_put_full_page.patch @@ -0,0 +1,135 @@ +From 1b7e585c04cd5f0731dd25ffd396277e55fae0e6 Mon Sep 17 00:00:00 2001 +From: Jiawen Wu +Date: Mon, 14 Jul 2025 10:47:53 +0800 +Subject: net: libwx: remove duplicate page_pool_put_full_page() + +From: Jiawen Wu + +commit 1b7e585c04cd5f0731dd25ffd396277e55fae0e6 upstream. + +page_pool_put_full_page() should only be invoked when freeing Rx buffers +or building a skb if the size is too short. At other times, the pages +need to be reused. So remove the redundant page put. In the original +code, double free pages cause kernel panic: + +[ 876.949834] __irq_exit_rcu+0xc7/0x130 +[ 876.949836] common_interrupt+0xb8/0xd0 +[ 876.949838] +[ 876.949838] +[ 876.949840] asm_common_interrupt+0x22/0x40 +[ 876.949841] RIP: 0010:cpuidle_enter_state+0xc2/0x420 +[ 876.949843] Code: 00 00 e8 d1 1d 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 cd fc 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d +[ 876.949844] RSP: 0018:ffffaa7340267e78 EFLAGS: 00000246 +[ 876.949845] RAX: ffff9e3f135be000 RBX: 0000000000000002 RCX: 0000000000000000 +[ 876.949846] RDX: 000000cc2dc4cb7c RSI: ffffffff89ee49ae RDI: ffffffff89ef9f9e +[ 876.949847] RBP: ffff9e378f940800 R08: 0000000000000002 R09: 00000000000000ed +[ 876.949848] R10: 000000000000afc8 R11: ffff9e3e9e5a9b6c R12: ffffffff8a6d8580 +[ 876.949849] R13: 000000cc2dc4cb7c R14: 0000000000000002 R15: 0000000000000000 +[ 876.949852] ? cpuidle_enter_state+0xb3/0x420 +[ 876.949855] cpuidle_enter+0x29/0x40 +[ 876.949857] cpuidle_idle_call+0xfd/0x170 +[ 876.949859] do_idle+0x7a/0xc0 +[ 876.949861] cpu_startup_entry+0x25/0x30 +[ 876.949862] start_secondary+0x117/0x140 +[ 876.949864] common_startup_64+0x13e/0x148 +[ 876.949867] +[ 876.949868] ---[ end trace 0000000000000000 ]--- +[ 876.949869] ------------[ cut here ]------------ +[ 876.949870] list_del corruption, ffffead40445a348->next is NULL +[ 876.949873] WARNING: CPU: 14 PID: 0 at lib/list_debug.c:52 __list_del_entry_valid_or_report+0x67/0x120 +[ 876.949875] Modules linked in: snd_hrtimer(E) bnep(E) binfmt_misc(E) amdgpu(E) squashfs(E) vfat(E) loop(E) fat(E) amd_atl(E) snd_hda_codec_realtek(E) intel_rapl_msr(E) snd_hda_codec_generic(E) intel_rapl_common(E) snd_hda_scodec_component(E) snd_hda_codec_hdmi(E) snd_hda_intel(E) edac_mce_amd(E) snd_intel_dspcfg(E) snd_hda_codec(E) snd_hda_core(E) amdxcp(E) kvm_amd(E) snd_hwdep(E) gpu_sched(E) drm_panel_backlight_quirks(E) cec(E) snd_pcm(E) drm_buddy(E) snd_seq_dummy(E) drm_ttm_helper(E) btusb(E) kvm(E) snd_seq_oss(E) btrtl(E) ttm(E) btintel(E) snd_seq_midi(E) btbcm(E) drm_exec(E) snd_seq_midi_event(E) i2c_algo_bit(E) snd_rawmidi(E) bluetooth(E) drm_suballoc_helper(E) irqbypass(E) snd_seq(E) ghash_clmulni_intel(E) sha512_ssse3(E) drm_display_helper(E) aesni_intel(E) snd_seq_device(E) rfkill(E) snd_timer(E) gf128mul(E) drm_client_lib(E) drm_kms_helper(E) snd(E) i2c_piix4(E) joydev(E) soundcore(E) wmi_bmof(E) ccp(E) k10temp(E) i2c_smbus(E) gpio_amdpt(E) i2c_designware_platform(E) gpio_generic(E) sg(E) +[ 876.949914] i2c_designware_core(E) sch_fq_codel(E) parport_pc(E) drm(E) ppdev(E) lp(E) parport(E) fuse(E) nfnetlink(E) ip_tables(E) ext4 crc16 mbcache jbd2 sd_mod sfp mdio_i2c i2c_core txgbe ahci ngbe pcs_xpcs libahci libwx r8169 phylink libata realtek ptp pps_core video wmi +[ 876.949933] CPU: 14 UID: 0 PID: 0 Comm: swapper/14 Kdump: loaded Tainted: G W E 6.16.0-rc2+ #20 PREEMPT(voluntary) +[ 876.949935] Tainted: [W]=WARN, [E]=UNSIGNED_MODULE +[ 876.949936] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024 +[ 876.949936] RIP: 0010:__list_del_entry_valid_or_report+0x67/0x120 +[ 876.949938] Code: 00 00 00 48 39 7d 08 0f 85 a6 00 00 00 5b b8 01 00 00 00 5d 41 5c e9 73 0d 93 ff 48 89 fe 48 c7 c7 a0 31 e8 89 e8 59 7c b3 ff <0f> 0b 31 c0 5b 5d 41 5c e9 57 0d 93 ff 48 89 fe 48 c7 c7 c8 31 e8 +[ 876.949940] RSP: 0018:ffffaa73405d0c60 EFLAGS: 00010282 +[ 876.949941] RAX: 0000000000000000 RBX: ffffead40445a348 RCX: 0000000000000000 +[ 876.949942] RDX: 0000000000000105 RSI: 0000000000000001 RDI: 00000000ffffffff +[ 876.949943] RBP: 0000000000000000 R08: 000000010006dfde R09: ffffffff8a47d150 +[ 876.949944] R10: ffffffff8a47d150 R11: 0000000000000003 R12: dead000000000122 +[ 876.949945] R13: ffff9e3e9e5af700 R14: ffffead40445a348 R15: ffff9e3e9e5af720 +[ 876.949946] FS: 0000000000000000(0000) GS:ffff9e3f135be000(0000) knlGS:0000000000000000 +[ 876.949947] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 876.949948] CR2: 00007fa58b480048 CR3: 0000000156724000 CR4: 0000000000750ef0 +[ 876.949949] PKRU: 55555554 +[ 876.949950] Call Trace: +[ 876.949951] +[ 876.949952] __rmqueue_pcplist+0x53/0x2c0 +[ 876.949955] alloc_pages_bulk_noprof+0x2e0/0x660 +[ 876.949958] __page_pool_alloc_pages_slow+0xa9/0x400 +[ 876.949961] page_pool_alloc_pages+0xa/0x20 +[ 876.949963] wx_alloc_rx_buffers+0xd7/0x110 [libwx] +[ 876.949967] wx_clean_rx_irq+0x262/0x430 [libwx] +[ 876.949971] wx_poll+0x92/0x130 [libwx] +[ 876.949975] __napi_poll+0x28/0x190 +[ 876.949977] net_rx_action+0x301/0x3f0 +[ 876.949980] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 876.949981] ? profile_tick+0x30/0x70 +[ 876.949983] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 876.949984] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 876.949986] ? timerqueue_add+0xa3/0xc0 +[ 876.949988] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 876.949989] ? __raise_softirq_irqoff+0x16/0x70 +[ 876.949991] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 876.949993] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 876.949994] ? wx_msix_clean_rings+0x41/0x50 [libwx] +[ 876.949998] handle_softirqs+0xf9/0x2c0 + +Fixes: 3c47e8ae113a ("net: libwx: Support to receive packets in NAPI") +Cc: stable@vger.kernel.org +Signed-off-by: Jiawen Wu +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250714024755.17512-2-jiawenwu@trustnetic.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/wangxun/libwx/wx_lib.c | 11 ----------- + drivers/net/ethernet/wangxun/libwx/wx_type.h | 1 - + 2 files changed, 12 deletions(-) + +--- a/drivers/net/ethernet/wangxun/libwx/wx_lib.c ++++ b/drivers/net/ethernet/wangxun/libwx/wx_lib.c +@@ -171,10 +171,6 @@ static void wx_dma_sync_frag(struct wx_r + skb_frag_off(frag), + skb_frag_size(frag), + DMA_FROM_DEVICE); +- +- /* If the page was released, just unmap it. */ +- if (unlikely(WX_CB(skb)->page_released)) +- page_pool_put_full_page(rx_ring->page_pool, rx_buffer->page, false); + } + + static struct wx_rx_buffer *wx_get_rx_buffer(struct wx_ring *rx_ring, +@@ -224,10 +220,6 @@ static void wx_put_rx_buffer(struct wx_r + struct sk_buff *skb, + int rx_buffer_pgcnt) + { +- if (!IS_ERR(skb) && WX_CB(skb)->dma == rx_buffer->dma) +- /* the page has been released from the ring */ +- WX_CB(skb)->page_released = true; +- + /* clear contents of rx_buffer */ + rx_buffer->page = NULL; + rx_buffer->skb = NULL; +@@ -2158,9 +2150,6 @@ static void wx_clean_rx_ring(struct wx_r + if (rx_buffer->skb) { + struct sk_buff *skb = rx_buffer->skb; + +- if (WX_CB(skb)->page_released) +- page_pool_put_full_page(rx_ring->page_pool, rx_buffer->page, false); +- + dev_kfree_skb(skb); + } + +--- a/drivers/net/ethernet/wangxun/libwx/wx_type.h ++++ b/drivers/net/ethernet/wangxun/libwx/wx_type.h +@@ -668,7 +668,6 @@ enum wx_reset_type { + struct wx_cb { + dma_addr_t dma; + u16 append_cnt; /* number of skb's appended */ +- bool page_released; + bool dma_released; + }; + diff --git a/queue-6.6/net-mlx5-update-the-list-of-the-pci-supported-devices.patch b/queue-6.6/net-mlx5-update-the-list-of-the-pci-supported-devices.patch new file mode 100644 index 0000000000..e20d6e3cb7 --- /dev/null +++ b/queue-6.6/net-mlx5-update-the-list-of-the-pci-supported-devices.patch @@ -0,0 +1,34 @@ +From ad4f6df4f384905bc85f9fbfc1c0c198fb563286 Mon Sep 17 00:00:00 2001 +From: Maor Gottlieb +Date: Wed, 16 Jul 2025 10:29:29 +0300 +Subject: net/mlx5: Update the list of the PCI supported devices + +From: Maor Gottlieb + +commit ad4f6df4f384905bc85f9fbfc1c0c198fb563286 upstream. + +Add the upcoming ConnectX-10 device ID to the table of supported +PCI device IDs. + +Cc: stable@vger.kernel.org +Signed-off-by: Maor Gottlieb +Reviewed-by: Mark Bloch +Reviewed-by: Eran Ben Elisha +Signed-off-by: Tariq Toukan +Link: https://patch.msgid.link/1752650969-148501-1-git-send-email-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -2206,6 +2206,7 @@ static const struct pci_device_id mlx5_c + { PCI_VDEVICE(MELLANOX, 0x1021) }, /* ConnectX-7 */ + { PCI_VDEVICE(MELLANOX, 0x1023) }, /* ConnectX-8 */ + { PCI_VDEVICE(MELLANOX, 0x1025) }, /* ConnectX-9 */ ++ { PCI_VDEVICE(MELLANOX, 0x1027) }, /* ConnectX-10 */ + { PCI_VDEVICE(MELLANOX, 0xa2d2) }, /* BlueField integrated ConnectX-5 network controller */ + { PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF}, /* BlueField integrated ConnectX-5 network controller VF */ + { PCI_VDEVICE(MELLANOX, 0xa2d6) }, /* BlueField-2 integrated ConnectX-6 Dx network controller */ diff --git a/queue-6.6/phonet-pep-move-call-to-pn_skb_get_dst_sockaddr-earlier-in-pep_sock_accept.patch b/queue-6.6/phonet-pep-move-call-to-pn_skb_get_dst_sockaddr-earlier-in-pep_sock_accept.patch new file mode 100644 index 0000000000..c4e963b7db --- /dev/null +++ b/queue-6.6/phonet-pep-move-call-to-pn_skb_get_dst_sockaddr-earlier-in-pep_sock_accept.patch @@ -0,0 +1,50 @@ +From 17ba793f381eb813596d6de1cc6820bcbda5ed8b Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Tue, 15 Jul 2025 16:15:40 -0700 +Subject: phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() + +From: Nathan Chancellor + +commit 17ba793f381eb813596d6de1cc6820bcbda5ed8b upstream. + +A new warning in clang [1] points out a place in pep_sock_accept() where +dst is uninitialized then passed as a const pointer to pep_find_pipe(): + + net/phonet/pep.c:829:37: error: variable 'dst' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] + 829 | newsk = pep_find_pipe(&pn->hlist, &dst, pipe_handle); + | ^~~: + +Move the call to pn_skb_get_dst_sockaddr(), which initializes dst, to +before the call to pep_find_pipe(), so that dst is consistently used +initialized throughout the function. + +Cc: stable@vger.kernel.org +Fixes: f7ae8d59f661 ("Phonet: allocate sock from accept syscall rather than soft IRQ") +Link: https://github.com/llvm/llvm-project/commit/00dacf8c22f065cb52efb14cd091d441f19b319e [1] +Closes: https://github.com/ClangBuiltLinux/linux/issues/2101 +Signed-off-by: Nathan Chancellor +Link: https://patch.msgid.link/20250715-net-phonet-fix-uninit-const-pointer-v1-1-8efd1bd188b3@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/phonet/pep.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/phonet/pep.c ++++ b/net/phonet/pep.c +@@ -826,6 +826,7 @@ static struct sock *pep_sock_accept(stru + } + + /* Check for duplicate pipe handle */ ++ pn_skb_get_dst_sockaddr(skb, &dst); + newsk = pep_find_pipe(&pn->hlist, &dst, pipe_handle); + if (unlikely(newsk)) { + __sock_put(newsk); +@@ -850,7 +851,6 @@ static struct sock *pep_sock_accept(stru + newsk->sk_destruct = pipe_destruct; + + newpn = pep_sk(newsk); +- pn_skb_get_dst_sockaddr(skb, &dst); + pn_skb_get_src_sockaddr(skb, &src); + newpn->pn_sk.sobject = pn_sockaddr_get_object(&dst); + newpn->pn_sk.dobject = pn_sockaddr_get_object(&src); diff --git a/queue-6.6/series b/queue-6.6/series index 2716f99459..5722c6765a 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -20,3 +20,23 @@ hid-core-do-not-bypass-hid_hw_raw_request.patch tracing-probes-avoid-using-params-uninitialized-in-parse_btf_arg.patch tracing-add-down_write-trace_event_sem-when-adding-trace-event.patch tracing-osnoise-fix-crash-in-timerlat_dump_stack.patch +drm-amdgpu-gfx8-reset-compute-ring-wptr-on-the-gpu-on-resume.patch +alsa-hda-realtek-add-quirk-for-asus-rog-strix-g712lws.patch +io_uring-poll-fix-pollerr-handling.patch +mptcp-reset-fallback-status-gracefully-at-disconnect-time.patch +phonet-pep-move-call-to-pn_skb_get_dst_sockaddr-earlier-in-pep_sock_accept.patch +net-mlx5-update-the-list-of-the-pci-supported-devices.patch +arm64-dts-imx8mp-venice-gw74xx-fix-tpm-spi-frequency.patch +arm64-dts-freescale-imx8mm-verdin-keep-ldo5-always-on.patch +arm64-dts-rockchip-use-cs-gpios-for-spi1-on-ringneck.patch +af_packet-fix-the-so_sndtimeo-constraint-not-effective-on-tpacked_snd.patch +af_packet-fix-soft-lockup-issue-caused-by-tpacket_snd.patch +dmaengine-nbpfaxi-fix-memory-corruption-in-probe.patch +isofs-verify-inode-mode-when-loading-from-disk.patch +memstick-core-zero-initialize-id_reg-in-h_memstick_read_dev_id.patch +mmc-bcm2835-fix-dma_unmap_sg-nents-value.patch +mmc-sdhci-pci-quirk-for-broken-command-queuing-on-intel-glk-based-positivo-models.patch +mmc-sdhci_am654-workaround-for-errata-i2312.patch +net-libwx-remove-duplicate-page_pool_put_full_page.patch +net-libwx-fix-the-using-of-rx-buffer-dma.patch +net-libwx-properly-reset-rx-ring-descriptor.patch