From: Sasha Levin Date: Mon, 6 Oct 2025 16:18:41 +0000 (-0400) Subject: Fixes for all trees X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7f392ba6aa790825ffcfbb429adcd3f5a5c41e49;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/dm-integrity-limit-max_tag_size-to-255.patch b/queue-5.10/dm-integrity-limit-max_tag_size-to-255.patch new file mode 100644 index 0000000000..2471cb227c --- /dev/null +++ b/queue-5.10/dm-integrity-limit-max_tag_size-to-255.patch @@ -0,0 +1,34 @@ +From 4144a04827f4dc9cb978a01b181895cd7ddfc0ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 15:52:02 +0200 +Subject: dm-integrity: limit MAX_TAG_SIZE to 255 + +From: Mikulas Patocka + +[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ] + +MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size += ic->tag_size" assignment. We need to limit it to 255. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-integrity.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index 07a7b4e51f0ef..6e5627975cdf5 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -119,7 +119,7 @@ struct journal_sector { + commit_id_t commit_id; + }; + +-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK])) ++#define MAX_TAG_SIZE 255 + + #define METADATA_PADDING_SECTORS 8 + +-- +2.51.0 + diff --git a/queue-5.10/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch b/queue-5.10/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch new file mode 100644 index 0000000000..583523fb20 --- /dev/null +++ b/queue-5.10/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch @@ -0,0 +1,49 @@ +From 4257d6a294d825c8a527dc1def6e3650432909d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:16:55 +0800 +Subject: perf subcmd: avoid crash in exclude_cmds when excludes is empty + +From: hupu + +[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ] + +When cross-compiling the perf tool for ARM64, `perf help` may crash +with the following assertion failure: + + help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed. + +This happens when the perf binary is not named exactly "perf" or when +multiple "perf-*" binaries exist in the same directory. In such cases, +the `excludes` command list can be empty, which leads to the final +assertion in exclude_cmds() being triggered. + +Add a simple guard at the beginning of exclude_cmds() to return early +if excludes->cnt is zero, preventing the crash. + +Signed-off-by: hupu +Reported-by: Guilherme Amadio +Reviewed-by: Namhyung Kim +Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/lib/subcmd/help.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c +index 42f57b640f119..687307f2fe0f7 100644 +--- a/tools/lib/subcmd/help.c ++++ b/tools/lib/subcmd/help.c +@@ -72,6 +72,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) + size_t ci, cj, ei; + int cmp; + ++ if (!excludes->cnt) ++ return; ++ + ci = cj = ei = 0; + while (ci < cmds->cnt && ei < excludes->cnt) { + cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name); +-- +2.51.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 4a860ef07d..5bda196c06 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -5,3 +5,5 @@ udp-fix-memory-accounting-leak.patch media-tunner-xc5000-refactor-firmware-load.patch media-tuner-xc5000-fix-use-after-free-in-xc5000_release.patch media-i2c-tc358743-fix-use-after-free-bugs-caused-by-orphan-timer-in-probe.patch +dm-integrity-limit-max_tag_size-to-255.patch +perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch diff --git a/queue-5.15/dm-integrity-limit-max_tag_size-to-255.patch b/queue-5.15/dm-integrity-limit-max_tag_size-to-255.patch new file mode 100644 index 0000000000..55528962e2 --- /dev/null +++ b/queue-5.15/dm-integrity-limit-max_tag_size-to-255.patch @@ -0,0 +1,34 @@ +From b1e3f88636b83a94e8061d0d0b5ef64ef60c9603 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 15:52:02 +0200 +Subject: dm-integrity: limit MAX_TAG_SIZE to 255 + +From: Mikulas Patocka + +[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ] + +MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size += ic->tag_size" assignment. We need to limit it to 255. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-integrity.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index e9d553eea9cd4..8b8babed11f5f 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -124,7 +124,7 @@ struct journal_sector { + commit_id_t commit_id; + }; + +-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK])) ++#define MAX_TAG_SIZE 255 + + #define METADATA_PADDING_SECTORS 8 + +-- +2.51.0 + diff --git a/queue-5.15/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch b/queue-5.15/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch new file mode 100644 index 0000000000..a6f7448b9b --- /dev/null +++ b/queue-5.15/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch @@ -0,0 +1,49 @@ +From b6759a1e506554e6ebf374da6e2b0090e09b7d33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:16:55 +0800 +Subject: perf subcmd: avoid crash in exclude_cmds when excludes is empty + +From: hupu + +[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ] + +When cross-compiling the perf tool for ARM64, `perf help` may crash +with the following assertion failure: + + help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed. + +This happens when the perf binary is not named exactly "perf" or when +multiple "perf-*" binaries exist in the same directory. In such cases, +the `excludes` command list can be empty, which leads to the final +assertion in exclude_cmds() being triggered. + +Add a simple guard at the beginning of exclude_cmds() to return early +if excludes->cnt is zero, preventing the crash. + +Signed-off-by: hupu +Reported-by: Guilherme Amadio +Reviewed-by: Namhyung Kim +Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/lib/subcmd/help.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c +index 42f57b640f119..687307f2fe0f7 100644 +--- a/tools/lib/subcmd/help.c ++++ b/tools/lib/subcmd/help.c +@@ -72,6 +72,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) + size_t ci, cj, ei; + int cmp; + ++ if (!excludes->cnt) ++ return; ++ + ci = cj = ei = 0; + while (ci < cmds->cnt && ei < excludes->cnt) { + cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name); +-- +2.51.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 83ca5b9398..3ed2e7588c 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -8,3 +8,5 @@ udp-fix-memory-accounting-leak.patch media-tunner-xc5000-refactor-firmware-load.patch media-tuner-xc5000-fix-use-after-free-in-xc5000_release.patch media-i2c-tc358743-fix-use-after-free-bugs-caused-by-orphan-timer-in-probe.patch +dm-integrity-limit-max_tag_size-to-255.patch +perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch diff --git a/queue-5.4/dm-integrity-limit-max_tag_size-to-255.patch b/queue-5.4/dm-integrity-limit-max_tag_size-to-255.patch new file mode 100644 index 0000000000..08731f1f01 --- /dev/null +++ b/queue-5.4/dm-integrity-limit-max_tag_size-to-255.patch @@ -0,0 +1,34 @@ +From b9fe36ca9a6b7aa2be5a4049ccb868d8e423251c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 15:52:02 +0200 +Subject: dm-integrity: limit MAX_TAG_SIZE to 255 + +From: Mikulas Patocka + +[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ] + +MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size += ic->tag_size" assignment. We need to limit it to 255. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-integrity.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index 15580ba773e72..38791b7e59ba3 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -116,7 +116,7 @@ struct journal_sector { + commit_id_t commit_id; + }; + +-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK])) ++#define MAX_TAG_SIZE 255 + + #define METADATA_PADDING_SECTORS 8 + +-- +2.51.0 + diff --git a/queue-5.4/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch b/queue-5.4/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch new file mode 100644 index 0000000000..16b20d1fe5 --- /dev/null +++ b/queue-5.4/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch @@ -0,0 +1,49 @@ +From 86947f32c8e5cd2f9ca08c7a5801558ffcc9fd86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:16:55 +0800 +Subject: perf subcmd: avoid crash in exclude_cmds when excludes is empty + +From: hupu + +[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ] + +When cross-compiling the perf tool for ARM64, `perf help` may crash +with the following assertion failure: + + help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed. + +This happens when the perf binary is not named exactly "perf" or when +multiple "perf-*" binaries exist in the same directory. In such cases, +the `excludes` command list can be empty, which leads to the final +assertion in exclude_cmds() being triggered. + +Add a simple guard at the beginning of exclude_cmds() to return early +if excludes->cnt is zero, preventing the crash. + +Signed-off-by: hupu +Reported-by: Guilherme Amadio +Reviewed-by: Namhyung Kim +Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/lib/subcmd/help.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c +index 4260c8b4257bd..10f134c64ada1 100644 +--- a/tools/lib/subcmd/help.c ++++ b/tools/lib/subcmd/help.c +@@ -72,6 +72,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) + size_t ci, cj, ei; + int cmp; + ++ if (!excludes->cnt) ++ return; ++ + ci = cj = ei = 0; + while (ci < cmds->cnt && ei < excludes->cnt) { + cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name); +-- +2.51.0 + diff --git a/queue-5.4/series b/queue-5.4/series index 0040022a6b..d3a4fc1582 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -8,3 +8,5 @@ media-rc-add-support-for-another-imon-0xffdc-device.patch media-imon-reorganize-serialization.patch media-imon-grab-lock-earlier-in-imon_ir_change_protocol.patch media-rc-fix-races-with-imon_disconnect.patch +dm-integrity-limit-max_tag_size-to-255.patch +perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch diff --git a/queue-6.1/asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch b/queue-6.1/asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch new file mode 100644 index 0000000000..c167c5b788 --- /dev/null +++ b/queue-6.1/asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch @@ -0,0 +1,83 @@ +From 6e5a45feee6aed24f036fdc99c4bf4049ccd05b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 08:11:43 +0000 +Subject: ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue + +From: Jack Yu + +[ Upstream commit 1dd28fd86c3fa4e395031dd6f2ba920242107010 ] + +Adjust register settings for SAR adc button detection mode +to fix noise issue in headset. + +Signed-off-by: Jack Yu +Link: https://patch.msgid.link/766cd1d2dd7a403ba65bb4cc44845f71@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682s.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c +index 07d514b4ce707..76f07ef142246 100644 +--- a/sound/soc/codecs/rt5682s.c ++++ b/sound/soc/codecs/rt5682s.c +@@ -653,14 +653,15 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode + switch (mode) { + case SAR_PWR_SAVING: + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_3, +- RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_DIS); ++ RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_EN); + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1, +- RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK, +- RT5682S_CTRL_MB1_REG | RT5682S_CTRL_MB2_REG); ++ RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK | ++ RT5682S_VREF_POW_MASK, RT5682S_CTRL_MB1_FSM | ++ RT5682S_CTRL_MB2_FSM | RT5682S_VREF_POW_FSM); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + usleep_range(5000, 5500); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK, RT5682S_SAR_BUTDET_EN); +@@ -688,7 +689,7 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + break; + default: + dev_err(component->dev, "Invalid SAR Power mode: %d\n", mode); +@@ -725,7 +726,7 @@ static void rt5682s_disable_push_button_irq(struct snd_soc_component *component) + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + } + + /** +@@ -786,7 +787,7 @@ static int rt5682s_headset_detect(struct snd_soc_component *component, int jack_ + jack_type = SND_JACK_HEADSET; + snd_soc_component_write(component, RT5682S_SAR_IL_CMD_3, 0x024c); + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1, +- RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_EN); ++ RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_DIS); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_SEL_MB1_2_MASK, val << RT5682S_SAR_SEL_MB1_2_SFT); + rt5682s_enable_push_button_irq(component); +@@ -966,7 +967,7 @@ static int rt5682s_set_jack_detect(struct snd_soc_component *component, + RT5682S_EMB_JD_MASK | RT5682S_DET_TYPE | + RT5682S_POL_FAST_OFF_MASK | RT5682S_MIC_CAP_MASK, + RT5682S_EMB_JD_EN | RT5682S_DET_TYPE | +- RT5682S_POL_FAST_OFF_HIGH | RT5682S_MIC_CAP_HS); ++ RT5682S_POL_FAST_OFF_LOW | RT5682S_MIC_CAP_HS); + regmap_update_bits(rt5682s->regmap, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_POW_MASK, RT5682S_SAR_POW_EN); + regmap_update_bits(rt5682s->regmap, RT5682S_GPIO_CTRL_1, +-- +2.51.0 + diff --git a/queue-6.1/btrfs-ref-verify-handle-damaged-extent-root-tree.patch b/queue-6.1/btrfs-ref-verify-handle-damaged-extent-root-tree.patch new file mode 100644 index 0000000000..5fbcb6ca50 --- /dev/null +++ b/queue-6.1/btrfs-ref-verify-handle-damaged-extent-root-tree.patch @@ -0,0 +1,50 @@ +From 55a02e2c669bde180340a957ab07657ce2d3944f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 08:37:47 +0200 +Subject: btrfs: ref-verify: handle damaged extent root tree + +From: David Sterba + +[ Upstream commit ed4e6b5d644c4dd2bc2872ffec036b7da0ec2e27 ] + +Syzbot hits a problem with enabled ref-verify, ignorebadroots and a +fuzzed/damaged extent tree. There's no fallback option like in other +places that can deal with it so disable the whole ref-verify as it is +just a debugging feature. + +Reported-by: syzbot+9c3e0cdfbfe351b0bc0e@syzkaller.appspotmail.com +Link: https://lore.kernel.org/all/0000000000001b6052062139be1c@google.com/ +Reviewed-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/ref-verify.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c +index 56ceb23bd7409..195fce42b982d 100644 +--- a/fs/btrfs/ref-verify.c ++++ b/fs/btrfs/ref-verify.c +@@ -987,11 +987,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info) + if (!btrfs_test_opt(fs_info, REF_VERIFY)) + return 0; + ++ extent_root = btrfs_extent_root(fs_info, 0); ++ /* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */ ++ if (IS_ERR(extent_root)) { ++ btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling"); ++ btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY); ++ return 0; ++ } ++ + path = btrfs_alloc_path(); + if (!path) + return -ENOMEM; + +- extent_root = btrfs_extent_root(fs_info, 0); + eb = btrfs_read_lock_root_node(extent_root); + level = btrfs_header_level(eb); + path->nodes[level] = eb; +-- +2.51.0 + diff --git a/queue-6.1/can-hi311x-fix-null-pointer-dereference-when-resumin.patch b/queue-6.1/can-hi311x-fix-null-pointer-dereference-when-resumin.patch new file mode 100644 index 0000000000..235bf97766 --- /dev/null +++ b/queue-6.1/can-hi311x-fix-null-pointer-dereference-when-resumin.patch @@ -0,0 +1,123 @@ +From a081d379561e704eb57844f134db76c716fccb41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 23:08:20 +0800 +Subject: can: hi311x: fix null pointer dereference when resuming from sleep + before interface was enabled + +From: Chen Yufeng + +[ Upstream commit 6b696808472197b77b888f50bc789a3bae077743 ] + +This issue is similar to the vulnerability in the `mcp251x` driver, +which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from +sleep before interface was brought up"). + +In the `hi311x` driver, when the device resumes from sleep, the driver +schedules `priv->restart_work`. However, if the network interface was +not previously enabled, the `priv->wq` (workqueue) is not allocated and +initialized, leading to a null pointer dereference. + +To fix this, we move the allocation and initialization of the workqueue +from the `hi3110_open` function to the `hi3110_can_probe` function. +This ensures that the workqueue is properly initialized before it is +used during device resume. And added logic to destroy the workqueue +in the error handling paths of `hi3110_can_probe` and in the +`hi3110_can_remove` function to prevent resource leaks. + +Signed-off-by: Chen Yufeng +Link: https://patch.msgid.link/20250911150820.250-1-chenyufeng@iie.ac.cn +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/hi311x.c | 33 +++++++++++++++++---------------- + 1 file changed, 17 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c +index 57ea7dfe8a596..1acd4fc7adc8b 100644 +--- a/drivers/net/can/spi/hi311x.c ++++ b/drivers/net/can/spi/hi311x.c +@@ -545,8 +545,6 @@ static int hi3110_stop(struct net_device *net) + + priv->force_quit = 1; + free_irq(spi->irq, priv); +- destroy_workqueue(priv->wq); +- priv->wq = NULL; + + mutex_lock(&priv->hi3110_lock); + +@@ -771,34 +769,23 @@ static int hi3110_open(struct net_device *net) + goto out_close; + } + +- priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM, +- 0); +- if (!priv->wq) { +- ret = -ENOMEM; +- goto out_free_irq; +- } +- INIT_WORK(&priv->tx_work, hi3110_tx_work_handler); +- INIT_WORK(&priv->restart_work, hi3110_restart_work_handler); +- + ret = hi3110_hw_reset(spi); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + ret = hi3110_setup(net); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + ret = hi3110_set_normal_mode(spi); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + netif_wake_queue(net); + mutex_unlock(&priv->hi3110_lock); + + return 0; + +- out_free_wq: +- destroy_workqueue(priv->wq); + out_free_irq: + free_irq(spi->irq, priv); + hi3110_hw_sleep(spi); +@@ -915,6 +902,15 @@ static int hi3110_can_probe(struct spi_device *spi) + if (ret) + goto out_clk; + ++ priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM, ++ 0); ++ if (!priv->wq) { ++ ret = -ENOMEM; ++ goto out_clk; ++ } ++ INIT_WORK(&priv->tx_work, hi3110_tx_work_handler); ++ INIT_WORK(&priv->restart_work, hi3110_restart_work_handler); ++ + priv->spi = spi; + mutex_init(&priv->hi3110_lock); + +@@ -950,6 +946,8 @@ static int hi3110_can_probe(struct spi_device *spi) + return 0; + + error_probe: ++ destroy_workqueue(priv->wq); ++ priv->wq = NULL; + hi3110_power_enable(priv->power, 0); + + out_clk: +@@ -970,6 +968,9 @@ static void hi3110_can_remove(struct spi_device *spi) + + hi3110_power_enable(priv->power, 0); + ++ destroy_workqueue(priv->wq); ++ priv->wq = NULL; ++ + clk_disable_unprepare(priv->clk); + + free_candev(net); +-- +2.51.0 + diff --git a/queue-6.1/can-rcar_canfd-fix-controller-mode-setting.patch b/queue-6.1/can-rcar_canfd-fix-controller-mode-setting.patch new file mode 100644 index 0000000000..e9cd561a0e --- /dev/null +++ b/queue-6.1/can-rcar_canfd-fix-controller-mode-setting.patch @@ -0,0 +1,50 @@ +From 07bbdbdf76148c08e021cc626d145315a346761e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 07:03:45 +0000 +Subject: can: rcar_canfd: Fix controller mode setting + +From: Duy Nguyen + +[ Upstream commit 5cff263606a10102a0ea19ff579eaa18fd5577ad ] + +Driver configures register to choose controller mode before +setting all channels to reset mode leading to failure. +The patch corrects operation of mode setting. + +Signed-off-by: Duy Nguyen +Signed-off-by: Tranh Ha +Link: https://patch.msgid.link/TYWPR01MB87434739F83E27EDCD23DF44B416A@TYWPR01MB8743.jpnprd01.prod.outlook.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rcar/rcar_canfd.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c +index a1f68b74229e6..3d6daeea83553 100644 +--- a/drivers/net/can/rcar/rcar_canfd.c ++++ b/drivers/net/can/rcar/rcar_canfd.c +@@ -717,9 +717,6 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) + /* Reset Global error flags */ + rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0); + +- /* Set the controller into appropriate mode */ +- rcar_canfd_set_mode(gpriv); +- + /* Transition all Channels to reset mode */ + for_each_set_bit(ch, &gpriv->channels_mask, gpriv->max_channels) { + rcar_canfd_clear_bit(gpriv->base, +@@ -739,6 +736,10 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) + return err; + } + } ++ ++ /* Set the controller into appropriate mode */ ++ rcar_canfd_set_mode(gpriv); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.1/dm-integrity-limit-max_tag_size-to-255.patch b/queue-6.1/dm-integrity-limit-max_tag_size-to-255.patch new file mode 100644 index 0000000000..d1cf870522 --- /dev/null +++ b/queue-6.1/dm-integrity-limit-max_tag_size-to-255.patch @@ -0,0 +1,34 @@ +From ec895bf65edf876ff6f306381860fc7afc88204f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 15:52:02 +0200 +Subject: dm-integrity: limit MAX_TAG_SIZE to 255 + +From: Mikulas Patocka + +[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ] + +MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size += ic->tag_size" assignment. We need to limit it to 255. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-integrity.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index fc9cb626ca917..19a0b1919a096 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -128,7 +128,7 @@ struct journal_sector { + commit_id_t commit_id; + }; + +-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK])) ++#define MAX_TAG_SIZE 255 + + #define METADATA_PADDING_SECTORS 8 + +-- +2.51.0 + diff --git a/queue-6.1/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch b/queue-6.1/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch new file mode 100644 index 0000000000..45a69f17c1 --- /dev/null +++ b/queue-6.1/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch @@ -0,0 +1,49 @@ +From 8592f76b93208097ba8e4d98fa5ba14d5d6d608a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:16:55 +0800 +Subject: perf subcmd: avoid crash in exclude_cmds when excludes is empty + +From: hupu + +[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ] + +When cross-compiling the perf tool for ARM64, `perf help` may crash +with the following assertion failure: + + help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed. + +This happens when the perf binary is not named exactly "perf" or when +multiple "perf-*" binaries exist in the same directory. In such cases, +the `excludes` command list can be empty, which leads to the final +assertion in exclude_cmds() being triggered. + +Add a simple guard at the beginning of exclude_cmds() to return early +if excludes->cnt is zero, preventing the crash. + +Signed-off-by: hupu +Reported-by: Guilherme Amadio +Reviewed-by: Namhyung Kim +Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/lib/subcmd/help.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c +index 42f57b640f119..687307f2fe0f7 100644 +--- a/tools/lib/subcmd/help.c ++++ b/tools/lib/subcmd/help.c +@@ -72,6 +72,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) + size_t ci, cj, ei; + int cmp; + ++ if (!excludes->cnt) ++ return; ++ + ci = cj = ei = 0; + while (ci < cmds->cnt && ei < excludes->cnt) { + cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name); +-- +2.51.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 7a27f86d20..688d0c1877 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -27,3 +27,9 @@ minmax.h-use-build_bug_on_msg-for-the-lo-hi-test-in-clamp.patch minmax.h-move-all-the-clamp-definitions-after-the-min-max-ones.patch minmax.h-simplify-the-variants-of-clamp.patch minmax.h-remove-some-defines-that-are-only-expanded-once.patch +dm-integrity-limit-max_tag_size-to-255.patch +perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch +asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch +btrfs-ref-verify-handle-damaged-extent-root-tree.patch +can-hi311x-fix-null-pointer-dereference-when-resumin.patch +can-rcar_canfd-fix-controller-mode-setting.patch diff --git a/queue-6.12/asoc-amd-acp-adjust-pdm-gain-value.patch b/queue-6.12/asoc-amd-acp-adjust-pdm-gain-value.patch new file mode 100644 index 0000000000..84187dcbdb --- /dev/null +++ b/queue-6.12/asoc-amd-acp-adjust-pdm-gain-value.patch @@ -0,0 +1,37 @@ +From ceec1ab0b3d891df7d67f4015c4fdf88d88a1f53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 11:15:47 +0530 +Subject: ASoC: amd: acp: Adjust pdm gain value + +From: Venkata Prasad Potturu + +[ Upstream commit f1d0260362d72f9f454dc1f9db2eeb80cb801f28 ] + +Set pdm gain value by setting PDM_MISC_CTRL_MASK value. +To avoid low pdm gain value. + +Signed-off-by: Venkata Prasad Potturu +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/20250821054606.1279178-1-venkataprasad.potturu@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp/amd.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/amd/acp/amd.h b/sound/soc/amd/acp/amd.h +index 854269fea875f..aa0aa64202fe4 100644 +--- a/sound/soc/amd/acp/amd.h ++++ b/sound/soc/amd/acp/amd.h +@@ -135,7 +135,7 @@ + #define PDM_DMA_INTR_MASK 0x10000 + #define PDM_DEC_64 0x2 + #define PDM_CLK_FREQ_MASK 0x07 +-#define PDM_MISC_CTRL_MASK 0x10 ++#define PDM_MISC_CTRL_MASK 0x18 + #define PDM_ENABLE 0x01 + #define PDM_DISABLE 0x00 + #define DMA_EN_MASK 0x02 +-- +2.51.0 + diff --git a/queue-6.12/asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch b/queue-6.12/asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch new file mode 100644 index 0000000000..3f80e77fa2 --- /dev/null +++ b/queue-6.12/asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch @@ -0,0 +1,83 @@ +From 5f102df56825457e38dea91a5e1861dbd89bd727 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 08:11:43 +0000 +Subject: ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue + +From: Jack Yu + +[ Upstream commit 1dd28fd86c3fa4e395031dd6f2ba920242107010 ] + +Adjust register settings for SAR adc button detection mode +to fix noise issue in headset. + +Signed-off-by: Jack Yu +Link: https://patch.msgid.link/766cd1d2dd7a403ba65bb4cc44845f71@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682s.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c +index ce2e88e066f3e..d773c96e2543c 100644 +--- a/sound/soc/codecs/rt5682s.c ++++ b/sound/soc/codecs/rt5682s.c +@@ -653,14 +653,15 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode + switch (mode) { + case SAR_PWR_SAVING: + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_3, +- RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_DIS); ++ RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_EN); + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1, +- RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK, +- RT5682S_CTRL_MB1_REG | RT5682S_CTRL_MB2_REG); ++ RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK | ++ RT5682S_VREF_POW_MASK, RT5682S_CTRL_MB1_FSM | ++ RT5682S_CTRL_MB2_FSM | RT5682S_VREF_POW_FSM); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + usleep_range(5000, 5500); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK, RT5682S_SAR_BUTDET_EN); +@@ -688,7 +689,7 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + break; + default: + dev_err(component->dev, "Invalid SAR Power mode: %d\n", mode); +@@ -725,7 +726,7 @@ static void rt5682s_disable_push_button_irq(struct snd_soc_component *component) + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + } + + /** +@@ -786,7 +787,7 @@ static int rt5682s_headset_detect(struct snd_soc_component *component, int jack_ + jack_type = SND_JACK_HEADSET; + snd_soc_component_write(component, RT5682S_SAR_IL_CMD_3, 0x024c); + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1, +- RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_EN); ++ RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_DIS); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_SEL_MB1_2_MASK, val << RT5682S_SAR_SEL_MB1_2_SFT); + rt5682s_enable_push_button_irq(component); +@@ -966,7 +967,7 @@ static int rt5682s_set_jack_detect(struct snd_soc_component *component, + RT5682S_EMB_JD_MASK | RT5682S_DET_TYPE | + RT5682S_POL_FAST_OFF_MASK | RT5682S_MIC_CAP_MASK, + RT5682S_EMB_JD_EN | RT5682S_DET_TYPE | +- RT5682S_POL_FAST_OFF_HIGH | RT5682S_MIC_CAP_HS); ++ RT5682S_POL_FAST_OFF_LOW | RT5682S_MIC_CAP_HS); + regmap_update_bits(rt5682s->regmap, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_POW_MASK, RT5682S_SAR_POW_EN); + regmap_update_bits(rt5682s->regmap, RT5682S_GPIO_CTRL_1, +-- +2.51.0 + diff --git a/queue-6.12/btrfs-ref-verify-handle-damaged-extent-root-tree.patch b/queue-6.12/btrfs-ref-verify-handle-damaged-extent-root-tree.patch new file mode 100644 index 0000000000..1f35dc1e4d --- /dev/null +++ b/queue-6.12/btrfs-ref-verify-handle-damaged-extent-root-tree.patch @@ -0,0 +1,50 @@ +From 667e52c892a080789f12c0791608f09e1605016e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 08:37:47 +0200 +Subject: btrfs: ref-verify: handle damaged extent root tree + +From: David Sterba + +[ Upstream commit ed4e6b5d644c4dd2bc2872ffec036b7da0ec2e27 ] + +Syzbot hits a problem with enabled ref-verify, ignorebadroots and a +fuzzed/damaged extent tree. There's no fallback option like in other +places that can deal with it so disable the whole ref-verify as it is +just a debugging feature. + +Reported-by: syzbot+9c3e0cdfbfe351b0bc0e@syzkaller.appspotmail.com +Link: https://lore.kernel.org/all/0000000000001b6052062139be1c@google.com/ +Reviewed-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/ref-verify.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c +index 2928abf7eb827..fc46190d26c8e 100644 +--- a/fs/btrfs/ref-verify.c ++++ b/fs/btrfs/ref-verify.c +@@ -998,11 +998,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info) + if (!btrfs_test_opt(fs_info, REF_VERIFY)) + return 0; + ++ extent_root = btrfs_extent_root(fs_info, 0); ++ /* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */ ++ if (IS_ERR(extent_root)) { ++ btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling"); ++ btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY); ++ return 0; ++ } ++ + path = btrfs_alloc_path(); + if (!path) + return -ENOMEM; + +- extent_root = btrfs_extent_root(fs_info, 0); + eb = btrfs_read_lock_root_node(extent_root); + level = btrfs_header_level(eb); + path->nodes[level] = eb; +-- +2.51.0 + diff --git a/queue-6.12/can-hi311x-fix-null-pointer-dereference-when-resumin.patch b/queue-6.12/can-hi311x-fix-null-pointer-dereference-when-resumin.patch new file mode 100644 index 0000000000..5dc389c174 --- /dev/null +++ b/queue-6.12/can-hi311x-fix-null-pointer-dereference-when-resumin.patch @@ -0,0 +1,123 @@ +From e0993112387a9767c025a1504e182bf3f3672f6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 23:08:20 +0800 +Subject: can: hi311x: fix null pointer dereference when resuming from sleep + before interface was enabled + +From: Chen Yufeng + +[ Upstream commit 6b696808472197b77b888f50bc789a3bae077743 ] + +This issue is similar to the vulnerability in the `mcp251x` driver, +which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from +sleep before interface was brought up"). + +In the `hi311x` driver, when the device resumes from sleep, the driver +schedules `priv->restart_work`. However, if the network interface was +not previously enabled, the `priv->wq` (workqueue) is not allocated and +initialized, leading to a null pointer dereference. + +To fix this, we move the allocation and initialization of the workqueue +from the `hi3110_open` function to the `hi3110_can_probe` function. +This ensures that the workqueue is properly initialized before it is +used during device resume. And added logic to destroy the workqueue +in the error handling paths of `hi3110_can_probe` and in the +`hi3110_can_remove` function to prevent resource leaks. + +Signed-off-by: Chen Yufeng +Link: https://patch.msgid.link/20250911150820.250-1-chenyufeng@iie.ac.cn +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/hi311x.c | 33 +++++++++++++++++---------------- + 1 file changed, 17 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c +index ff39afc77d7d2..c9eba1d37b0eb 100644 +--- a/drivers/net/can/spi/hi311x.c ++++ b/drivers/net/can/spi/hi311x.c +@@ -545,8 +545,6 @@ static int hi3110_stop(struct net_device *net) + + priv->force_quit = 1; + free_irq(spi->irq, priv); +- destroy_workqueue(priv->wq); +- priv->wq = NULL; + + mutex_lock(&priv->hi3110_lock); + +@@ -771,34 +769,23 @@ static int hi3110_open(struct net_device *net) + goto out_close; + } + +- priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM, +- 0); +- if (!priv->wq) { +- ret = -ENOMEM; +- goto out_free_irq; +- } +- INIT_WORK(&priv->tx_work, hi3110_tx_work_handler); +- INIT_WORK(&priv->restart_work, hi3110_restart_work_handler); +- + ret = hi3110_hw_reset(spi); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + ret = hi3110_setup(net); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + ret = hi3110_set_normal_mode(spi); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + netif_wake_queue(net); + mutex_unlock(&priv->hi3110_lock); + + return 0; + +- out_free_wq: +- destroy_workqueue(priv->wq); + out_free_irq: + free_irq(spi->irq, priv); + hi3110_hw_sleep(spi); +@@ -910,6 +897,15 @@ static int hi3110_can_probe(struct spi_device *spi) + if (ret) + goto out_clk; + ++ priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM, ++ 0); ++ if (!priv->wq) { ++ ret = -ENOMEM; ++ goto out_clk; ++ } ++ INIT_WORK(&priv->tx_work, hi3110_tx_work_handler); ++ INIT_WORK(&priv->restart_work, hi3110_restart_work_handler); ++ + priv->spi = spi; + mutex_init(&priv->hi3110_lock); + +@@ -945,6 +941,8 @@ static int hi3110_can_probe(struct spi_device *spi) + return 0; + + error_probe: ++ destroy_workqueue(priv->wq); ++ priv->wq = NULL; + hi3110_power_enable(priv->power, 0); + + out_clk: +@@ -965,6 +963,9 @@ static void hi3110_can_remove(struct spi_device *spi) + + hi3110_power_enable(priv->power, 0); + ++ destroy_workqueue(priv->wq); ++ priv->wq = NULL; ++ + clk_disable_unprepare(priv->clk); + + free_candev(net); +-- +2.51.0 + diff --git a/queue-6.12/can-rcar_canfd-fix-controller-mode-setting.patch b/queue-6.12/can-rcar_canfd-fix-controller-mode-setting.patch new file mode 100644 index 0000000000..8a4eedd23e --- /dev/null +++ b/queue-6.12/can-rcar_canfd-fix-controller-mode-setting.patch @@ -0,0 +1,50 @@ +From 97854ed2add66516bb1489a5fb8c3e84b7b3dcbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 07:03:45 +0000 +Subject: can: rcar_canfd: Fix controller mode setting + +From: Duy Nguyen + +[ Upstream commit 5cff263606a10102a0ea19ff579eaa18fd5577ad ] + +Driver configures register to choose controller mode before +setting all channels to reset mode leading to failure. +The patch corrects operation of mode setting. + +Signed-off-by: Duy Nguyen +Signed-off-by: Tranh Ha +Link: https://patch.msgid.link/TYWPR01MB87434739F83E27EDCD23DF44B416A@TYWPR01MB8743.jpnprd01.prod.outlook.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rcar/rcar_canfd.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c +index aa3df0d05b853..24dd15c917228 100644 +--- a/drivers/net/can/rcar/rcar_canfd.c ++++ b/drivers/net/can/rcar/rcar_canfd.c +@@ -732,9 +732,6 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) + /* Reset Global error flags */ + rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0); + +- /* Set the controller into appropriate mode */ +- rcar_canfd_set_mode(gpriv); +- + /* Transition all Channels to reset mode */ + for_each_set_bit(ch, &gpriv->channels_mask, gpriv->info->max_channels) { + rcar_canfd_clear_bit(gpriv->base, +@@ -754,6 +751,10 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) + return err; + } + } ++ ++ /* Set the controller into appropriate mode */ ++ rcar_canfd_set_mode(gpriv); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.12/dm-integrity-limit-max_tag_size-to-255.patch b/queue-6.12/dm-integrity-limit-max_tag_size-to-255.patch new file mode 100644 index 0000000000..a84eca7058 --- /dev/null +++ b/queue-6.12/dm-integrity-limit-max_tag_size-to-255.patch @@ -0,0 +1,34 @@ +From 89e7d3438081d53fe0ce88691f7ba4cc9af566a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 15:52:02 +0200 +Subject: dm-integrity: limit MAX_TAG_SIZE to 255 + +From: Mikulas Patocka + +[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ] + +MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size += ic->tag_size" assignment. We need to limit it to 255. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-integrity.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index 450e1a7e7bac7..444cf35feebf4 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -133,7 +133,7 @@ struct journal_sector { + commit_id_t commit_id; + }; + +-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK])) ++#define MAX_TAG_SIZE 255 + + #define METADATA_PADDING_SECTORS 8 + +-- +2.51.0 + diff --git a/queue-6.12/netfs-prevent-duplicate-unlocking.patch b/queue-6.12/netfs-prevent-duplicate-unlocking.patch new file mode 100644 index 0000000000..445a8d67b7 --- /dev/null +++ b/queue-6.12/netfs-prevent-duplicate-unlocking.patch @@ -0,0 +1,39 @@ +From 59cb3a4c096dc2a2c25c91826dae6218af308c3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 09:59:25 +0800 +Subject: netfs: Prevent duplicate unlocking + +From: Lizhi Xu + +[ Upstream commit 66d938e89e940e512f4c3deac938ecef399c13f9 ] + +The filio lock has been released here, so there is no need to jump to +error_folio_unlock to release it again. + +Reported-by: syzbot+b73c7d94a151e2ee1e9b@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=b73c7d94a151e2ee1e9b +Signed-off-by: Lizhi Xu +Acked-by: David Howells +Reviewed-by: Paulo Alcantara (Red Hat) +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/netfs/buffered_write.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/netfs/buffered_write.c b/fs/netfs/buffered_write.c +index 896d1d4219ed9..be77a137cc871 100644 +--- a/fs/netfs/buffered_write.c ++++ b/fs/netfs/buffered_write.c +@@ -340,7 +340,7 @@ ssize_t netfs_perform_write(struct kiocb *iocb, struct iov_iter *iter, + folio_put(folio); + ret = filemap_write_and_wait_range(mapping, fpos, fpos + flen - 1); + if (ret < 0) +- goto error_folio_unlock; ++ goto out; + continue; + + copied: +-- +2.51.0 + diff --git a/queue-6.12/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch b/queue-6.12/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch new file mode 100644 index 0000000000..d4a322e178 --- /dev/null +++ b/queue-6.12/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch @@ -0,0 +1,49 @@ +From bbf78c215c628b7186715876aab1cb9f502f6c5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:16:55 +0800 +Subject: perf subcmd: avoid crash in exclude_cmds when excludes is empty + +From: hupu + +[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ] + +When cross-compiling the perf tool for ARM64, `perf help` may crash +with the following assertion failure: + + help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed. + +This happens when the perf binary is not named exactly "perf" or when +multiple "perf-*" binaries exist in the same directory. In such cases, +the `excludes` command list can be empty, which leads to the final +assertion in exclude_cmds() being triggered. + +Add a simple guard at the beginning of exclude_cmds() to return early +if excludes->cnt is zero, preventing the crash. + +Signed-off-by: hupu +Reported-by: Guilherme Amadio +Reviewed-by: Namhyung Kim +Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/lib/subcmd/help.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c +index 9ef569492560e..ddaeb4eb3e249 100644 +--- a/tools/lib/subcmd/help.c ++++ b/tools/lib/subcmd/help.c +@@ -75,6 +75,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) + size_t ci, cj, ei; + int cmp; + ++ if (!excludes->cnt) ++ return; ++ + ci = cj = ei = 0; + while (ci < cmds->cnt && ei < excludes->cnt) { + cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name); +-- +2.51.0 + diff --git a/queue-6.12/platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch b/queue-6.12/platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch new file mode 100644 index 0000000000..802375d7af --- /dev/null +++ b/queue-6.12/platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch @@ -0,0 +1,51 @@ +From e953a7a8ec2c13f98fb340994cd116204ccee67f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Sep 2025 09:06:11 +0000 +Subject: platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: aprilgrimoire + +[ Upstream commit 8822e8be86d40410ddd2ac8ff44f3050c9ecf9c6 ] + +The firmware of Mechrevo Yilong15Pro emits a spurious keyboard interrupt on +events including closing the lid. When a user closes the lid on an already +suspended system this causes the system to wake up. +Add Mechrevo Yilong15Pro Series (GM5HG7A) to the list of quirk +spurious_8042 to work around this issue. + +Link: https://lore.kernel.org/linux-pm/6ww4uu6Gl4F5n6VY5dl1ufASfKzs4DhMxAN8BuqUpCoqU3PQukVSVSBCl_lKIzkQ-S8kt1acPd58eyolhkWN32lMLFj4ViI0Tdu2jwhnYZ8=@proton.me/ +Signed-off-by: April Grimoire +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/IvSc_IN5Pa0wRXElTk_fEl-cTpMZxg6TCQk_7aRUkTd9vJUp_ZeC0NdXZ0z6Tn7B-XiqqqQvCH65lq6FqhuECBMEYWcHQmWm1Jo7Br8kpeg=@proton.me +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index 6f5437d210a61..b872baf35808f 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -233,6 +233,14 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"), + } + }, ++ { ++ .ident = "MECHREVO Yilong15Pro Series GM5HG7A", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "MECHREVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Yilong15Pro Series GM5HG7A"), ++ } ++ }, + /* https://bugzilla.kernel.org/show_bug.cgi?id=220116 */ + { + .ident = "PCSpecialist Lafite Pro V 14M", +-- +2.51.0 + diff --git a/queue-6.12/platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch b/queue-6.12/platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch new file mode 100644 index 0000000000..af33cead2d --- /dev/null +++ b/queue-6.12/platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch @@ -0,0 +1,46 @@ +From edf300f601daf8723cf67cd20a85627369773cb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 18:46:49 +0200 +Subject: platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 + quirks list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christoffer Sandberg + +[ Upstream commit 12a3dd4d2cd9232d4e4df3b9a5b3d745db559941 ] + +Prevents instant wakeup ~1s after suspend + +Signed-off-by: Christoffer Sandberg +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20250916164700.32896-1-wse@tuxedocomputers.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index b872baf35808f..9fd2829ee2ab4 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -250,6 +250,13 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Lafite Pro V 14M"), + } + }, ++ { ++ .ident = "TUXEDO Stellaris Slim 15 AMD Gen6", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"), ++ } ++ }, + { + .ident = "TUXEDO InfinityBook Pro 14/15 AMD Gen10", + .driver_data = &quirk_spurious_8042, +-- +2.51.0 + diff --git a/queue-6.12/platform-x86-amd-pmf-support-new-acpi-id-amdi0108.patch b/queue-6.12/platform-x86-amd-pmf-support-new-acpi-id-amdi0108.patch new file mode 100644 index 0000000000..ad4c7ac119 --- /dev/null +++ b/queue-6.12/platform-x86-amd-pmf-support-new-acpi-id-amdi0108.patch @@ -0,0 +1,39 @@ +From ee611b0dba31786f70c8eb59985d411f6dd7406b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 14:35:46 +0530 +Subject: platform/x86/amd/pmf: Support new ACPI ID AMDI0108 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shyam Sundar S K + +[ Upstream commit 1b09d08866277677d11726116f5e786d5ba00173 ] + +Include the ACPI ID AMDI0108, which is used on upcoming AMD platforms, in +the PMF driver's list of supported devices. + +Signed-off-by: Shyam Sundar S K +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/20250915090546.2759130-1-Shyam-sundar.S-k@amd.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/amd/pmf/core.c b/drivers/platform/x86/amd/pmf/core.c +index 719caa2a00f05..8a1e2268d301a 100644 +--- a/drivers/platform/x86/amd/pmf/core.c ++++ b/drivers/platform/x86/amd/pmf/core.c +@@ -406,6 +406,7 @@ static const struct acpi_device_id amd_pmf_acpi_ids[] = { + {"AMDI0103", 0}, + {"AMDI0105", 0}, + {"AMDI0107", 0}, ++ {"AMDI0108", 0}, + { } + }; + MODULE_DEVICE_TABLE(acpi, amd_pmf_acpi_ids); +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series index 524680a779..1408c45b69 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -1,2 +1,13 @@ wifi-rtw89-fix-use-after-free-in-rtw89_core_tx_kick_off_and_wait.patch media-i2c-tc358743-fix-use-after-free-bugs-caused-by-orphan-timer-in-probe.patch +asoc-amd-acp-adjust-pdm-gain-value.patch +dm-integrity-limit-max_tag_size-to-255.patch +platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch +perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch +platform-x86-amd-pmf-support-new-acpi-id-amdi0108.patch +asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch +btrfs-ref-verify-handle-damaged-extent-root-tree.patch +netfs-prevent-duplicate-unlocking.patch +can-hi311x-fix-null-pointer-dereference-when-resumin.patch +can-rcar_canfd-fix-controller-mode-setting.patch +platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch diff --git a/queue-6.16/asoc-amd-acp-adjust-pdm-gain-value.patch b/queue-6.16/asoc-amd-acp-adjust-pdm-gain-value.patch new file mode 100644 index 0000000000..08bcf7dfc0 --- /dev/null +++ b/queue-6.16/asoc-amd-acp-adjust-pdm-gain-value.patch @@ -0,0 +1,37 @@ +From 8a94c2dcbe50cd3c3d91cdc82331624938cb8475 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 11:15:47 +0530 +Subject: ASoC: amd: acp: Adjust pdm gain value + +From: Venkata Prasad Potturu + +[ Upstream commit f1d0260362d72f9f454dc1f9db2eeb80cb801f28 ] + +Set pdm gain value by setting PDM_MISC_CTRL_MASK value. +To avoid low pdm gain value. + +Signed-off-by: Venkata Prasad Potturu +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/20250821054606.1279178-1-venkataprasad.potturu@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp/amd.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/amd/acp/amd.h b/sound/soc/amd/acp/amd.h +index cb8d97122f95c..73a028e672462 100644 +--- a/sound/soc/amd/acp/amd.h ++++ b/sound/soc/amd/acp/amd.h +@@ -130,7 +130,7 @@ + #define PDM_DMA_INTR_MASK 0x10000 + #define PDM_DEC_64 0x2 + #define PDM_CLK_FREQ_MASK 0x07 +-#define PDM_MISC_CTRL_MASK 0x10 ++#define PDM_MISC_CTRL_MASK 0x18 + #define PDM_ENABLE 0x01 + #define PDM_DISABLE 0x00 + #define DMA_EN_MASK 0x02 +-- +2.51.0 + diff --git a/queue-6.16/asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch b/queue-6.16/asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch new file mode 100644 index 0000000000..df3fdf9dfd --- /dev/null +++ b/queue-6.16/asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch @@ -0,0 +1,83 @@ +From 5866501f0312a6c9a6ccaeba5f0bcc757fc2b545 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 08:11:43 +0000 +Subject: ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue + +From: Jack Yu + +[ Upstream commit 1dd28fd86c3fa4e395031dd6f2ba920242107010 ] + +Adjust register settings for SAR adc button detection mode +to fix noise issue in headset. + +Signed-off-by: Jack Yu +Link: https://patch.msgid.link/766cd1d2dd7a403ba65bb4cc44845f71@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682s.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c +index 73c4b3c31f8c4..d44f7574631dc 100644 +--- a/sound/soc/codecs/rt5682s.c ++++ b/sound/soc/codecs/rt5682s.c +@@ -653,14 +653,15 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode + switch (mode) { + case SAR_PWR_SAVING: + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_3, +- RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_DIS); ++ RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_EN); + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1, +- RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK, +- RT5682S_CTRL_MB1_REG | RT5682S_CTRL_MB2_REG); ++ RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK | ++ RT5682S_VREF_POW_MASK, RT5682S_CTRL_MB1_FSM | ++ RT5682S_CTRL_MB2_FSM | RT5682S_VREF_POW_FSM); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + usleep_range(5000, 5500); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK, RT5682S_SAR_BUTDET_EN); +@@ -688,7 +689,7 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + break; + default: + dev_err(component->dev, "Invalid SAR Power mode: %d\n", mode); +@@ -725,7 +726,7 @@ static void rt5682s_disable_push_button_irq(struct snd_soc_component *component) + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + } + + /** +@@ -786,7 +787,7 @@ static int rt5682s_headset_detect(struct snd_soc_component *component, int jack_ + jack_type = SND_JACK_HEADSET; + snd_soc_component_write(component, RT5682S_SAR_IL_CMD_3, 0x024c); + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1, +- RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_EN); ++ RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_DIS); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_SEL_MB1_2_MASK, val << RT5682S_SAR_SEL_MB1_2_SFT); + rt5682s_enable_push_button_irq(component); +@@ -966,7 +967,7 @@ static int rt5682s_set_jack_detect(struct snd_soc_component *component, + RT5682S_EMB_JD_MASK | RT5682S_DET_TYPE | + RT5682S_POL_FAST_OFF_MASK | RT5682S_MIC_CAP_MASK, + RT5682S_EMB_JD_EN | RT5682S_DET_TYPE | +- RT5682S_POL_FAST_OFF_HIGH | RT5682S_MIC_CAP_HS); ++ RT5682S_POL_FAST_OFF_LOW | RT5682S_MIC_CAP_HS); + regmap_update_bits(rt5682s->regmap, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_POW_MASK, RT5682S_SAR_POW_EN); + regmap_update_bits(rt5682s->regmap, RT5682S_GPIO_CTRL_1, +-- +2.51.0 + diff --git a/queue-6.16/asoc-rt712-avoid-skipping-the-blind-write.patch b/queue-6.16/asoc-rt712-avoid-skipping-the-blind-write.patch new file mode 100644 index 0000000000..9fdfeef6ec --- /dev/null +++ b/queue-6.16/asoc-rt712-avoid-skipping-the-blind-write.patch @@ -0,0 +1,41 @@ +From 650598d7f0f98f5a9bc64c5166482e29157e08c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Sep 2025 16:57:57 +0800 +Subject: ASoC: rt712: avoid skipping the blind write + +From: Shuming Fan + +[ Upstream commit f54d87dad7619c8026e95b848d6ef677b9f2b55f ] + +Some devices might not use the DMIC function of the RT712VB. +Therefore, this patch avoids skipping the blind write with RT712VB. + +Signed-off-by: Shuming Fan +Link: https://patch.msgid.link/20250901085757.1287945-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt712-sdca.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/codecs/rt712-sdca.c b/sound/soc/codecs/rt712-sdca.c +index 570c2af1245d6..0c57aee766b5c 100644 +--- a/sound/soc/codecs/rt712-sdca.c ++++ b/sound/soc/codecs/rt712-sdca.c +@@ -1891,11 +1891,9 @@ int rt712_sdca_io_init(struct device *dev, struct sdw_slave *slave) + + rt712_sdca_va_io_init(rt712); + } else { +- if (!rt712->dmic_function_found) { +- dev_err(&slave->dev, "%s RT712 VB detected but no SMART_MIC function exposed in ACPI\n", ++ if (!rt712->dmic_function_found) ++ dev_warn(&slave->dev, "%s RT712 VB detected but no SMART_MIC function exposed in ACPI\n", + __func__); +- goto suspend; +- } + + /* multilanes and DMIC are supported by rt712vb */ + prop->lane_control_support = true; +-- +2.51.0 + diff --git a/queue-6.16/btrfs-ref-verify-handle-damaged-extent-root-tree.patch b/queue-6.16/btrfs-ref-verify-handle-damaged-extent-root-tree.patch new file mode 100644 index 0000000000..368912d952 --- /dev/null +++ b/queue-6.16/btrfs-ref-verify-handle-damaged-extent-root-tree.patch @@ -0,0 +1,50 @@ +From 3423a5817b7e5cc1858e3b7634846f2b5f819a35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 08:37:47 +0200 +Subject: btrfs: ref-verify: handle damaged extent root tree + +From: David Sterba + +[ Upstream commit ed4e6b5d644c4dd2bc2872ffec036b7da0ec2e27 ] + +Syzbot hits a problem with enabled ref-verify, ignorebadroots and a +fuzzed/damaged extent tree. There's no fallback option like in other +places that can deal with it so disable the whole ref-verify as it is +just a debugging feature. + +Reported-by: syzbot+9c3e0cdfbfe351b0bc0e@syzkaller.appspotmail.com +Link: https://lore.kernel.org/all/0000000000001b6052062139be1c@google.com/ +Reviewed-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/ref-verify.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c +index 2928abf7eb827..fc46190d26c8e 100644 +--- a/fs/btrfs/ref-verify.c ++++ b/fs/btrfs/ref-verify.c +@@ -998,11 +998,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info) + if (!btrfs_test_opt(fs_info, REF_VERIFY)) + return 0; + ++ extent_root = btrfs_extent_root(fs_info, 0); ++ /* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */ ++ if (IS_ERR(extent_root)) { ++ btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling"); ++ btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY); ++ return 0; ++ } ++ + path = btrfs_alloc_path(); + if (!path) + return -ENOMEM; + +- extent_root = btrfs_extent_root(fs_info, 0); + eb = btrfs_read_lock_root_node(extent_root); + level = btrfs_header_level(eb); + path->nodes[level] = eb; +-- +2.51.0 + diff --git a/queue-6.16/can-hi311x-fix-null-pointer-dereference-when-resumin.patch b/queue-6.16/can-hi311x-fix-null-pointer-dereference-when-resumin.patch new file mode 100644 index 0000000000..541a34f98f --- /dev/null +++ b/queue-6.16/can-hi311x-fix-null-pointer-dereference-when-resumin.patch @@ -0,0 +1,123 @@ +From 7288fad173af58d034ccb9b1c34bdb66e892e82c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 23:08:20 +0800 +Subject: can: hi311x: fix null pointer dereference when resuming from sleep + before interface was enabled + +From: Chen Yufeng + +[ Upstream commit 6b696808472197b77b888f50bc789a3bae077743 ] + +This issue is similar to the vulnerability in the `mcp251x` driver, +which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from +sleep before interface was brought up"). + +In the `hi311x` driver, when the device resumes from sleep, the driver +schedules `priv->restart_work`. However, if the network interface was +not previously enabled, the `priv->wq` (workqueue) is not allocated and +initialized, leading to a null pointer dereference. + +To fix this, we move the allocation and initialization of the workqueue +from the `hi3110_open` function to the `hi3110_can_probe` function. +This ensures that the workqueue is properly initialized before it is +used during device resume. And added logic to destroy the workqueue +in the error handling paths of `hi3110_can_probe` and in the +`hi3110_can_remove` function to prevent resource leaks. + +Signed-off-by: Chen Yufeng +Link: https://patch.msgid.link/20250911150820.250-1-chenyufeng@iie.ac.cn +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/hi311x.c | 33 +++++++++++++++++---------------- + 1 file changed, 17 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c +index 6441ff3b41987..963ea8510dd9b 100644 +--- a/drivers/net/can/spi/hi311x.c ++++ b/drivers/net/can/spi/hi311x.c +@@ -545,8 +545,6 @@ static int hi3110_stop(struct net_device *net) + + priv->force_quit = 1; + free_irq(spi->irq, priv); +- destroy_workqueue(priv->wq); +- priv->wq = NULL; + + mutex_lock(&priv->hi3110_lock); + +@@ -770,34 +768,23 @@ static int hi3110_open(struct net_device *net) + goto out_close; + } + +- priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM, +- 0); +- if (!priv->wq) { +- ret = -ENOMEM; +- goto out_free_irq; +- } +- INIT_WORK(&priv->tx_work, hi3110_tx_work_handler); +- INIT_WORK(&priv->restart_work, hi3110_restart_work_handler); +- + ret = hi3110_hw_reset(spi); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + ret = hi3110_setup(net); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + ret = hi3110_set_normal_mode(spi); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + netif_wake_queue(net); + mutex_unlock(&priv->hi3110_lock); + + return 0; + +- out_free_wq: +- destroy_workqueue(priv->wq); + out_free_irq: + free_irq(spi->irq, priv); + hi3110_hw_sleep(spi); +@@ -909,6 +896,15 @@ static int hi3110_can_probe(struct spi_device *spi) + if (ret) + goto out_clk; + ++ priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM, ++ 0); ++ if (!priv->wq) { ++ ret = -ENOMEM; ++ goto out_clk; ++ } ++ INIT_WORK(&priv->tx_work, hi3110_tx_work_handler); ++ INIT_WORK(&priv->restart_work, hi3110_restart_work_handler); ++ + priv->spi = spi; + mutex_init(&priv->hi3110_lock); + +@@ -944,6 +940,8 @@ static int hi3110_can_probe(struct spi_device *spi) + return 0; + + error_probe: ++ destroy_workqueue(priv->wq); ++ priv->wq = NULL; + hi3110_power_enable(priv->power, 0); + + out_clk: +@@ -964,6 +962,9 @@ static void hi3110_can_remove(struct spi_device *spi) + + hi3110_power_enable(priv->power, 0); + ++ destroy_workqueue(priv->wq); ++ priv->wq = NULL; ++ + clk_disable_unprepare(priv->clk); + + free_candev(net); +-- +2.51.0 + diff --git a/queue-6.16/can-rcar_canfd-fix-controller-mode-setting.patch b/queue-6.16/can-rcar_canfd-fix-controller-mode-setting.patch new file mode 100644 index 0000000000..7575e2f2a7 --- /dev/null +++ b/queue-6.16/can-rcar_canfd-fix-controller-mode-setting.patch @@ -0,0 +1,50 @@ +From e1413981e0e93e58f436f48fecee0327af939213 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 07:03:45 +0000 +Subject: can: rcar_canfd: Fix controller mode setting + +From: Duy Nguyen + +[ Upstream commit 5cff263606a10102a0ea19ff579eaa18fd5577ad ] + +Driver configures register to choose controller mode before +setting all channels to reset mode leading to failure. +The patch corrects operation of mode setting. + +Signed-off-by: Duy Nguyen +Signed-off-by: Tranh Ha +Link: https://patch.msgid.link/TYWPR01MB87434739F83E27EDCD23DF44B416A@TYWPR01MB8743.jpnprd01.prod.outlook.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rcar/rcar_canfd.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c +index 7f10213738e5c..e2ae8d6a9de64 100644 +--- a/drivers/net/can/rcar/rcar_canfd.c ++++ b/drivers/net/can/rcar/rcar_canfd.c +@@ -870,9 +870,6 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) + /* Reset Global error flags */ + rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0); + +- /* Set the controller into appropriate mode */ +- rcar_canfd_set_mode(gpriv); +- + /* Transition all Channels to reset mode */ + for_each_set_bit(ch, &gpriv->channels_mask, gpriv->info->max_channels) { + rcar_canfd_clear_bit(gpriv->base, +@@ -892,6 +889,10 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) + return err; + } + } ++ ++ /* Set the controller into appropriate mode */ ++ rcar_canfd_set_mode(gpriv); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.16/dm-integrity-limit-max_tag_size-to-255.patch b/queue-6.16/dm-integrity-limit-max_tag_size-to-255.patch new file mode 100644 index 0000000000..ab9fde438c --- /dev/null +++ b/queue-6.16/dm-integrity-limit-max_tag_size-to-255.patch @@ -0,0 +1,34 @@ +From fc1773fb232f4152cc253f0cf3b79e4104ddf57c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 15:52:02 +0200 +Subject: dm-integrity: limit MAX_TAG_SIZE to 255 + +From: Mikulas Patocka + +[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ] + +MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size += ic->tag_size" assignment. We need to limit it to 255. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-integrity.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index 4395657fa5838..7b1d8f0c62fda 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -133,7 +133,7 @@ struct journal_sector { + commit_id_t commit_id; + }; + +-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK])) ++#define MAX_TAG_SIZE 255 + + #define METADATA_PADDING_SECTORS 8 + +-- +2.51.0 + diff --git a/queue-6.16/drm-amdgpu-gfx11-add-cleaner-shader-support-for-gfx1.patch b/queue-6.16/drm-amdgpu-gfx11-add-cleaner-shader-support-for-gfx1.patch new file mode 100644 index 0000000000..ef38ed5e9f --- /dev/null +++ b/queue-6.16/drm-amdgpu-gfx11-add-cleaner-shader-support-for-gfx1.patch @@ -0,0 +1,66 @@ +From e205cfd1ceaa1e17df11fe0db89532d33ae105a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 12:27:05 +0530 +Subject: drm/amdgpu/gfx11: Add Cleaner Shader Support for GFX11.0.1/11.0.4 + GPUs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivasan Shanmugam + +[ Upstream commit c1b6b8c7706354b73196649c46b5e6d4d61c2f5c ] + +Enable the cleaner shader for additional GFX11.0.1/11.0.4 series GPUs to +ensure data isolation among GPU tasks. The cleaner shader is tasked with +clearing the Local Data Store (LDS), Vector General Purpose Registers +(VGPRs), and Scalar General Purpose Registers (SGPRs), which helps avoid +data leakage and guarantees the accuracy of computational results. + +This update extends cleaner shader support to GFX11.0.1/11.0.4 GPUs, +previously available for GFX11.0.3. It enhances security by clearing GPU +memory between processes and maintains a consistent GPU state across KGD +and KFD workloads. + +Cc: Wasee Alam +Cc: Mario Sopena-Novales +Cc: Christian König +Cc: Alex Deucher +Signed-off-by: Srinivasan Shanmugam +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 0a71ceb27f88a944c2de2808b67b2f46ac75076b) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +index 96566870f079b..199bd9340b3bf 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +@@ -1654,6 +1654,21 @@ static int gfx_v11_0_sw_init(struct amdgpu_ip_block *ip_block) + } + } + break; ++ case IP_VERSION(11, 0, 1): ++ case IP_VERSION(11, 0, 4): ++ adev->gfx.cleaner_shader_ptr = gfx_11_0_3_cleaner_shader_hex; ++ adev->gfx.cleaner_shader_size = sizeof(gfx_11_0_3_cleaner_shader_hex); ++ if (adev->gfx.pfp_fw_version >= 102 && ++ adev->gfx.mec_fw_version >= 66 && ++ adev->mes.fw_version[0] >= 128) { ++ adev->gfx.enable_cleaner_shader = true; ++ r = amdgpu_gfx_cleaner_shader_sw_init(adev, adev->gfx.cleaner_shader_size); ++ if (r) { ++ adev->gfx.enable_cleaner_shader = false; ++ dev_err(adev->dev, "Failed to initialize cleaner shader\n"); ++ } ++ } ++ break; + case IP_VERSION(11, 5, 0): + case IP_VERSION(11, 5, 1): + adev->gfx.cleaner_shader_ptr = gfx_11_0_3_cleaner_shader_hex; +-- +2.51.0 + diff --git a/queue-6.16/gpiolib-acpi-ignore-touchpad-wakeup-on-gpd-g1619-05.patch b/queue-6.16/gpiolib-acpi-ignore-touchpad-wakeup-on-gpd-g1619-05.patch new file mode 100644 index 0000000000..276764b9b1 --- /dev/null +++ b/queue-6.16/gpiolib-acpi-ignore-touchpad-wakeup-on-gpd-g1619-05.patch @@ -0,0 +1,47 @@ +From cec9fbc2e966be708ebae0bb38db7680f9913d43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Aug 2025 19:58:42 +0200 +Subject: gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-05 + +From: Antheas Kapenekakis + +[ Upstream commit 3712ce9fa501617cdc4466d30ae3894d50887743 ] + +Same issue as G1619-04 in commit 805c74eac8cb ("gpiolib: acpi: Ignore +touchpad wakeup on GPD G1619-04"), Strix Point lineup uses 05. + +Signed-off-by: Antheas Kapenekakis +Reviewed-by: Mika Westerberg +Reviewed-by: Mario Limonciello +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-acpi-quirks.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/gpio/gpiolib-acpi-quirks.c b/drivers/gpio/gpiolib-acpi-quirks.c +index bfb04e67c4bc8..7b95d1b033614 100644 +--- a/drivers/gpio/gpiolib-acpi-quirks.c ++++ b/drivers/gpio/gpiolib-acpi-quirks.c +@@ -317,6 +317,18 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] __initconst = { + .ignore_wake = "PNP0C50:00@8", + }, + }, ++ { ++ /* ++ * Same as G1619-04. New model. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "GPD"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "G1619-05"), ++ }, ++ .driver_data = &(struct acpi_gpiolib_dmi_quirk) { ++ .ignore_wake = "PNP0C50:00@8", ++ }, ++ }, + { + /* + * Spurious wakeups from GPIO 11 +-- +2.51.0 + diff --git a/queue-6.16/iommufd-warn-if-an-object-is-aborted-with-an-elevate.patch b/queue-6.16/iommufd-warn-if-an-object-is-aborted-with-an-elevate.patch new file mode 100644 index 0000000000..323507eb54 --- /dev/null +++ b/queue-6.16/iommufd-warn-if-an-object-is-aborted-with-an-elevate.patch @@ -0,0 +1,82 @@ +From 6f268e492f0d90647bdd8c107be1b565e25ac0fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 15:59:59 -0300 +Subject: iommufd: WARN if an object is aborted with an elevated refcount + +From: Jason Gunthorpe + +[ Upstream commit 53d0584eeb2c85a46c83656246d61a89558d74b3 ] + +If something holds a refcount then it is at risk of UAFing. For abort +paths we expect the caller to never share the object with a parallel +thread and to clean up any refcounts it obtained on its own. + +Add the missing dec inside iommufd_hwpt_paging_alloc() during error unwind +by making iommufd_hw_pagetable_attach/detach() proper pairs. + +Link: https://patch.msgid.link/r/2-v1-02cd136829df+31-iommufd_syz_fput_jgg@nvidia.com +Reviewed-by: Kevin Tian +Reviewed-by: Nicolin Chen +Tested-by: Nicolin Chen +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommufd/device.c | 3 ++- + drivers/iommu/iommufd/iommufd_private.h | 3 +-- + drivers/iommu/iommufd/main.c | 4 ++++ + 3 files changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/iommu/iommufd/device.c b/drivers/iommu/iommufd/device.c +index 86244403b5320..674f9f244f7b4 100644 +--- a/drivers/iommu/iommufd/device.c ++++ b/drivers/iommu/iommufd/device.c +@@ -661,6 +661,8 @@ iommufd_hw_pagetable_detach(struct iommufd_device *idev, ioasid_t pasid) + iopt_remove_reserved_iova(&hwpt_paging->ioas->iopt, idev->dev); + mutex_unlock(&igroup->lock); + ++ iommufd_hw_pagetable_put(idev->ictx, hwpt); ++ + /* Caller must destroy hwpt */ + return hwpt; + } +@@ -1007,7 +1009,6 @@ void iommufd_device_detach(struct iommufd_device *idev, ioasid_t pasid) + hwpt = iommufd_hw_pagetable_detach(idev, pasid); + if (!hwpt) + return; +- iommufd_hw_pagetable_put(idev->ictx, hwpt); + refcount_dec(&idev->obj.users); + } + EXPORT_SYMBOL_NS_GPL(iommufd_device_detach, "IOMMUFD"); +diff --git a/drivers/iommu/iommufd/iommufd_private.h b/drivers/iommu/iommufd/iommufd_private.h +index 9ccc83341f321..e68d8d63076a8 100644 +--- a/drivers/iommu/iommufd/iommufd_private.h ++++ b/drivers/iommu/iommufd/iommufd_private.h +@@ -390,9 +390,8 @@ static inline void iommufd_hw_pagetable_put(struct iommufd_ctx *ictx, + if (hwpt->obj.type == IOMMUFD_OBJ_HWPT_PAGING) { + struct iommufd_hwpt_paging *hwpt_paging = to_hwpt_paging(hwpt); + +- lockdep_assert_not_held(&hwpt_paging->ioas->mutex); +- + if (hwpt_paging->auto_domain) { ++ lockdep_assert_not_held(&hwpt_paging->ioas->mutex); + iommufd_object_put_and_try_destroy(ictx, &hwpt->obj); + return; + } +diff --git a/drivers/iommu/iommufd/main.c b/drivers/iommu/iommufd/main.c +index 62a3469bbd37e..2b26747ac2021 100644 +--- a/drivers/iommu/iommufd/main.c ++++ b/drivers/iommu/iommufd/main.c +@@ -62,6 +62,10 @@ void iommufd_object_abort(struct iommufd_ctx *ictx, struct iommufd_object *obj) + old = xas_store(&xas, NULL); + xa_unlock(&ictx->objects); + WARN_ON(old != XA_ZERO_ENTRY); ++ ++ if (WARN_ON(!refcount_dec_and_test(&obj->users))) ++ return; ++ + kfree(obj); + } + +-- +2.51.0 + diff --git a/queue-6.16/netfs-prevent-duplicate-unlocking.patch b/queue-6.16/netfs-prevent-duplicate-unlocking.patch new file mode 100644 index 0000000000..3cd8ce693b --- /dev/null +++ b/queue-6.16/netfs-prevent-duplicate-unlocking.patch @@ -0,0 +1,39 @@ +From 4f4fbdab3de0180ff3e27d2ec9a3a0b47996f765 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 09:59:25 +0800 +Subject: netfs: Prevent duplicate unlocking + +From: Lizhi Xu + +[ Upstream commit 66d938e89e940e512f4c3deac938ecef399c13f9 ] + +The filio lock has been released here, so there is no need to jump to +error_folio_unlock to release it again. + +Reported-by: syzbot+b73c7d94a151e2ee1e9b@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=b73c7d94a151e2ee1e9b +Signed-off-by: Lizhi Xu +Acked-by: David Howells +Reviewed-by: Paulo Alcantara (Red Hat) +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/netfs/buffered_write.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/netfs/buffered_write.c b/fs/netfs/buffered_write.c +index f27ea5099a681..09394ac2c180d 100644 +--- a/fs/netfs/buffered_write.c ++++ b/fs/netfs/buffered_write.c +@@ -347,7 +347,7 @@ ssize_t netfs_perform_write(struct kiocb *iocb, struct iov_iter *iter, + folio_put(folio); + ret = filemap_write_and_wait_range(mapping, fpos, fpos + flen - 1); + if (ret < 0) +- goto error_folio_unlock; ++ goto out; + continue; + + copied: +-- +2.51.0 + diff --git a/queue-6.16/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch b/queue-6.16/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch new file mode 100644 index 0000000000..0ce43aeb84 --- /dev/null +++ b/queue-6.16/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch @@ -0,0 +1,49 @@ +From e67dfae60929ac2409a9904edcbbf48b027b5a2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:16:55 +0800 +Subject: perf subcmd: avoid crash in exclude_cmds when excludes is empty + +From: hupu + +[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ] + +When cross-compiling the perf tool for ARM64, `perf help` may crash +with the following assertion failure: + + help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed. + +This happens when the perf binary is not named exactly "perf" or when +multiple "perf-*" binaries exist in the same directory. In such cases, +the `excludes` command list can be empty, which leads to the final +assertion in exclude_cmds() being triggered. + +Add a simple guard at the beginning of exclude_cmds() to return early +if excludes->cnt is zero, preventing the crash. + +Signed-off-by: hupu +Reported-by: Guilherme Amadio +Reviewed-by: Namhyung Kim +Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/lib/subcmd/help.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c +index 9ef569492560e..ddaeb4eb3e249 100644 +--- a/tools/lib/subcmd/help.c ++++ b/tools/lib/subcmd/help.c +@@ -75,6 +75,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) + size_t ci, cj, ei; + int cmp; + ++ if (!excludes->cnt) ++ return; ++ + ci = cj = ei = 0; + while (ci < cmds->cnt && ei < excludes->cnt) { + cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name); +-- +2.51.0 + diff --git a/queue-6.16/platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch b/queue-6.16/platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch new file mode 100644 index 0000000000..57cb22a8c1 --- /dev/null +++ b/queue-6.16/platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch @@ -0,0 +1,51 @@ +From 5a19385137607053966860cb8fa56dc99a7f95c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Sep 2025 09:06:11 +0000 +Subject: platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: aprilgrimoire + +[ Upstream commit 8822e8be86d40410ddd2ac8ff44f3050c9ecf9c6 ] + +The firmware of Mechrevo Yilong15Pro emits a spurious keyboard interrupt on +events including closing the lid. When a user closes the lid on an already +suspended system this causes the system to wake up. +Add Mechrevo Yilong15Pro Series (GM5HG7A) to the list of quirk +spurious_8042 to work around this issue. + +Link: https://lore.kernel.org/linux-pm/6ww4uu6Gl4F5n6VY5dl1ufASfKzs4DhMxAN8BuqUpCoqU3PQukVSVSBCl_lKIzkQ-S8kt1acPd58eyolhkWN32lMLFj4ViI0Tdu2jwhnYZ8=@proton.me/ +Signed-off-by: April Grimoire +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/IvSc_IN5Pa0wRXElTk_fEl-cTpMZxg6TCQk_7aRUkTd9vJUp_ZeC0NdXZ0z6Tn7B-XiqqqQvCH65lq6FqhuECBMEYWcHQmWm1Jo7Br8kpeg=@proton.me +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index 18fb44139de25..4d0a38e06f083 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -239,6 +239,14 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"), + } + }, ++ { ++ .ident = "MECHREVO Yilong15Pro Series GM5HG7A", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "MECHREVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Yilong15Pro Series GM5HG7A"), ++ } ++ }, + /* https://bugzilla.kernel.org/show_bug.cgi?id=220116 */ + { + .ident = "PCSpecialist Lafite Pro V 14M", +-- +2.51.0 + diff --git a/queue-6.16/platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch b/queue-6.16/platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch new file mode 100644 index 0000000000..c0007921d5 --- /dev/null +++ b/queue-6.16/platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch @@ -0,0 +1,46 @@ +From 6255496e2436827dcca5b1f95d09a9d63439e568 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 18:46:49 +0200 +Subject: platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 + quirks list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christoffer Sandberg + +[ Upstream commit 12a3dd4d2cd9232d4e4df3b9a5b3d745db559941 ] + +Prevents instant wakeup ~1s after suspend + +Signed-off-by: Christoffer Sandberg +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20250916164700.32896-1-wse@tuxedocomputers.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index 4d0a38e06f083..d63aaad7ef599 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -256,6 +256,13 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Lafite Pro V 14M"), + } + }, ++ { ++ .ident = "TUXEDO Stellaris Slim 15 AMD Gen6", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"), ++ } ++ }, + { + .ident = "TUXEDO InfinityBook Pro 14/15 AMD Gen10", + .driver_data = &quirk_spurious_8042, +-- +2.51.0 + diff --git a/queue-6.16/platform-x86-amd-pmf-support-new-acpi-id-amdi0108.patch b/queue-6.16/platform-x86-amd-pmf-support-new-acpi-id-amdi0108.patch new file mode 100644 index 0000000000..2b0e39c426 --- /dev/null +++ b/queue-6.16/platform-x86-amd-pmf-support-new-acpi-id-amdi0108.patch @@ -0,0 +1,39 @@ +From e3401b16db832fe5d2f5d5ff2790b5e2fd001548 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 14:35:46 +0530 +Subject: platform/x86/amd/pmf: Support new ACPI ID AMDI0108 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shyam Sundar S K + +[ Upstream commit 1b09d08866277677d11726116f5e786d5ba00173 ] + +Include the ACPI ID AMDI0108, which is used on upcoming AMD platforms, in +the PMF driver's list of supported devices. + +Signed-off-by: Shyam Sundar S K +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/20250915090546.2759130-1-Shyam-sundar.S-k@amd.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/amd/pmf/core.c b/drivers/platform/x86/amd/pmf/core.c +index ef988605c4da6..bc544a4a5266e 100644 +--- a/drivers/platform/x86/amd/pmf/core.c ++++ b/drivers/platform/x86/amd/pmf/core.c +@@ -403,6 +403,7 @@ static const struct acpi_device_id amd_pmf_acpi_ids[] = { + {"AMDI0103", 0}, + {"AMDI0105", 0}, + {"AMDI0107", 0}, ++ {"AMDI0108", 0}, + { } + }; + MODULE_DEVICE_TABLE(acpi, amd_pmf_acpi_ids); +-- +2.51.0 + diff --git a/queue-6.16/platform-x86-oxpec-add-support-for-onexplayer-x1pro-.patch b/queue-6.16/platform-x86-oxpec-add-support-for-onexplayer-x1pro-.patch new file mode 100644 index 0000000000..c7749db5a9 --- /dev/null +++ b/queue-6.16/platform-x86-oxpec-add-support-for-onexplayer-x1pro-.patch @@ -0,0 +1,44 @@ +From f15ab63281c302a5ba5bf7a5c5bf3fc2e5c93558 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 15:22:51 +0200 +Subject: platform/x86: oxpec: Add support for OneXPlayer X1Pro EVA-02 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Antheas Kapenekakis + +[ Upstream commit fba9d5448bd45b0ff7199c47023e9308ea4f1730 ] + +It is a special edition of X1Pro with a different color. + +Signed-off-by: Antheas Kapenekakis +Link: https://patch.msgid.link/20250904132252.3041613-1-lkml@antheas.dev +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/oxpec.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/platform/x86/oxpec.c b/drivers/platform/x86/oxpec.c +index eb076bb4099be..4f540a9932fe1 100644 +--- a/drivers/platform/x86/oxpec.c ++++ b/drivers/platform/x86/oxpec.c +@@ -306,6 +306,13 @@ static const struct dmi_system_id dmi_table[] = { + }, + .driver_data = (void *)oxp_x1, + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ONE-NETBOOK"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "ONEXPLAYER X1Pro EVA-02"), ++ }, ++ .driver_data = (void *)oxp_x1, ++ }, + {}, + }; + +-- +2.51.0 + diff --git a/queue-6.16/series b/queue-6.16/series index 060ade6938..ef618961ee 100644 --- a/queue-6.16/series +++ b/queue-6.16/series @@ -2,3 +2,19 @@ alsa-hda-tas2781-fix-the-order-of-tas2781-calibrated-data.patch drm-amdgpu-enable-mes-lr_compute_wa-by-default.patch wifi-rtw89-mcc-stop-tx-during-mcc-prepare.patch wifi-rtw89-fix-use-after-free-in-rtw89_core_tx_kick_off_and_wait.patch +gpiolib-acpi-ignore-touchpad-wakeup-on-gpd-g1619-05.patch +asoc-rt712-avoid-skipping-the-blind-write.patch +asoc-amd-acp-adjust-pdm-gain-value.patch +dm-integrity-limit-max_tag_size-to-255.patch +platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch +platform-x86-oxpec-add-support-for-onexplayer-x1pro-.patch +perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch +drm-amdgpu-gfx11-add-cleaner-shader-support-for-gfx1.patch +platform-x86-amd-pmf-support-new-acpi-id-amdi0108.patch +asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch +btrfs-ref-verify-handle-damaged-extent-root-tree.patch +netfs-prevent-duplicate-unlocking.patch +iommufd-warn-if-an-object-is-aborted-with-an-elevate.patch +can-hi311x-fix-null-pointer-dereference-when-resumin.patch +can-rcar_canfd-fix-controller-mode-setting.patch +platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch diff --git a/queue-6.6/asoc-amd-acp-adjust-pdm-gain-value.patch b/queue-6.6/asoc-amd-acp-adjust-pdm-gain-value.patch new file mode 100644 index 0000000000..6d3cc187c2 --- /dev/null +++ b/queue-6.6/asoc-amd-acp-adjust-pdm-gain-value.patch @@ -0,0 +1,37 @@ +From c1f1e77f67de5dfb5ff9c934c5c486f1f592ba62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 11:15:47 +0530 +Subject: ASoC: amd: acp: Adjust pdm gain value + +From: Venkata Prasad Potturu + +[ Upstream commit f1d0260362d72f9f454dc1f9db2eeb80cb801f28 ] + +Set pdm gain value by setting PDM_MISC_CTRL_MASK value. +To avoid low pdm gain value. + +Signed-off-by: Venkata Prasad Potturu +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/20250821054606.1279178-1-venkataprasad.potturu@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp/amd.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/amd/acp/amd.h b/sound/soc/amd/acp/amd.h +index d6cfae6ec5f74..3f1761755b866 100644 +--- a/sound/soc/amd/acp/amd.h ++++ b/sound/soc/amd/acp/amd.h +@@ -116,7 +116,7 @@ + #define PDM_DMA_INTR_MASK 0x10000 + #define PDM_DEC_64 0x2 + #define PDM_CLK_FREQ_MASK 0x07 +-#define PDM_MISC_CTRL_MASK 0x10 ++#define PDM_MISC_CTRL_MASK 0x18 + #define PDM_ENABLE 0x01 + #define PDM_DISABLE 0x00 + #define DMA_EN_MASK 0x02 +-- +2.51.0 + diff --git a/queue-6.6/asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch b/queue-6.6/asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch new file mode 100644 index 0000000000..3eaeee4735 --- /dev/null +++ b/queue-6.6/asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch @@ -0,0 +1,83 @@ +From 81a884957971133d646abad29bc8ef2f16d5157a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 08:11:43 +0000 +Subject: ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue + +From: Jack Yu + +[ Upstream commit 1dd28fd86c3fa4e395031dd6f2ba920242107010 ] + +Adjust register settings for SAR adc button detection mode +to fix noise issue in headset. + +Signed-off-by: Jack Yu +Link: https://patch.msgid.link/766cd1d2dd7a403ba65bb4cc44845f71@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682s.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/codecs/rt5682s.c b/sound/soc/codecs/rt5682s.c +index 92c647d439ec7..89de427c19e79 100644 +--- a/sound/soc/codecs/rt5682s.c ++++ b/sound/soc/codecs/rt5682s.c +@@ -653,14 +653,15 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode + switch (mode) { + case SAR_PWR_SAVING: + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_3, +- RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_DIS); ++ RT5682S_CBJ_IN_BUF_MASK, RT5682S_CBJ_IN_BUF_EN); + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1, +- RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK, +- RT5682S_CTRL_MB1_REG | RT5682S_CTRL_MB2_REG); ++ RT5682S_MB1_PATH_MASK | RT5682S_MB2_PATH_MASK | ++ RT5682S_VREF_POW_MASK, RT5682S_CTRL_MB1_FSM | ++ RT5682S_CTRL_MB2_FSM | RT5682S_VREF_POW_FSM); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + usleep_range(5000, 5500); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK, RT5682S_SAR_BUTDET_EN); +@@ -688,7 +689,7 @@ static void rt5682s_sar_power_mode(struct snd_soc_component *component, int mode + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + break; + default: + dev_err(component->dev, "Invalid SAR Power mode: %d\n", mode); +@@ -725,7 +726,7 @@ static void rt5682s_disable_push_button_irq(struct snd_soc_component *component) + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_BUTDET_MASK | RT5682S_SAR_BUTDET_POW_MASK | + RT5682S_SAR_SEL_MB1_2_CTL_MASK, RT5682S_SAR_BUTDET_DIS | +- RT5682S_SAR_BUTDET_POW_SAV | RT5682S_SAR_SEL_MB1_2_MANU); ++ RT5682S_SAR_BUTDET_POW_NORM | RT5682S_SAR_SEL_MB1_2_MANU); + } + + /** +@@ -786,7 +787,7 @@ static int rt5682s_headset_detect(struct snd_soc_component *component, int jack_ + jack_type = SND_JACK_HEADSET; + snd_soc_component_write(component, RT5682S_SAR_IL_CMD_3, 0x024c); + snd_soc_component_update_bits(component, RT5682S_CBJ_CTRL_1, +- RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_EN); ++ RT5682S_FAST_OFF_MASK, RT5682S_FAST_OFF_DIS); + snd_soc_component_update_bits(component, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_SEL_MB1_2_MASK, val << RT5682S_SAR_SEL_MB1_2_SFT); + rt5682s_enable_push_button_irq(component); +@@ -966,7 +967,7 @@ static int rt5682s_set_jack_detect(struct snd_soc_component *component, + RT5682S_EMB_JD_MASK | RT5682S_DET_TYPE | + RT5682S_POL_FAST_OFF_MASK | RT5682S_MIC_CAP_MASK, + RT5682S_EMB_JD_EN | RT5682S_DET_TYPE | +- RT5682S_POL_FAST_OFF_HIGH | RT5682S_MIC_CAP_HS); ++ RT5682S_POL_FAST_OFF_LOW | RT5682S_MIC_CAP_HS); + regmap_update_bits(rt5682s->regmap, RT5682S_SAR_IL_CMD_1, + RT5682S_SAR_POW_MASK, RT5682S_SAR_POW_EN); + regmap_update_bits(rt5682s->regmap, RT5682S_GPIO_CTRL_1, +-- +2.51.0 + diff --git a/queue-6.6/btrfs-ref-verify-handle-damaged-extent-root-tree.patch b/queue-6.6/btrfs-ref-verify-handle-damaged-extent-root-tree.patch new file mode 100644 index 0000000000..99a383fe75 --- /dev/null +++ b/queue-6.6/btrfs-ref-verify-handle-damaged-extent-root-tree.patch @@ -0,0 +1,50 @@ +From 841cba80bf7a5ef58a8d142ffc5f4c580b5ac93b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Sep 2025 08:37:47 +0200 +Subject: btrfs: ref-verify: handle damaged extent root tree + +From: David Sterba + +[ Upstream commit ed4e6b5d644c4dd2bc2872ffec036b7da0ec2e27 ] + +Syzbot hits a problem with enabled ref-verify, ignorebadroots and a +fuzzed/damaged extent tree. There's no fallback option like in other +places that can deal with it so disable the whole ref-verify as it is +just a debugging feature. + +Reported-by: syzbot+9c3e0cdfbfe351b0bc0e@syzkaller.appspotmail.com +Link: https://lore.kernel.org/all/0000000000001b6052062139be1c@google.com/ +Reviewed-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/ref-verify.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c +index 28ac7995716e0..b8122582d7555 100644 +--- a/fs/btrfs/ref-verify.c ++++ b/fs/btrfs/ref-verify.c +@@ -990,11 +990,18 @@ int btrfs_build_ref_tree(struct btrfs_fs_info *fs_info) + if (!btrfs_test_opt(fs_info, REF_VERIFY)) + return 0; + ++ extent_root = btrfs_extent_root(fs_info, 0); ++ /* If the extent tree is damaged we cannot ignore it (IGNOREBADROOTS). */ ++ if (IS_ERR(extent_root)) { ++ btrfs_warn(fs_info, "ref-verify: extent tree not available, disabling"); ++ btrfs_clear_opt(fs_info->mount_opt, REF_VERIFY); ++ return 0; ++ } ++ + path = btrfs_alloc_path(); + if (!path) + return -ENOMEM; + +- extent_root = btrfs_extent_root(fs_info, 0); + eb = btrfs_read_lock_root_node(extent_root); + level = btrfs_header_level(eb); + path->nodes[level] = eb; +-- +2.51.0 + diff --git a/queue-6.6/can-hi311x-fix-null-pointer-dereference-when-resumin.patch b/queue-6.6/can-hi311x-fix-null-pointer-dereference-when-resumin.patch new file mode 100644 index 0000000000..3ec09890c5 --- /dev/null +++ b/queue-6.6/can-hi311x-fix-null-pointer-dereference-when-resumin.patch @@ -0,0 +1,123 @@ +From ecb466533f8933a2742d81c3948787a64adbf97c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 23:08:20 +0800 +Subject: can: hi311x: fix null pointer dereference when resuming from sleep + before interface was enabled + +From: Chen Yufeng + +[ Upstream commit 6b696808472197b77b888f50bc789a3bae077743 ] + +This issue is similar to the vulnerability in the `mcp251x` driver, +which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from +sleep before interface was brought up"). + +In the `hi311x` driver, when the device resumes from sleep, the driver +schedules `priv->restart_work`. However, if the network interface was +not previously enabled, the `priv->wq` (workqueue) is not allocated and +initialized, leading to a null pointer dereference. + +To fix this, we move the allocation and initialization of the workqueue +from the `hi3110_open` function to the `hi3110_can_probe` function. +This ensures that the workqueue is properly initialized before it is +used during device resume. And added logic to destroy the workqueue +in the error handling paths of `hi3110_can_probe` and in the +`hi3110_can_remove` function to prevent resource leaks. + +Signed-off-by: Chen Yufeng +Link: https://patch.msgid.link/20250911150820.250-1-chenyufeng@iie.ac.cn +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/hi311x.c | 33 +++++++++++++++++---------------- + 1 file changed, 17 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c +index 57ea7dfe8a596..1acd4fc7adc8b 100644 +--- a/drivers/net/can/spi/hi311x.c ++++ b/drivers/net/can/spi/hi311x.c +@@ -545,8 +545,6 @@ static int hi3110_stop(struct net_device *net) + + priv->force_quit = 1; + free_irq(spi->irq, priv); +- destroy_workqueue(priv->wq); +- priv->wq = NULL; + + mutex_lock(&priv->hi3110_lock); + +@@ -771,34 +769,23 @@ static int hi3110_open(struct net_device *net) + goto out_close; + } + +- priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM, +- 0); +- if (!priv->wq) { +- ret = -ENOMEM; +- goto out_free_irq; +- } +- INIT_WORK(&priv->tx_work, hi3110_tx_work_handler); +- INIT_WORK(&priv->restart_work, hi3110_restart_work_handler); +- + ret = hi3110_hw_reset(spi); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + ret = hi3110_setup(net); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + ret = hi3110_set_normal_mode(spi); + if (ret) +- goto out_free_wq; ++ goto out_free_irq; + + netif_wake_queue(net); + mutex_unlock(&priv->hi3110_lock); + + return 0; + +- out_free_wq: +- destroy_workqueue(priv->wq); + out_free_irq: + free_irq(spi->irq, priv); + hi3110_hw_sleep(spi); +@@ -915,6 +902,15 @@ static int hi3110_can_probe(struct spi_device *spi) + if (ret) + goto out_clk; + ++ priv->wq = alloc_workqueue("hi3110_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM, ++ 0); ++ if (!priv->wq) { ++ ret = -ENOMEM; ++ goto out_clk; ++ } ++ INIT_WORK(&priv->tx_work, hi3110_tx_work_handler); ++ INIT_WORK(&priv->restart_work, hi3110_restart_work_handler); ++ + priv->spi = spi; + mutex_init(&priv->hi3110_lock); + +@@ -950,6 +946,8 @@ static int hi3110_can_probe(struct spi_device *spi) + return 0; + + error_probe: ++ destroy_workqueue(priv->wq); ++ priv->wq = NULL; + hi3110_power_enable(priv->power, 0); + + out_clk: +@@ -970,6 +968,9 @@ static void hi3110_can_remove(struct spi_device *spi) + + hi3110_power_enable(priv->power, 0); + ++ destroy_workqueue(priv->wq); ++ priv->wq = NULL; ++ + clk_disable_unprepare(priv->clk); + + free_candev(net); +-- +2.51.0 + diff --git a/queue-6.6/can-rcar_canfd-fix-controller-mode-setting.patch b/queue-6.6/can-rcar_canfd-fix-controller-mode-setting.patch new file mode 100644 index 0000000000..4c6d092a0c --- /dev/null +++ b/queue-6.6/can-rcar_canfd-fix-controller-mode-setting.patch @@ -0,0 +1,50 @@ +From 2f822346df8ea0bfc70698d743ec8d7f1c0ddf6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 07:03:45 +0000 +Subject: can: rcar_canfd: Fix controller mode setting + +From: Duy Nguyen + +[ Upstream commit 5cff263606a10102a0ea19ff579eaa18fd5577ad ] + +Driver configures register to choose controller mode before +setting all channels to reset mode leading to failure. +The patch corrects operation of mode setting. + +Signed-off-by: Duy Nguyen +Signed-off-by: Tranh Ha +Link: https://patch.msgid.link/TYWPR01MB87434739F83E27EDCD23DF44B416A@TYWPR01MB8743.jpnprd01.prod.outlook.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rcar/rcar_canfd.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c +index e501b55678d1d..ae4ebcee60779 100644 +--- a/drivers/net/can/rcar/rcar_canfd.c ++++ b/drivers/net/can/rcar/rcar_canfd.c +@@ -738,9 +738,6 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) + /* Reset Global error flags */ + rcar_canfd_write(gpriv->base, RCANFD_GERFL, 0x0); + +- /* Set the controller into appropriate mode */ +- rcar_canfd_set_mode(gpriv); +- + /* Transition all Channels to reset mode */ + for_each_set_bit(ch, &gpriv->channels_mask, gpriv->info->max_channels) { + rcar_canfd_clear_bit(gpriv->base, +@@ -760,6 +757,10 @@ static int rcar_canfd_reset_controller(struct rcar_canfd_global *gpriv) + return err; + } + } ++ ++ /* Set the controller into appropriate mode */ ++ rcar_canfd_set_mode(gpriv); ++ + return 0; + } + +-- +2.51.0 + diff --git a/queue-6.6/dm-integrity-limit-max_tag_size-to-255.patch b/queue-6.6/dm-integrity-limit-max_tag_size-to-255.patch new file mode 100644 index 0000000000..19abdc3194 --- /dev/null +++ b/queue-6.6/dm-integrity-limit-max_tag_size-to-255.patch @@ -0,0 +1,34 @@ +From 68841b727bb143d83cb111340034c046d364109f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Sep 2025 15:52:02 +0200 +Subject: dm-integrity: limit MAX_TAG_SIZE to 255 + +From: Mikulas Patocka + +[ Upstream commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb ] + +MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size += ic->tag_size" assignment. We need to limit it to 255. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-integrity.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index 0bd76f8d4dc6b..6442d41622eff 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -129,7 +129,7 @@ struct journal_sector { + commit_id_t commit_id; + }; + +-#define MAX_TAG_SIZE (JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK])) ++#define MAX_TAG_SIZE 255 + + #define METADATA_PADDING_SECTORS 8 + +-- +2.51.0 + diff --git a/queue-6.6/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch b/queue-6.6/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch new file mode 100644 index 0000000000..e53a875b4a --- /dev/null +++ b/queue-6.6/perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch @@ -0,0 +1,49 @@ +From f964de4e6e7e05fc0484151ca52b5bac479a1c51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 16:16:55 +0800 +Subject: perf subcmd: avoid crash in exclude_cmds when excludes is empty + +From: hupu + +[ Upstream commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 ] + +When cross-compiling the perf tool for ARM64, `perf help` may crash +with the following assertion failure: + + help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed. + +This happens when the perf binary is not named exactly "perf" or when +multiple "perf-*" binaries exist in the same directory. In such cases, +the `excludes` command list can be empty, which leads to the final +assertion in exclude_cmds() being triggered. + +Add a simple guard at the beginning of exclude_cmds() to return early +if excludes->cnt is zero, preventing the crash. + +Signed-off-by: hupu +Reported-by: Guilherme Amadio +Reviewed-by: Namhyung Kim +Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/lib/subcmd/help.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c +index 9ef569492560e..ddaeb4eb3e249 100644 +--- a/tools/lib/subcmd/help.c ++++ b/tools/lib/subcmd/help.c +@@ -75,6 +75,9 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) + size_t ci, cj, ei; + int cmp; + ++ if (!excludes->cnt) ++ return; ++ + ci = cj = ei = 0; + while (ci < cmds->cnt && ei < excludes->cnt) { + cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name); +-- +2.51.0 + diff --git a/queue-6.6/platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch b/queue-6.6/platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch new file mode 100644 index 0000000000..1f54a37db9 --- /dev/null +++ b/queue-6.6/platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch @@ -0,0 +1,51 @@ +From facfbdabd60399c00d43f3b95544b1c202195017 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Sep 2025 09:06:11 +0000 +Subject: platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: aprilgrimoire + +[ Upstream commit 8822e8be86d40410ddd2ac8ff44f3050c9ecf9c6 ] + +The firmware of Mechrevo Yilong15Pro emits a spurious keyboard interrupt on +events including closing the lid. When a user closes the lid on an already +suspended system this causes the system to wake up. +Add Mechrevo Yilong15Pro Series (GM5HG7A) to the list of quirk +spurious_8042 to work around this issue. + +Link: https://lore.kernel.org/linux-pm/6ww4uu6Gl4F5n6VY5dl1ufASfKzs4DhMxAN8BuqUpCoqU3PQukVSVSBCl_lKIzkQ-S8kt1acPd58eyolhkWN32lMLFj4ViI0Tdu2jwhnYZ8=@proton.me/ +Signed-off-by: April Grimoire +Reviewed-by: Mario Limonciello (AMD) +Link: https://patch.msgid.link/IvSc_IN5Pa0wRXElTk_fEl-cTpMZxg6TCQk_7aRUkTd9vJUp_ZeC0NdXZ0z6Tn7B-XiqqqQvCH65lq6FqhuECBMEYWcHQmWm1Jo7Br8kpeg=@proton.me +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index 6f5437d210a61..b872baf35808f 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -233,6 +233,14 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_BOARD_NAME, "WUJIE14-GX4HRXL"), + } + }, ++ { ++ .ident = "MECHREVO Yilong15Pro Series GM5HG7A", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "MECHREVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Yilong15Pro Series GM5HG7A"), ++ } ++ }, + /* https://bugzilla.kernel.org/show_bug.cgi?id=220116 */ + { + .ident = "PCSpecialist Lafite Pro V 14M", +-- +2.51.0 + diff --git a/queue-6.6/platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch b/queue-6.6/platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch new file mode 100644 index 0000000000..e592d26521 --- /dev/null +++ b/queue-6.6/platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch @@ -0,0 +1,46 @@ +From 4e2a77e6f07274c149a7b0a574ac6298e5f688a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 18:46:49 +0200 +Subject: platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 + quirks list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christoffer Sandberg + +[ Upstream commit 12a3dd4d2cd9232d4e4df3b9a5b3d745db559941 ] + +Prevents instant wakeup ~1s after suspend + +Signed-off-by: Christoffer Sandberg +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20250916164700.32896-1-wse@tuxedocomputers.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index b872baf35808f..9fd2829ee2ab4 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -250,6 +250,13 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Lafite Pro V 14M"), + } + }, ++ { ++ .ident = "TUXEDO Stellaris Slim 15 AMD Gen6", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "GMxHGxx"), ++ } ++ }, + { + .ident = "TUXEDO InfinityBook Pro 14/15 AMD Gen10", + .driver_data = &quirk_spurious_8042, +-- +2.51.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 76edaf23b8..a4ea2182df 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -2,3 +2,12 @@ kvm-arm64-fix-softirq-masking-in-fpsimd-register-saving-sequence.patch media-tunner-xc5000-refactor-firmware-load.patch media-tuner-xc5000-fix-use-after-free-in-xc5000_release.patch media-i2c-tc358743-fix-use-after-free-bugs-caused-by-orphan-timer-in-probe.patch +asoc-amd-acp-adjust-pdm-gain-value.patch +dm-integrity-limit-max_tag_size-to-255.patch +platform-x86-amd-pmc-add-mechrevo-yilong15pro-to-spu.patch +perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch +asoc-rt5682s-adjust-sar-adc-button-mode-to-fix-noise.patch +btrfs-ref-verify-handle-damaged-extent-root-tree.patch +can-hi311x-fix-null-pointer-dereference-when-resumin.patch +can-rcar_canfd-fix-controller-mode-setting.patch +platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch