From: Sasha Levin Date: Sun, 21 Sep 2025 13:17:06 +0000 (-0400) Subject: Fixes for all trees X-Git-Tag: v6.1.154~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b308655333fb8bdda38f60431e63e552732dd3a1;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch b/queue-5.10/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch new file mode 100644 index 0000000000..6b7203f234 --- /dev/null +++ b/queue-5.10/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch @@ -0,0 +1,40 @@ +From bcbdd9a84517e1caca3ae248612df8edca5e5cfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 13:06:39 +0100 +Subject: ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error + message + +From: Colin Ian King + +[ Upstream commit 35fc531a59694f24a2456569cf7d1a9c6436841c ] + +The dev_err message is reporting an error about capture streams however +it is using the incorrect variable num_playback instead of num_capture. +Fix this by using the correct variable num_capture. + +Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations") +Signed-off-by: Colin Ian King +Acked-by: Peter Ujfalusi +Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-stream.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c +index 0e09ede922c7a..ea4fe28cbdace 100644 +--- a/sound/soc/sof/intel/hda-stream.c ++++ b/sound/soc/sof/intel/hda-stream.c +@@ -771,7 +771,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev) + + if (num_capture >= SOF_HDA_CAPTURE_STREAMS) { + dev_err(sdev->dev, "error: too many capture streams %d\n", +- num_playback); ++ num_capture); + return -EINVAL; + } + +-- +2.51.0 + diff --git a/queue-5.10/asoc-wm8940-correct-typo-in-control-name.patch b/queue-5.10/asoc-wm8940-correct-typo-in-control-name.patch new file mode 100644 index 0000000000..80be6084ec --- /dev/null +++ b/queue-5.10/asoc-wm8940-correct-typo-in-control-name.patch @@ -0,0 +1,36 @@ +From 3c88a028f2a8df501c1ed4dbdf24ea701595de1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:38 +0100 +Subject: ASoC: wm8940: Correct typo in control name + +From: Charles Keepax + +[ Upstream commit b4799520dcd6fe1e14495cecbbe9975d847cd482 ] + +Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver") +Reported-by: Ankur Tyagi +Signed-off-by: Charles Keepax +Tested-by: Ankur Tyagi +Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8940.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c +index 016cd8aeef37c..31234ad14e688 100644 +--- a/sound/soc/codecs/wm8940.c ++++ b/sound/soc/codecs/wm8940.c +@@ -218,7 +218,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = { + SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL, + 0, 255, 0, wm8940_adc_tlv), + SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum), +- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST, ++ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST, + 8, 1, 0, wm8940_capture_boost_vol_tlv), + SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL, + 0, 63, 0, wm8940_spk_vol_tlv), +-- +2.51.0 + diff --git a/queue-5.10/asoc-wm8974-correct-pll-rate-rounding.patch b/queue-5.10/asoc-wm8974-correct-pll-rate-rounding.patch new file mode 100644 index 0000000000..c88f1f71ec --- /dev/null +++ b/queue-5.10/asoc-wm8974-correct-pll-rate-rounding.patch @@ -0,0 +1,46 @@ +From d34bb63507b740b2cd1189244f39cc610f07f2f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:39 +0100 +Subject: ASoC: wm8974: Correct PLL rate rounding + +From: Charles Keepax + +[ Upstream commit 9b17d3724df55ecc2bc67978822585f2b023be48 ] + +Using a single value of 22500000 for both 48000Hz and 44100Hz audio +will sometimes result in returning wrong dividers due to rounding. +Update the code to use the actual value for both. + +Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically") +Signed-off-by: Charles Keepax +Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8974.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c +index 600e93d61a90f..bfc72c2bf90b8 100644 +--- a/sound/soc/codecs/wm8974.c ++++ b/sound/soc/codecs/wm8974.c +@@ -419,10 +419,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai) + fs256 = 256 * priv->fs; + + f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv); +- + if (f != priv->mclk) { + /* The PLL performs best around 90MHz */ +- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv); ++ if (fs256 % 8000) ++ f = 22579200; ++ else ++ f = 24576000; ++ ++ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv); + } + + wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll); +-- +2.51.0 + diff --git a/queue-5.10/crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch b/queue-5.10/crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch new file mode 100644 index 0000000000..1be512e835 --- /dev/null +++ b/queue-5.10/crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch @@ -0,0 +1,83 @@ +From 0bca3a9ab055629969325e2f0d7ea5931833ad05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 17:20:59 +0800 +Subject: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg + +From: Herbert Xu + +[ Upstream commit 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ] + +Issuing two writes to the same af_alg socket is bogus as the +data will be interleaved in an unpredictable fashion. Furthermore, +concurrent writes may create inconsistencies in the internal +socket state. + +Disallow this by adding a new ctx->write field that indiciates +exclusive ownership for writing. + +Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations") +Reported-by: Muhammad Alifa Ramdhan +Reported-by: Bing-Jhong Billy Jheng +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/af_alg.c | 7 +++++++ + include/crypto/if_alg.h | 10 ++++++---- + 2 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index 755e6caf18d28..25cf2fa3dde75 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -862,6 +862,12 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + } + + lock_sock(sk); ++ if (ctx->write) { ++ release_sock(sk); ++ return -EBUSY; ++ } ++ ctx->write = true; ++ + if (ctx->init && !ctx->more) { + if (ctx->used) { + err = -EINVAL; +@@ -969,6 +975,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + + unlock: + af_alg_data_wakeup(sk); ++ ctx->write = false; + release_sock(sk); + + return copied ?: err; +diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h +index a406e281ae571..1424200fe88cf 100644 +--- a/include/crypto/if_alg.h ++++ b/include/crypto/if_alg.h +@@ -136,6 +136,7 @@ struct af_alg_async_req { + * SG? + * @enc: Cryptographic operation to be performed when + * recvmsg is invoked. ++ * @write: True if we are in the middle of a write. + * @init: True if metadata has been sent. + * @len: Length of memory allocated for this data structure. + * @inflight: Non-zero when AIO requests are in flight. +@@ -151,10 +152,11 @@ struct af_alg_ctx { + size_t used; + atomic_t rcvused; + +- bool more; +- bool merge; +- bool enc; +- bool init; ++ u32 more:1, ++ merge:1, ++ enc:1, ++ write:1, ++ init:1; + + unsigned int len; + +-- +2.51.0 + diff --git a/queue-5.10/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch b/queue-5.10/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch new file mode 100644 index 0000000000..21c61a2a03 --- /dev/null +++ b/queue-5.10/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch @@ -0,0 +1,44 @@ +From 05b59f9c63d8162d6981fd673a6cdda63547628e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 11:44:47 +0800 +Subject: drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path + +From: Qi Xi + +[ Upstream commit 288dac9fb6084330d968459c750c838fd06e10e6 ] + +Add missing mutex unlock before returning from the error path in +cdns_mhdp_atomic_enable(). + +Fixes: 935a92a1c400 ("drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference") +Reported-by: Hulk Robot +Signed-off-by: Qi Xi +Reviewed-by: Luca Ceresoli +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250904034447.665427-1-xiqi2@huawei.com +Signed-off-by: Luca Ceresoli +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +index ae99d04f00456..5876589d42b7d 100644 +--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c ++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +@@ -1978,8 +1978,10 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge, + mhdp_state = to_cdns_mhdp_bridge_state(new_state); + + mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode); +- if (!mhdp_state->current_mode) +- return; ++ if (!mhdp_state->current_mode) { ++ ret = -EINVAL; ++ goto out; ++ } + + drm_mode_set_name(mhdp_state->current_mode); + +-- +2.51.0 + diff --git a/queue-5.10/series b/queue-5.10/series index ee525c3f85..1e7f649378 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -61,3 +61,8 @@ power-supply-bq27xxx-restrict-no-battery-detection-to-bq27000.patch mmc-mvsdio-fix-dma_unmap_sg-nents-value.patch kvm-svm-sync-tpr-from-lapic-into-vmcb-v_tpr-even-if-avic-is-active.patch rds-ib-increment-i_fastreg_wrs-before-bailing-out.patch +asoc-wm8940-correct-typo-in-control-name.patch +asoc-wm8974-correct-pll-rate-rounding.patch +asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch +drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch +crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch diff --git a/queue-5.15/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch b/queue-5.15/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch new file mode 100644 index 0000000000..e2b3938e78 --- /dev/null +++ b/queue-5.15/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch @@ -0,0 +1,40 @@ +From 311571c184f79cd353aa25b7aedfd7fb65ff02c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 13:06:39 +0100 +Subject: ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error + message + +From: Colin Ian King + +[ Upstream commit 35fc531a59694f24a2456569cf7d1a9c6436841c ] + +The dev_err message is reporting an error about capture streams however +it is using the incorrect variable num_playback instead of num_capture. +Fix this by using the correct variable num_capture. + +Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations") +Signed-off-by: Colin Ian King +Acked-by: Peter Ujfalusi +Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-stream.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c +index 63c367478f1c9..bf91ac39af1c7 100644 +--- a/sound/soc/sof/intel/hda-stream.c ++++ b/sound/soc/sof/intel/hda-stream.c +@@ -776,7 +776,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev) + + if (num_capture >= SOF_HDA_CAPTURE_STREAMS) { + dev_err(sdev->dev, "error: too many capture streams %d\n", +- num_playback); ++ num_capture); + return -EINVAL; + } + +-- +2.51.0 + diff --git a/queue-5.15/asoc-wm8940-correct-typo-in-control-name.patch b/queue-5.15/asoc-wm8940-correct-typo-in-control-name.patch new file mode 100644 index 0000000000..5e2b954e92 --- /dev/null +++ b/queue-5.15/asoc-wm8940-correct-typo-in-control-name.patch @@ -0,0 +1,36 @@ +From c5843a657ee9b6cc04b05055e539b689ae1c62a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:38 +0100 +Subject: ASoC: wm8940: Correct typo in control name + +From: Charles Keepax + +[ Upstream commit b4799520dcd6fe1e14495cecbbe9975d847cd482 ] + +Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver") +Reported-by: Ankur Tyagi +Signed-off-by: Charles Keepax +Tested-by: Ankur Tyagi +Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8940.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c +index 440d048ef0c02..03f5aedab4a54 100644 +--- a/sound/soc/codecs/wm8940.c ++++ b/sound/soc/codecs/wm8940.c +@@ -218,7 +218,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = { + SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL, + 0, 255, 0, wm8940_adc_tlv), + SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum), +- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST, ++ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST, + 8, 1, 0, wm8940_capture_boost_vol_tlv), + SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL, + 0, 63, 0, wm8940_spk_vol_tlv), +-- +2.51.0 + diff --git a/queue-5.15/asoc-wm8974-correct-pll-rate-rounding.patch b/queue-5.15/asoc-wm8974-correct-pll-rate-rounding.patch new file mode 100644 index 0000000000..f08cfb2969 --- /dev/null +++ b/queue-5.15/asoc-wm8974-correct-pll-rate-rounding.patch @@ -0,0 +1,46 @@ +From 94435845cb37a177ea654eedc10e6edce4b73da0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:39 +0100 +Subject: ASoC: wm8974: Correct PLL rate rounding + +From: Charles Keepax + +[ Upstream commit 9b17d3724df55ecc2bc67978822585f2b023be48 ] + +Using a single value of 22500000 for both 48000Hz and 44100Hz audio +will sometimes result in returning wrong dividers due to rounding. +Update the code to use the actual value for both. + +Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically") +Signed-off-by: Charles Keepax +Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8974.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c +index 9eeac34435664..914b7d04b09ca 100644 +--- a/sound/soc/codecs/wm8974.c ++++ b/sound/soc/codecs/wm8974.c +@@ -419,10 +419,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai) + fs256 = 256 * priv->fs; + + f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv); +- + if (f != priv->mclk) { + /* The PLL performs best around 90MHz */ +- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv); ++ if (fs256 % 8000) ++ f = 22579200; ++ else ++ f = 24576000; ++ ++ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv); + } + + wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll); +-- +2.51.0 + diff --git a/queue-5.15/crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch b/queue-5.15/crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch new file mode 100644 index 0000000000..36ca2cdd8f --- /dev/null +++ b/queue-5.15/crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch @@ -0,0 +1,83 @@ +From edd879d8cc795165f726a5c776ee2d5c8dc1dbce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 17:20:59 +0800 +Subject: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg + +From: Herbert Xu + +[ Upstream commit 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ] + +Issuing two writes to the same af_alg socket is bogus as the +data will be interleaved in an unpredictable fashion. Furthermore, +concurrent writes may create inconsistencies in the internal +socket state. + +Disallow this by adding a new ctx->write field that indiciates +exclusive ownership for writing. + +Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations") +Reported-by: Muhammad Alifa Ramdhan +Reported-by: Bing-Jhong Billy Jheng +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/af_alg.c | 7 +++++++ + include/crypto/if_alg.h | 10 ++++++---- + 2 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index aa93501e27b95..24c273f53e90a 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -862,6 +862,12 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + } + + lock_sock(sk); ++ if (ctx->write) { ++ release_sock(sk); ++ return -EBUSY; ++ } ++ ctx->write = true; ++ + if (ctx->init && !ctx->more) { + if (ctx->used) { + err = -EINVAL; +@@ -969,6 +975,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + + unlock: + af_alg_data_wakeup(sk); ++ ctx->write = false; + release_sock(sk); + + return copied ?: err; +diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h +index a406e281ae571..1424200fe88cf 100644 +--- a/include/crypto/if_alg.h ++++ b/include/crypto/if_alg.h +@@ -136,6 +136,7 @@ struct af_alg_async_req { + * SG? + * @enc: Cryptographic operation to be performed when + * recvmsg is invoked. ++ * @write: True if we are in the middle of a write. + * @init: True if metadata has been sent. + * @len: Length of memory allocated for this data structure. + * @inflight: Non-zero when AIO requests are in flight. +@@ -151,10 +152,11 @@ struct af_alg_ctx { + size_t used; + atomic_t rcvused; + +- bool more; +- bool merge; +- bool enc; +- bool init; ++ u32 more:1, ++ merge:1, ++ enc:1, ++ write:1, ++ init:1; + + unsigned int len; + +-- +2.51.0 + diff --git a/queue-5.15/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch b/queue-5.15/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch new file mode 100644 index 0000000000..26d79c171a --- /dev/null +++ b/queue-5.15/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch @@ -0,0 +1,51 @@ +From b2fdc2a4a6574991c7d5cae7fbc3356f29ac97ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 10:54:38 +0200 +Subject: drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ + +From: Loic Poulain + +[ Upstream commit a10f910c77f280327b481e77eab909934ec508f0 ] + +If the interrupt occurs before resource initialization is complete, the +interrupt handler/worker may access uninitialized data such as the I2C +tcpc_client device, potentially leading to NULL pointer dereference. + +Signed-off-by: Loic Poulain +Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP") +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250709085438.56188-1-loic.poulain@oss.qualcomm.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index 257f69b5e1783..4b3b6969da75f 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -1822,7 +1822,7 @@ static int anx7625_i2c_probe(struct i2c_client *client, + ret = devm_request_threaded_irq(dev, platform->pdata.intp_irq, + NULL, anx7625_intr_hpd_isr, + IRQF_TRIGGER_FALLING | +- IRQF_ONESHOT, ++ IRQF_ONESHOT | IRQF_NO_AUTOEN, + "anx7625-intp", platform); + if (ret) { + DRM_DEV_ERROR(dev, "fail to request irq\n"); +@@ -1844,8 +1844,10 @@ static int anx7625_i2c_probe(struct i2c_client *client, + } + + /* Add work function */ +- if (platform->pdata.intp_irq) ++ if (platform->pdata.intp_irq) { ++ enable_irq(platform->pdata.intp_irq); + queue_work(platform->workqueue, &platform->work); ++ } + + platform->bridge.funcs = &anx7625_bridge_funcs; + platform->bridge.of_node = client->dev.of_node; +-- +2.51.0 + diff --git a/queue-5.15/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch b/queue-5.15/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch new file mode 100644 index 0000000000..02da00de92 --- /dev/null +++ b/queue-5.15/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch @@ -0,0 +1,44 @@ +From 669a86e96c79c65eca05730cf9335eff493b1b8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 11:44:47 +0800 +Subject: drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path + +From: Qi Xi + +[ Upstream commit 288dac9fb6084330d968459c750c838fd06e10e6 ] + +Add missing mutex unlock before returning from the error path in +cdns_mhdp_atomic_enable(). + +Fixes: 935a92a1c400 ("drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference") +Reported-by: Hulk Robot +Signed-off-by: Qi Xi +Reviewed-by: Luca Ceresoli +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250904034447.665427-1-xiqi2@huawei.com +Signed-off-by: Luca Ceresoli +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +index c8386311cc704..0d523812afd5a 100644 +--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c ++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +@@ -2040,8 +2040,10 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge, + mhdp_state = to_cdns_mhdp_bridge_state(new_state); + + mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode); +- if (!mhdp_state->current_mode) +- return; ++ if (!mhdp_state->current_mode) { ++ ret = -EINVAL; ++ goto out; ++ } + + drm_mode_set_name(mhdp_state->current_mode); + +-- +2.51.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 0ce1d8e962..eee79d14b5 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -82,3 +82,9 @@ btrfs-tree-checker-fix-the-incorrect-inode-ref-size-check.patch mmc-mvsdio-fix-dma_unmap_sg-nents-value.patch kvm-svm-sync-tpr-from-lapic-into-vmcb-v_tpr-even-if-avic-is-active.patch rds-ib-increment-i_fastreg_wrs-before-bailing-out.patch +asoc-wm8940-correct-typo-in-control-name.patch +asoc-wm8974-correct-pll-rate-rounding.patch +asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch +drm-bridge-anx7625-fix-null-pointer-dereference-with.patch +drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch +crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch diff --git a/queue-5.4/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch b/queue-5.4/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch new file mode 100644 index 0000000000..1fdddbc7ec --- /dev/null +++ b/queue-5.4/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch @@ -0,0 +1,40 @@ +From 7d858eb1d775e942b4d531e8d70255a109d1f2f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 13:06:39 +0100 +Subject: ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error + message + +From: Colin Ian King + +[ Upstream commit 35fc531a59694f24a2456569cf7d1a9c6436841c ] + +The dev_err message is reporting an error about capture streams however +it is using the incorrect variable num_playback instead of num_capture. +Fix this by using the correct variable num_capture. + +Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations") +Signed-off-by: Colin Ian King +Acked-by: Peter Ujfalusi +Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-stream.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c +index 0c11fceb28a7a..d3edc40c7f473 100644 +--- a/sound/soc/sof/intel/hda-stream.c ++++ b/sound/soc/sof/intel/hda-stream.c +@@ -655,7 +655,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev) + + if (num_capture >= SOF_HDA_CAPTURE_STREAMS) { + dev_err(sdev->dev, "error: too many capture streams %d\n", +- num_playback); ++ num_capture); + return -EINVAL; + } + +-- +2.51.0 + diff --git a/queue-5.4/asoc-wm8940-correct-typo-in-control-name.patch b/queue-5.4/asoc-wm8940-correct-typo-in-control-name.patch new file mode 100644 index 0000000000..98957c15aa --- /dev/null +++ b/queue-5.4/asoc-wm8940-correct-typo-in-control-name.patch @@ -0,0 +1,36 @@ +From a2e856e3e287e5d5191d7534153211a53203c0d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:38 +0100 +Subject: ASoC: wm8940: Correct typo in control name + +From: Charles Keepax + +[ Upstream commit b4799520dcd6fe1e14495cecbbe9975d847cd482 ] + +Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver") +Reported-by: Ankur Tyagi +Signed-off-by: Charles Keepax +Tested-by: Ankur Tyagi +Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8940.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c +index c194fbde8ad6e..a02554b8edf71 100644 +--- a/sound/soc/codecs/wm8940.c ++++ b/sound/soc/codecs/wm8940.c +@@ -218,7 +218,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = { + SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL, + 0, 255, 0, wm8940_adc_tlv), + SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum), +- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST, ++ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST, + 8, 1, 0, wm8940_capture_boost_vol_tlv), + SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL, + 0, 63, 0, wm8940_spk_vol_tlv), +-- +2.51.0 + diff --git a/queue-5.4/asoc-wm8974-correct-pll-rate-rounding.patch b/queue-5.4/asoc-wm8974-correct-pll-rate-rounding.patch new file mode 100644 index 0000000000..d3a99418c3 --- /dev/null +++ b/queue-5.4/asoc-wm8974-correct-pll-rate-rounding.patch @@ -0,0 +1,46 @@ +From 5c29663b48224d9ce0a4da8cc5ccd07f6cb2350d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:39 +0100 +Subject: ASoC: wm8974: Correct PLL rate rounding + +From: Charles Keepax + +[ Upstream commit 9b17d3724df55ecc2bc67978822585f2b023be48 ] + +Using a single value of 22500000 for both 48000Hz and 44100Hz audio +will sometimes result in returning wrong dividers due to rounding. +Update the code to use the actual value for both. + +Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically") +Signed-off-by: Charles Keepax +Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8974.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c +index dc4fe4f5239d6..f32527ed06fb5 100644 +--- a/sound/soc/codecs/wm8974.c ++++ b/sound/soc/codecs/wm8974.c +@@ -427,10 +427,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai) + fs256 = 256 * priv->fs; + + f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv); +- + if (f != priv->mclk) { + /* The PLL performs best around 90MHz */ +- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv); ++ if (fs256 % 8000) ++ f = 22579200; ++ else ++ f = 24576000; ++ ++ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv); + } + + wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll); +-- +2.51.0 + diff --git a/queue-5.4/crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch b/queue-5.4/crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch new file mode 100644 index 0000000000..67d4707658 --- /dev/null +++ b/queue-5.4/crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch @@ -0,0 +1,83 @@ +From 7297cc29c3021dc031ea70bfdc30f56227263f99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 17:20:59 +0800 +Subject: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg + +From: Herbert Xu + +[ Upstream commit 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ] + +Issuing two writes to the same af_alg socket is bogus as the +data will be interleaved in an unpredictable fashion. Furthermore, +concurrent writes may create inconsistencies in the internal +socket state. + +Disallow this by adding a new ctx->write field that indiciates +exclusive ownership for writing. + +Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations") +Reported-by: Muhammad Alifa Ramdhan +Reported-by: Bing-Jhong Billy Jheng +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/af_alg.c | 7 +++++++ + include/crypto/if_alg.h | 10 ++++++---- + 2 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index bc96a4b21bec5..66f0d829f46f8 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -852,6 +852,12 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + } + + lock_sock(sk); ++ if (ctx->write) { ++ release_sock(sk); ++ return -EBUSY; ++ } ++ ctx->write = true; ++ + if (ctx->init && !ctx->more) { + if (ctx->used) { + err = -EINVAL; +@@ -959,6 +965,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + + unlock: + af_alg_data_wakeup(sk); ++ ctx->write = false; + release_sock(sk); + + return copied ?: err; +diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h +index f4ff7ae0128a2..5a5ec21fe147b 100644 +--- a/include/crypto/if_alg.h ++++ b/include/crypto/if_alg.h +@@ -135,6 +135,7 @@ struct af_alg_async_req { + * SG? + * @enc: Cryptographic operation to be performed when + * recvmsg is invoked. ++ * @write: True if we are in the middle of a write. + * @init: True if metadata has been sent. + * @len: Length of memory allocated for this data structure. + * @inflight: Non-zero when AIO requests are in flight. +@@ -150,10 +151,11 @@ struct af_alg_ctx { + size_t used; + atomic_t rcvused; + +- bool more; +- bool merge; +- bool enc; +- bool init; ++ u32 more:1, ++ merge:1, ++ enc:1, ++ write:1, ++ init:1; + + unsigned int len; + +-- +2.51.0 + diff --git a/queue-5.4/series b/queue-5.4/series index 1d1364deb0..413bcfffbc 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -43,3 +43,7 @@ power-supply-bq27xxx-fix-error-return-in-case-of-no-bq27000-hdq-battery.patch power-supply-bq27xxx-restrict-no-battery-detection-to-bq27000.patch mmc-mvsdio-fix-dma_unmap_sg-nents-value.patch rds-ib-increment-i_fastreg_wrs-before-bailing-out.patch +asoc-wm8940-correct-typo-in-control-name.patch +asoc-wm8974-correct-pll-rate-rounding.patch +asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch +crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch diff --git a/queue-6.1/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch b/queue-6.1/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch new file mode 100644 index 0000000000..06b5c6dd2e --- /dev/null +++ b/queue-6.1/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch @@ -0,0 +1,40 @@ +From c3f05c7a67a1bef17212e3c907fc7e305543b61e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 13:06:39 +0100 +Subject: ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error + message + +From: Colin Ian King + +[ Upstream commit 35fc531a59694f24a2456569cf7d1a9c6436841c ] + +The dev_err message is reporting an error about capture streams however +it is using the incorrect variable num_playback instead of num_capture. +Fix this by using the correct variable num_capture. + +Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations") +Signed-off-by: Colin Ian King +Acked-by: Peter Ujfalusi +Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-stream.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c +index be60e7785da94..fafaf9a8e6c44 100644 +--- a/sound/soc/sof/intel/hda-stream.c ++++ b/sound/soc/sof/intel/hda-stream.c +@@ -837,7 +837,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev) + + if (num_capture >= SOF_HDA_CAPTURE_STREAMS) { + dev_err(sdev->dev, "error: too many capture streams %d\n", +- num_playback); ++ num_capture); + return -EINVAL; + } + +-- +2.51.0 + diff --git a/queue-6.1/asoc-wm8940-correct-typo-in-control-name.patch b/queue-6.1/asoc-wm8940-correct-typo-in-control-name.patch new file mode 100644 index 0000000000..1e9d0623fa --- /dev/null +++ b/queue-6.1/asoc-wm8940-correct-typo-in-control-name.patch @@ -0,0 +1,36 @@ +From 8ddbe382556252796979850d5b979cff91894a76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:38 +0100 +Subject: ASoC: wm8940: Correct typo in control name + +From: Charles Keepax + +[ Upstream commit b4799520dcd6fe1e14495cecbbe9975d847cd482 ] + +Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver") +Reported-by: Ankur Tyagi +Signed-off-by: Charles Keepax +Tested-by: Ankur Tyagi +Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8940.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c +index 8dac9fd885470..2e70045d5920d 100644 +--- a/sound/soc/codecs/wm8940.c ++++ b/sound/soc/codecs/wm8940.c +@@ -218,7 +218,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = { + SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL, + 0, 255, 0, wm8940_adc_tlv), + SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum), +- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST, ++ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST, + 8, 1, 0, wm8940_capture_boost_vol_tlv), + SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL, + 0, 63, 0, wm8940_spk_vol_tlv), +-- +2.51.0 + diff --git a/queue-6.1/asoc-wm8974-correct-pll-rate-rounding.patch b/queue-6.1/asoc-wm8974-correct-pll-rate-rounding.patch new file mode 100644 index 0000000000..b3c393a888 --- /dev/null +++ b/queue-6.1/asoc-wm8974-correct-pll-rate-rounding.patch @@ -0,0 +1,46 @@ +From bd7ce18bece54649b861eee274bb63766e72b903 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:39 +0100 +Subject: ASoC: wm8974: Correct PLL rate rounding + +From: Charles Keepax + +[ Upstream commit 9b17d3724df55ecc2bc67978822585f2b023be48 ] + +Using a single value of 22500000 for both 48000Hz and 44100Hz audio +will sometimes result in returning wrong dividers due to rounding. +Update the code to use the actual value for both. + +Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically") +Signed-off-by: Charles Keepax +Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8974.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c +index 1becbf2c6ffad..587e200913767 100644 +--- a/sound/soc/codecs/wm8974.c ++++ b/sound/soc/codecs/wm8974.c +@@ -419,10 +419,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai) + fs256 = 256 * priv->fs; + + f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv); +- + if (f != priv->mclk) { + /* The PLL performs best around 90MHz */ +- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv); ++ if (fs256 % 8000) ++ f = 22579200; ++ else ++ f = 24576000; ++ ++ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv); + } + + wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll); +-- +2.51.0 + diff --git a/queue-6.1/crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch b/queue-6.1/crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch new file mode 100644 index 0000000000..b09c4596f7 --- /dev/null +++ b/queue-6.1/crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch @@ -0,0 +1,83 @@ +From a5206cb3b3e7407a342f33266e71dffd8ad7f13f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 17:20:59 +0800 +Subject: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg + +From: Herbert Xu + +[ Upstream commit 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ] + +Issuing two writes to the same af_alg socket is bogus as the +data will be interleaved in an unpredictable fashion. Furthermore, +concurrent writes may create inconsistencies in the internal +socket state. + +Disallow this by adding a new ctx->write field that indiciates +exclusive ownership for writing. + +Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations") +Reported-by: Muhammad Alifa Ramdhan +Reported-by: Bing-Jhong Billy Jheng +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/af_alg.c | 7 +++++++ + include/crypto/if_alg.h | 10 ++++++---- + 2 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index aca9d72553e8f..316771eb17e27 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -859,6 +859,12 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + } + + lock_sock(sk); ++ if (ctx->write) { ++ release_sock(sk); ++ return -EBUSY; ++ } ++ ctx->write = true; ++ + if (ctx->init && !ctx->more) { + if (ctx->used) { + err = -EINVAL; +@@ -974,6 +980,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + + unlock: + af_alg_data_wakeup(sk); ++ ctx->write = false; + release_sock(sk); + + return copied ?: err; +diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h +index a406e281ae571..1424200fe88cf 100644 +--- a/include/crypto/if_alg.h ++++ b/include/crypto/if_alg.h +@@ -136,6 +136,7 @@ struct af_alg_async_req { + * SG? + * @enc: Cryptographic operation to be performed when + * recvmsg is invoked. ++ * @write: True if we are in the middle of a write. + * @init: True if metadata has been sent. + * @len: Length of memory allocated for this data structure. + * @inflight: Non-zero when AIO requests are in flight. +@@ -151,10 +152,11 @@ struct af_alg_ctx { + size_t used; + atomic_t rcvused; + +- bool more; +- bool merge; +- bool enc; +- bool init; ++ u32 more:1, ++ merge:1, ++ enc:1, ++ write:1, ++ init:1; + + unsigned int len; + +-- +2.51.0 + diff --git a/queue-6.1/crypto-af_alg-indent-the-loop-in-af_alg_sendmsg.patch b/queue-6.1/crypto-af_alg-indent-the-loop-in-af_alg_sendmsg.patch new file mode 100644 index 0000000000..cded44447d --- /dev/null +++ b/queue-6.1/crypto-af_alg-indent-the-loop-in-af_alg_sendmsg.patch @@ -0,0 +1,101 @@ +From 4bfa344fbfd9b550a8727200379871d856389fda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 14:08:53 +0100 +Subject: crypto: af_alg: Indent the loop in af_alg_sendmsg() + +From: David Howells + +[ Upstream commit 73d7409cfdad7fd08a9203eb2912c1c77e527776 ] + +Put the loop in af_alg_sendmsg() into an if-statement to indent it to make +the next patch easier to review as that will add another branch to handle +MSG_SPLICE_PAGES to the if-statement. + +Signed-off-by: David Howells +cc: Herbert Xu +cc: "David S. Miller" +cc: Eric Dumazet +cc: Jakub Kicinski +cc: Paolo Abeni +cc: Jens Axboe +cc: Matthew Wilcox +cc: linux-crypto@vger.kernel.org +cc: netdev@vger.kernel.org +Acked-by: Herbert Xu +Signed-off-by: Paolo Abeni +Stable-dep-of: 9574b2330dbd ("crypto: af_alg - Set merge to zero early in af_alg_sendmsg") +Signed-off-by: Sasha Levin +--- + crypto/af_alg.c | 51 ++++++++++++++++++++++++++----------------------- + 1 file changed, 27 insertions(+), 24 deletions(-) + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index fef69d2a6b183..d5a8368a47c5c 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -927,35 +927,38 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + if (sgl->cur) + sg_unmark_end(sg + sgl->cur - 1); + +- do { +- struct page *pg; +- unsigned int i = sgl->cur; ++ if (1 /* TODO check MSG_SPLICE_PAGES */) { ++ do { ++ struct page *pg; ++ unsigned int i = sgl->cur; + +- plen = min_t(size_t, len, PAGE_SIZE); ++ plen = min_t(size_t, len, PAGE_SIZE); + +- pg = alloc_page(GFP_KERNEL); +- if (!pg) { +- err = -ENOMEM; +- goto unlock; +- } ++ pg = alloc_page(GFP_KERNEL); ++ if (!pg) { ++ err = -ENOMEM; ++ goto unlock; ++ } + +- sg_assign_page(sg + i, pg); ++ sg_assign_page(sg + i, pg); + +- err = memcpy_from_msg(page_address(sg_page(sg + i)), +- msg, plen); +- if (err) { +- __free_page(sg_page(sg + i)); +- sg_assign_page(sg + i, NULL); +- goto unlock; +- } ++ err = memcpy_from_msg( ++ page_address(sg_page(sg + i)), ++ msg, plen); ++ if (err) { ++ __free_page(sg_page(sg + i)); ++ sg_assign_page(sg + i, NULL); ++ goto unlock; ++ } + +- sg[i].length = plen; +- len -= plen; +- ctx->used += plen; +- copied += plen; +- size -= plen; +- sgl->cur++; +- } while (len && sgl->cur < MAX_SGL_ENTS); ++ sg[i].length = plen; ++ len -= plen; ++ ctx->used += plen; ++ copied += plen; ++ size -= plen; ++ sgl->cur++; ++ } while (len && sgl->cur < MAX_SGL_ENTS); ++ } + + if (!size) + sg_mark_end(sg + sgl->cur - 1); +-- +2.51.0 + diff --git a/queue-6.1/crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch b/queue-6.1/crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch new file mode 100644 index 0000000000..191a484929 --- /dev/null +++ b/queue-6.1/crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch @@ -0,0 +1,41 @@ +From b6d324338b3414cfd0fb4f63baa577b79bcec21c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 15:42:41 +0800 +Subject: crypto: af_alg - Set merge to zero early in af_alg_sendmsg + +From: Herbert Xu + +[ Upstream commit 9574b2330dbd2b5459b74d3b5e9619d39299fc6f ] + +If an error causes af_alg_sendmsg to abort, ctx->merge may contain +a garbage value from the previous loop. This may then trigger a +crash on the next entry into af_alg_sendmsg when it attempts to do +a merge that can't be done. + +Fix this by setting ctx->merge to zero near the start of the loop. + +Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations") +Reported-by: Muhammad Alifa Ramdhan +Reported-by: Bing-Jhong Billy Jheng +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/af_alg.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index d5a8368a47c5c..aca9d72553e8f 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -908,6 +908,8 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + continue; + } + ++ ctx->merge = 0; ++ + if (!af_alg_writable(sk)) { + err = af_alg_wait_for_wmem(sk, msg->msg_flags); + if (err) +-- +2.51.0 + diff --git a/queue-6.1/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch b/queue-6.1/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch new file mode 100644 index 0000000000..196f940366 --- /dev/null +++ b/queue-6.1/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch @@ -0,0 +1,51 @@ +From bdbaa2838adefe71f42f31011b19dd3dc41ffb9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 10:54:38 +0200 +Subject: drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ + +From: Loic Poulain + +[ Upstream commit a10f910c77f280327b481e77eab909934ec508f0 ] + +If the interrupt occurs before resource initialization is complete, the +interrupt handler/worker may access uninitialized data such as the I2C +tcpc_client device, potentially leading to NULL pointer dereference. + +Signed-off-by: Loic Poulain +Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP") +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250709085438.56188-1-loic.poulain@oss.qualcomm.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index e14c9fdabe2ba..690a0e7f5f6e2 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -2697,7 +2697,7 @@ static int anx7625_i2c_probe(struct i2c_client *client) + ret = devm_request_threaded_irq(dev, platform->pdata.intp_irq, + NULL, anx7625_intr_hpd_isr, + IRQF_TRIGGER_FALLING | +- IRQF_ONESHOT, ++ IRQF_ONESHOT | IRQF_NO_AUTOEN, + "anx7625-intp", platform); + if (ret) { + DRM_DEV_ERROR(dev, "fail to request irq\n"); +@@ -2767,8 +2767,10 @@ static int anx7625_i2c_probe(struct i2c_client *client) + } + + /* Add work function */ +- if (platform->pdata.intp_irq) ++ if (platform->pdata.intp_irq) { ++ enable_irq(platform->pdata.intp_irq); + queue_work(platform->workqueue, &platform->work); ++ } + + if (platform->pdata.audio_en) + anx7625_register_audio(dev, platform); +-- +2.51.0 + diff --git a/queue-6.1/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch b/queue-6.1/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch new file mode 100644 index 0000000000..35a8839a81 --- /dev/null +++ b/queue-6.1/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch @@ -0,0 +1,44 @@ +From b2ec9a3b8eb1dcf29485ba5ab82c0c2539b6d358 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 11:44:47 +0800 +Subject: drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path + +From: Qi Xi + +[ Upstream commit 288dac9fb6084330d968459c750c838fd06e10e6 ] + +Add missing mutex unlock before returning from the error path in +cdns_mhdp_atomic_enable(). + +Fixes: 935a92a1c400 ("drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference") +Reported-by: Hulk Robot +Signed-off-by: Qi Xi +Reviewed-by: Luca Ceresoli +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250904034447.665427-1-xiqi2@huawei.com +Signed-off-by: Luca Ceresoli +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +index 1b7c14d7c5ee3..aaa9f44d27be5 100644 +--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c ++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +@@ -2042,8 +2042,10 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge, + mhdp_state = to_cdns_mhdp_bridge_state(new_state); + + mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode); +- if (!mhdp_state->current_mode) +- return; ++ if (!mhdp_state->current_mode) { ++ ret = -EINVAL; ++ goto out; ++ } + + drm_mode_set_name(mhdp_state->current_mode); + +-- +2.51.0 + diff --git a/queue-6.1/series b/queue-6.1/series index b8afc654db..0302d5c9c8 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -35,3 +35,12 @@ selftests-mptcp-avoid-spurious-errors-on-tcp-disconnect.patch alsa-hda-realtek-fix-mute-led-for-hp-laptop-15-dw4xx.patch io_uring-backport-io_should_terminate_tw.patch io_uring-include-dying-ring-in-task_work-should-cancel-state.patch +asoc-wm8940-correct-typo-in-control-name.patch +asoc-wm8974-correct-pll-rate-rounding.patch +asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch +drm-bridge-anx7625-fix-null-pointer-dereference-with.patch +drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch +crypto-af_alg-indent-the-loop-in-af_alg_sendmsg.patch +crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch +crypto-af_alg-disallow-concurrent-writes-in-af_alg_s.patch +smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch diff --git a/queue-6.1/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch b/queue-6.1/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch new file mode 100644 index 0000000000..0c8cd75724 --- /dev/null +++ b/queue-6.1/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch @@ -0,0 +1,46 @@ +From bbaa4f608d1843a85e101bdd5bac0197d63e6512 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 03:06:46 +0200 +Subject: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error + path + +From: Stefan Metzmacher + +[ Upstream commit daac51c7032036a0ca5f1aa419ad1b0471d1c6e0 ] + +During tests of another unrelated patch I was able to trigger this +error: Objects remaining on __kmem_cache_shutdown() + +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smbdirect.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c +index d47eae133a202..b648bb30401d5 100644 +--- a/fs/smb/client/smbdirect.c ++++ b/fs/smb/client/smbdirect.c +@@ -1084,8 +1084,10 @@ static int smbd_negotiate(struct smbd_connection *info) + log_rdma_event(INFO, "smbd_post_recv rc=%d iov.addr=0x%llx iov.length=%u iov.lkey=0x%x\n", + rc, response->sge.addr, + response->sge.length, response->sge.lkey); +- if (rc) ++ if (rc) { ++ put_receive_buffer(info, response); + return rc; ++ } + + init_completion(&info->negotiate_completion); + info->negotiate_done = false; +-- +2.51.0 + diff --git a/queue-6.12/asoc-intel-catpt-expose-correct-bit-depth-to-userspa.patch b/queue-6.12/asoc-intel-catpt-expose-correct-bit-depth-to-userspa.patch new file mode 100644 index 0000000000..e796e089c3 --- /dev/null +++ b/queue-6.12/asoc-intel-catpt-expose-correct-bit-depth-to-userspa.patch @@ -0,0 +1,99 @@ +From 8b5a074dd4f375bbe9b163c56462d0d8e5c17cb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:28:29 +0200 +Subject: ASoC: Intel: catpt: Expose correct bit depth to userspace +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit 690aa09b1845c0d5c3c29dabd50a9d0488c97c48 ] + +Currently wrong bit depth is exposed in hw params, causing clipped +volume during playback. Expose correct parameters. + +Fixes: a126750fc865 ("ASoC: Intel: catpt: PCM operations") +Reported-by: Andy Shevchenko +Tested-by: Andy Shevchenko +Reviewed-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Message-ID: <20250909092829.375953-1-amadeuszx.slawinski@linux.intel.com> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/catpt/pcm.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/intel/catpt/pcm.c b/sound/soc/intel/catpt/pcm.c +index 81a2f0339e055..ff1fa01acb85b 100644 +--- a/sound/soc/intel/catpt/pcm.c ++++ b/sound/soc/intel/catpt/pcm.c +@@ -568,8 +568,9 @@ static const struct snd_pcm_hardware catpt_pcm_hardware = { + SNDRV_PCM_INFO_RESUME | + SNDRV_PCM_INFO_NO_PERIOD_WAKEUP, + .formats = SNDRV_PCM_FMTBIT_S16_LE | +- SNDRV_PCM_FMTBIT_S24_LE | + SNDRV_PCM_FMTBIT_S32_LE, ++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 | ++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX, + .period_bytes_min = PAGE_SIZE, + .period_bytes_max = CATPT_BUFFER_MAX_SIZE / CATPT_PCM_PERIODS_MIN, + .periods_min = CATPT_PCM_PERIODS_MIN, +@@ -699,14 +700,18 @@ static struct snd_soc_dai_driver dai_drivers[] = { + .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_48000, +- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE, ++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE, ++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 | ++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX, + }, + .capture = { + .stream_name = "Analog Capture", + .channels_min = 2, + .channels_max = 4, + .rates = SNDRV_PCM_RATE_48000, +- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE, ++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE, ++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 | ++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX, + }, + }, + { +@@ -718,7 +723,9 @@ static struct snd_soc_dai_driver dai_drivers[] = { + .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_8000_192000, +- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE, ++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE, ++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 | ++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX, + }, + }, + { +@@ -730,7 +737,9 @@ static struct snd_soc_dai_driver dai_drivers[] = { + .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_8000_192000, +- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE, ++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE, ++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 | ++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX, + }, + }, + { +@@ -742,7 +751,9 @@ static struct snd_soc_dai_driver dai_drivers[] = { + .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_48000, +- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE, ++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE, ++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 | ++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX, + }, + }, + { +-- +2.51.0 + diff --git a/queue-6.12/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch b/queue-6.12/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch new file mode 100644 index 0000000000..761e6a8571 --- /dev/null +++ b/queue-6.12/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch @@ -0,0 +1,40 @@ +From 9558e1b66aa04c74ef73a81ede059494f440c9c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 13:06:39 +0100 +Subject: ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error + message + +From: Colin Ian King + +[ Upstream commit 35fc531a59694f24a2456569cf7d1a9c6436841c ] + +The dev_err message is reporting an error about capture streams however +it is using the incorrect variable num_playback instead of num_capture. +Fix this by using the correct variable num_capture. + +Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations") +Signed-off-by: Colin Ian King +Acked-by: Peter Ujfalusi +Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-stream.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c +index 3ac63ce67ab1c..24f3cc7676142 100644 +--- a/sound/soc/sof/intel/hda-stream.c ++++ b/sound/soc/sof/intel/hda-stream.c +@@ -864,7 +864,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev) + + if (num_capture >= SOF_HDA_CAPTURE_STREAMS) { + dev_err(sdev->dev, "error: too many capture streams %d\n", +- num_playback); ++ num_capture); + return -EINVAL; + } + +-- +2.51.0 + diff --git a/queue-6.12/asoc-wm8940-correct-pll-rate-rounding.patch b/queue-6.12/asoc-wm8940-correct-pll-rate-rounding.patch new file mode 100644 index 0000000000..aa4a646771 --- /dev/null +++ b/queue-6.12/asoc-wm8940-correct-pll-rate-rounding.patch @@ -0,0 +1,45 @@ +From d8030f7fb1a3a2f23710391e62864375d888039a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:37 +0100 +Subject: ASoC: wm8940: Correct PLL rate rounding + +From: Charles Keepax + +[ Upstream commit d05afb53c683ef7ed1228b593c3360f4d3126c58 ] + +Using a single value of 22500000 for both 48000Hz and 44100Hz audio +will sometimes result in returning wrong dividers due to rounding. +Update the code to use the actual value for both. + +Fixes: 294833fc9eb4 ("ASoC: wm8940: Rewrite code to set proper clocks") +Reported-by: Ankur Tyagi +Signed-off-by: Charles Keepax +Tested-by: Ankur Tyagi +Link: https://patch.msgid.link/20250821082639.1301453-2-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8940.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c +index 8a532f7d750c8..5e8ed8a2c270a 100644 +--- a/sound/soc/codecs/wm8940.c ++++ b/sound/soc/codecs/wm8940.c +@@ -693,7 +693,12 @@ static int wm8940_update_clocks(struct snd_soc_dai *dai) + f = wm8940_get_mclkdiv(priv->mclk, fs256, &mclkdiv); + if (f != priv->mclk) { + /* The PLL performs best around 90MHz */ +- fpll = wm8940_get_mclkdiv(22500000, fs256, &mclkdiv); ++ if (fs256 % 8000) ++ f = 22579200; ++ else ++ f = 24576000; ++ ++ fpll = wm8940_get_mclkdiv(f, fs256, &mclkdiv); + } + + wm8940_set_dai_pll(dai, 0, 0, priv->mclk, fpll); +-- +2.51.0 + diff --git a/queue-6.12/asoc-wm8940-correct-typo-in-control-name.patch b/queue-6.12/asoc-wm8940-correct-typo-in-control-name.patch new file mode 100644 index 0000000000..9c7bfd2638 --- /dev/null +++ b/queue-6.12/asoc-wm8940-correct-typo-in-control-name.patch @@ -0,0 +1,36 @@ +From b07d1e184771bf69902738df7ab8fbb6d70f0031 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:38 +0100 +Subject: ASoC: wm8940: Correct typo in control name + +From: Charles Keepax + +[ Upstream commit b4799520dcd6fe1e14495cecbbe9975d847cd482 ] + +Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver") +Reported-by: Ankur Tyagi +Signed-off-by: Charles Keepax +Tested-by: Ankur Tyagi +Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8940.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c +index 5e8ed8a2c270a..808a4d4b6f80b 100644 +--- a/sound/soc/codecs/wm8940.c ++++ b/sound/soc/codecs/wm8940.c +@@ -220,7 +220,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = { + SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL, + 0, 255, 0, wm8940_adc_tlv), + SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum), +- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST, ++ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST, + 8, 1, 0, wm8940_capture_boost_vol_tlv), + SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL, + 0, 63, 0, wm8940_spk_vol_tlv), +-- +2.51.0 + diff --git a/queue-6.12/asoc-wm8974-correct-pll-rate-rounding.patch b/queue-6.12/asoc-wm8974-correct-pll-rate-rounding.patch new file mode 100644 index 0000000000..449dea1386 --- /dev/null +++ b/queue-6.12/asoc-wm8974-correct-pll-rate-rounding.patch @@ -0,0 +1,46 @@ +From fa516863cbf16c710be42545fbe92a269f856728 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:39 +0100 +Subject: ASoC: wm8974: Correct PLL rate rounding + +From: Charles Keepax + +[ Upstream commit 9b17d3724df55ecc2bc67978822585f2b023be48 ] + +Using a single value of 22500000 for both 48000Hz and 44100Hz audio +will sometimes result in returning wrong dividers due to rounding. +Update the code to use the actual value for both. + +Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically") +Signed-off-by: Charles Keepax +Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8974.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c +index 0ee3655cad01f..c0a8fc867301c 100644 +--- a/sound/soc/codecs/wm8974.c ++++ b/sound/soc/codecs/wm8974.c +@@ -419,10 +419,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai) + fs256 = 256 * priv->fs; + + f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv); +- + if (f != priv->mclk) { + /* The PLL performs best around 90MHz */ +- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv); ++ if (fs256 % 8000) ++ f = 22579200; ++ else ++ f = 24576000; ++ ++ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv); + } + + wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll); +-- +2.51.0 + diff --git a/queue-6.12/crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch b/queue-6.12/crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch new file mode 100644 index 0000000000..bad047233d --- /dev/null +++ b/queue-6.12/crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch @@ -0,0 +1,49 @@ +From 5574b2a8895e322ac82b6041385803c1726ed469 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 15:42:41 +0800 +Subject: crypto: af_alg - Set merge to zero early in af_alg_sendmsg + +From: Herbert Xu + +[ Upstream commit 9574b2330dbd2b5459b74d3b5e9619d39299fc6f ] + +If an error causes af_alg_sendmsg to abort, ctx->merge may contain +a garbage value from the previous loop. This may then trigger a +crash on the next entry into af_alg_sendmsg when it attempts to do +a merge that can't be done. + +Fix this by setting ctx->merge to zero near the start of the loop. + +Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations") +Reported-by: Muhammad Alifa Ramdhan +Reported-by: Bing-Jhong Billy Jheng +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/af_alg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index f02c5586a8ab3..ca6fdcc6c54ac 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -1025,6 +1025,8 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + continue; + } + ++ ctx->merge = 0; ++ + if (!af_alg_writable(sk)) { + err = af_alg_wait_for_wmem(sk, msg->msg_flags); + if (err) +@@ -1064,7 +1066,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + ctx->used += plen; + copied += plen; + size -= plen; +- ctx->merge = 0; + } else { + do { + struct page *pg; +-- +2.51.0 + diff --git a/queue-6.12/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch b/queue-6.12/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch new file mode 100644 index 0000000000..013468a755 --- /dev/null +++ b/queue-6.12/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch @@ -0,0 +1,51 @@ +From ae8f3d05fee3dd17931e6f354db6dc37d227eb94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 10:54:38 +0200 +Subject: drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ + +From: Loic Poulain + +[ Upstream commit a10f910c77f280327b481e77eab909934ec508f0 ] + +If the interrupt occurs before resource initialization is complete, the +interrupt handler/worker may access uninitialized data such as the I2C +tcpc_client device, potentially leading to NULL pointer dereference. + +Signed-off-by: Loic Poulain +Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP") +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250709085438.56188-1-loic.poulain@oss.qualcomm.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index c036bbc92ba96..7244c3abb7f99 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -2683,7 +2683,7 @@ static int anx7625_i2c_probe(struct i2c_client *client) + ret = devm_request_threaded_irq(dev, platform->pdata.intp_irq, + NULL, anx7625_intr_hpd_isr, + IRQF_TRIGGER_FALLING | +- IRQF_ONESHOT, ++ IRQF_ONESHOT | IRQF_NO_AUTOEN, + "anx7625-intp", platform); + if (ret) { + DRM_DEV_ERROR(dev, "fail to request irq\n"); +@@ -2753,8 +2753,10 @@ static int anx7625_i2c_probe(struct i2c_client *client) + } + + /* Add work function */ +- if (platform->pdata.intp_irq) ++ if (platform->pdata.intp_irq) { ++ enable_irq(platform->pdata.intp_irq); + queue_work(platform->workqueue, &platform->work); ++ } + + if (platform->pdata.audio_en) + anx7625_register_audio(dev, platform); +-- +2.51.0 + diff --git a/queue-6.12/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch b/queue-6.12/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch new file mode 100644 index 0000000000..70703a7a4b --- /dev/null +++ b/queue-6.12/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch @@ -0,0 +1,44 @@ +From f4e59df258e8feb23497edf31f3dd12138b87c41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 11:44:47 +0800 +Subject: drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path + +From: Qi Xi + +[ Upstream commit 288dac9fb6084330d968459c750c838fd06e10e6 ] + +Add missing mutex unlock before returning from the error path in +cdns_mhdp_atomic_enable(). + +Fixes: 935a92a1c400 ("drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference") +Reported-by: Hulk Robot +Signed-off-by: Qi Xi +Reviewed-by: Luca Ceresoli +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250904034447.665427-1-xiqi2@huawei.com +Signed-off-by: Luca Ceresoli +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +index 9ba2a667a1f3a..b18bdb2daddf8 100644 +--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c ++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +@@ -2054,8 +2054,10 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge, + mhdp_state = to_cdns_mhdp_bridge_state(new_state); + + mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode); +- if (!mhdp_state->current_mode) +- return; ++ if (!mhdp_state->current_mode) { ++ ret = -EINVAL; ++ goto out; ++ } + + drm_mode_set_name(mhdp_state->current_mode); + +-- +2.51.0 + diff --git a/queue-6.12/drm-xe-fix-a-null-vs-is_err-in-xe_vm_add_compute_exe.patch b/queue-6.12/drm-xe-fix-a-null-vs-is_err-in-xe_vm_add_compute_exe.patch new file mode 100644 index 0000000000..bb930b2077 --- /dev/null +++ b/queue-6.12/drm-xe-fix-a-null-vs-is_err-in-xe_vm_add_compute_exe.patch @@ -0,0 +1,42 @@ +From f484c6af134a9fa31d655884ab4e4c6a3ea9d8b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:53:41 +0300 +Subject: drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() + +From: Dan Carpenter + +[ Upstream commit cbc7f3b4f6ca19320e2eacf8fc1403d6f331ce14 ] + +The xe_preempt_fence_create() function returns error pointers. It +never returns NULL. Update the error checking to match. + +Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") +Signed-off-by: Dan Carpenter +Reviewed-by: Matthew Brost +Link: https://lore.kernel.org/r/aJTMBdX97cof_009@stanley.mountain +Signed-off-by: Rodrigo Vivi +(cherry picked from commit 75cc23ffe5b422bc3cbd5cf0956b8b86e4b0e162) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_vm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c +index a4845d4213b00..fc5f0e1351932 100644 +--- a/drivers/gpu/drm/xe/xe_vm.c ++++ b/drivers/gpu/drm/xe/xe_vm.c +@@ -239,8 +239,8 @@ int xe_vm_add_compute_exec_queue(struct xe_vm *vm, struct xe_exec_queue *q) + + pfence = xe_preempt_fence_create(q, q->lr.context, + ++q->lr.seqno); +- if (!pfence) { +- err = -ENOMEM; ++ if (IS_ERR(pfence)) { ++ err = PTR_ERR(pfence); + goto out_fini; + } + +-- +2.51.0 + diff --git a/queue-6.12/drm-xe-tile-release-kobject-for-the-failure-path.patch b/queue-6.12/drm-xe-tile-release-kobject-for-the-failure-path.patch new file mode 100644 index 0000000000..5733dac2eb --- /dev/null +++ b/queue-6.12/drm-xe-tile-release-kobject-for-the-failure-path.patch @@ -0,0 +1,57 @@ +From d529324448b37499ada46abccf992e38b97a3d74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 15:39:51 +0000 +Subject: drm/xe/tile: Release kobject for the failure path + +From: Shuicheng Lin + +[ Upstream commit 013e484dbd687a9174acf8f4450217bdb86ad788 ] + +Call kobject_put() for the failure path to release the kobject + +v2: remove extra newline. (Matt) + +Fixes: e3d0839aa501 ("drm/xe/tile: Abort driver load for sysfs creation failure") +Cc: Himal Prasad Ghimiray +Reviewed-by: Matthew Brost +Signed-off-by: Shuicheng Lin +Link: https://lore.kernel.org/r/20250819153950.2973344-2-shuicheng.lin@intel.com +Signed-off-by: Lucas De Marchi +(cherry picked from commit b98775bca99511cc22ab459a2de646cd2fa7241f) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_tile_sysfs.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_tile_sysfs.c b/drivers/gpu/drm/xe/xe_tile_sysfs.c +index b804234a65516..9e1236a9ec673 100644 +--- a/drivers/gpu/drm/xe/xe_tile_sysfs.c ++++ b/drivers/gpu/drm/xe/xe_tile_sysfs.c +@@ -44,16 +44,18 @@ int xe_tile_sysfs_init(struct xe_tile *tile) + kt->tile = tile; + + err = kobject_add(&kt->base, &dev->kobj, "tile%d", tile->id); +- if (err) { +- kobject_put(&kt->base); +- return err; +- } ++ if (err) ++ goto err_object; + + tile->sysfs = &kt->base; + + err = xe_vram_freq_sysfs_init(tile); + if (err) +- return err; ++ goto err_object; + + return devm_add_action_or_reset(xe->drm.dev, tile_sysfs_fini, tile); ++ ++err_object: ++ kobject_put(&kt->base); ++ return err; + } +-- +2.51.0 + diff --git a/queue-6.12/io_uring-fix-incorrect-io_kiocb-reference-in-io_link.patch b/queue-6.12/io_uring-fix-incorrect-io_kiocb-reference-in-io_link.patch new file mode 100644 index 0000000000..8aad1b6673 --- /dev/null +++ b/queue-6.12/io_uring-fix-incorrect-io_kiocb-reference-in-io_link.patch @@ -0,0 +1,41 @@ +From c478eefb96499fbc42bcf99906247f5ee795d546 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 17:03:52 +0800 +Subject: io_uring: fix incorrect io_kiocb reference in io_link_skb + +From: Yang Xiuwei + +[ Upstream commit 2c139a47eff8de24e3350dadb4c9d5e3426db826 ] + +In io_link_skb function, there is a bug where prev_notif is incorrectly +assigned using 'nd' instead of 'prev_nd'. This causes the context +validation check to compare the current notification with itself instead +of comparing it with the previous notification. + +Fix by using the correct prev_nd parameter when obtaining prev_notif. + +Signed-off-by: Yang Xiuwei +Reviewed-by: Pavel Begunkov +Fixes: 6fe4220912d19 ("io_uring/notif: implement notification stacking") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/notif.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/io_uring/notif.c b/io_uring/notif.c +index 28859ae3ee6eb..d4cf5a1328e63 100644 +--- a/io_uring/notif.c ++++ b/io_uring/notif.c +@@ -85,7 +85,7 @@ static int io_link_skb(struct sk_buff *skb, struct ubuf_info *uarg) + return -EEXIST; + + prev_nd = container_of(prev_uarg, struct io_notif_data, uarg); +- prev_notif = cmd_to_io_kiocb(nd); ++ prev_notif = cmd_to_io_kiocb(prev_nd); + + /* make sure all noifications can be finished in the same task_work */ + if (unlikely(notif->ctx != prev_notif->ctx || +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series index 63e8dee7e7..5232633149 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -68,3 +68,17 @@ io_uring-backport-io_should_terminate_tw.patch io_uring-include-dying-ring-in-task_work-should-cancel-state.patch io_uring-msg_ring-kill-alloc_cache-for-io_kiocb-allocations.patch io_uring-kbuf-drop-warn_on_once-from-incremental-length-check.patch +asoc-wm8940-correct-pll-rate-rounding.patch +asoc-wm8940-correct-typo-in-control-name.patch +asoc-wm8974-correct-pll-rate-rounding.patch +asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch +asoc-intel-catpt-expose-correct-bit-depth-to-userspa.patch +drm-xe-tile-release-kobject-for-the-failure-path.patch +drm-bridge-anx7625-fix-null-pointer-dereference-with.patch +drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch +drm-xe-fix-a-null-vs-is_err-in-xe_vm_add_compute_exe.patch +smb-client-fix-filename-matching-of-deferred-files.patch +smb-client-let-smbd_destroy-call-disable_work_sync-i.patch +crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch +smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch +io_uring-fix-incorrect-io_kiocb-reference-in-io_link.patch diff --git a/queue-6.12/smb-client-fix-filename-matching-of-deferred-files.patch b/queue-6.12/smb-client-fix-filename-matching-of-deferred-files.patch new file mode 100644 index 0000000000..be0f6dd80f --- /dev/null +++ b/queue-6.12/smb-client-fix-filename-matching-of-deferred-files.patch @@ -0,0 +1,139 @@ +From 0a6704530fec4892f0dceed8c914147b32a67757 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 16:03:22 -0300 +Subject: smb: client: fix filename matching of deferred files + +From: Paulo Alcantara + +[ Upstream commit 93ed9a2951308db374cba4562533dde97bac70d3 ] + +Fix the following case where the client would end up closing both +deferred files (foo.tmp & foo) after unlink(foo) due to strstr() call +in cifs_close_deferred_file_under_dentry(): + + fd1 = openat(AT_FDCWD, "foo", O_WRONLY|O_CREAT|O_TRUNC, 0666); + fd2 = openat(AT_FDCWD, "foo.tmp", O_WRONLY|O_CREAT|O_TRUNC, 0666); + close(fd1); + close(fd2); + unlink("foo"); + +Fixes: e3fc065682eb ("cifs: Deferred close performance improvements") +Signed-off-by: Paulo Alcantara (Red Hat) +Reviewed-by: Enzo Matsumiya +Cc: Frank Sorenson +Cc: David Howells +Cc: linux-cifs@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsproto.h | 4 ++-- + fs/smb/client/inode.c | 6 +++--- + fs/smb/client/misc.c | 38 ++++++++++++++++---------------------- + 3 files changed, 21 insertions(+), 27 deletions(-) + +diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h +index fee7bc9848a36..b59647291363b 100644 +--- a/fs/smb/client/cifsproto.h ++++ b/fs/smb/client/cifsproto.h +@@ -298,8 +298,8 @@ extern void cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode); + + extern void cifs_close_all_deferred_files(struct cifs_tcon *cifs_tcon); + +-extern void cifs_close_deferred_file_under_dentry(struct cifs_tcon *cifs_tcon, +- const char *path); ++void cifs_close_deferred_file_under_dentry(struct cifs_tcon *cifs_tcon, ++ struct dentry *dentry); + + extern void cifs_mark_open_handles_for_deleted_file(struct inode *inode, + const char *path); +diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c +index c0df2c1841243..e06d02b68c538 100644 +--- a/fs/smb/client/inode.c ++++ b/fs/smb/client/inode.c +@@ -1958,7 +1958,7 @@ int cifs_unlink(struct inode *dir, struct dentry *dentry) + } + + netfs_wait_for_outstanding_io(inode); +- cifs_close_deferred_file_under_dentry(tcon, full_path); ++ cifs_close_deferred_file_under_dentry(tcon, dentry); + #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY + if (cap_unix(tcon->ses) && (CIFS_UNIX_POSIX_PATH_OPS_CAP & + le64_to_cpu(tcon->fsUnixInfo.Capability))) { +@@ -2489,10 +2489,10 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir, + goto cifs_rename_exit; + } + +- cifs_close_deferred_file_under_dentry(tcon, from_name); ++ cifs_close_deferred_file_under_dentry(tcon, source_dentry); + if (d_inode(target_dentry) != NULL) { + netfs_wait_for_outstanding_io(d_inode(target_dentry)); +- cifs_close_deferred_file_under_dentry(tcon, to_name); ++ cifs_close_deferred_file_under_dentry(tcon, target_dentry); + } + + rc = cifs_do_rename(xid, source_dentry, from_name, target_dentry, +diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c +index 57b6b191293ee..499f791df7799 100644 +--- a/fs/smb/client/misc.c ++++ b/fs/smb/client/misc.c +@@ -829,33 +829,28 @@ cifs_close_all_deferred_files(struct cifs_tcon *tcon) + kfree(tmp_list); + } + } +-void +-cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, const char *path) ++ ++void cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, ++ struct dentry *dentry) + { +- struct cifsFileInfo *cfile; + struct file_list *tmp_list, *tmp_next_list; +- void *page; +- const char *full_path; ++ struct cifsFileInfo *cfile; + LIST_HEAD(file_head); + +- page = alloc_dentry_path(); + spin_lock(&tcon->open_file_lock); + list_for_each_entry(cfile, &tcon->openFileList, tlist) { +- full_path = build_path_from_dentry(cfile->dentry, page); +- if (strstr(full_path, path)) { +- if (delayed_work_pending(&cfile->deferred)) { +- if (cancel_delayed_work(&cfile->deferred)) { +- spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); +- cifs_del_deferred_close(cfile); +- spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); +- +- tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC); +- if (tmp_list == NULL) +- break; +- tmp_list->cfile = cfile; +- list_add_tail(&tmp_list->list, &file_head); +- } +- } ++ if ((cfile->dentry == dentry) && ++ delayed_work_pending(&cfile->deferred) && ++ cancel_delayed_work(&cfile->deferred)) { ++ spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); ++ cifs_del_deferred_close(cfile); ++ spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); ++ ++ tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC); ++ if (tmp_list == NULL) ++ break; ++ tmp_list->cfile = cfile; ++ list_add_tail(&tmp_list->list, &file_head); + } + } + spin_unlock(&tcon->open_file_lock); +@@ -865,7 +860,6 @@ cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, const char *path) + list_del(&tmp_list->list); + kfree(tmp_list); + } +- free_dentry_path(page); + } + + /* +-- +2.51.0 + diff --git a/queue-6.12/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch b/queue-6.12/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch new file mode 100644 index 0000000000..10095648a1 --- /dev/null +++ b/queue-6.12/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch @@ -0,0 +1,46 @@ +From 8abbb54cd4d452a0e7516f1f190c5d3de95c5075 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 03:06:46 +0200 +Subject: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error + path + +From: Stefan Metzmacher + +[ Upstream commit daac51c7032036a0ca5f1aa419ad1b0471d1c6e0 ] + +During tests of another unrelated patch I was able to trigger this +error: Objects remaining on __kmem_cache_shutdown() + +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smbdirect.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c +index 6284252aa4882..b1548269c308a 100644 +--- a/fs/smb/client/smbdirect.c ++++ b/fs/smb/client/smbdirect.c +@@ -1075,8 +1075,10 @@ static int smbd_negotiate(struct smbd_connection *info) + log_rdma_event(INFO, "smbd_post_recv rc=%d iov.addr=0x%llx iov.length=%u iov.lkey=0x%x\n", + rc, response->sge.addr, + response->sge.length, response->sge.lkey); +- if (rc) ++ if (rc) { ++ put_receive_buffer(info, response); + return rc; ++ } + + init_completion(&info->negotiate_completion); + info->negotiate_done = false; +-- +2.51.0 + diff --git a/queue-6.12/smb-client-let-smbd_destroy-call-disable_work_sync-i.patch b/queue-6.12/smb-client-let-smbd_destroy-call-disable_work_sync-i.patch new file mode 100644 index 0000000000..d5f8315fad --- /dev/null +++ b/queue-6.12/smb-client-let-smbd_destroy-call-disable_work_sync-i.patch @@ -0,0 +1,75 @@ +From 889bd068afccf1c30bdf19447c832315000210c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 13:03:19 +0200 +Subject: smb: client: let smbd_destroy() call + disable_work_sync(&info->post_send_credits_work) + +From: Stefan Metzmacher + +[ Upstream commit d9dcbbcf9145b68aa85c40947311a6907277e097 ] + +In smbd_destroy() we may destroy the memory so we better +wait until post_send_credits_work is no longer pending +and will never be started again. + +I actually just hit the case using rxe: + +WARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe] +... +[ 5305.686979] [ T138] smbd_post_recv+0x445/0xc10 [cifs] +[ 5305.687135] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 5305.687149] [ T138] ? __kasan_check_write+0x14/0x30 +[ 5305.687185] [ T138] ? __pfx_smbd_post_recv+0x10/0x10 [cifs] +[ 5305.687329] [ T138] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 +[ 5305.687356] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 5305.687368] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 5305.687378] [ T138] ? _raw_spin_unlock_irqrestore+0x11/0x60 +[ 5305.687389] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 5305.687399] [ T138] ? get_receive_buffer+0x168/0x210 [cifs] +[ 5305.687555] [ T138] smbd_post_send_credits+0x382/0x4b0 [cifs] +[ 5305.687701] [ T138] ? __pfx_smbd_post_send_credits+0x10/0x10 [cifs] +[ 5305.687855] [ T138] ? __pfx___schedule+0x10/0x10 +[ 5305.687865] [ T138] ? __pfx__raw_spin_lock_irq+0x10/0x10 +[ 5305.687875] [ T138] ? queue_delayed_work_on+0x8e/0xa0 +[ 5305.687889] [ T138] process_one_work+0x629/0xf80 +[ 5305.687908] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 5305.687917] [ T138] ? __kasan_check_write+0x14/0x30 +[ 5305.687933] [ T138] worker_thread+0x87f/0x1570 +... + +It means rxe_post_recv was called after rdma_destroy_qp(). +This happened because put_receive_buffer() was triggered +by ib_drain_qp() and called: +queue_work(info->workqueue, &info->post_send_credits_work); + +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smbdirect.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c +index b9bb531717a65..6284252aa4882 100644 +--- a/fs/smb/client/smbdirect.c ++++ b/fs/smb/client/smbdirect.c +@@ -1308,6 +1308,9 @@ void smbd_destroy(struct TCP_Server_Info *server) + sc->status == SMBDIRECT_SOCKET_DISCONNECTED); + } + ++ log_rdma_event(INFO, "cancelling post_send_credits_work\n"); ++ disable_work_sync(&info->post_send_credits_work); ++ + log_rdma_event(INFO, "destroying qp\n"); + ib_drain_qp(sc->ib.qp); + rdma_destroy_qp(sc->rdma.cm_id); +-- +2.51.0 + diff --git a/queue-6.16/alsa-usb-qcom-fix-false-positive-address-space-check.patch b/queue-6.16/alsa-usb-qcom-fix-false-positive-address-space-check.patch new file mode 100644 index 0000000000..cc909277d1 --- /dev/null +++ b/queue-6.16/alsa-usb-qcom-fix-false-positive-address-space-check.patch @@ -0,0 +1,207 @@ +From ac0058399f069b64c0e48b3b2d149cd1fd0ba0bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 15:09:01 +0200 +Subject: ALSA: usb: qcom: Fix false-positive address space check + +From: Takashi Iwai + +[ Upstream commit 44499ecb4f2817743c37d861bdb3e95f37d3d9cd ] + +The sanity check previously added to uaudio_transfer_buffer_setup() +assumed the allocated buffer being linear-mapped. But the buffer +allocated via usb_alloc_coherent() isn't always so, rather to be used +with (SG-)DMA API. This leaded to a false-positive warning and the +driver failed to work. + +Actually uaudio_transfer_buffer_setup() deals only with the DMA-API +addresses for MEM_XFER_BUF type, while other callers of +uaudio_iommu_map() are with pages with physical addresses for +MEM_EVENT_RING and MEM_XFER_RING types. So this patch splits the +mapping helper function to two different ones, uaudio_iommu_map() for +the DMA pages and uaudio_iommu_map_pa() for the latter, in order to +handle mapping differently for each type. Along with it, the +unnecessary address check that caused probe error is dropped, too. + +Fixes: 3335a1bbd624 ("ALSA: qc_audio_offload: try to reduce address space confusion") +Suggested-by: Arnd Bergmann +Acked-by: Arnd Bergmann +Reported-and-tested-by: Luca Weiss +Closes: https://lore.kernel.org/DBR2363A95M1.L9XBNC003490@fairphone.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/qcom/qc_audio_offload.c | 92 ++++++++++++++++--------------- + 1 file changed, 48 insertions(+), 44 deletions(-) + +diff --git a/sound/usb/qcom/qc_audio_offload.c b/sound/usb/qcom/qc_audio_offload.c +index a25c5a5316901..9ad76fff741b8 100644 +--- a/sound/usb/qcom/qc_audio_offload.c ++++ b/sound/usb/qcom/qc_audio_offload.c +@@ -538,38 +538,33 @@ static void uaudio_iommu_unmap(enum mem_type mtype, unsigned long iova, + umap_size, iova, mapped_iova_size); + } + ++static int uaudio_iommu_map_prot(bool dma_coherent) ++{ ++ int prot = IOMMU_READ | IOMMU_WRITE; ++ ++ if (dma_coherent) ++ prot |= IOMMU_CACHE; ++ return prot; ++} ++ + /** +- * uaudio_iommu_map() - maps iommu memory for adsp ++ * uaudio_iommu_map_pa() - maps iommu memory for adsp + * @mtype: ring type + * @dma_coherent: dma coherent + * @pa: physical address for ring/buffer + * @size: size of memory region +- * @sgt: sg table for memory region + * + * Maps the XHCI related resources to a memory region that is assigned to be + * used by the adsp. This will be mapped to the domain, which is created by + * the ASoC USB backend driver. + * + */ +-static unsigned long uaudio_iommu_map(enum mem_type mtype, bool dma_coherent, +- phys_addr_t pa, size_t size, +- struct sg_table *sgt) ++static unsigned long uaudio_iommu_map_pa(enum mem_type mtype, bool dma_coherent, ++ phys_addr_t pa, size_t size) + { +- struct scatterlist *sg; + unsigned long iova = 0; +- size_t total_len = 0; +- unsigned long iova_sg; +- phys_addr_t pa_sg; + bool map = true; +- size_t sg_len; +- int prot; +- int ret; +- int i; +- +- prot = IOMMU_READ | IOMMU_WRITE; +- +- if (dma_coherent) +- prot |= IOMMU_CACHE; ++ int prot = uaudio_iommu_map_prot(dma_coherent); + + switch (mtype) { + case MEM_EVENT_RING: +@@ -583,20 +578,41 @@ static unsigned long uaudio_iommu_map(enum mem_type mtype, bool dma_coherent, + &uaudio_qdev->xfer_ring_iova_size, + &uaudio_qdev->xfer_ring_list, size); + break; +- case MEM_XFER_BUF: +- iova = uaudio_get_iova(&uaudio_qdev->curr_xfer_buf_iova, +- &uaudio_qdev->xfer_buf_iova_size, +- &uaudio_qdev->xfer_buf_list, size); +- break; + default: + dev_err(uaudio_qdev->data->dev, "unknown mem type %d\n", mtype); + } + + if (!iova || !map) +- goto done; ++ return 0; ++ ++ iommu_map(uaudio_qdev->data->domain, iova, pa, size, prot, GFP_KERNEL); + +- if (!sgt) +- goto skip_sgt_map; ++ return iova; ++} ++ ++static unsigned long uaudio_iommu_map_xfer_buf(bool dma_coherent, size_t size, ++ struct sg_table *sgt) ++{ ++ struct scatterlist *sg; ++ unsigned long iova = 0; ++ size_t total_len = 0; ++ unsigned long iova_sg; ++ phys_addr_t pa_sg; ++ size_t sg_len; ++ int prot = uaudio_iommu_map_prot(dma_coherent); ++ int ret; ++ int i; ++ ++ prot = IOMMU_READ | IOMMU_WRITE; ++ ++ if (dma_coherent) ++ prot |= IOMMU_CACHE; ++ ++ iova = uaudio_get_iova(&uaudio_qdev->curr_xfer_buf_iova, ++ &uaudio_qdev->xfer_buf_iova_size, ++ &uaudio_qdev->xfer_buf_list, size); ++ if (!iova) ++ goto done; + + iova_sg = iova; + for_each_sg(sgt->sgl, sg, sgt->nents, i) { +@@ -618,11 +634,6 @@ static unsigned long uaudio_iommu_map(enum mem_type mtype, bool dma_coherent, + uaudio_iommu_unmap(MEM_XFER_BUF, iova, size, total_len); + iova = 0; + } +- return iova; +- +-skip_sgt_map: +- iommu_map(uaudio_qdev->data->domain, iova, pa, size, prot, GFP_KERNEL); +- + done: + return iova; + } +@@ -1020,7 +1031,6 @@ static int uaudio_transfer_buffer_setup(struct snd_usb_substream *subs, + struct sg_table xfer_buf_sgt; + dma_addr_t xfer_buf_dma; + void *xfer_buf; +- phys_addr_t xfer_buf_pa; + u32 len = xfer_buf_len; + bool dma_coherent; + dma_addr_t xfer_buf_dma_sysdev; +@@ -1051,18 +1061,12 @@ static int uaudio_transfer_buffer_setup(struct snd_usb_substream *subs, + if (!xfer_buf) + return -ENOMEM; + +- /* Remapping is not possible if xfer_buf is outside of linear map */ +- xfer_buf_pa = virt_to_phys(xfer_buf); +- if (WARN_ON(!page_is_ram(PFN_DOWN(xfer_buf_pa)))) { +- ret = -ENXIO; +- goto unmap_sync; +- } + dma_get_sgtable(subs->dev->bus->sysdev, &xfer_buf_sgt, xfer_buf, + xfer_buf_dma, len); + + /* map the physical buffer into sysdev as well */ +- xfer_buf_dma_sysdev = uaudio_iommu_map(MEM_XFER_BUF, dma_coherent, +- xfer_buf_pa, len, &xfer_buf_sgt); ++ xfer_buf_dma_sysdev = uaudio_iommu_map_xfer_buf(dma_coherent, ++ len, &xfer_buf_sgt); + if (!xfer_buf_dma_sysdev) { + ret = -ENOMEM; + goto unmap_sync; +@@ -1143,8 +1147,8 @@ uaudio_endpoint_setup(struct snd_usb_substream *subs, + sg_free_table(sgt); + + /* data transfer ring */ +- iova = uaudio_iommu_map(MEM_XFER_RING, dma_coherent, tr_pa, +- PAGE_SIZE, NULL); ++ iova = uaudio_iommu_map_pa(MEM_XFER_RING, dma_coherent, tr_pa, ++ PAGE_SIZE); + if (!iova) { + ret = -ENOMEM; + goto clear_pa; +@@ -1207,8 +1211,8 @@ static int uaudio_event_ring_setup(struct snd_usb_substream *subs, + mem_info->dma = sg_dma_address(sgt->sgl); + sg_free_table(sgt); + +- iova = uaudio_iommu_map(MEM_EVENT_RING, dma_coherent, er_pa, +- PAGE_SIZE, NULL); ++ iova = uaudio_iommu_map_pa(MEM_EVENT_RING, dma_coherent, er_pa, ++ PAGE_SIZE); + if (!iova) { + ret = -ENOMEM; + goto clear_pa; +-- +2.51.0 + diff --git a/queue-6.16/asoc-amd-acp-fix-incorrect-retrival-of-acp_chip_info.patch b/queue-6.16/asoc-amd-acp-fix-incorrect-retrival-of-acp_chip_info.patch new file mode 100644 index 0000000000..f0b3e0f91b --- /dev/null +++ b/queue-6.16/asoc-amd-acp-fix-incorrect-retrival-of-acp_chip_info.patch @@ -0,0 +1,91 @@ +From 2e85a5f3b533f04660553252aaf4cfa18ddbea9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 22:43:59 +0530 +Subject: ASoC: amd: acp: Fix incorrect retrival of acp_chip_info + +From: Venkata Prasad Potturu + +[ Upstream commit d7871f400cad1da376f1d7724209a1c49226c456 ] + +Use dev_get_drvdata(dev->parent) instead of dev_get_platdata(dev) +to correctly obtain acp_chip_info members in the acp I2S driver. +Previously, some members were not updated properly due to incorrect +data access, which could potentially lead to null pointer +dereferences. + +This issue was missed in the earlier commit +("ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot"), +which only addressed set_tdm_slot(). This change ensures that all +relevant functions correctly retrieve acp_chip_info, preventing +further null pointer dereference issues. + +Fixes: e3933683b25e ("ASoC: amd: acp: Remove redundant acp_dev_data structure") + +Signed-off-by: Venkata Prasad Potturu +Reviewed-by: Cezary Rojewski +Link: https://patch.msgid.link/20250910171419.3682468-1-venkataprasad.potturu@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp/acp-i2s.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/amd/acp/acp-i2s.c b/sound/soc/amd/acp/acp-i2s.c +index 70fa54d568ef6..4d9589b67099e 100644 +--- a/sound/soc/amd/acp/acp-i2s.c ++++ b/sound/soc/amd/acp/acp-i2s.c +@@ -72,7 +72,7 @@ static int acp_i2s_set_fmt(struct snd_soc_dai *cpu_dai, + unsigned int fmt) + { + struct device *dev = cpu_dai->component->dev; +- struct acp_chip_info *chip = dev_get_platdata(dev); ++ struct acp_chip_info *chip = dev_get_drvdata(dev->parent); + int mode; + + mode = fmt & SND_SOC_DAIFMT_FORMAT_MASK; +@@ -196,7 +196,7 @@ static int acp_i2s_hwparams(struct snd_pcm_substream *substream, struct snd_pcm_ + u32 reg_val, fmt_reg, tdm_fmt; + u32 lrclk_div_val, bclk_div_val; + +- chip = dev_get_platdata(dev); ++ chip = dev_get_drvdata(dev->parent); + rsrc = chip->rsrc; + + /* These values are as per Hardware Spec */ +@@ -383,7 +383,7 @@ static int acp_i2s_trigger(struct snd_pcm_substream *substream, int cmd, struct + { + struct acp_stream *stream = substream->runtime->private_data; + struct device *dev = dai->component->dev; +- struct acp_chip_info *chip = dev_get_platdata(dev); ++ struct acp_chip_info *chip = dev_get_drvdata(dev->parent); + struct acp_resource *rsrc = chip->rsrc; + u32 val, period_bytes, reg_val, ier_val, water_val, buf_size, buf_reg; + +@@ -513,14 +513,13 @@ static int acp_i2s_trigger(struct snd_pcm_substream *substream, int cmd, struct + static int acp_i2s_prepare(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) + { + struct device *dev = dai->component->dev; +- struct acp_chip_info *chip = dev_get_platdata(dev); ++ struct acp_chip_info *chip = dev_get_drvdata(dev->parent); + struct acp_resource *rsrc = chip->rsrc; + struct acp_stream *stream = substream->runtime->private_data; + u32 reg_dma_size = 0, reg_fifo_size = 0, reg_fifo_addr = 0; + u32 phy_addr = 0, acp_fifo_addr = 0, ext_int_ctrl; + unsigned int dir = substream->stream; + +- chip = dev_get_platdata(dev); + switch (dai->driver->id) { + case I2S_SP_INSTANCE: + if (dir == SNDRV_PCM_STREAM_PLAYBACK) { +@@ -629,7 +628,7 @@ static int acp_i2s_startup(struct snd_pcm_substream *substream, struct snd_soc_d + { + struct acp_stream *stream = substream->runtime->private_data; + struct device *dev = dai->component->dev; +- struct acp_chip_info *chip = dev_get_platdata(dev); ++ struct acp_chip_info *chip = dev_get_drvdata(dev->parent); + struct acp_resource *rsrc = chip->rsrc; + unsigned int dir = substream->stream; + unsigned int irq_bit = 0; +-- +2.51.0 + diff --git a/queue-6.16/asoc-codec-sma1307-fix-memory-corruption-in-sma1307_.patch b/queue-6.16/asoc-codec-sma1307-fix-memory-corruption-in-sma1307_.patch new file mode 100644 index 0000000000..e449fd5dca --- /dev/null +++ b/queue-6.16/asoc-codec-sma1307-fix-memory-corruption-in-sma1307_.patch @@ -0,0 +1,52 @@ +From 8faf0e9aa12a52f235114d529b1aeb1d2a3f237b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Aug 2025 15:57:34 +0300 +Subject: ASoC: codec: sma1307: Fix memory corruption in + sma1307_setting_loaded() + +From: Dan Carpenter + +[ Upstream commit 78338108b5a856dc98223a335f147846a8a18c51 ] + +The sma1307->set.header_size is how many integers are in the header +(there are 8 of them) but instead of allocating space of 8 integers +we allocate 8 bytes. This leads to memory corruption when we copy data +it on the next line: + + memcpy(sma1307->set.header, data, + sma1307->set.header_size * sizeof(int)); + +Also since we're immediately copying over the memory in ->set.header, +there is no need to zero it in the allocator. Use devm_kmalloc_array() +to allocate the memory instead. + +Fixes: 576c57e6b4c1 ("ASoC: sma1307: Add driver for Iron Device SMA1307") +Signed-off-by: Dan Carpenter +Link: https://patch.msgid.link/aLGjvjpueVstekXP@stanley.mountain +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/sma1307.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/sma1307.c b/sound/soc/codecs/sma1307.c +index b3d401ada1760..2d993428f87e3 100644 +--- a/sound/soc/codecs/sma1307.c ++++ b/sound/soc/codecs/sma1307.c +@@ -1737,9 +1737,10 @@ static void sma1307_setting_loaded(struct sma1307_priv *sma1307, const char *fil + sma1307->set.checksum = data[sma1307->set.header_size - 2]; + sma1307->set.num_mode = data[sma1307->set.header_size - 1]; + num_mode = sma1307->set.num_mode; +- sma1307->set.header = devm_kzalloc(sma1307->dev, +- sma1307->set.header_size, +- GFP_KERNEL); ++ sma1307->set.header = devm_kmalloc_array(sma1307->dev, ++ sma1307->set.header_size, ++ sizeof(int), ++ GFP_KERNEL); + if (!sma1307->set.header) { + sma1307->set.status = false; + return; +-- +2.51.0 + diff --git a/queue-6.16/asoc-intel-catpt-expose-correct-bit-depth-to-userspa.patch b/queue-6.16/asoc-intel-catpt-expose-correct-bit-depth-to-userspa.patch new file mode 100644 index 0000000000..cba18d1cae --- /dev/null +++ b/queue-6.16/asoc-intel-catpt-expose-correct-bit-depth-to-userspa.patch @@ -0,0 +1,99 @@ +From 15180b3103f848537d3538411750f2bcb34de873 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 11:28:29 +0200 +Subject: ASoC: Intel: catpt: Expose correct bit depth to userspace +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit 690aa09b1845c0d5c3c29dabd50a9d0488c97c48 ] + +Currently wrong bit depth is exposed in hw params, causing clipped +volume during playback. Expose correct parameters. + +Fixes: a126750fc865 ("ASoC: Intel: catpt: PCM operations") +Reported-by: Andy Shevchenko +Tested-by: Andy Shevchenko +Reviewed-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Message-ID: <20250909092829.375953-1-amadeuszx.slawinski@linux.intel.com> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/catpt/pcm.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/intel/catpt/pcm.c b/sound/soc/intel/catpt/pcm.c +index 81a2f0339e055..ff1fa01acb85b 100644 +--- a/sound/soc/intel/catpt/pcm.c ++++ b/sound/soc/intel/catpt/pcm.c +@@ -568,8 +568,9 @@ static const struct snd_pcm_hardware catpt_pcm_hardware = { + SNDRV_PCM_INFO_RESUME | + SNDRV_PCM_INFO_NO_PERIOD_WAKEUP, + .formats = SNDRV_PCM_FMTBIT_S16_LE | +- SNDRV_PCM_FMTBIT_S24_LE | + SNDRV_PCM_FMTBIT_S32_LE, ++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 | ++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX, + .period_bytes_min = PAGE_SIZE, + .period_bytes_max = CATPT_BUFFER_MAX_SIZE / CATPT_PCM_PERIODS_MIN, + .periods_min = CATPT_PCM_PERIODS_MIN, +@@ -699,14 +700,18 @@ static struct snd_soc_dai_driver dai_drivers[] = { + .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_48000, +- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE, ++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE, ++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 | ++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX, + }, + .capture = { + .stream_name = "Analog Capture", + .channels_min = 2, + .channels_max = 4, + .rates = SNDRV_PCM_RATE_48000, +- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE, ++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE, ++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 | ++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX, + }, + }, + { +@@ -718,7 +723,9 @@ static struct snd_soc_dai_driver dai_drivers[] = { + .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_8000_192000, +- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE, ++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE, ++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 | ++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX, + }, + }, + { +@@ -730,7 +737,9 @@ static struct snd_soc_dai_driver dai_drivers[] = { + .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_8000_192000, +- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE, ++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE, ++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 | ++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX, + }, + }, + { +@@ -742,7 +751,9 @@ static struct snd_soc_dai_driver dai_drivers[] = { + .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_48000, +- .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE, ++ .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE, ++ .subformats = SNDRV_PCM_SUBFMTBIT_MSBITS_24 | ++ SNDRV_PCM_SUBFMTBIT_MSBITS_MAX, + }, + }, + { +-- +2.51.0 + diff --git a/queue-6.16/asoc-sdca-fix-return-value-in-sdca_regmap_mbq_size.patch b/queue-6.16/asoc-sdca-fix-return-value-in-sdca_regmap_mbq_size.patch new file mode 100644 index 0000000000..12ec141dca --- /dev/null +++ b/queue-6.16/asoc-sdca-fix-return-value-in-sdca_regmap_mbq_size.patch @@ -0,0 +1,38 @@ +From 1b99db24ce5e12e5d8fcdeb1a6d4cc35934fb4b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Aug 2025 17:37:15 +0100 +Subject: ASoC: SDCA: Fix return value in sdca_regmap_mbq_size() + +From: Charles Keepax + +[ Upstream commit f81e63047600d023cbfda372b6de8f2821ff6839 ] + +The MBQ size function returns an integer representing the size of a +Control. Currently if the Control is not found the function will return +false which makes little sense. Correct this typo to return -EINVAL. + +Fixes: e3f7caf74b79 ("ASoC: SDCA: Add generic regmap SDCA helpers") +Signed-off-by: Charles Keepax +Message-ID: <20250820163717.1095846-2-ckeepax@opensource.cirrus.com> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sdca/sdca_regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sdca/sdca_regmap.c b/sound/soc/sdca/sdca_regmap.c +index c41c67c2204a4..ff1f8fe2a39bb 100644 +--- a/sound/soc/sdca/sdca_regmap.c ++++ b/sound/soc/sdca/sdca_regmap.c +@@ -196,7 +196,7 @@ int sdca_regmap_mbq_size(struct sdca_function_data *function, unsigned int reg) + + control = function_find_control(function, reg); + if (!control) +- return false; ++ return -EINVAL; + + return clamp_val(control->nbits / BITS_PER_BYTE, sizeof(u8), sizeof(u32)); + } +-- +2.51.0 + diff --git a/queue-6.16/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch b/queue-6.16/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch new file mode 100644 index 0000000000..f75759fb94 --- /dev/null +++ b/queue-6.16/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch @@ -0,0 +1,40 @@ +From b94bd69cfa18551c1b4bb5474a9d84078d0c44d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 13:06:39 +0100 +Subject: ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error + message + +From: Colin Ian King + +[ Upstream commit 35fc531a59694f24a2456569cf7d1a9c6436841c ] + +The dev_err message is reporting an error about capture streams however +it is using the incorrect variable num_playback instead of num_capture. +Fix this by using the correct variable num_capture. + +Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations") +Signed-off-by: Colin Ian King +Acked-by: Peter Ujfalusi +Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-stream.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c +index aa6b0247d5c99..a34f472ef1751 100644 +--- a/sound/soc/sof/intel/hda-stream.c ++++ b/sound/soc/sof/intel/hda-stream.c +@@ -890,7 +890,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev) + + if (num_capture >= SOF_HDA_CAPTURE_STREAMS) { + dev_err(sdev->dev, "error: too many capture streams %d\n", +- num_playback); ++ num_capture); + return -EINVAL; + } + +-- +2.51.0 + diff --git a/queue-6.16/asoc-wm8940-correct-pll-rate-rounding.patch b/queue-6.16/asoc-wm8940-correct-pll-rate-rounding.patch new file mode 100644 index 0000000000..4a290c0c1d --- /dev/null +++ b/queue-6.16/asoc-wm8940-correct-pll-rate-rounding.patch @@ -0,0 +1,45 @@ +From 23ca46d115ed9da5258d26467bc0340cfc620cf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:37 +0100 +Subject: ASoC: wm8940: Correct PLL rate rounding + +From: Charles Keepax + +[ Upstream commit d05afb53c683ef7ed1228b593c3360f4d3126c58 ] + +Using a single value of 22500000 for both 48000Hz and 44100Hz audio +will sometimes result in returning wrong dividers due to rounding. +Update the code to use the actual value for both. + +Fixes: 294833fc9eb4 ("ASoC: wm8940: Rewrite code to set proper clocks") +Reported-by: Ankur Tyagi +Signed-off-by: Charles Keepax +Tested-by: Ankur Tyagi +Link: https://patch.msgid.link/20250821082639.1301453-2-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8940.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c +index 401ee20897b1b..46c16c9bc17a8 100644 +--- a/sound/soc/codecs/wm8940.c ++++ b/sound/soc/codecs/wm8940.c +@@ -693,7 +693,12 @@ static int wm8940_update_clocks(struct snd_soc_dai *dai) + f = wm8940_get_mclkdiv(priv->mclk, fs256, &mclkdiv); + if (f != priv->mclk) { + /* The PLL performs best around 90MHz */ +- fpll = wm8940_get_mclkdiv(22500000, fs256, &mclkdiv); ++ if (fs256 % 8000) ++ f = 22579200; ++ else ++ f = 24576000; ++ ++ fpll = wm8940_get_mclkdiv(f, fs256, &mclkdiv); + } + + wm8940_set_dai_pll(dai, 0, 0, priv->mclk, fpll); +-- +2.51.0 + diff --git a/queue-6.16/asoc-wm8940-correct-typo-in-control-name.patch b/queue-6.16/asoc-wm8940-correct-typo-in-control-name.patch new file mode 100644 index 0000000000..e37cfa1000 --- /dev/null +++ b/queue-6.16/asoc-wm8940-correct-typo-in-control-name.patch @@ -0,0 +1,36 @@ +From 66df33a01eaf39ffcd06f52bde50c5f5054036d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:38 +0100 +Subject: ASoC: wm8940: Correct typo in control name + +From: Charles Keepax + +[ Upstream commit b4799520dcd6fe1e14495cecbbe9975d847cd482 ] + +Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver") +Reported-by: Ankur Tyagi +Signed-off-by: Charles Keepax +Tested-by: Ankur Tyagi +Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8940.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c +index 46c16c9bc17a8..94873ea630146 100644 +--- a/sound/soc/codecs/wm8940.c ++++ b/sound/soc/codecs/wm8940.c +@@ -220,7 +220,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = { + SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL, + 0, 255, 0, wm8940_adc_tlv), + SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum), +- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST, ++ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST, + 8, 1, 0, wm8940_capture_boost_vol_tlv), + SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL, + 0, 63, 0, wm8940_spk_vol_tlv), +-- +2.51.0 + diff --git a/queue-6.16/asoc-wm8974-correct-pll-rate-rounding.patch b/queue-6.16/asoc-wm8974-correct-pll-rate-rounding.patch new file mode 100644 index 0000000000..eceb425ce1 --- /dev/null +++ b/queue-6.16/asoc-wm8974-correct-pll-rate-rounding.patch @@ -0,0 +1,46 @@ +From bd4dc5ea38419dba30a25cf141ec4beed418e768 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:39 +0100 +Subject: ASoC: wm8974: Correct PLL rate rounding + +From: Charles Keepax + +[ Upstream commit 9b17d3724df55ecc2bc67978822585f2b023be48 ] + +Using a single value of 22500000 for both 48000Hz and 44100Hz audio +will sometimes result in returning wrong dividers due to rounding. +Update the code to use the actual value for both. + +Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically") +Signed-off-by: Charles Keepax +Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8974.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c +index bdf437a5403fe..db16d893a2351 100644 +--- a/sound/soc/codecs/wm8974.c ++++ b/sound/soc/codecs/wm8974.c +@@ -419,10 +419,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai) + fs256 = 256 * priv->fs; + + f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv); +- + if (f != priv->mclk) { + /* The PLL performs best around 90MHz */ +- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv); ++ if (fs256 % 8000) ++ f = 22579200; ++ else ++ f = 24576000; ++ ++ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv); + } + + wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll); +-- +2.51.0 + diff --git a/queue-6.16/crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch b/queue-6.16/crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch new file mode 100644 index 0000000000..cd497ed563 --- /dev/null +++ b/queue-6.16/crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch @@ -0,0 +1,49 @@ +From 442fc9e8f9001a0afe19b5a942212e273b350338 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 15:42:41 +0800 +Subject: crypto: af_alg - Set merge to zero early in af_alg_sendmsg + +From: Herbert Xu + +[ Upstream commit 9574b2330dbd2b5459b74d3b5e9619d39299fc6f ] + +If an error causes af_alg_sendmsg to abort, ctx->merge may contain +a garbage value from the previous loop. This may then trigger a +crash on the next entry into af_alg_sendmsg when it attempts to do +a merge that can't be done. + +Fix this by setting ctx->merge to zero near the start of the loop. + +Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations") +Reported-by: Muhammad Alifa Ramdhan +Reported-by: Bing-Jhong Billy Jheng +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/af_alg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index f02c5586a8ab3..ca6fdcc6c54ac 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -1025,6 +1025,8 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + continue; + } + ++ ctx->merge = 0; ++ + if (!af_alg_writable(sk)) { + err = af_alg_wait_for_wmem(sk, msg->msg_flags); + if (err) +@@ -1064,7 +1066,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + ctx->used += plen; + copied += plen; + size -= plen; +- ctx->merge = 0; + } else { + do { + struct page *pg; +-- +2.51.0 + diff --git a/queue-6.16/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch b/queue-6.16/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch new file mode 100644 index 0000000000..e1fe68d860 --- /dev/null +++ b/queue-6.16/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch @@ -0,0 +1,51 @@ +From e3d3409823377d15c5da48ee1ff43775345a4922 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 10:54:38 +0200 +Subject: drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ + +From: Loic Poulain + +[ Upstream commit a10f910c77f280327b481e77eab909934ec508f0 ] + +If the interrupt occurs before resource initialization is complete, the +interrupt handler/worker may access uninitialized data such as the I2C +tcpc_client device, potentially leading to NULL pointer dereference. + +Signed-off-by: Loic Poulain +Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP") +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250709085438.56188-1-loic.poulain@oss.qualcomm.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index 8a9079c2ed5c2..8257132a8ee9d 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -2678,7 +2678,7 @@ static int anx7625_i2c_probe(struct i2c_client *client) + ret = devm_request_threaded_irq(dev, platform->pdata.intp_irq, + NULL, anx7625_intr_hpd_isr, + IRQF_TRIGGER_FALLING | +- IRQF_ONESHOT, ++ IRQF_ONESHOT | IRQF_NO_AUTOEN, + "anx7625-intp", platform); + if (ret) { + DRM_DEV_ERROR(dev, "fail to request irq\n"); +@@ -2747,8 +2747,10 @@ static int anx7625_i2c_probe(struct i2c_client *client) + } + + /* Add work function */ +- if (platform->pdata.intp_irq) ++ if (platform->pdata.intp_irq) { ++ enable_irq(platform->pdata.intp_irq); + queue_work(platform->workqueue, &platform->work); ++ } + + if (platform->pdata.audio_en) + anx7625_register_audio(dev, platform); +-- +2.51.0 + diff --git a/queue-6.16/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch b/queue-6.16/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch new file mode 100644 index 0000000000..382a3b7977 --- /dev/null +++ b/queue-6.16/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch @@ -0,0 +1,44 @@ +From 0ebeac4dfce976051ae85ab9bc7c0b635bebb247 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 11:44:47 +0800 +Subject: drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path + +From: Qi Xi + +[ Upstream commit 288dac9fb6084330d968459c750c838fd06e10e6 ] + +Add missing mutex unlock before returning from the error path in +cdns_mhdp_atomic_enable(). + +Fixes: 935a92a1c400 ("drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference") +Reported-by: Hulk Robot +Signed-off-by: Qi Xi +Reviewed-by: Luca Ceresoli +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250904034447.665427-1-xiqi2@huawei.com +Signed-off-by: Luca Ceresoli +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +index b431e7efd1f0d..dbef0ca1a22a3 100644 +--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c ++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +@@ -1984,8 +1984,10 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge, + mhdp_state = to_cdns_mhdp_bridge_state(new_state); + + mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode); +- if (!mhdp_state->current_mode) +- return; ++ if (!mhdp_state->current_mode) { ++ ret = -EINVAL; ++ goto out; ++ } + + drm_mode_set_name(mhdp_state->current_mode); + +-- +2.51.0 + diff --git a/queue-6.16/drm-xe-fix-a-null-vs-is_err-in-xe_vm_add_compute_exe.patch b/queue-6.16/drm-xe-fix-a-null-vs-is_err-in-xe_vm_add_compute_exe.patch new file mode 100644 index 0000000000..f3bbc7afa1 --- /dev/null +++ b/queue-6.16/drm-xe-fix-a-null-vs-is_err-in-xe_vm_add_compute_exe.patch @@ -0,0 +1,42 @@ +From a416340cd8dba6079da1f0f032b08edc4c4dab17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Aug 2025 18:53:41 +0300 +Subject: drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() + +From: Dan Carpenter + +[ Upstream commit cbc7f3b4f6ca19320e2eacf8fc1403d6f331ce14 ] + +The xe_preempt_fence_create() function returns error pointers. It +never returns NULL. Update the error checking to match. + +Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") +Signed-off-by: Dan Carpenter +Reviewed-by: Matthew Brost +Link: https://lore.kernel.org/r/aJTMBdX97cof_009@stanley.mountain +Signed-off-by: Rodrigo Vivi +(cherry picked from commit 75cc23ffe5b422bc3cbd5cf0956b8b86e4b0e162) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_vm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c +index 84052b98002d1..92ce7374a79ce 100644 +--- a/drivers/gpu/drm/xe/xe_vm.c ++++ b/drivers/gpu/drm/xe/xe_vm.c +@@ -240,8 +240,8 @@ int xe_vm_add_compute_exec_queue(struct xe_vm *vm, struct xe_exec_queue *q) + + pfence = xe_preempt_fence_create(q, q->lr.context, + ++q->lr.seqno); +- if (!pfence) { +- err = -ENOMEM; ++ if (IS_ERR(pfence)) { ++ err = PTR_ERR(pfence); + goto out_fini; + } + +-- +2.51.0 + diff --git a/queue-6.16/drm-xe-fix-error-handling-if-pxp-fails-to-start.patch b/queue-6.16/drm-xe-fix-error-handling-if-pxp-fails-to-start.patch new file mode 100644 index 0000000000..f21ca777bb --- /dev/null +++ b/queue-6.16/drm-xe-fix-error-handling-if-pxp-fails-to-start.patch @@ -0,0 +1,351 @@ +From b0139b76266d0450b66ba5aafba99e2daccd917c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Sep 2025 15:12:40 -0700 +Subject: drm/xe: Fix error handling if PXP fails to start + +From: Daniele Ceraolo Spurio + +[ Upstream commit ae5fbbda341f92e605a9508a0fb18456155517f0 ] + +Since the PXP start comes after __xe_exec_queue_init() has completed, +we need to cleanup what was done in that function in case of a PXP +start error. +__xe_exec_queue_init calls the submission backend init() function, +so we need to introduce an opposite for that. Unfortunately, while +we already have a fini() function pointer, it performs other +operations in addition to cleaning up what was done by the init(). +Therefore, for clarity, the existing fini() has been renamed to +destroy(), while a new fini() has been added to only clean up what was +done by the init(), with the latter being called by the former (via +xe_exec_queue_fini). + +Fixes: 72d479601d67 ("drm/xe/pxp/uapi: Add userspace and LRC support for PXP-using queues") +Signed-off-by: Daniele Ceraolo Spurio +Cc: John Harrison +Cc: Matthew Brost +Reviewed-by: John Harrison +Signed-off-by: John Harrison +Link: https://lore.kernel.org/r/20250909221240.3711023-3-daniele.ceraolospurio@intel.com +(cherry picked from commit 626667321deb4c7a294725406faa3dd71c3d445d) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_exec_queue.c | 22 ++++++--- + drivers/gpu/drm/xe/xe_exec_queue_types.h | 8 ++- + drivers/gpu/drm/xe/xe_execlist.c | 25 ++++++---- + drivers/gpu/drm/xe/xe_execlist_types.h | 2 +- + drivers/gpu/drm/xe/xe_guc_exec_queue_types.h | 4 +- + drivers/gpu/drm/xe/xe_guc_submit.c | 52 ++++++++++++-------- + 6 files changed, 72 insertions(+), 41 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c +index fee22358cc09b..e511697596146 100644 +--- a/drivers/gpu/drm/xe/xe_exec_queue.c ++++ b/drivers/gpu/drm/xe/xe_exec_queue.c +@@ -151,6 +151,16 @@ static int __xe_exec_queue_init(struct xe_exec_queue *q) + return err; + } + ++static void __xe_exec_queue_fini(struct xe_exec_queue *q) ++{ ++ int i; ++ ++ q->ops->fini(q); ++ ++ for (i = 0; i < q->width; ++i) ++ xe_lrc_put(q->lrc[i]); ++} ++ + struct xe_exec_queue *xe_exec_queue_create(struct xe_device *xe, struct xe_vm *vm, + u32 logical_mask, u16 width, + struct xe_hw_engine *hwe, u32 flags, +@@ -181,11 +191,13 @@ struct xe_exec_queue *xe_exec_queue_create(struct xe_device *xe, struct xe_vm *v + if (xe_exec_queue_uses_pxp(q)) { + err = xe_pxp_exec_queue_add(xe->pxp, q); + if (err) +- goto err_post_alloc; ++ goto err_post_init; + } + + return q; + ++err_post_init: ++ __xe_exec_queue_fini(q); + err_post_alloc: + __xe_exec_queue_free(q); + return ERR_PTR(err); +@@ -283,13 +295,11 @@ void xe_exec_queue_destroy(struct kref *ref) + xe_exec_queue_put(eq); + } + +- q->ops->fini(q); ++ q->ops->destroy(q); + } + + void xe_exec_queue_fini(struct xe_exec_queue *q) + { +- int i; +- + /* + * Before releasing our ref to lrc and xef, accumulate our run ticks + * and wakeup any waiters. +@@ -298,9 +308,7 @@ void xe_exec_queue_fini(struct xe_exec_queue *q) + if (q->xef && atomic_dec_and_test(&q->xef->exec_queue.pending_removal)) + wake_up_var(&q->xef->exec_queue.pending_removal); + +- for (i = 0; i < q->width; ++i) +- xe_lrc_put(q->lrc[i]); +- ++ __xe_exec_queue_fini(q); + __xe_exec_queue_free(q); + } + +diff --git a/drivers/gpu/drm/xe/xe_exec_queue_types.h b/drivers/gpu/drm/xe/xe_exec_queue_types.h +index cc1cffb5c87f1..1c9d03f2a3e5d 100644 +--- a/drivers/gpu/drm/xe/xe_exec_queue_types.h ++++ b/drivers/gpu/drm/xe/xe_exec_queue_types.h +@@ -166,8 +166,14 @@ struct xe_exec_queue_ops { + int (*init)(struct xe_exec_queue *q); + /** @kill: Kill inflight submissions for backend */ + void (*kill)(struct xe_exec_queue *q); +- /** @fini: Fini exec queue for submission backend */ ++ /** @fini: Undoes the init() for submission backend */ + void (*fini)(struct xe_exec_queue *q); ++ /** ++ * @destroy: Destroy exec queue for submission backend. The backend ++ * function must call xe_exec_queue_fini() (which will in turn call the ++ * fini() backend function) to ensure the queue is properly cleaned up. ++ */ ++ void (*destroy)(struct xe_exec_queue *q); + /** @set_priority: Set priority for exec queue */ + int (*set_priority)(struct xe_exec_queue *q, + enum xe_exec_queue_priority priority); +diff --git a/drivers/gpu/drm/xe/xe_execlist.c b/drivers/gpu/drm/xe/xe_execlist.c +index 788f56b066b6a..f83d421ac9d3d 100644 +--- a/drivers/gpu/drm/xe/xe_execlist.c ++++ b/drivers/gpu/drm/xe/xe_execlist.c +@@ -385,10 +385,20 @@ static int execlist_exec_queue_init(struct xe_exec_queue *q) + return err; + } + +-static void execlist_exec_queue_fini_async(struct work_struct *w) ++static void execlist_exec_queue_fini(struct xe_exec_queue *q) ++{ ++ struct xe_execlist_exec_queue *exl = q->execlist; ++ ++ drm_sched_entity_fini(&exl->entity); ++ drm_sched_fini(&exl->sched); ++ ++ kfree(exl); ++} ++ ++static void execlist_exec_queue_destroy_async(struct work_struct *w) + { + struct xe_execlist_exec_queue *ee = +- container_of(w, struct xe_execlist_exec_queue, fini_async); ++ container_of(w, struct xe_execlist_exec_queue, destroy_async); + struct xe_exec_queue *q = ee->q; + struct xe_execlist_exec_queue *exl = q->execlist; + struct xe_device *xe = gt_to_xe(q->gt); +@@ -401,10 +411,6 @@ static void execlist_exec_queue_fini_async(struct work_struct *w) + list_del(&exl->active_link); + spin_unlock_irqrestore(&exl->port->lock, flags); + +- drm_sched_entity_fini(&exl->entity); +- drm_sched_fini(&exl->sched); +- kfree(exl); +- + xe_exec_queue_fini(q); + } + +@@ -413,10 +419,10 @@ static void execlist_exec_queue_kill(struct xe_exec_queue *q) + /* NIY */ + } + +-static void execlist_exec_queue_fini(struct xe_exec_queue *q) ++static void execlist_exec_queue_destroy(struct xe_exec_queue *q) + { +- INIT_WORK(&q->execlist->fini_async, execlist_exec_queue_fini_async); +- queue_work(system_unbound_wq, &q->execlist->fini_async); ++ INIT_WORK(&q->execlist->destroy_async, execlist_exec_queue_destroy_async); ++ queue_work(system_unbound_wq, &q->execlist->destroy_async); + } + + static int execlist_exec_queue_set_priority(struct xe_exec_queue *q, +@@ -467,6 +473,7 @@ static const struct xe_exec_queue_ops execlist_exec_queue_ops = { + .init = execlist_exec_queue_init, + .kill = execlist_exec_queue_kill, + .fini = execlist_exec_queue_fini, ++ .destroy = execlist_exec_queue_destroy, + .set_priority = execlist_exec_queue_set_priority, + .set_timeslice = execlist_exec_queue_set_timeslice, + .set_preempt_timeout = execlist_exec_queue_set_preempt_timeout, +diff --git a/drivers/gpu/drm/xe/xe_execlist_types.h b/drivers/gpu/drm/xe/xe_execlist_types.h +index 415140936f11d..92c4ba52db0cb 100644 +--- a/drivers/gpu/drm/xe/xe_execlist_types.h ++++ b/drivers/gpu/drm/xe/xe_execlist_types.h +@@ -42,7 +42,7 @@ struct xe_execlist_exec_queue { + + bool has_run; + +- struct work_struct fini_async; ++ struct work_struct destroy_async; + + enum xe_exec_queue_priority active_priority; + struct list_head active_link; +diff --git a/drivers/gpu/drm/xe/xe_guc_exec_queue_types.h b/drivers/gpu/drm/xe/xe_guc_exec_queue_types.h +index a3f421e2adc03..c30c0e3ccbbb9 100644 +--- a/drivers/gpu/drm/xe/xe_guc_exec_queue_types.h ++++ b/drivers/gpu/drm/xe/xe_guc_exec_queue_types.h +@@ -35,8 +35,8 @@ struct xe_guc_exec_queue { + struct xe_sched_msg static_msgs[MAX_STATIC_MSG_TYPE]; + /** @lr_tdr: long running TDR worker */ + struct work_struct lr_tdr; +- /** @fini_async: do final fini async from this worker */ +- struct work_struct fini_async; ++ /** @destroy_async: do final destroy async from this worker */ ++ struct work_struct destroy_async; + /** @resume_time: time of last resume */ + u64 resume_time; + /** @state: GuC specific state for this xe_exec_queue */ +diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c +index ef3e9e1588f7c..45a21af126927 100644 +--- a/drivers/gpu/drm/xe/xe_guc_submit.c ++++ b/drivers/gpu/drm/xe/xe_guc_submit.c +@@ -1269,48 +1269,57 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job) + return DRM_GPU_SCHED_STAT_NOMINAL; + } + +-static void __guc_exec_queue_fini_async(struct work_struct *w) ++static void guc_exec_queue_fini(struct xe_exec_queue *q) ++{ ++ struct xe_guc_exec_queue *ge = q->guc; ++ struct xe_guc *guc = exec_queue_to_guc(q); ++ ++ release_guc_id(guc, q); ++ xe_sched_entity_fini(&ge->entity); ++ xe_sched_fini(&ge->sched); ++ ++ /* ++ * RCU free due sched being exported via DRM scheduler fences ++ * (timeline name). ++ */ ++ kfree_rcu(ge, rcu); ++} ++ ++static void __guc_exec_queue_destroy_async(struct work_struct *w) + { + struct xe_guc_exec_queue *ge = +- container_of(w, struct xe_guc_exec_queue, fini_async); ++ container_of(w, struct xe_guc_exec_queue, destroy_async); + struct xe_exec_queue *q = ge->q; + struct xe_guc *guc = exec_queue_to_guc(q); + + xe_pm_runtime_get(guc_to_xe(guc)); + trace_xe_exec_queue_destroy(q); + +- release_guc_id(guc, q); + if (xe_exec_queue_is_lr(q)) + cancel_work_sync(&ge->lr_tdr); + /* Confirm no work left behind accessing device structures */ + cancel_delayed_work_sync(&ge->sched.base.work_tdr); +- xe_sched_entity_fini(&ge->entity); +- xe_sched_fini(&ge->sched); + +- /* +- * RCU free due sched being exported via DRM scheduler fences +- * (timeline name). +- */ +- kfree_rcu(ge, rcu); + xe_exec_queue_fini(q); ++ + xe_pm_runtime_put(guc_to_xe(guc)); + } + +-static void guc_exec_queue_fini_async(struct xe_exec_queue *q) ++static void guc_exec_queue_destroy_async(struct xe_exec_queue *q) + { + struct xe_guc *guc = exec_queue_to_guc(q); + struct xe_device *xe = guc_to_xe(guc); + +- INIT_WORK(&q->guc->fini_async, __guc_exec_queue_fini_async); ++ INIT_WORK(&q->guc->destroy_async, __guc_exec_queue_destroy_async); + + /* We must block on kernel engines so slabs are empty on driver unload */ + if (q->flags & EXEC_QUEUE_FLAG_PERMANENT || exec_queue_wedged(q)) +- __guc_exec_queue_fini_async(&q->guc->fini_async); ++ __guc_exec_queue_destroy_async(&q->guc->destroy_async); + else +- queue_work(xe->destroy_wq, &q->guc->fini_async); ++ queue_work(xe->destroy_wq, &q->guc->destroy_async); + } + +-static void __guc_exec_queue_fini(struct xe_guc *guc, struct xe_exec_queue *q) ++static void __guc_exec_queue_destroy(struct xe_guc *guc, struct xe_exec_queue *q) + { + /* + * Might be done from within the GPU scheduler, need to do async as we +@@ -1319,7 +1328,7 @@ static void __guc_exec_queue_fini(struct xe_guc *guc, struct xe_exec_queue *q) + * this we and don't really care when everything is fini'd, just that it + * is. + */ +- guc_exec_queue_fini_async(q); ++ guc_exec_queue_destroy_async(q); + } + + static void __guc_exec_queue_process_msg_cleanup(struct xe_sched_msg *msg) +@@ -1333,7 +1342,7 @@ static void __guc_exec_queue_process_msg_cleanup(struct xe_sched_msg *msg) + if (exec_queue_registered(q)) + disable_scheduling_deregister(guc, q); + else +- __guc_exec_queue_fini(guc, q); ++ __guc_exec_queue_destroy(guc, q); + } + + static bool guc_exec_queue_allowed_to_change_state(struct xe_exec_queue *q) +@@ -1566,14 +1575,14 @@ static bool guc_exec_queue_try_add_msg(struct xe_exec_queue *q, + #define STATIC_MSG_CLEANUP 0 + #define STATIC_MSG_SUSPEND 1 + #define STATIC_MSG_RESUME 2 +-static void guc_exec_queue_fini(struct xe_exec_queue *q) ++static void guc_exec_queue_destroy(struct xe_exec_queue *q) + { + struct xe_sched_msg *msg = q->guc->static_msgs + STATIC_MSG_CLEANUP; + + if (!(q->flags & EXEC_QUEUE_FLAG_PERMANENT) && !exec_queue_wedged(q)) + guc_exec_queue_add_msg(q, msg, CLEANUP); + else +- __guc_exec_queue_fini(exec_queue_to_guc(q), q); ++ __guc_exec_queue_destroy(exec_queue_to_guc(q), q); + } + + static int guc_exec_queue_set_priority(struct xe_exec_queue *q, +@@ -1703,6 +1712,7 @@ static const struct xe_exec_queue_ops guc_exec_queue_ops = { + .init = guc_exec_queue_init, + .kill = guc_exec_queue_kill, + .fini = guc_exec_queue_fini, ++ .destroy = guc_exec_queue_destroy, + .set_priority = guc_exec_queue_set_priority, + .set_timeslice = guc_exec_queue_set_timeslice, + .set_preempt_timeout = guc_exec_queue_set_preempt_timeout, +@@ -1724,7 +1734,7 @@ static void guc_exec_queue_stop(struct xe_guc *guc, struct xe_exec_queue *q) + if (exec_queue_extra_ref(q) || xe_exec_queue_is_lr(q)) + xe_exec_queue_put(q); + else if (exec_queue_destroyed(q)) +- __guc_exec_queue_fini(guc, q); ++ __guc_exec_queue_destroy(guc, q); + } + if (q->guc->suspend_pending) { + set_exec_queue_suspended(q); +@@ -1981,7 +1991,7 @@ static void handle_deregister_done(struct xe_guc *guc, struct xe_exec_queue *q) + if (exec_queue_extra_ref(q) || xe_exec_queue_is_lr(q)) + xe_exec_queue_put(q); + else +- __guc_exec_queue_fini(guc, q); ++ __guc_exec_queue_destroy(guc, q); + } + + int xe_guc_deregister_done_handler(struct xe_guc *guc, u32 *msg, u32 len) +-- +2.51.0 + diff --git a/queue-6.16/drm-xe-guc-enable-extended-cat-error-reporting.patch b/queue-6.16/drm-xe-guc-enable-extended-cat-error-reporting.patch new file mode 100644 index 0000000000..561f8da77b --- /dev/null +++ b/queue-6.16/drm-xe-guc-enable-extended-cat-error-reporting.patch @@ -0,0 +1,258 @@ +From 11e953e772c7f292e1596139968c837359f1dab4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jun 2025 13:54:06 -0700 +Subject: drm/xe/guc: Enable extended CAT error reporting + +From: Daniele Ceraolo Spurio + +[ Upstream commit a7ffcea8631af91479cab10aa7fbfd0722f01d9a ] + +On newer HW (Xe2 onwards + PVC) it is possible to get extra information +when a CAT error occurs, specifically a dword reporting the error type. +To enable this extra reporting, we need to opt-in with the GuC, which is +done via a specific per-VF feature opt-in H2G. + +On platforms where the HW does not support the extra reporting, the GuC +will set the type to 0xdeadbeef, so we can keep the code simple and +opt-in to the feature on every platform and then just discard the data +if it is invalid. + +Note that on native/PF we're guaranteed that the opt in is available +because we don't support any GuC old enough to not have it, but if we're +a VF we might be running on a non-XE PF with an older GuC, so we need to +handle that case. We can re-use the invalid type above to handle this +scenario the same way as if the feature was not supported in HW. + +Given that this patch is the first user of the guc_buf_cache on native +and VF, it also extends that feature to non-PF use-cases. + +v2: simpler print for the error type (John), rebase +v3: use guc_buf_cache instead of new alloc, simpler doc (Michal) + +Signed-off-by: Daniele Ceraolo Spurio +Cc: Nirmoy Das +Cc: John Harrison +Cc: Michal Wajdeczko +Reviewed-by: Nirmoy Das #v1 +Reviewed-by: Michal Wajdeczko +Reviewed-by: John Harrison +Link: https://lore.kernel.org/r/20250625205405.1653212-3-daniele.ceraolospurio@intel.com +Stable-dep-of: 26caeae9fb48 ("drm/xe/guc: Set RCS/CCS yield policy") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/abi/guc_actions_abi.h | 4 ++ + drivers/gpu/drm/xe/abi/guc_klvs_abi.h | 15 +++++++ + drivers/gpu/drm/xe/xe_guc.c | 56 ++++++++++++++++++++++++ + drivers/gpu/drm/xe/xe_guc.h | 1 + + drivers/gpu/drm/xe/xe_guc_submit.c | 21 +++++++-- + drivers/gpu/drm/xe/xe_uc.c | 4 ++ + 6 files changed, 98 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/xe/abi/guc_actions_abi.h b/drivers/gpu/drm/xe/abi/guc_actions_abi.h +index 448afb86e05c7..b55d4cfb483a1 100644 +--- a/drivers/gpu/drm/xe/abi/guc_actions_abi.h ++++ b/drivers/gpu/drm/xe/abi/guc_actions_abi.h +@@ -142,6 +142,7 @@ enum xe_guc_action { + XE_GUC_ACTION_SET_ENG_UTIL_BUFF = 0x550A, + XE_GUC_ACTION_SET_DEVICE_ENGINE_ACTIVITY_BUFFER = 0x550C, + XE_GUC_ACTION_SET_FUNCTION_ENGINE_ACTIVITY_BUFFER = 0x550D, ++ XE_GUC_ACTION_OPT_IN_FEATURE_KLV = 0x550E, + XE_GUC_ACTION_NOTIFY_MEMORY_CAT_ERROR = 0x6000, + XE_GUC_ACTION_REPORT_PAGE_FAULT_REQ_DESC = 0x6002, + XE_GUC_ACTION_PAGE_FAULT_RES_DESC = 0x6003, +@@ -240,4 +241,7 @@ enum xe_guc_g2g_type { + #define XE_G2G_DEREGISTER_TILE REG_GENMASK(15, 12) + #define XE_G2G_DEREGISTER_TYPE REG_GENMASK(11, 8) + ++/* invalid type for XE_GUC_ACTION_NOTIFY_MEMORY_CAT_ERROR */ ++#define XE_GUC_CAT_ERR_TYPE_INVALID 0xdeadbeef ++ + #endif +diff --git a/drivers/gpu/drm/xe/abi/guc_klvs_abi.h b/drivers/gpu/drm/xe/abi/guc_klvs_abi.h +index 7de8f827281fc..5b2502bec2dcc 100644 +--- a/drivers/gpu/drm/xe/abi/guc_klvs_abi.h ++++ b/drivers/gpu/drm/xe/abi/guc_klvs_abi.h +@@ -16,6 +16,7 @@ + * +===+=======+==============================================================+ + * | 0 | 31:16 | **KEY** - KLV key identifier | + * | | | - `GuC Self Config KLVs`_ | ++ * | | | - `GuC Opt In Feature KLVs`_ | + * | | | - `GuC VGT Policy KLVs`_ | + * | | | - `GuC VF Configuration KLVs`_ | + * | | | | +@@ -124,6 +125,20 @@ enum { + GUC_CONTEXT_POLICIES_KLV_NUM_IDS = 5, + }; + ++/** ++ * DOC: GuC Opt In Feature KLVs ++ * ++ * `GuC KLV`_ keys available for use with OPT_IN_FEATURE_KLV ++ * ++ * _`GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE` : 0x4001 ++ * Adds an extra dword to the XE_GUC_ACTION_NOTIFY_MEMORY_CAT_ERROR G2H ++ * containing the type of the CAT error. On HW that does not support ++ * reporting the CAT error type, the extra dword is set to 0xdeadbeef. ++ */ ++ ++#define GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE_KEY 0x4001 ++#define GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE_LEN 0u ++ + /** + * DOC: GuC VGT Policy KLVs + * +diff --git a/drivers/gpu/drm/xe/xe_guc.c b/drivers/gpu/drm/xe/xe_guc.c +index bac5471a1a780..2efc0298e1a4c 100644 +--- a/drivers/gpu/drm/xe/xe_guc.c ++++ b/drivers/gpu/drm/xe/xe_guc.c +@@ -29,6 +29,7 @@ + #include "xe_guc_db_mgr.h" + #include "xe_guc_engine_activity.h" + #include "xe_guc_hwconfig.h" ++#include "xe_guc_klv_helpers.h" + #include "xe_guc_log.h" + #include "xe_guc_pc.h" + #include "xe_guc_relay.h" +@@ -570,6 +571,57 @@ static int guc_g2g_start(struct xe_guc *guc) + return err; + } + ++static int __guc_opt_in_features_enable(struct xe_guc *guc, u64 addr, u32 num_dwords) ++{ ++ u32 action[] = { ++ XE_GUC_ACTION_OPT_IN_FEATURE_KLV, ++ lower_32_bits(addr), ++ upper_32_bits(addr), ++ num_dwords ++ }; ++ ++ return xe_guc_ct_send_block(&guc->ct, action, ARRAY_SIZE(action)); ++} ++ ++#define OPT_IN_MAX_DWORDS 16 ++int xe_guc_opt_in_features_enable(struct xe_guc *guc) ++{ ++ struct xe_device *xe = guc_to_xe(guc); ++ CLASS(xe_guc_buf, buf)(&guc->buf, OPT_IN_MAX_DWORDS); ++ u32 count = 0; ++ u32 *klvs; ++ int ret; ++ ++ if (!xe_guc_buf_is_valid(buf)) ++ return -ENOBUFS; ++ ++ klvs = xe_guc_buf_cpu_ptr(buf); ++ ++ /* ++ * The extra CAT error type opt-in was added in GuC v70.17.0, which maps ++ * to compatibility version v1.7.0. ++ * Note that the GuC allows enabling this KLV even on platforms that do ++ * not support the extra type; in such case the returned type variable ++ * will be set to a known invalid value which we can check against. ++ */ ++ if (GUC_SUBMIT_VER(guc) >= MAKE_GUC_VER(1, 7, 0)) ++ klvs[count++] = PREP_GUC_KLV_TAG(OPT_IN_FEATURE_EXT_CAT_ERR_TYPE); ++ ++ if (count) { ++ xe_assert(xe, count <= OPT_IN_MAX_DWORDS); ++ ++ ret = __guc_opt_in_features_enable(guc, xe_guc_buf_flush(buf), count); ++ if (ret < 0) { ++ xe_gt_err(guc_to_gt(guc), ++ "failed to enable GuC opt-in features: %pe\n", ++ ERR_PTR(ret)); ++ return ret; ++ } ++ } ++ ++ return 0; ++} ++ + static void guc_fini_hw(void *arg) + { + struct xe_guc *guc = arg; +@@ -763,6 +815,10 @@ int xe_guc_post_load_init(struct xe_guc *guc) + + xe_guc_ads_populate_post_load(&guc->ads); + ++ ret = xe_guc_opt_in_features_enable(guc); ++ if (ret) ++ return ret; ++ + if (xe_guc_g2g_wanted(guc_to_xe(guc))) { + ret = guc_g2g_start(guc); + if (ret) +diff --git a/drivers/gpu/drm/xe/xe_guc.h b/drivers/gpu/drm/xe/xe_guc.h +index 58338be445585..4a66575f017d2 100644 +--- a/drivers/gpu/drm/xe/xe_guc.h ++++ b/drivers/gpu/drm/xe/xe_guc.h +@@ -33,6 +33,7 @@ int xe_guc_reset(struct xe_guc *guc); + int xe_guc_upload(struct xe_guc *guc); + int xe_guc_min_load_for_hwconfig(struct xe_guc *guc); + int xe_guc_enable_communication(struct xe_guc *guc); ++int xe_guc_opt_in_features_enable(struct xe_guc *guc); + int xe_guc_suspend(struct xe_guc *guc); + void xe_guc_notify(struct xe_guc *guc); + int xe_guc_auth_huc(struct xe_guc *guc, u32 rsa_addr); +diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c +index 45a21af126927..e670dcb0f0932 100644 +--- a/drivers/gpu/drm/xe/xe_guc_submit.c ++++ b/drivers/gpu/drm/xe/xe_guc_submit.c +@@ -2088,12 +2088,16 @@ int xe_guc_exec_queue_memory_cat_error_handler(struct xe_guc *guc, u32 *msg, + struct xe_gt *gt = guc_to_gt(guc); + struct xe_exec_queue *q; + u32 guc_id; ++ u32 type = XE_GUC_CAT_ERR_TYPE_INVALID; + +- if (unlikely(len < 1)) ++ if (unlikely(!len || len > 2)) + return -EPROTO; + + guc_id = msg[0]; + ++ if (len == 2) ++ type = msg[1]; ++ + if (guc_id == GUC_ID_UNKNOWN) { + /* + * GuC uses GUC_ID_UNKNOWN if it can not map the CAT fault to any PF/VF +@@ -2107,8 +2111,19 @@ int xe_guc_exec_queue_memory_cat_error_handler(struct xe_guc *guc, u32 *msg, + if (unlikely(!q)) + return -EPROTO; + +- xe_gt_dbg(gt, "Engine memory cat error: engine_class=%s, logical_mask: 0x%x, guc_id=%d", +- xe_hw_engine_class_to_str(q->class), q->logical_mask, guc_id); ++ /* ++ * The type is HW-defined and changes based on platform, so we don't ++ * decode it in the kernel and only check if it is valid. ++ * See bspec 54047 and 72187 for details. ++ */ ++ if (type != XE_GUC_CAT_ERR_TYPE_INVALID) ++ xe_gt_dbg(gt, ++ "Engine memory CAT error [%u]: class=%s, logical_mask: 0x%x, guc_id=%d", ++ type, xe_hw_engine_class_to_str(q->class), q->logical_mask, guc_id); ++ else ++ xe_gt_dbg(gt, ++ "Engine memory CAT error: class=%s, logical_mask: 0x%x, guc_id=%d", ++ xe_hw_engine_class_to_str(q->class), q->logical_mask, guc_id); + + trace_xe_exec_queue_memory_cat_error(q); + +diff --git a/drivers/gpu/drm/xe/xe_uc.c b/drivers/gpu/drm/xe/xe_uc.c +index 3a8751a8b92dd..5c45b0f072a4c 100644 +--- a/drivers/gpu/drm/xe/xe_uc.c ++++ b/drivers/gpu/drm/xe/xe_uc.c +@@ -165,6 +165,10 @@ static int vf_uc_init_hw(struct xe_uc *uc) + + uc->guc.submission_state.enabled = true; + ++ err = xe_guc_opt_in_features_enable(&uc->guc); ++ if (err) ++ return err; ++ + err = xe_gt_record_default_lrcs(uc_to_gt(uc)); + if (err) + return err; +-- +2.51.0 + diff --git a/queue-6.16/drm-xe-guc-set-rcs-ccs-yield-policy.patch b/queue-6.16/drm-xe-guc-set-rcs-ccs-yield-policy.patch new file mode 100644 index 0000000000..9b4848f40b --- /dev/null +++ b/queue-6.16/drm-xe-guc-set-rcs-ccs-yield-policy.patch @@ -0,0 +1,251 @@ +From ebd6c8a7f2fe15afc288dc8eeb7605b2313995f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Sep 2025 16:56:33 -0700 +Subject: drm/xe/guc: Set RCS/CCS yield policy + +From: Daniele Ceraolo Spurio + +[ Upstream commit 26caeae9fb482ec443753b4e3307e5122b60b850 ] + +All recent platforms (including all the ones officially supported by the +Xe driver) do not allow concurrent execution of RCS and CCS workloads +from different address spaces, with the HW blocking the context switch +when it detects such a scenario. +The DUAL_QUEUE flag helps with this, by causing the GuC to not submit a +context it knows will not be able to execute. This, however, causes a new +problem: if RCS and CCS queues have pending workloads from different +address spaces, the GuC needs to choose from which of the 2 queues to +pick the next workload to execute. By default, the GuC prioritizes RCS +submissions over CCS ones, which can lead to CCS workloads being +significantly (or completely) starved of execution time. +The driver can tune this by setting a dedicated scheduling policy KLV; +this KLV allows the driver to specify a quantum (in ms) and a ratio +(percentage value between 0 and 100), and the GuC will prioritize the CCS +for that percentage of each quantum. +Given that we want to guarantee enough RCS throughput to avoid missing +frames, we set the yield policy to 20% of each 80ms interval. + +v2: updated quantum and ratio, improved comment, use xe_guc_submit_disable +in gt_sanitize + +Fixes: d9a1ae0d17bd ("drm/xe/guc: Enable WA_DUAL_QUEUE for newer platforms") +Signed-off-by: Daniele Ceraolo Spurio +Cc: Matthew Brost +Cc: John Harrison +Cc: Vinay Belgaumkar +Reviewed-by: John Harrison +Tested-by: Vinay Belgaumkar +Link: https://lore.kernel.org/r/20250905235632.3333247-2-daniele.ceraolospurio@intel.com +(cherry picked from commit 88434448438e4302e272b2a2b810b42e05ea024b) +Signed-off-by: Rodrigo Vivi +[Rodrigo added #include "xe_guc_submit.h" while backporting] +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/abi/guc_actions_abi.h | 1 + + drivers/gpu/drm/xe/abi/guc_klvs_abi.h | 25 +++++++++ + drivers/gpu/drm/xe/xe_gt.c | 3 +- + drivers/gpu/drm/xe/xe_guc.c | 6 +-- + drivers/gpu/drm/xe/xe_guc_submit.c | 66 ++++++++++++++++++++++++ + drivers/gpu/drm/xe/xe_guc_submit.h | 2 + + 6 files changed, 98 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/xe/abi/guc_actions_abi.h b/drivers/gpu/drm/xe/abi/guc_actions_abi.h +index b55d4cfb483a1..4d9896e14649c 100644 +--- a/drivers/gpu/drm/xe/abi/guc_actions_abi.h ++++ b/drivers/gpu/drm/xe/abi/guc_actions_abi.h +@@ -117,6 +117,7 @@ enum xe_guc_action { + XE_GUC_ACTION_ENTER_S_STATE = 0x501, + XE_GUC_ACTION_EXIT_S_STATE = 0x502, + XE_GUC_ACTION_GLOBAL_SCHED_POLICY_CHANGE = 0x506, ++ XE_GUC_ACTION_UPDATE_SCHEDULING_POLICIES_KLV = 0x509, + XE_GUC_ACTION_SCHED_CONTEXT = 0x1000, + XE_GUC_ACTION_SCHED_CONTEXT_MODE_SET = 0x1001, + XE_GUC_ACTION_SCHED_CONTEXT_MODE_DONE = 0x1002, +diff --git a/drivers/gpu/drm/xe/abi/guc_klvs_abi.h b/drivers/gpu/drm/xe/abi/guc_klvs_abi.h +index 5b2502bec2dcc..89034bc97ec5a 100644 +--- a/drivers/gpu/drm/xe/abi/guc_klvs_abi.h ++++ b/drivers/gpu/drm/xe/abi/guc_klvs_abi.h +@@ -17,6 +17,7 @@ + * | 0 | 31:16 | **KEY** - KLV key identifier | + * | | | - `GuC Self Config KLVs`_ | + * | | | - `GuC Opt In Feature KLVs`_ | ++ * | | | - `GuC Scheduling Policies KLVs`_ | + * | | | - `GuC VGT Policy KLVs`_ | + * | | | - `GuC VF Configuration KLVs`_ | + * | | | | +@@ -139,6 +140,30 @@ enum { + #define GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE_KEY 0x4001 + #define GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE_LEN 0u + ++/** ++ * DOC: GuC Scheduling Policies KLVs ++ * ++ * `GuC KLV`_ keys available for use with UPDATE_SCHEDULING_POLICIES_KLV. ++ * ++ * _`GUC_KLV_SCHEDULING_POLICIES_RENDER_COMPUTE_YIELD` : 0x1001 ++ * Some platforms do not allow concurrent execution of RCS and CCS ++ * workloads from different address spaces. By default, the GuC prioritizes ++ * RCS submissions over CCS ones, which can lead to CCS workloads being ++ * significantly (or completely) starved of execution time. This KLV allows ++ * the driver to specify a quantum (in ms) and a ratio (percentage value ++ * between 0 and 100), and the GuC will prioritize the CCS for that ++ * percentage of each quantum. For example, specifying 100ms and 30% will ++ * make the GuC prioritize the CCS for 30ms of every 100ms. ++ * Note that this does not necessarly mean that RCS and CCS engines will ++ * only be active for their percentage of the quantum, as the restriction ++ * only kicks in if both classes are fully busy with non-compatible address ++ * spaces; i.e., if one engine is idle or running the same address space, ++ * a pending job on the other engine will still be submitted to the HW no ++ * matter what the ratio is ++ */ ++#define GUC_KLV_SCHEDULING_POLICIES_RENDER_COMPUTE_YIELD_KEY 0x1001 ++#define GUC_KLV_SCHEDULING_POLICIES_RENDER_COMPUTE_YIELD_LEN 2u ++ + /** + * DOC: GuC VGT Policy KLVs + * +diff --git a/drivers/gpu/drm/xe/xe_gt.c b/drivers/gpu/drm/xe/xe_gt.c +index e3517ce2e18c1..eaf7569a7c1d1 100644 +--- a/drivers/gpu/drm/xe/xe_gt.c ++++ b/drivers/gpu/drm/xe/xe_gt.c +@@ -41,6 +41,7 @@ + #include "xe_gt_topology.h" + #include "xe_guc_exec_queue_types.h" + #include "xe_guc_pc.h" ++#include "xe_guc_submit.h" + #include "xe_hw_fence.h" + #include "xe_hw_engine_class_sysfs.h" + #include "xe_irq.h" +@@ -97,7 +98,7 @@ void xe_gt_sanitize(struct xe_gt *gt) + * FIXME: if xe_uc_sanitize is called here, on TGL driver will not + * reload + */ +- gt->uc.guc.submission_state.enabled = false; ++ xe_guc_submit_disable(>->uc.guc); + } + + static void xe_gt_enable_host_l2_vram(struct xe_gt *gt) +diff --git a/drivers/gpu/drm/xe/xe_guc.c b/drivers/gpu/drm/xe/xe_guc.c +index 2efc0298e1a4c..b9d21fdaad48b 100644 +--- a/drivers/gpu/drm/xe/xe_guc.c ++++ b/drivers/gpu/drm/xe/xe_guc.c +@@ -825,9 +825,7 @@ int xe_guc_post_load_init(struct xe_guc *guc) + return ret; + } + +- guc->submission_state.enabled = true; +- +- return 0; ++ return xe_guc_submit_enable(guc); + } + + int xe_guc_reset(struct xe_guc *guc) +@@ -1521,7 +1519,7 @@ void xe_guc_sanitize(struct xe_guc *guc) + { + xe_uc_fw_sanitize(&guc->fw); + xe_guc_ct_disable(&guc->ct); +- guc->submission_state.enabled = false; ++ xe_guc_submit_disable(guc); + } + + int xe_guc_reset_prepare(struct xe_guc *guc) +diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c +index e670dcb0f0932..18ddbb7b98a15 100644 +--- a/drivers/gpu/drm/xe/xe_guc_submit.c ++++ b/drivers/gpu/drm/xe/xe_guc_submit.c +@@ -32,6 +32,7 @@ + #include "xe_guc_ct.h" + #include "xe_guc_exec_queue_types.h" + #include "xe_guc_id_mgr.h" ++#include "xe_guc_klv_helpers.h" + #include "xe_guc_submit_types.h" + #include "xe_hw_engine.h" + #include "xe_hw_fence.h" +@@ -316,6 +317,71 @@ int xe_guc_submit_init(struct xe_guc *guc, unsigned int num_ids) + return drmm_add_action_or_reset(&xe->drm, guc_submit_fini, guc); + } + ++/* ++ * Given that we want to guarantee enough RCS throughput to avoid missing ++ * frames, we set the yield policy to 20% of each 80ms interval. ++ */ ++#define RC_YIELD_DURATION 80 /* in ms */ ++#define RC_YIELD_RATIO 20 /* in percent */ ++static u32 *emit_render_compute_yield_klv(u32 *emit) ++{ ++ *emit++ = PREP_GUC_KLV_TAG(SCHEDULING_POLICIES_RENDER_COMPUTE_YIELD); ++ *emit++ = RC_YIELD_DURATION; ++ *emit++ = RC_YIELD_RATIO; ++ ++ return emit; ++} ++ ++#define SCHEDULING_POLICY_MAX_DWORDS 16 ++static int guc_init_global_schedule_policy(struct xe_guc *guc) ++{ ++ u32 data[SCHEDULING_POLICY_MAX_DWORDS]; ++ u32 *emit = data; ++ u32 count = 0; ++ int ret; ++ ++ if (GUC_SUBMIT_VER(guc) < MAKE_GUC_VER(1, 1, 0)) ++ return 0; ++ ++ *emit++ = XE_GUC_ACTION_UPDATE_SCHEDULING_POLICIES_KLV; ++ ++ if (CCS_MASK(guc_to_gt(guc))) ++ emit = emit_render_compute_yield_klv(emit); ++ ++ count = emit - data; ++ if (count > 1) { ++ xe_assert(guc_to_xe(guc), count <= SCHEDULING_POLICY_MAX_DWORDS); ++ ++ ret = xe_guc_ct_send_block(&guc->ct, data, count); ++ if (ret < 0) { ++ xe_gt_err(guc_to_gt(guc), ++ "failed to enable GuC sheduling policies: %pe\n", ++ ERR_PTR(ret)); ++ return ret; ++ } ++ } ++ ++ return 0; ++} ++ ++int xe_guc_submit_enable(struct xe_guc *guc) ++{ ++ int ret; ++ ++ ret = guc_init_global_schedule_policy(guc); ++ if (ret) ++ return ret; ++ ++ guc->submission_state.enabled = true; ++ ++ return 0; ++} ++ ++void xe_guc_submit_disable(struct xe_guc *guc) ++{ ++ guc->submission_state.enabled = false; ++} ++ + static void __release_guc_id(struct xe_guc *guc, struct xe_exec_queue *q, u32 xa_count) + { + int i; +diff --git a/drivers/gpu/drm/xe/xe_guc_submit.h b/drivers/gpu/drm/xe/xe_guc_submit.h +index 9b71a986c6ca6..0d126b807c104 100644 +--- a/drivers/gpu/drm/xe/xe_guc_submit.h ++++ b/drivers/gpu/drm/xe/xe_guc_submit.h +@@ -13,6 +13,8 @@ struct xe_exec_queue; + struct xe_guc; + + int xe_guc_submit_init(struct xe_guc *guc, unsigned int num_ids); ++int xe_guc_submit_enable(struct xe_guc *guc); ++void xe_guc_submit_disable(struct xe_guc *guc); + + int xe_guc_submit_reset_prepare(struct xe_guc *guc); + void xe_guc_submit_reset_wait(struct xe_guc *guc); +-- +2.51.0 + diff --git a/queue-6.16/drm-xe-pf-drop-rounddown_pow_of_two-fair-lmem-limita.patch b/queue-6.16/drm-xe-pf-drop-rounddown_pow_of_two-fair-lmem-limita.patch new file mode 100644 index 0000000000..8371d28a1c --- /dev/null +++ b/queue-6.16/drm-xe-pf-drop-rounddown_pow_of_two-fair-lmem-limita.patch @@ -0,0 +1,57 @@ +From eb10855cd510017edf0b74aa552001478495df70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 00:24:39 +0200 +Subject: drm/xe/pf: Drop rounddown_pow_of_two fair LMEM limitation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Wajdeczko + +[ Upstream commit fef8b64e48e836344574b85132a1c317f4260022 ] + +This effectively reverts commit 4c3fe5eae46b ("drm/xe/pf: Limit +fair VF LMEM provisioning") since we don't need it any more after +non-contig VRAM allocations were fixed. This allows larger LMEM +auto-provisioning for VFs, so instead: + + [ ] GT0: PF: LMEM available(14096M) fair(1 x 8192M) + [ ] GT0: PF: VF1 provisioned with 8589934592 (8.00 GiB) LMEM +or + [ ] GT0: PF: LMEM available(14096M) fair(2 x 4096M) + [ ] GT0: PF: VF1..VF2 provisioned with 4294967296 (4.00 GiB) LMEM + +we may get: + + [ ] GT0: PF: LMEM available(14096M) fair(1 x 14096M) + [ ] GT0: PF: VF1 provisioned with 14780727296 (13.8 GiB) LMEM +and + [ ] GT0: PF: LMEM available(14096M) fair(2 x 7048M) + [ ] GT0: PF: VF1..VF2 provisioned with 7390363648 (6.88 GiB) LMEM + +Fixes: 1e32ffbc9dc8 ("drm/xe/sriov: support non-contig VRAM provisioning") +Signed-off-by: Michal Wajdeczko +Reviewed-by: Piotr Piórkowski +Link: https://lore.kernel.org/r/20250910222439.32869-1-michal.wajdeczko@intel.com +(cherry picked from commit 95c1cfa306087142989bff34ea0e05dcd95ddc58) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c b/drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c +index 53a44702c04af..c15dc600dcae7 100644 +--- a/drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c ++++ b/drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c +@@ -1600,7 +1600,6 @@ static u64 pf_estimate_fair_lmem(struct xe_gt *gt, unsigned int num_vfs) + u64 fair; + + fair = div_u64(available, num_vfs); +- fair = rounddown_pow_of_two(fair); /* XXX: ttm_vram_mgr & drm_buddy limitation */ + fair = ALIGN_DOWN(fair, alignment); + #ifdef MAX_FAIR_LMEM + fair = min_t(u64, MAX_FAIR_LMEM, fair); +-- +2.51.0 + diff --git a/queue-6.16/drm-xe-tile-release-kobject-for-the-failure-path.patch b/queue-6.16/drm-xe-tile-release-kobject-for-the-failure-path.patch new file mode 100644 index 0000000000..b836dbb18c --- /dev/null +++ b/queue-6.16/drm-xe-tile-release-kobject-for-the-failure-path.patch @@ -0,0 +1,57 @@ +From c0e395158d9150e16770441f4ec31926892b93e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Aug 2025 15:39:51 +0000 +Subject: drm/xe/tile: Release kobject for the failure path + +From: Shuicheng Lin + +[ Upstream commit 013e484dbd687a9174acf8f4450217bdb86ad788 ] + +Call kobject_put() for the failure path to release the kobject + +v2: remove extra newline. (Matt) + +Fixes: e3d0839aa501 ("drm/xe/tile: Abort driver load for sysfs creation failure") +Cc: Himal Prasad Ghimiray +Reviewed-by: Matthew Brost +Signed-off-by: Shuicheng Lin +Link: https://lore.kernel.org/r/20250819153950.2973344-2-shuicheng.lin@intel.com +Signed-off-by: Lucas De Marchi +(cherry picked from commit b98775bca99511cc22ab459a2de646cd2fa7241f) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_tile_sysfs.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_tile_sysfs.c b/drivers/gpu/drm/xe/xe_tile_sysfs.c +index b804234a65516..9e1236a9ec673 100644 +--- a/drivers/gpu/drm/xe/xe_tile_sysfs.c ++++ b/drivers/gpu/drm/xe/xe_tile_sysfs.c +@@ -44,16 +44,18 @@ int xe_tile_sysfs_init(struct xe_tile *tile) + kt->tile = tile; + + err = kobject_add(&kt->base, &dev->kobj, "tile%d", tile->id); +- if (err) { +- kobject_put(&kt->base); +- return err; +- } ++ if (err) ++ goto err_object; + + tile->sysfs = &kt->base; + + err = xe_vram_freq_sysfs_init(tile); + if (err) +- return err; ++ goto err_object; + + return devm_add_action_or_reset(xe->drm.dev, tile_sysfs_fini, tile); ++ ++err_object: ++ kobject_put(&kt->base); ++ return err; + } +-- +2.51.0 + diff --git a/queue-6.16/io_uring-fix-incorrect-io_kiocb-reference-in-io_link.patch b/queue-6.16/io_uring-fix-incorrect-io_kiocb-reference-in-io_link.patch new file mode 100644 index 0000000000..34f903428d --- /dev/null +++ b/queue-6.16/io_uring-fix-incorrect-io_kiocb-reference-in-io_link.patch @@ -0,0 +1,41 @@ +From ac18da7c0fea070d6416cd383d1d59034232dde2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 17:03:52 +0800 +Subject: io_uring: fix incorrect io_kiocb reference in io_link_skb + +From: Yang Xiuwei + +[ Upstream commit 2c139a47eff8de24e3350dadb4c9d5e3426db826 ] + +In io_link_skb function, there is a bug where prev_notif is incorrectly +assigned using 'nd' instead of 'prev_nd'. This causes the context +validation check to compare the current notification with itself instead +of comparing it with the previous notification. + +Fix by using the correct prev_nd parameter when obtaining prev_notif. + +Signed-off-by: Yang Xiuwei +Reviewed-by: Pavel Begunkov +Fixes: 6fe4220912d19 ("io_uring/notif: implement notification stacking") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/notif.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/io_uring/notif.c b/io_uring/notif.c +index 9a6f6e92d7424..ea9c0116cec2d 100644 +--- a/io_uring/notif.c ++++ b/io_uring/notif.c +@@ -85,7 +85,7 @@ static int io_link_skb(struct sk_buff *skb, struct ubuf_info *uarg) + return -EEXIST; + + prev_nd = container_of(prev_uarg, struct io_notif_data, uarg); +- prev_notif = cmd_to_io_kiocb(nd); ++ prev_notif = cmd_to_io_kiocb(prev_nd); + + /* make sure all noifications can be finished in the same task_work */ + if (unlikely(notif->ctx != prev_notif->ctx || +-- +2.51.0 + diff --git a/queue-6.16/io_uring-msg_ring-kill-alloc_cache-for-io_kiocb-allo.patch b/queue-6.16/io_uring-msg_ring-kill-alloc_cache-for-io_kiocb-allo.patch new file mode 100644 index 0000000000..f69158ab8e --- /dev/null +++ b/queue-6.16/io_uring-msg_ring-kill-alloc_cache-for-io_kiocb-allo.patch @@ -0,0 +1,129 @@ +From f7a63be0a3dfac03f847cc0911a2f7dadd0d3940 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 13:59:15 -0600 +Subject: io_uring/msg_ring: kill alloc_cache for io_kiocb allocations + +From: Jens Axboe + +[ Upstream commit df8922afc37aa2111ca79a216653a629146763ad ] + +A recent commit: + +fc582cd26e88 ("io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU") + +fixed an issue with not deferring freeing of io_kiocb structs that +msg_ring allocates to after the current RCU grace period. But this only +covers requests that don't end up in the allocation cache. If a request +goes into the alloc cache, it can get reused before it is sane to do so. +A recent syzbot report would seem to indicate that there's something +there, however it may very well just be because of the KASAN poisoning +that the alloc_cache handles manually. + +Rather than attempt to make the alloc_cache sane for that use case, just +drop the usage of the alloc_cache for msg_ring request payload data. + +Fixes: 50cf5f3842af ("io_uring/msg_ring: add an alloc cache for io_kiocb entries") +Link: https://lore.kernel.org/io-uring/68cc2687.050a0220.139b6.0005.GAE@google.com/ +Reported-by: syzbot+baa2e0f4e02df602583e@syzkaller.appspotmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + include/linux/io_uring_types.h | 3 --- + io_uring/io_uring.c | 4 ---- + io_uring/msg_ring.c | 24 ++---------------------- + 3 files changed, 2 insertions(+), 29 deletions(-) + +diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h +index a7efcec2e3d08..215ff20affa33 100644 +--- a/include/linux/io_uring_types.h ++++ b/include/linux/io_uring_types.h +@@ -418,9 +418,6 @@ struct io_ring_ctx { + struct list_head defer_list; + unsigned nr_drained; + +- struct io_alloc_cache msg_cache; +- spinlock_t msg_lock; +- + #ifdef CONFIG_NET_RX_BUSY_POLL + struct list_head napi_list; /* track busy poll napi_id */ + spinlock_t napi_lock; /* napi_list lock */ +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index aa8787777f29a..eaa5410e5a70a 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -290,7 +290,6 @@ static void io_free_alloc_caches(struct io_ring_ctx *ctx) + io_alloc_cache_free(&ctx->netmsg_cache, io_netmsg_cache_free); + io_alloc_cache_free(&ctx->rw_cache, io_rw_cache_free); + io_alloc_cache_free(&ctx->cmd_cache, io_cmd_cache_free); +- io_alloc_cache_free(&ctx->msg_cache, kfree); + io_futex_cache_free(ctx); + io_rsrc_cache_free(ctx); + } +@@ -337,9 +336,6 @@ static __cold struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p) + ret |= io_alloc_cache_init(&ctx->cmd_cache, IO_ALLOC_CACHE_MAX, + sizeof(struct io_async_cmd), + sizeof(struct io_async_cmd)); +- spin_lock_init(&ctx->msg_lock); +- ret |= io_alloc_cache_init(&ctx->msg_cache, IO_ALLOC_CACHE_MAX, +- sizeof(struct io_kiocb), 0); + ret |= io_futex_cache_init(ctx); + ret |= io_rsrc_cache_init(ctx); + if (ret) +diff --git a/io_uring/msg_ring.c b/io_uring/msg_ring.c +index 4c2578f2efcb0..5e5b94236d720 100644 +--- a/io_uring/msg_ring.c ++++ b/io_uring/msg_ring.c +@@ -11,7 +11,6 @@ + #include "io_uring.h" + #include "rsrc.h" + #include "filetable.h" +-#include "alloc_cache.h" + #include "msg_ring.h" + + /* All valid masks for MSG_RING */ +@@ -76,13 +75,7 @@ static void io_msg_tw_complete(struct io_kiocb *req, io_tw_token_t tw) + struct io_ring_ctx *ctx = req->ctx; + + io_add_aux_cqe(ctx, req->cqe.user_data, req->cqe.res, req->cqe.flags); +- if (spin_trylock(&ctx->msg_lock)) { +- if (io_alloc_cache_put(&ctx->msg_cache, req)) +- req = NULL; +- spin_unlock(&ctx->msg_lock); +- } +- if (req) +- kfree_rcu(req, rcu_head); ++ kfree_rcu(req, rcu_head); + percpu_ref_put(&ctx->refs); + } + +@@ -104,26 +97,13 @@ static int io_msg_remote_post(struct io_ring_ctx *ctx, struct io_kiocb *req, + return 0; + } + +-static struct io_kiocb *io_msg_get_kiocb(struct io_ring_ctx *ctx) +-{ +- struct io_kiocb *req = NULL; +- +- if (spin_trylock(&ctx->msg_lock)) { +- req = io_alloc_cache_get(&ctx->msg_cache); +- spin_unlock(&ctx->msg_lock); +- if (req) +- return req; +- } +- return kmem_cache_alloc(req_cachep, GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO); +-} +- + static int io_msg_data_remote(struct io_ring_ctx *target_ctx, + struct io_msg *msg) + { + struct io_kiocb *target; + u32 flags = 0; + +- target = io_msg_get_kiocb(target_ctx); ++ target = kmem_cache_alloc(req_cachep, GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO) ; + if (unlikely(!target)) + return -ENOMEM; + +-- +2.51.0 + diff --git a/queue-6.16/iommu-amd-fix-alias-device-dte-setting.patch b/queue-6.16/iommu-amd-fix-alias-device-dte-setting.patch new file mode 100644 index 0000000000..be74636fff --- /dev/null +++ b/queue-6.16/iommu-amd-fix-alias-device-dte-setting.patch @@ -0,0 +1,49 @@ +From 781766b15707033b5f2ac055810de8c862d3dd34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Sep 2025 13:14:06 +0000 +Subject: iommu/amd: Fix alias device DTE setting + +From: Vasant Hegde + +[ Upstream commit a0c17ed907ac3326cf3c9d6007ea222a746f5cc2 ] + +Commit 7bea695ada0 restructured DTE flag handling but inadvertently changed +the alias device configuration logic. This may cause incorrect DTE settings +for certain devices. + +Add alias flag check before calling set_dev_entry_from_acpi(). Also move the +device iteration loop inside the alias check to restrict execution to cases +where alias devices are present. + +Fixes: 7bea695ada0 ("iommu/amd: Introduce struct ivhd_dte_flags to store persistent DTE flags") +Cc: Suravee Suthikulpanit +Signed-off-by: Vasant Hegde +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/init.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c +index 3a97cc667943f..eef55aa4143c1 100644 +--- a/drivers/iommu/amd/init.c ++++ b/drivers/iommu/amd/init.c +@@ -1450,12 +1450,12 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu, + PCI_FUNC(e->devid)); + + devid = e->devid; +- for (dev_i = devid_start; dev_i <= devid; ++dev_i) { +- if (alias) ++ if (alias) { ++ for (dev_i = devid_start; dev_i <= devid; ++dev_i) + pci_seg->alias_table[dev_i] = devid_to; ++ set_dev_entry_from_acpi(iommu, devid_to, flags, ext_flags); + } + set_dev_entry_from_acpi_range(iommu, devid_start, devid, flags, ext_flags); +- set_dev_entry_from_acpi(iommu, devid_to, flags, ext_flags); + break; + case IVHD_DEV_SPECIAL: { + u8 handle, type; +-- +2.51.0 + diff --git a/queue-6.16/series b/queue-6.16/series index ba880eb4f9..4bb64ca3f1 100644 --- a/queue-6.16/series +++ b/queue-6.16/series @@ -105,3 +105,34 @@ mptcp-propagate-shutdown-to-subflows-when-possible.patch selftests-mptcp-connect-catch-io-errors-on-listen-side.patch selftests-mptcp-avoid-spurious-errors-on-tcp-disconnect.patch alsa-hda-realtek-fix-mute-led-for-hp-laptop-15-dw4xx.patch +asoc-wm8940-correct-pll-rate-rounding.patch +asoc-wm8940-correct-typo-in-control-name.patch +asoc-wm8974-correct-pll-rate-rounding.patch +asoc-codec-sma1307-fix-memory-corruption-in-sma1307_.patch +asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch +asoc-sdca-fix-return-value-in-sdca_regmap_mbq_size.patch +asoc-intel-catpt-expose-correct-bit-depth-to-userspa.patch +iommu-amd-fix-alias-device-dte-setting.patch +asoc-amd-acp-fix-incorrect-retrival-of-acp_chip_info.patch +drm-xe-tile-release-kobject-for-the-failure-path.patch +drm-xe-pf-drop-rounddown_pow_of_two-fair-lmem-limita.patch +drm-bridge-anx7625-fix-null-pointer-dereference-with.patch +drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch +drm-xe-fix-a-null-vs-is_err-in-xe_vm_add_compute_exe.patch +alsa-usb-qcom-fix-false-positive-address-space-check.patch +drm-xe-fix-error-handling-if-pxp-fails-to-start.patch +drm-xe-guc-enable-extended-cat-error-reporting.patch +drm-xe-guc-set-rcs-ccs-yield-policy.patch +smb-smbdirect-introduce-smbdirect_socket.recv_io.exp.patch +smb-client-make-use-of-smbdirect_socket-recv_io.expe.patch +smb-smbdirect-introduce-struct-smbdirect_recv_io.patch +smb-client-make-use-of-struct-smbdirect_recv_io.patch +smb-client-let-recv_done-verify-data_offset-data_len.patch +smb-client-fix-filename-matching-of-deferred-files.patch +smb-client-use-disable-_delayed-_work_sync-in-smbdir.patch +smb-client-let-smbd_destroy-call-disable_work_sync-i.patch +crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch +io_uring-msg_ring-kill-alloc_cache-for-io_kiocb-allo.patch +smb-client-fix-file-open-check-in-__cifs_unlink.patch +smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch +io_uring-fix-incorrect-io_kiocb-reference-in-io_link.patch diff --git a/queue-6.16/smb-client-fix-file-open-check-in-__cifs_unlink.patch b/queue-6.16/smb-client-fix-file-open-check-in-__cifs_unlink.patch new file mode 100644 index 0000000000..57cd3fee6d --- /dev/null +++ b/queue-6.16/smb-client-fix-file-open-check-in-__cifs_unlink.patch @@ -0,0 +1,54 @@ +From 4eea563d962dbf31e423fa0edf25636ece174472 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 12:30:32 -0300 +Subject: smb: client: fix file open check in __cifs_unlink() + +From: Paulo Alcantara + +[ Upstream commit 251090e2c2c1be60607d1c521af2c993f04d4f61 ] + +Fix the file open check to decide whether or not silly-rename the file +in SMB2+. + +Fixes: c5ea3065586d ("smb: client: fix data loss due to broken rename(2)") +Signed-off-by: Paulo Alcantara (Red Hat) +Cc: Frank Sorenson +Reviewed-by: David Howells +Cc: linux-cifs@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/inode.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c +index 1703f1285d36d..0f0d2dae6283a 100644 +--- a/fs/smb/client/inode.c ++++ b/fs/smb/client/inode.c +@@ -2003,8 +2003,21 @@ static int __cifs_unlink(struct inode *dir, struct dentry *dentry, bool sillyren + goto psx_del_no_retry; + } + +- if (sillyrename || (server->vals->protocol_id > SMB10_PROT_ID && +- d_is_positive(dentry) && d_count(dentry) > 2)) ++ /* For SMB2+, if the file is open, we always perform a silly rename. ++ * ++ * We check for d_count() right after calling ++ * cifs_close_deferred_file_under_dentry() to make sure that the ++ * dentry's refcount gets dropped in case the file had any deferred ++ * close. ++ */ ++ if (!sillyrename && server->vals->protocol_id > SMB10_PROT_ID) { ++ spin_lock(&dentry->d_lock); ++ if (d_count(dentry) > 1) ++ sillyrename = true; ++ spin_unlock(&dentry->d_lock); ++ } ++ ++ if (sillyrename) + rc = -EBUSY; + else + rc = server->ops->unlink(xid, tcon, full_path, cifs_sb, dentry); +-- +2.51.0 + diff --git a/queue-6.16/smb-client-fix-filename-matching-of-deferred-files.patch b/queue-6.16/smb-client-fix-filename-matching-of-deferred-files.patch new file mode 100644 index 0000000000..2705ef82d5 --- /dev/null +++ b/queue-6.16/smb-client-fix-filename-matching-of-deferred-files.patch @@ -0,0 +1,139 @@ +From 7f18145b22aff861112d024ed8805ccdb8d0772e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Sep 2025 16:03:22 -0300 +Subject: smb: client: fix filename matching of deferred files + +From: Paulo Alcantara + +[ Upstream commit 93ed9a2951308db374cba4562533dde97bac70d3 ] + +Fix the following case where the client would end up closing both +deferred files (foo.tmp & foo) after unlink(foo) due to strstr() call +in cifs_close_deferred_file_under_dentry(): + + fd1 = openat(AT_FDCWD, "foo", O_WRONLY|O_CREAT|O_TRUNC, 0666); + fd2 = openat(AT_FDCWD, "foo.tmp", O_WRONLY|O_CREAT|O_TRUNC, 0666); + close(fd1); + close(fd2); + unlink("foo"); + +Fixes: e3fc065682eb ("cifs: Deferred close performance improvements") +Signed-off-by: Paulo Alcantara (Red Hat) +Reviewed-by: Enzo Matsumiya +Cc: Frank Sorenson +Cc: David Howells +Cc: linux-cifs@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsproto.h | 4 ++-- + fs/smb/client/inode.c | 6 +++--- + fs/smb/client/misc.c | 38 ++++++++++++++++---------------------- + 3 files changed, 21 insertions(+), 27 deletions(-) + +diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h +index 045227ed4efc9..0dcea9acca544 100644 +--- a/fs/smb/client/cifsproto.h ++++ b/fs/smb/client/cifsproto.h +@@ -297,8 +297,8 @@ extern void cifs_close_deferred_file(struct cifsInodeInfo *cifs_inode); + + extern void cifs_close_all_deferred_files(struct cifs_tcon *cifs_tcon); + +-extern void cifs_close_deferred_file_under_dentry(struct cifs_tcon *cifs_tcon, +- const char *path); ++void cifs_close_deferred_file_under_dentry(struct cifs_tcon *cifs_tcon, ++ struct dentry *dentry); + + extern void cifs_mark_open_handles_for_deleted_file(struct inode *inode, + const char *path); +diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c +index 11d442e8b3d62..1703f1285d36d 100644 +--- a/fs/smb/client/inode.c ++++ b/fs/smb/client/inode.c +@@ -1984,7 +1984,7 @@ static int __cifs_unlink(struct inode *dir, struct dentry *dentry, bool sillyren + } + + netfs_wait_for_outstanding_io(inode); +- cifs_close_deferred_file_under_dentry(tcon, full_path); ++ cifs_close_deferred_file_under_dentry(tcon, dentry); + #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY + if (cap_unix(tcon->ses) && (CIFS_UNIX_POSIX_PATH_OPS_CAP & + le64_to_cpu(tcon->fsUnixInfo.Capability))) { +@@ -2538,10 +2538,10 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir, + goto cifs_rename_exit; + } + +- cifs_close_deferred_file_under_dentry(tcon, from_name); ++ cifs_close_deferred_file_under_dentry(tcon, source_dentry); + if (d_inode(target_dentry) != NULL) { + netfs_wait_for_outstanding_io(d_inode(target_dentry)); +- cifs_close_deferred_file_under_dentry(tcon, to_name); ++ cifs_close_deferred_file_under_dentry(tcon, target_dentry); + } + + rc = cifs_do_rename(xid, source_dentry, from_name, target_dentry, +diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c +index da23cc12a52ca..dda6dece802ad 100644 +--- a/fs/smb/client/misc.c ++++ b/fs/smb/client/misc.c +@@ -832,33 +832,28 @@ cifs_close_all_deferred_files(struct cifs_tcon *tcon) + kfree(tmp_list); + } + } +-void +-cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, const char *path) ++ ++void cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, ++ struct dentry *dentry) + { +- struct cifsFileInfo *cfile; + struct file_list *tmp_list, *tmp_next_list; +- void *page; +- const char *full_path; ++ struct cifsFileInfo *cfile; + LIST_HEAD(file_head); + +- page = alloc_dentry_path(); + spin_lock(&tcon->open_file_lock); + list_for_each_entry(cfile, &tcon->openFileList, tlist) { +- full_path = build_path_from_dentry(cfile->dentry, page); +- if (strstr(full_path, path)) { +- if (delayed_work_pending(&cfile->deferred)) { +- if (cancel_delayed_work(&cfile->deferred)) { +- spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); +- cifs_del_deferred_close(cfile); +- spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); +- +- tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC); +- if (tmp_list == NULL) +- break; +- tmp_list->cfile = cfile; +- list_add_tail(&tmp_list->list, &file_head); +- } +- } ++ if ((cfile->dentry == dentry) && ++ delayed_work_pending(&cfile->deferred) && ++ cancel_delayed_work(&cfile->deferred)) { ++ spin_lock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); ++ cifs_del_deferred_close(cfile); ++ spin_unlock(&CIFS_I(d_inode(cfile->dentry))->deferred_lock); ++ ++ tmp_list = kmalloc(sizeof(struct file_list), GFP_ATOMIC); ++ if (tmp_list == NULL) ++ break; ++ tmp_list->cfile = cfile; ++ list_add_tail(&tmp_list->list, &file_head); + } + } + spin_unlock(&tcon->open_file_lock); +@@ -868,7 +863,6 @@ cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, const char *path) + list_del(&tmp_list->list); + kfree(tmp_list); + } +- free_dentry_path(page); + } + + /* +-- +2.51.0 + diff --git a/queue-6.16/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch b/queue-6.16/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch new file mode 100644 index 0000000000..27306120dd --- /dev/null +++ b/queue-6.16/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch @@ -0,0 +1,46 @@ +From d172afc896e8b3707a55b520c4f23dae608b22d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 03:06:46 +0200 +Subject: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error + path + +From: Stefan Metzmacher + +[ Upstream commit daac51c7032036a0ca5f1aa419ad1b0471d1c6e0 ] + +During tests of another unrelated patch I was able to trigger this +error: Objects remaining on __kmem_cache_shutdown() + +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smbdirect.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c +index 8b920410cd2fe..6dd2a1c66df3d 100644 +--- a/fs/smb/client/smbdirect.c ++++ b/fs/smb/client/smbdirect.c +@@ -1101,8 +1101,10 @@ static int smbd_negotiate(struct smbd_connection *info) + log_rdma_event(INFO, "smbd_post_recv rc=%d iov.addr=0x%llx iov.length=%u iov.lkey=0x%x\n", + rc, response->sge.addr, + response->sge.length, response->sge.lkey); +- if (rc) ++ if (rc) { ++ put_receive_buffer(info, response); + return rc; ++ } + + init_completion(&info->negotiate_completion); + info->negotiate_done = false; +-- +2.51.0 + diff --git a/queue-6.16/smb-client-let-recv_done-verify-data_offset-data_len.patch b/queue-6.16/smb-client-let-recv_done-verify-data_offset-data_len.patch new file mode 100644 index 0000000000..e58796b5c4 --- /dev/null +++ b/queue-6.16/smb-client-let-recv_done-verify-data_offset-data_len.patch @@ -0,0 +1,69 @@ +From 2c3f3d2caa6324d781d9e4ce2f2cf5c72a478094 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Sep 2025 11:49:05 +0200 +Subject: smb: client: let recv_done verify data_offset, data_length and + remaining_data_length + +From: Stefan Metzmacher + +[ Upstream commit f57e53ea252363234f86674db475839e5b87102e ] + +This is inspired by the related server fixes. + +Cc: Tom Talpey +Cc: Long Li +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Reviewed-by: Namjae Jeon +Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smbdirect.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c +index 18702c67c8484..65175ac3d8418 100644 +--- a/fs/smb/client/smbdirect.c ++++ b/fs/smb/client/smbdirect.c +@@ -446,9 +446,12 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) + struct smbdirect_recv_io *response = + container_of(wc->wr_cqe, struct smbdirect_recv_io, cqe); + struct smbdirect_socket *sc = response->socket; ++ struct smbdirect_socket_parameters *sp = &sc->parameters; + struct smbd_connection *info = + container_of(sc, struct smbd_connection, socket); +- int data_length = 0; ++ u32 data_offset = 0; ++ u32 data_length = 0; ++ u32 remaining_data_length = 0; + + log_rdma_recv(INFO, "response=0x%p type=%d wc status=%d wc opcode %d byte_len=%d pkey_index=%u\n", + response, sc->recv_io.expected, wc->status, wc->opcode, +@@ -480,7 +483,22 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) + /* SMBD data transfer packet */ + case SMBDIRECT_EXPECT_DATA_TRANSFER: + data_transfer = smbdirect_recv_io_payload(response); ++ ++ if (wc->byte_len < ++ offsetof(struct smbdirect_data_transfer, padding)) ++ goto error; ++ ++ remaining_data_length = le32_to_cpu(data_transfer->remaining_data_length); ++ data_offset = le32_to_cpu(data_transfer->data_offset); + data_length = le32_to_cpu(data_transfer->data_length); ++ if (wc->byte_len < data_offset || ++ (u64)wc->byte_len < (u64)data_offset + data_length) ++ goto error; ++ ++ if (remaining_data_length > sp->max_fragmented_recv_size || ++ data_length > sp->max_fragmented_recv_size || ++ (u64)remaining_data_length + (u64)data_length > (u64)sp->max_fragmented_recv_size) ++ goto error; + + if (data_length) { + if (info->full_packet_received) +-- +2.51.0 + diff --git a/queue-6.16/smb-client-let-smbd_destroy-call-disable_work_sync-i.patch b/queue-6.16/smb-client-let-smbd_destroy-call-disable_work_sync-i.patch new file mode 100644 index 0000000000..9ce6d5bd10 --- /dev/null +++ b/queue-6.16/smb-client-let-smbd_destroy-call-disable_work_sync-i.patch @@ -0,0 +1,75 @@ +From 7705468b9b2dc2323c6a7cbbbfeba7312013f6b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 13:03:19 +0200 +Subject: smb: client: let smbd_destroy() call + disable_work_sync(&info->post_send_credits_work) + +From: Stefan Metzmacher + +[ Upstream commit d9dcbbcf9145b68aa85c40947311a6907277e097 ] + +In smbd_destroy() we may destroy the memory so we better +wait until post_send_credits_work is no longer pending +and will never be started again. + +I actually just hit the case using rxe: + +WARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe] +... +[ 5305.686979] [ T138] smbd_post_recv+0x445/0xc10 [cifs] +[ 5305.687135] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 5305.687149] [ T138] ? __kasan_check_write+0x14/0x30 +[ 5305.687185] [ T138] ? __pfx_smbd_post_recv+0x10/0x10 [cifs] +[ 5305.687329] [ T138] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 +[ 5305.687356] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 5305.687368] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 5305.687378] [ T138] ? _raw_spin_unlock_irqrestore+0x11/0x60 +[ 5305.687389] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 5305.687399] [ T138] ? get_receive_buffer+0x168/0x210 [cifs] +[ 5305.687555] [ T138] smbd_post_send_credits+0x382/0x4b0 [cifs] +[ 5305.687701] [ T138] ? __pfx_smbd_post_send_credits+0x10/0x10 [cifs] +[ 5305.687855] [ T138] ? __pfx___schedule+0x10/0x10 +[ 5305.687865] [ T138] ? __pfx__raw_spin_lock_irq+0x10/0x10 +[ 5305.687875] [ T138] ? queue_delayed_work_on+0x8e/0xa0 +[ 5305.687889] [ T138] process_one_work+0x629/0xf80 +[ 5305.687908] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 +[ 5305.687917] [ T138] ? __kasan_check_write+0x14/0x30 +[ 5305.687933] [ T138] worker_thread+0x87f/0x1570 +... + +It means rxe_post_recv was called after rdma_destroy_qp(). +This happened because put_receive_buffer() was triggered +by ib_drain_qp() and called: +queue_work(info->workqueue, &info->post_send_credits_work); + +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smbdirect.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c +index 8c6e766078e14..8b920410cd2fe 100644 +--- a/fs/smb/client/smbdirect.c ++++ b/fs/smb/client/smbdirect.c +@@ -1335,6 +1335,9 @@ void smbd_destroy(struct TCP_Server_Info *server) + sc->status == SMBDIRECT_SOCKET_DISCONNECTED); + } + ++ log_rdma_event(INFO, "cancelling post_send_credits_work\n"); ++ disable_work_sync(&info->post_send_credits_work); ++ + log_rdma_event(INFO, "destroying qp\n"); + ib_drain_qp(sc->ib.qp); + rdma_destroy_qp(sc->rdma.cm_id); +-- +2.51.0 + diff --git a/queue-6.16/smb-client-make-use-of-smbdirect_socket-recv_io.expe.patch b/queue-6.16/smb-client-make-use-of-smbdirect_socket-recv_io.expe.patch new file mode 100644 index 0000000000..38eaee9e35 --- /dev/null +++ b/queue-6.16/smb-client-make-use-of-smbdirect_socket-recv_io.expe.patch @@ -0,0 +1,140 @@ +From 793bcf95683f1c4bef17adc4d8df87a65db09fb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Aug 2025 18:11:31 +0200 +Subject: smb: client: make use of smbdirect_socket->recv_io.expected + +From: Stefan Metzmacher + +[ Upstream commit bbdbd9ae47155da65aa0c1641698a44d85c2faa2 ] + +The expected incoming message type can be per connection. + +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Stable-dep-of: f57e53ea2523 ("smb: client: let recv_done verify data_offset, data_length and remaining_data_length") +Signed-off-by: Sasha Levin +--- + fs/smb/client/smbdirect.c | 22 ++++++++++++++-------- + fs/smb/client/smbdirect.h | 7 ------- + 2 files changed, 14 insertions(+), 15 deletions(-) + +diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c +index b9bb531717a65..a6aa2c609dc3b 100644 +--- a/fs/smb/client/smbdirect.c ++++ b/fs/smb/client/smbdirect.c +@@ -383,6 +383,7 @@ static bool process_negotiation_response( + info->max_frmr_depth * PAGE_SIZE); + info->max_frmr_depth = sp->max_read_write_size / PAGE_SIZE; + ++ sc->recv_io.expected = SMBDIRECT_EXPECT_DATA_TRANSFER; + return true; + } + +@@ -408,7 +409,6 @@ static void smbd_post_send_credits(struct work_struct *work) + if (!response) + break; + +- response->type = SMBD_TRANSFER_DATA; + response->first_segment = false; + rc = smbd_post_recv(info, response); + if (rc) { +@@ -445,10 +445,11 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) + struct smbd_response *response = + container_of(wc->wr_cqe, struct smbd_response, cqe); + struct smbd_connection *info = response->info; ++ struct smbdirect_socket *sc = &info->socket; + int data_length = 0; + + log_rdma_recv(INFO, "response=0x%p type=%d wc status=%d wc opcode %d byte_len=%d pkey_index=%u\n", +- response, response->type, wc->status, wc->opcode, ++ response, sc->recv_io.expected, wc->status, wc->opcode, + wc->byte_len, wc->pkey_index); + + if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_RECV) { +@@ -463,9 +464,9 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) + response->sge.length, + DMA_FROM_DEVICE); + +- switch (response->type) { ++ switch (sc->recv_io.expected) { + /* SMBD negotiation response */ +- case SMBD_NEGOTIATE_RESP: ++ case SMBDIRECT_EXPECT_NEGOTIATE_REP: + dump_smbdirect_negotiate_resp(smbd_response_payload(response)); + info->full_packet_received = true; + info->negotiate_done = +@@ -475,7 +476,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) + return; + + /* SMBD data transfer packet */ +- case SMBD_TRANSFER_DATA: ++ case SMBDIRECT_EXPECT_DATA_TRANSFER: + data_transfer = smbd_response_payload(response); + data_length = le32_to_cpu(data_transfer->data_length); + +@@ -526,13 +527,17 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) + put_receive_buffer(info, response); + + return; ++ ++ case SMBDIRECT_EXPECT_NEGOTIATE_REQ: ++ /* Only server... */ ++ break; + } + + /* + * This is an internal error! + */ +- log_rdma_recv(ERR, "unexpected response type=%d\n", response->type); +- WARN_ON_ONCE(response->type != SMBD_TRANSFER_DATA); ++ log_rdma_recv(ERR, "unexpected response type=%d\n", sc->recv_io.expected); ++ WARN_ON_ONCE(sc->recv_io.expected != SMBDIRECT_EXPECT_DATA_TRANSFER); + error: + put_receive_buffer(info, response); + smbd_disconnect_rdma_connection(info); +@@ -1067,10 +1072,11 @@ static int smbd_post_recv( + /* Perform SMBD negotiate according to [MS-SMBD] 3.1.5.2 */ + static int smbd_negotiate(struct smbd_connection *info) + { ++ struct smbdirect_socket *sc = &info->socket; + int rc; + struct smbd_response *response = get_receive_buffer(info); + +- response->type = SMBD_NEGOTIATE_RESP; ++ sc->recv_io.expected = SMBDIRECT_EXPECT_NEGOTIATE_REP; + rc = smbd_post_recv(info, response); + log_rdma_event(INFO, "smbd_post_recv rc=%d iov.addr=0x%llx iov.length=%u iov.lkey=0x%x\n", + rc, response->sge.addr, +diff --git a/fs/smb/client/smbdirect.h b/fs/smb/client/smbdirect.h +index ea04ce8a9763a..bf50544eaf02d 100644 +--- a/fs/smb/client/smbdirect.h ++++ b/fs/smb/client/smbdirect.h +@@ -157,11 +157,6 @@ struct smbd_connection { + unsigned int count_send_empty; + }; + +-enum smbd_message_type { +- SMBD_NEGOTIATE_RESP, +- SMBD_TRANSFER_DATA, +-}; +- + /* Maximum number of SGEs used by smbdirect.c in any send work request */ + #define SMBDIRECT_MAX_SEND_SGE 6 + +@@ -187,8 +182,6 @@ struct smbd_response { + struct ib_cqe cqe; + struct ib_sge sge; + +- enum smbd_message_type type; +- + /* Link to receive queue or reassembly queue */ + struct list_head list; + +-- +2.51.0 + diff --git a/queue-6.16/smb-client-make-use-of-struct-smbdirect_recv_io.patch b/queue-6.16/smb-client-make-use-of-struct-smbdirect_recv_io.patch new file mode 100644 index 0000000000..b0749592e7 --- /dev/null +++ b/queue-6.16/smb-client-make-use-of-struct-smbdirect_recv_io.patch @@ -0,0 +1,321 @@ +From 1232a1f85dd88d3a1f1bbc52827d27b0f27f6549 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Aug 2025 18:11:33 +0200 +Subject: smb: client: make use of struct smbdirect_recv_io + +From: Stefan Metzmacher + +[ Upstream commit 5dddf0497445d247e995306daf3b76dd0633831c ] + +This is the shared structure that will be used in +the server too and will allow us to move helper functions +into common code soon. + +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Stable-dep-of: f57e53ea2523 ("smb: client: let recv_done verify data_offset, data_length and remaining_data_length") +Signed-off-by: Sasha Levin +--- + fs/smb/client/smbdirect.c | 79 ++++++++++++++++++++------------------- + fs/smb/client/smbdirect.h | 16 -------- + 2 files changed, 41 insertions(+), 54 deletions(-) + +diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c +index a6aa2c609dc3b..18702c67c8484 100644 +--- a/fs/smb/client/smbdirect.c ++++ b/fs/smb/client/smbdirect.c +@@ -13,23 +13,23 @@ + #include "cifsproto.h" + #include "smb2proto.h" + +-static struct smbd_response *get_receive_buffer( ++static struct smbdirect_recv_io *get_receive_buffer( + struct smbd_connection *info); + static void put_receive_buffer( + struct smbd_connection *info, +- struct smbd_response *response); ++ struct smbdirect_recv_io *response); + static int allocate_receive_buffers(struct smbd_connection *info, int num_buf); + static void destroy_receive_buffers(struct smbd_connection *info); + + static void enqueue_reassembly( + struct smbd_connection *info, +- struct smbd_response *response, int data_length); +-static struct smbd_response *_get_first_reassembly( ++ struct smbdirect_recv_io *response, int data_length); ++static struct smbdirect_recv_io *_get_first_reassembly( + struct smbd_connection *info); + + static int smbd_post_recv( + struct smbd_connection *info, +- struct smbd_response *response); ++ struct smbdirect_recv_io *response); + + static int smbd_post_send_empty(struct smbd_connection *info); + +@@ -260,7 +260,7 @@ static inline void *smbd_request_payload(struct smbd_request *request) + return (void *)request->packet; + } + +-static inline void *smbd_response_payload(struct smbd_response *response) ++static inline void *smbdirect_recv_io_payload(struct smbdirect_recv_io *response) + { + return (void *)response->packet; + } +@@ -315,12 +315,13 @@ static void dump_smbdirect_negotiate_resp(struct smbdirect_negotiate_resp *resp) + * return value: true if negotiation is a success, false if failed + */ + static bool process_negotiation_response( +- struct smbd_response *response, int packet_length) ++ struct smbdirect_recv_io *response, int packet_length) + { +- struct smbd_connection *info = response->info; +- struct smbdirect_socket *sc = &info->socket; ++ struct smbdirect_socket *sc = response->socket; ++ struct smbd_connection *info = ++ container_of(sc, struct smbd_connection, socket); + struct smbdirect_socket_parameters *sp = &sc->parameters; +- struct smbdirect_negotiate_resp *packet = smbd_response_payload(response); ++ struct smbdirect_negotiate_resp *packet = smbdirect_recv_io_payload(response); + + if (packet_length < sizeof(struct smbdirect_negotiate_resp)) { + log_rdma_event(ERR, +@@ -391,7 +392,7 @@ static void smbd_post_send_credits(struct work_struct *work) + { + int ret = 0; + int rc; +- struct smbd_response *response; ++ struct smbdirect_recv_io *response; + struct smbd_connection *info = + container_of(work, struct smbd_connection, + post_send_credits_work); +@@ -442,10 +443,11 @@ static void smbd_post_send_credits(struct work_struct *work) + static void recv_done(struct ib_cq *cq, struct ib_wc *wc) + { + struct smbdirect_data_transfer *data_transfer; +- struct smbd_response *response = +- container_of(wc->wr_cqe, struct smbd_response, cqe); +- struct smbd_connection *info = response->info; +- struct smbdirect_socket *sc = &info->socket; ++ struct smbdirect_recv_io *response = ++ container_of(wc->wr_cqe, struct smbdirect_recv_io, cqe); ++ struct smbdirect_socket *sc = response->socket; ++ struct smbd_connection *info = ++ container_of(sc, struct smbd_connection, socket); + int data_length = 0; + + log_rdma_recv(INFO, "response=0x%p type=%d wc status=%d wc opcode %d byte_len=%d pkey_index=%u\n", +@@ -467,7 +469,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) + switch (sc->recv_io.expected) { + /* SMBD negotiation response */ + case SMBDIRECT_EXPECT_NEGOTIATE_REP: +- dump_smbdirect_negotiate_resp(smbd_response_payload(response)); ++ dump_smbdirect_negotiate_resp(smbdirect_recv_io_payload(response)); + info->full_packet_received = true; + info->negotiate_done = + process_negotiation_response(response, wc->byte_len); +@@ -477,7 +479,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc) + + /* SMBD data transfer packet */ + case SMBDIRECT_EXPECT_DATA_TRANSFER: +- data_transfer = smbd_response_payload(response); ++ data_transfer = smbdirect_recv_io_payload(response); + data_length = le32_to_cpu(data_transfer->data_length); + + if (data_length) { +@@ -1034,7 +1036,7 @@ static int smbd_post_send_full_iter(struct smbd_connection *info, + * The interaction is controlled by send/receive credit system + */ + static int smbd_post_recv( +- struct smbd_connection *info, struct smbd_response *response) ++ struct smbd_connection *info, struct smbdirect_recv_io *response) + { + struct smbdirect_socket *sc = &info->socket; + struct smbdirect_socket_parameters *sp = &sc->parameters; +@@ -1074,7 +1076,7 @@ static int smbd_negotiate(struct smbd_connection *info) + { + struct smbdirect_socket *sc = &info->socket; + int rc; +- struct smbd_response *response = get_receive_buffer(info); ++ struct smbdirect_recv_io *response = get_receive_buffer(info); + + sc->recv_io.expected = SMBDIRECT_EXPECT_NEGOTIATE_REP; + rc = smbd_post_recv(info, response); +@@ -1119,7 +1121,7 @@ static int smbd_negotiate(struct smbd_connection *info) + */ + static void enqueue_reassembly( + struct smbd_connection *info, +- struct smbd_response *response, ++ struct smbdirect_recv_io *response, + int data_length) + { + spin_lock(&info->reassembly_queue_lock); +@@ -1143,14 +1145,14 @@ static void enqueue_reassembly( + * Caller is responsible for locking + * return value: the first entry if any, NULL if queue is empty + */ +-static struct smbd_response *_get_first_reassembly(struct smbd_connection *info) ++static struct smbdirect_recv_io *_get_first_reassembly(struct smbd_connection *info) + { +- struct smbd_response *ret = NULL; ++ struct smbdirect_recv_io *ret = NULL; + + if (!list_empty(&info->reassembly_queue)) { + ret = list_first_entry( + &info->reassembly_queue, +- struct smbd_response, list); ++ struct smbdirect_recv_io, list); + } + return ret; + } +@@ -1161,16 +1163,16 @@ static struct smbd_response *_get_first_reassembly(struct smbd_connection *info) + * pre-allocated in advance. + * return value: the receive buffer, NULL if none is available + */ +-static struct smbd_response *get_receive_buffer(struct smbd_connection *info) ++static struct smbdirect_recv_io *get_receive_buffer(struct smbd_connection *info) + { +- struct smbd_response *ret = NULL; ++ struct smbdirect_recv_io *ret = NULL; + unsigned long flags; + + spin_lock_irqsave(&info->receive_queue_lock, flags); + if (!list_empty(&info->receive_queue)) { + ret = list_first_entry( + &info->receive_queue, +- struct smbd_response, list); ++ struct smbdirect_recv_io, list); + list_del(&ret->list); + info->count_receive_queue--; + info->count_get_receive_buffer++; +@@ -1187,7 +1189,7 @@ static struct smbd_response *get_receive_buffer(struct smbd_connection *info) + * receive buffer is returned. + */ + static void put_receive_buffer( +- struct smbd_connection *info, struct smbd_response *response) ++ struct smbd_connection *info, struct smbdirect_recv_io *response) + { + struct smbdirect_socket *sc = &info->socket; + unsigned long flags; +@@ -1212,8 +1214,9 @@ static void put_receive_buffer( + /* Preallocate all receive buffer on transport establishment */ + static int allocate_receive_buffers(struct smbd_connection *info, int num_buf) + { ++ struct smbdirect_socket *sc = &info->socket; ++ struct smbdirect_recv_io *response; + int i; +- struct smbd_response *response; + + INIT_LIST_HEAD(&info->reassembly_queue); + spin_lock_init(&info->reassembly_queue_lock); +@@ -1231,7 +1234,7 @@ static int allocate_receive_buffers(struct smbd_connection *info, int num_buf) + if (!response) + goto allocate_failed; + +- response->info = info; ++ response->socket = sc; + response->sge.length = 0; + list_add_tail(&response->list, &info->receive_queue); + info->count_receive_queue++; +@@ -1243,7 +1246,7 @@ static int allocate_receive_buffers(struct smbd_connection *info, int num_buf) + while (!list_empty(&info->receive_queue)) { + response = list_first_entry( + &info->receive_queue, +- struct smbd_response, list); ++ struct smbdirect_recv_io, list); + list_del(&response->list); + info->count_receive_queue--; + +@@ -1254,7 +1257,7 @@ static int allocate_receive_buffers(struct smbd_connection *info, int num_buf) + + static void destroy_receive_buffers(struct smbd_connection *info) + { +- struct smbd_response *response; ++ struct smbdirect_recv_io *response; + + while ((response = get_receive_buffer(info))) + mempool_free(response, info->response_mempool); +@@ -1295,7 +1298,7 @@ void smbd_destroy(struct TCP_Server_Info *server) + struct smbd_connection *info = server->smbd_conn; + struct smbdirect_socket *sc; + struct smbdirect_socket_parameters *sp; +- struct smbd_response *response; ++ struct smbdirect_recv_io *response; + unsigned long flags; + + if (!info) { +@@ -1452,17 +1455,17 @@ static int allocate_caches_and_workqueue(struct smbd_connection *info) + if (!info->request_mempool) + goto out1; + +- scnprintf(name, MAX_NAME_LEN, "smbd_response_%p", info); ++ scnprintf(name, MAX_NAME_LEN, "smbdirect_recv_io_%p", info); + + struct kmem_cache_args response_args = { +- .align = __alignof__(struct smbd_response), +- .useroffset = (offsetof(struct smbd_response, packet) + ++ .align = __alignof__(struct smbdirect_recv_io), ++ .useroffset = (offsetof(struct smbdirect_recv_io, packet) + + sizeof(struct smbdirect_data_transfer)), + .usersize = sp->max_recv_size - sizeof(struct smbdirect_data_transfer), + }; + info->response_cache = + kmem_cache_create(name, +- sizeof(struct smbd_response) + sp->max_recv_size, ++ sizeof(struct smbdirect_recv_io) + sp->max_recv_size, + &response_args, SLAB_HWCACHE_ALIGN); + if (!info->response_cache) + goto out2; +@@ -1753,7 +1756,7 @@ struct smbd_connection *smbd_get_connection( + int smbd_recv(struct smbd_connection *info, struct msghdr *msg) + { + struct smbdirect_socket *sc = &info->socket; +- struct smbd_response *response; ++ struct smbdirect_recv_io *response; + struct smbdirect_data_transfer *data_transfer; + size_t size = iov_iter_count(&msg->msg_iter); + int to_copy, to_read, data_read, offset; +@@ -1789,7 +1792,7 @@ int smbd_recv(struct smbd_connection *info, struct msghdr *msg) + offset = info->first_entry_offset; + while (data_read < size) { + response = _get_first_reassembly(info); +- data_transfer = smbd_response_payload(response); ++ data_transfer = smbdirect_recv_io_payload(response); + data_length = le32_to_cpu(data_transfer->data_length); + remaining_data_length = + le32_to_cpu( +diff --git a/fs/smb/client/smbdirect.h b/fs/smb/client/smbdirect.h +index bf50544eaf02d..d60e445da2256 100644 +--- a/fs/smb/client/smbdirect.h ++++ b/fs/smb/client/smbdirect.h +@@ -176,22 +176,6 @@ struct smbd_request { + /* Maximum number of SGEs used by smbdirect.c in any receive work request */ + #define SMBDIRECT_MAX_RECV_SGE 1 + +-/* The context for a SMBD response */ +-struct smbd_response { +- struct smbd_connection *info; +- struct ib_cqe cqe; +- struct ib_sge sge; +- +- /* Link to receive queue or reassembly queue */ +- struct list_head list; +- +- /* Indicate if this is the 1st packet of a payload */ +- bool first_segment; +- +- /* SMBD packet header and payload follows this structure */ +- u8 packet[]; +-}; +- + /* Create a SMBDirect session */ + struct smbd_connection *smbd_get_connection( + struct TCP_Server_Info *server, struct sockaddr *dstaddr); +-- +2.51.0 + diff --git a/queue-6.16/smb-client-use-disable-_delayed-_work_sync-in-smbdir.patch b/queue-6.16/smb-client-use-disable-_delayed-_work_sync-in-smbdir.patch new file mode 100644 index 0000000000..eb354d64e8 --- /dev/null +++ b/queue-6.16/smb-client-use-disable-_delayed-_work_sync-in-smbdir.patch @@ -0,0 +1,64 @@ +From fa51146113a8cf5d599716959423afa87a7dafd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Aug 2025 12:58:21 +0200 +Subject: smb: client: use disable[_delayed]_work_sync in smbdirect.c + +From: Stefan Metzmacher + +[ Upstream commit bac28f604c7699727b2fecf14c3a54668bbe458e ] + +This makes it safer during the disconnect and avoids +requeueing. + +It's ok to call disable[delayed_]work[_sync]() more than once. + +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Fixes: 050b8c374019 ("smbd: Make upper layer decide when to destroy the transport") +Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") +Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smbdirect.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c +index 65175ac3d8418..8c6e766078e14 100644 +--- a/fs/smb/client/smbdirect.c ++++ b/fs/smb/client/smbdirect.c +@@ -1341,7 +1341,7 @@ void smbd_destroy(struct TCP_Server_Info *server) + sc->ib.qp = NULL; + + log_rdma_event(INFO, "cancelling idle timer\n"); +- cancel_delayed_work_sync(&info->idle_timer_work); ++ disable_delayed_work_sync(&info->idle_timer_work); + + /* It's not possible for upper layer to get to reassembly */ + log_rdma_event(INFO, "drain the reassembly queue\n"); +@@ -1713,7 +1713,7 @@ static struct smbd_connection *_smbd_get_connection( + return NULL; + + negotiation_failed: +- cancel_delayed_work_sync(&info->idle_timer_work); ++ disable_delayed_work_sync(&info->idle_timer_work); + destroy_caches_and_workqueue(info); + sc->status = SMBDIRECT_SOCKET_NEGOTIATE_FAILED; + rdma_disconnect(sc->rdma.cm_id); +@@ -2072,7 +2072,7 @@ static void destroy_mr_list(struct smbd_connection *info) + struct smbdirect_socket *sc = &info->socket; + struct smbd_mr *mr, *tmp; + +- cancel_work_sync(&info->mr_recovery_work); ++ disable_work_sync(&info->mr_recovery_work); + list_for_each_entry_safe(mr, tmp, &info->mr_list, list) { + if (mr->state == MR_INVALIDATED) + ib_dma_unmap_sg(sc->ib.dev, mr->sgt.sgl, +-- +2.51.0 + diff --git a/queue-6.16/smb-smbdirect-introduce-smbdirect_socket.recv_io.exp.patch b/queue-6.16/smb-smbdirect-introduce-smbdirect_socket.recv_io.exp.patch new file mode 100644 index 0000000000..1ce5c388d4 --- /dev/null +++ b/queue-6.16/smb-smbdirect-introduce-smbdirect_socket.recv_io.exp.patch @@ -0,0 +1,57 @@ +From 8d1290adc3051be1a50aeba98780205c23f627ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Aug 2025 18:11:30 +0200 +Subject: smb: smbdirect: introduce smbdirect_socket.recv_io.expected + +From: Stefan Metzmacher + +[ Upstream commit 33dd53a90e3419ea260e9ff2b4aa107385cdf7fa ] + +The expected message type can be global as they never change +during the after negotiation process. + +This will replace smbd_response->type and smb_direct_recvmsg->type +in future. + +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Stable-dep-of: f57e53ea2523 ("smb: client: let recv_done verify data_offset, data_length and remaining_data_length") +Signed-off-by: Sasha Levin +--- + fs/smb/common/smbdirect/smbdirect_socket.h | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/fs/smb/common/smbdirect/smbdirect_socket.h b/fs/smb/common/smbdirect/smbdirect_socket.h +index e5b15cc44a7ba..5db7815b614f8 100644 +--- a/fs/smb/common/smbdirect/smbdirect_socket.h ++++ b/fs/smb/common/smbdirect/smbdirect_socket.h +@@ -38,6 +38,20 @@ struct smbdirect_socket { + } ib; + + struct smbdirect_socket_parameters parameters; ++ ++ /* ++ * The state for posted receive buffers ++ */ ++ struct { ++ /* ++ * The type of PDU we are expecting ++ */ ++ enum { ++ SMBDIRECT_EXPECT_NEGOTIATE_REQ = 1, ++ SMBDIRECT_EXPECT_NEGOTIATE_REP = 2, ++ SMBDIRECT_EXPECT_DATA_TRANSFER = 3, ++ } expected; ++ } recv_io; + }; + + #endif /* __FS_SMB_COMMON_SMBDIRECT_SMBDIRECT_SOCKET_H__ */ +-- +2.51.0 + diff --git a/queue-6.16/smb-smbdirect-introduce-struct-smbdirect_recv_io.patch b/queue-6.16/smb-smbdirect-introduce-struct-smbdirect_recv_io.patch new file mode 100644 index 0000000000..210e1086a9 --- /dev/null +++ b/queue-6.16/smb-smbdirect-introduce-struct-smbdirect_recv_io.patch @@ -0,0 +1,53 @@ +From 63ea292785da87bbcf4b76331f68fc4ba8201614 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Aug 2025 18:11:32 +0200 +Subject: smb: smbdirect: introduce struct smbdirect_recv_io + +From: Stefan Metzmacher + +[ Upstream commit 60812d20da82606f0620904c281579a9af0ab452 ] + +This will be used in client and server soon +in order to replace smbd_response/smb_direct_recvmsg. + +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Stable-dep-of: f57e53ea2523 ("smb: client: let recv_done verify data_offset, data_length and remaining_data_length") +Signed-off-by: Sasha Levin +--- + fs/smb/common/smbdirect/smbdirect_socket.h | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/fs/smb/common/smbdirect/smbdirect_socket.h b/fs/smb/common/smbdirect/smbdirect_socket.h +index 5db7815b614f8..a7ad31c471a7b 100644 +--- a/fs/smb/common/smbdirect/smbdirect_socket.h ++++ b/fs/smb/common/smbdirect/smbdirect_socket.h +@@ -54,4 +54,19 @@ struct smbdirect_socket { + } recv_io; + }; + ++struct smbdirect_recv_io { ++ struct smbdirect_socket *socket; ++ struct ib_cqe cqe; ++ struct ib_sge sge; ++ ++ /* Link to free or reassembly list */ ++ struct list_head list; ++ ++ /* Indicate if this is the 1st packet of a payload */ ++ bool first_segment; ++ ++ /* SMBD packet header and payload follows this structure */ ++ u8 packet[]; ++}; ++ + #endif /* __FS_SMB_COMMON_SMBDIRECT_SMBDIRECT_SOCKET_H__ */ +-- +2.51.0 + diff --git a/queue-6.6/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch b/queue-6.6/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch new file mode 100644 index 0000000000..53c8336e26 --- /dev/null +++ b/queue-6.6/asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch @@ -0,0 +1,40 @@ +From 2308d770e5d4bdcaaf69ac6aff82810a51c7262e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Sep 2025 13:06:39 +0100 +Subject: ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error + message + +From: Colin Ian King + +[ Upstream commit 35fc531a59694f24a2456569cf7d1a9c6436841c ] + +The dev_err message is reporting an error about capture streams however +it is using the incorrect variable num_playback instead of num_capture. +Fix this by using the correct variable num_capture. + +Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations") +Signed-off-by: Colin Ian King +Acked-by: Peter Ujfalusi +Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-stream.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sof/intel/hda-stream.c b/sound/soc/sof/intel/hda-stream.c +index 0b0087abcc50e..3bb743cb167a5 100644 +--- a/sound/soc/sof/intel/hda-stream.c ++++ b/sound/soc/sof/intel/hda-stream.c +@@ -842,7 +842,7 @@ int hda_dsp_stream_init(struct snd_sof_dev *sdev) + + if (num_capture >= SOF_HDA_CAPTURE_STREAMS) { + dev_err(sdev->dev, "error: too many capture streams %d\n", +- num_playback); ++ num_capture); + return -EINVAL; + } + +-- +2.51.0 + diff --git a/queue-6.6/asoc-wm8940-correct-pll-rate-rounding.patch b/queue-6.6/asoc-wm8940-correct-pll-rate-rounding.patch new file mode 100644 index 0000000000..dec3da2523 --- /dev/null +++ b/queue-6.6/asoc-wm8940-correct-pll-rate-rounding.patch @@ -0,0 +1,45 @@ +From a32a8da31e013fb03bd9267ca12d40cd30ff225f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:37 +0100 +Subject: ASoC: wm8940: Correct PLL rate rounding + +From: Charles Keepax + +[ Upstream commit d05afb53c683ef7ed1228b593c3360f4d3126c58 ] + +Using a single value of 22500000 for both 48000Hz and 44100Hz audio +will sometimes result in returning wrong dividers due to rounding. +Update the code to use the actual value for both. + +Fixes: 294833fc9eb4 ("ASoC: wm8940: Rewrite code to set proper clocks") +Reported-by: Ankur Tyagi +Signed-off-by: Charles Keepax +Tested-by: Ankur Tyagi +Link: https://patch.msgid.link/20250821082639.1301453-2-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8940.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c +index b9432f8b64e5b..eff7d1369d01a 100644 +--- a/sound/soc/codecs/wm8940.c ++++ b/sound/soc/codecs/wm8940.c +@@ -693,7 +693,12 @@ static int wm8940_update_clocks(struct snd_soc_dai *dai) + f = wm8940_get_mclkdiv(priv->mclk, fs256, &mclkdiv); + if (f != priv->mclk) { + /* The PLL performs best around 90MHz */ +- fpll = wm8940_get_mclkdiv(22500000, fs256, &mclkdiv); ++ if (fs256 % 8000) ++ f = 22579200; ++ else ++ f = 24576000; ++ ++ fpll = wm8940_get_mclkdiv(f, fs256, &mclkdiv); + } + + wm8940_set_dai_pll(dai, 0, 0, priv->mclk, fpll); +-- +2.51.0 + diff --git a/queue-6.6/asoc-wm8940-correct-typo-in-control-name.patch b/queue-6.6/asoc-wm8940-correct-typo-in-control-name.patch new file mode 100644 index 0000000000..4aac7c2c51 --- /dev/null +++ b/queue-6.6/asoc-wm8940-correct-typo-in-control-name.patch @@ -0,0 +1,36 @@ +From cf0f8da50adbf1c047ee969c1bd15aaa8be34c04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:38 +0100 +Subject: ASoC: wm8940: Correct typo in control name + +From: Charles Keepax + +[ Upstream commit b4799520dcd6fe1e14495cecbbe9975d847cd482 ] + +Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver") +Reported-by: Ankur Tyagi +Signed-off-by: Charles Keepax +Tested-by: Ankur Tyagi +Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8940.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c +index eff7d1369d01a..39d2c8e85d9db 100644 +--- a/sound/soc/codecs/wm8940.c ++++ b/sound/soc/codecs/wm8940.c +@@ -220,7 +220,7 @@ static const struct snd_kcontrol_new wm8940_snd_controls[] = { + SOC_SINGLE_TLV("Digital Capture Volume", WM8940_ADCVOL, + 0, 255, 0, wm8940_adc_tlv), + SOC_ENUM("Mic Bias Level", wm8940_mic_bias_level_enum), +- SOC_SINGLE_TLV("Capture Boost Volue", WM8940_ADCBOOST, ++ SOC_SINGLE_TLV("Capture Boost Volume", WM8940_ADCBOOST, + 8, 1, 0, wm8940_capture_boost_vol_tlv), + SOC_SINGLE_TLV("Speaker Playback Volume", WM8940_SPKVOL, + 0, 63, 0, wm8940_spk_vol_tlv), +-- +2.51.0 + diff --git a/queue-6.6/asoc-wm8974-correct-pll-rate-rounding.patch b/queue-6.6/asoc-wm8974-correct-pll-rate-rounding.patch new file mode 100644 index 0000000000..5386f13344 --- /dev/null +++ b/queue-6.6/asoc-wm8974-correct-pll-rate-rounding.patch @@ -0,0 +1,46 @@ +From 2862ba2ec0bc3627caf3b01d29082d56d5b7187a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 09:26:39 +0100 +Subject: ASoC: wm8974: Correct PLL rate rounding + +From: Charles Keepax + +[ Upstream commit 9b17d3724df55ecc2bc67978822585f2b023be48 ] + +Using a single value of 22500000 for both 48000Hz and 44100Hz audio +will sometimes result in returning wrong dividers due to rounding. +Update the code to use the actual value for both. + +Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically") +Signed-off-by: Charles Keepax +Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8974.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c +index 260bac695b20a..2aaa1cbe68b71 100644 +--- a/sound/soc/codecs/wm8974.c ++++ b/sound/soc/codecs/wm8974.c +@@ -419,10 +419,14 @@ static int wm8974_update_clocks(struct snd_soc_dai *dai) + fs256 = 256 * priv->fs; + + f = wm8974_get_mclkdiv(priv->mclk, fs256, &mclkdiv); +- + if (f != priv->mclk) { + /* The PLL performs best around 90MHz */ +- fpll = wm8974_get_mclkdiv(22500000, fs256, &mclkdiv); ++ if (fs256 % 8000) ++ f = 22579200; ++ else ++ f = 24576000; ++ ++ fpll = wm8974_get_mclkdiv(f, fs256, &mclkdiv); + } + + wm8974_set_dai_pll(dai, 0, 0, priv->mclk, fpll); +-- +2.51.0 + diff --git a/queue-6.6/crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch b/queue-6.6/crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch new file mode 100644 index 0000000000..0e5816a2a3 --- /dev/null +++ b/queue-6.6/crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch @@ -0,0 +1,49 @@ +From aaa33ca0fd83d32224c8fa2e70db3f3d7fb56075 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 15:42:41 +0800 +Subject: crypto: af_alg - Set merge to zero early in af_alg_sendmsg + +From: Herbert Xu + +[ Upstream commit 9574b2330dbd2b5459b74d3b5e9619d39299fc6f ] + +If an error causes af_alg_sendmsg to abort, ctx->merge may contain +a garbage value from the previous loop. This may then trigger a +crash on the next entry into af_alg_sendmsg when it attempts to do +a merge that can't be done. + +Fix this by setting ctx->merge to zero near the start of the loop. + +Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations") +Reported-by: Muhammad Alifa Ramdhan +Reported-by: Bing-Jhong Billy Jheng +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/af_alg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index dbddcf52b9920..886eccb97b041 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -1024,6 +1024,8 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + continue; + } + ++ ctx->merge = 0; ++ + if (!af_alg_writable(sk)) { + err = af_alg_wait_for_wmem(sk, msg->msg_flags); + if (err) +@@ -1063,7 +1065,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + ctx->used += plen; + copied += plen; + size -= plen; +- ctx->merge = 0; + } else { + do { + struct page *pg; +-- +2.51.0 + diff --git a/queue-6.6/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch b/queue-6.6/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch new file mode 100644 index 0000000000..94e1a1397d --- /dev/null +++ b/queue-6.6/drm-bridge-anx7625-fix-null-pointer-dereference-with.patch @@ -0,0 +1,51 @@ +From c47441a6d52f8b2ab3df006a51b60a08f626d82e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jul 2025 10:54:38 +0200 +Subject: drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ + +From: Loic Poulain + +[ Upstream commit a10f910c77f280327b481e77eab909934ec508f0 ] + +If the interrupt occurs before resource initialization is complete, the +interrupt handler/worker may access uninitialized data such as the I2C +tcpc_client device, potentially leading to NULL pointer dereference. + +Signed-off-by: Loic Poulain +Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP") +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250709085438.56188-1-loic.poulain@oss.qualcomm.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index ddf944651c55a..08885a5ba826e 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -2705,7 +2705,7 @@ static int anx7625_i2c_probe(struct i2c_client *client) + ret = devm_request_threaded_irq(dev, platform->pdata.intp_irq, + NULL, anx7625_intr_hpd_isr, + IRQF_TRIGGER_FALLING | +- IRQF_ONESHOT, ++ IRQF_ONESHOT | IRQF_NO_AUTOEN, + "anx7625-intp", platform); + if (ret) { + DRM_DEV_ERROR(dev, "fail to request irq\n"); +@@ -2775,8 +2775,10 @@ static int anx7625_i2c_probe(struct i2c_client *client) + } + + /* Add work function */ +- if (platform->pdata.intp_irq) ++ if (platform->pdata.intp_irq) { ++ enable_irq(platform->pdata.intp_irq); + queue_work(platform->workqueue, &platform->work); ++ } + + if (platform->pdata.audio_en) + anx7625_register_audio(dev, platform); +-- +2.51.0 + diff --git a/queue-6.6/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch b/queue-6.6/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch new file mode 100644 index 0000000000..fd1d19154c --- /dev/null +++ b/queue-6.6/drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch @@ -0,0 +1,44 @@ +From 08f56f0a156485e7d5ccad528554d4569aec8dde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Sep 2025 11:44:47 +0800 +Subject: drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path + +From: Qi Xi + +[ Upstream commit 288dac9fb6084330d968459c750c838fd06e10e6 ] + +Add missing mutex unlock before returning from the error path in +cdns_mhdp_atomic_enable(). + +Fixes: 935a92a1c400 ("drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference") +Reported-by: Hulk Robot +Signed-off-by: Qi Xi +Reviewed-by: Luca Ceresoli +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250904034447.665427-1-xiqi2@huawei.com +Signed-off-by: Luca Ceresoli +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +index 858f5b6508491..bdb9fc00c776b 100644 +--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c ++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c +@@ -2057,8 +2057,10 @@ static void cdns_mhdp_atomic_enable(struct drm_bridge *bridge, + mhdp_state = to_cdns_mhdp_bridge_state(new_state); + + mhdp_state->current_mode = drm_mode_duplicate(bridge->dev, mode); +- if (!mhdp_state->current_mode) +- return; ++ if (!mhdp_state->current_mode) { ++ ret = -EINVAL; ++ goto out; ++ } + + drm_mode_set_name(mhdp_state->current_mode); + +-- +2.51.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 973cc797e5..28e6be9bc7 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -46,3 +46,11 @@ selftests-mptcp-avoid-spurious-errors-on-tcp-disconnect.patch alsa-hda-realtek-fix-mute-led-for-hp-laptop-15-dw4xx.patch io_uring-backport-io_should_terminate_tw.patch io_uring-include-dying-ring-in-task_work-should-cancel-state.patch +asoc-wm8940-correct-pll-rate-rounding.patch +asoc-wm8940-correct-typo-in-control-name.patch +asoc-wm8974-correct-pll-rate-rounding.patch +asoc-sof-intel-hda-stream-fix-incorrect-variable-use.patch +drm-bridge-anx7625-fix-null-pointer-dereference-with.patch +drm-bridge-cdns-mhdp8546-fix-missing-mutex-unlock-on.patch +crypto-af_alg-set-merge-to-zero-early-in-af_alg_send.patch +smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch diff --git a/queue-6.6/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch b/queue-6.6/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch new file mode 100644 index 0000000000..949deb62d3 --- /dev/null +++ b/queue-6.6/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch @@ -0,0 +1,46 @@ +From 645f7b937a7cb13ab6d249f5cd981494567d085d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Sep 2025 03:06:46 +0200 +Subject: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error + path + +From: Stefan Metzmacher + +[ Upstream commit daac51c7032036a0ca5f1aa419ad1b0471d1c6e0 ] + +During tests of another unrelated patch I was able to trigger this +error: Objects remaining on __kmem_cache_shutdown() + +Cc: Steve French +Cc: Tom Talpey +Cc: Long Li +Cc: Namjae Jeon +Cc: linux-cifs@vger.kernel.org +Cc: samba-technical@lists.samba.org +Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smbdirect.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c +index 713bd1dcd39cc..be9be8f363319 100644 +--- a/fs/smb/client/smbdirect.c ++++ b/fs/smb/client/smbdirect.c +@@ -1064,8 +1064,10 @@ static int smbd_negotiate(struct smbd_connection *info) + log_rdma_event(INFO, "smbd_post_recv rc=%d iov.addr=0x%llx iov.length=%u iov.lkey=0x%x\n", + rc, response->sge.addr, + response->sge.length, response->sge.lkey); +- if (rc) ++ if (rc) { ++ put_receive_buffer(info, response); + return rc; ++ } + + init_completion(&info->negotiate_completion); + info->negotiate_done = false; +-- +2.51.0 +