From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 10:53:46 +0000 (+0200) Subject: 7.1-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ef2ab949e83e55557e064bc2c0e86de8e37feda4;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch afs-fix-null-pointer-dereference-in-afs_get_tree.patch afs-fix-uncancelled-rxrpc-oob-message-handler.patch afs-handle-cb.initcallbackstate3-requests-without-a-server-record.patch alsa-hda-conexant-remove-mic-bias-threshold-override.patch alsa-hda-fix-cached-processing-coefficient-verbs.patch alsa-hda-realtek-add-quirk-for-tongfang-x6xx45xu.patch alsa-hda-realtek-fix-speakers-on-legion-pro-7-16arx8h-with-codec-ssid-17aa-38a7.patch dt-bindings-media-sun4i-a10-video-engine-add-interconnect-properties.patch dt-bindings-power-imx93-add-mipi-phy-power-domain.patch fbcon-fix-null-pointer-dereference-for-a-console-without-vc_data.patch fbcon-use-correct-type-for-vc_resize-return-value.patch media-uvcvideo-avoid-partial-metadata-buffers.patch media-uvcvideo-do-not-add-clock-samples-with-small-sof-delta.patch media-uvcvideo-fix-buffer-sequence-in-frame-gaps.patch media-uvcvideo-fix-deadlock-if-uvc_status_stop-is-called-from-async_ctrl.work.patch media-uvcvideo-fix-dev_sof-filtering-in-hw-timestamp.patch media-uvcvideo-fix-sequence-number-when-no-eof.patch media-uvcvideo-relax-the-constrains-for-interpolating-the-hw-clock.patch media-uvcvideo-use-hw-timestaming-if-the-clock-buffer-is-full.patch rxrpc-don-t-move-a-peeked-oob-message-onto-the-pending-queue.patch rxrpc-fix-ackall-packet-handling.patch rxrpc-fix-double-unlock-in-rxrpc_recvmsg.patch rxrpc-fix-leak-of-connection-from-oob-challenge.patch rxrpc-fix-leak-of-released-call-in-recvmsg-msg_peek.patch rxrpc-fix-oob-challenge-leak-in-cleanup-after-notification-failure.patch rxrpc-fix-potential-infinite-loop-in-rxrpc_recvmsg.patch rxrpc-fix-rxrpc_rotate_tx_rotate-to-check-there-s-something-to-rotate.patch rxrpc-fix-socket-notification-race.patch rxrpc-fix-the-reception-of-a-reply-packet-before-data-transmission.patch rxrpc-fix-uaf-in-rxgk_issue_challenge.patch rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch serial-8250_omap-clear-rx_running-on-zero-length-dma-completes.patch serial-max310x-implement-gpio_chip-get_direction.patch serial-msm-disable-dma-for-kernel-console-uart.patch --- diff --git a/queue-7.1/afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch b/queue-7.1/afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch new file mode 100644 index 0000000000..8aacc0d353 --- /dev/null +++ b/queue-7.1/afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch @@ -0,0 +1,52 @@ +From 2daf8ac812c3d78c642fe7652f62e29df5e3da20 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Wed, 24 Jun 2026 17:38:11 +0100 +Subject: afs: Fix further netns teardown to cancel the preallocation charger + +From: David Howells + +commit 2daf8ac812c3d78c642fe7652f62e29df5e3da20 upstream. + +When an afs network namespace is torn down, it cancels and waits for the +work item that keeps the preallocated rxrpc call/conn/peer queue charged +before disabling incoming (i.e. listen 0), but there's a small window in +which it can be requeued by an incoming call wending through the I/O +thread. + +Fix this by cancelling the charger work item again after reducing the +listen backlog to zero. + +Fixes: 47694fbc9d24 ("afs: Fix netns teardown to cancel the preallocation charger") +Reported-by: Jakub Kicinski +Signed-off-by: David Howells +Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com +cc: Li Daming +cc: Ren Wei +cc: Marc Dionne +cc: Jeffrey Altman +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260624163819.3017002-5-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/rxrpc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/afs/rxrpc.c ++++ b/fs/afs/rxrpc.c +@@ -128,8 +128,13 @@ void afs_close_socket(struct afs_net *ne + _enter(""); + + cancel_work_sync(&net->charge_preallocation_work); ++ /* Future work items should now see ->live is false. */ ++ + kernel_listen(net->socket, 0); ++ ++ /* Make sure work items are no longer running. */ + flush_workqueue(afs_async_calls); ++ cancel_work_sync(&net->charge_preallocation_work); + + if (net->spare_incoming_call) { + afs_put_call(net->spare_incoming_call); diff --git a/queue-7.1/afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch b/queue-7.1/afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch new file mode 100644 index 0000000000..a397cc6c68 --- /dev/null +++ b/queue-7.1/afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch @@ -0,0 +1,64 @@ +From 47694fbc9d24ab6bf210f91e8efe06a10a478064 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 9 Jun 2026 15:09:08 +0100 +Subject: afs: Fix netns teardown to cancel the preallocation charger + +From: David Howells + +commit 47694fbc9d24ab6bf210f91e8efe06a10a478064 upstream. + +Fix the teardown of an afs network namespace to make sure it cancels the +work item that keeps the preallocated rxrpc call/conn/peer queue charged +before incoming calls are disabled (i.e. listen 0). + +Also, if net->live is false because the afs netns is being deleted, make +afs_charge_preallocation() skip charging and make afs_rx_new_call() avoid +requeuing the charger. + +(This was found by AI review). + +Fixes: 00e907127e6f ("rxrpc: Preallocate peers, conns and calls for incoming service requests") +Reported-by: Simon Horman +Signed-off-by: David Howells +cc: Li Daming +cc: Ren Wei +cc: Marc Dionne +cc: Jeffrey Altman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260609140911.838677-5-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/rxrpc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/afs/rxrpc.c ++++ b/fs/afs/rxrpc.c +@@ -127,6 +127,7 @@ void afs_close_socket(struct afs_net *ne + { + _enter(""); + ++ cancel_work_sync(&net->charge_preallocation_work); + kernel_listen(net->socket, 0); + flush_workqueue(afs_async_calls); + +@@ -742,7 +743,7 @@ void afs_charge_preallocation(struct wor + container_of(work, struct afs_net, charge_preallocation_work); + struct afs_call *call = net->spare_incoming_call; + +- for (;;) { ++ while (READ_ONCE(net->live)) { + if (!call) { + call = afs_alloc_call(net, &afs_RXCMxxxx, GFP_KERNEL); + if (!call) +@@ -792,7 +793,8 @@ static void afs_rx_new_call(struct sock + if (!call->server) + trace_afs_cm_no_server(call, rxrpc_kernel_remote_srx(call->peer)); + +- queue_work(afs_wq, &net->charge_preallocation_work); ++ if (net->live) ++ queue_work(afs_wq, &net->charge_preallocation_work); + } + + /* diff --git a/queue-7.1/afs-fix-null-pointer-dereference-in-afs_get_tree.patch b/queue-7.1/afs-fix-null-pointer-dereference-in-afs_get_tree.patch new file mode 100644 index 0000000000..0e9037d40b --- /dev/null +++ b/queue-7.1/afs-fix-null-pointer-dereference-in-afs_get_tree.patch @@ -0,0 +1,62 @@ +From 0b70716081c6462be9b2928ad736d0d527b09678 Mon Sep 17 00:00:00 2001 +From: Matvey Kovalev +Date: Mon, 22 Jun 2026 10:08:37 +0100 +Subject: afs: fix NULL pointer dereference in afs_get_tree() + +From: Matvey Kovalev + +commit 0b70716081c6462be9b2928ad736d0d527b09678 upstream. + +afs_alloc_sbi() uses kzalloc for memory allocation. And, if +ctx->dyn_root is not null, as->cell and as->volume are null. +In trace_afs_get_tree() they are dereferenced. + +KASAN error message: + +KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] +CPU: 2 PID: 18478 Comm: syz-executor.7 Not tainted 5.10.246-syzkaller #0 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 +04/01/2014 +RIP: 0010:perf_trace_afs_get_tree+0x1d9/0x550 +include/trace/events/afs.h:1365 + +Call Trace: +trace_afs_get_tree include/trace/events/afs.h:1365 [inline] +afs_get_tree+0x922/0x1350 fs/afs/super.c:599 +vfs_get_tree+0x8e/0x300 fs/super.c:1572 +do_new_mount fs/namespace.c:3011 [inline] +path_mount+0x14a5/0x2220 fs/namespace.c:3341 +do_mount fs/namespace.c:3354 [inline] +__do_sys_mount fs/namespace.c:3562 [inline] +__se_sys_mount fs/namespace.c:3539 [inline] +__x64_sys_mount+0x283/0x300 fs/namespace.c:3539 + do_syscall_64+0x33/0x50 arch/x86/entry/common.c:46 +entry_SYSCALL_64_after_hwframe+0x67/0xd1 + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: 80548b03991f5 ("afs: Add more tracepoints") +Cc: stable@vger.kernel.org +Signed-off-by: Matvey Kovalev +Signed-off-by: David Howells +Link: https://patch.msgid.link/20260622090856.2746629-4-dhowells@redhat.com +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/super.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/afs/super.c ++++ b/fs/afs/super.c +@@ -587,7 +587,8 @@ static int afs_get_tree(struct fs_contex + } + + fc->root = dget(sb->s_root); +- trace_afs_get_tree(as->cell, as->volume); ++ if (!ctx->dyn_root) ++ trace_afs_get_tree(as->cell, as->volume); + _leave(" = 0 [%p]", sb); + return 0; + diff --git a/queue-7.1/afs-fix-uncancelled-rxrpc-oob-message-handler.patch b/queue-7.1/afs-fix-uncancelled-rxrpc-oob-message-handler.patch new file mode 100644 index 0000000000..b702e46ddb --- /dev/null +++ b/queue-7.1/afs-fix-uncancelled-rxrpc-oob-message-handler.patch @@ -0,0 +1,70 @@ +From a4057e58b07005d0fe0491bdbf1868c1491909ee Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Wed, 24 Jun 2026 17:38:12 +0100 +Subject: afs: Fix uncancelled rxrpc OOB message handler + +From: David Howells + +commit a4057e58b07005d0fe0491bdbf1868c1491909ee upstream. + +Fix AFS to cancel its OOB message processing (typically to respond to +security challenges). Also move OOB message processing to afs_wq so that +it's also waited for and make the OOB handler just return if the net +namespace is no longer live. + +Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE") +Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com +Signed-off-by: David Howells +cc: Li Daming +cc: Ren Wei +cc: Marc Dionne +cc: Jeffrey Altman +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260624163819.3017002-6-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/cm_security.c | 3 ++- + fs/afs/rxrpc.c | 5 ++++- + 2 files changed, 6 insertions(+), 2 deletions(-) + +--- a/fs/afs/cm_security.c ++++ b/fs/afs/cm_security.c +@@ -101,7 +101,8 @@ void afs_process_oob_queue(struct work_s + struct sk_buff *oob; + enum rxrpc_oob_type type; + +- while ((oob = rxrpc_kernel_dequeue_oob(net->socket, &type))) { ++ while (READ_ONCE(net->live) && ++ (oob = rxrpc_kernel_dequeue_oob(net->socket, &type))) { + switch (type) { + case RXRPC_OOB_CHALLENGE: + afs_respond_to_challenge(oob); +--- a/fs/afs/rxrpc.c ++++ b/fs/afs/rxrpc.c +@@ -128,6 +128,7 @@ void afs_close_socket(struct afs_net *ne + _enter(""); + + cancel_work_sync(&net->charge_preallocation_work); ++ cancel_work_sync(&net->rx_oob_work); + /* Future work items should now see ->live is false. */ + + kernel_listen(net->socket, 0); +@@ -148,6 +149,7 @@ void afs_close_socket(struct afs_net *ne + + kernel_sock_shutdown(net->socket, SHUT_RDWR); + flush_workqueue(afs_async_calls); ++ cancel_work_sync(&net->rx_oob_work); + net->socket->sk->sk_user_data = NULL; + sock_release(net->socket); + key_put(net->fs_cm_token_key); +@@ -989,5 +991,6 @@ static void afs_rx_notify_oob(struct soc + { + struct afs_net *net = sk->sk_user_data; + +- schedule_work(&net->rx_oob_work); ++ if (READ_ONCE(net->live)) ++ queue_work(afs_wq, &net->rx_oob_work); + } diff --git a/queue-7.1/afs-handle-cb.initcallbackstate3-requests-without-a-server-record.patch b/queue-7.1/afs-handle-cb.initcallbackstate3-requests-without-a-server-record.patch new file mode 100644 index 0000000000..78360dbf9b --- /dev/null +++ b/queue-7.1/afs-handle-cb.initcallbackstate3-requests-without-a-server-record.patch @@ -0,0 +1,55 @@ +From f3cf725cd284b7912d5522babb44721bf38c8887 Mon Sep 17 00:00:00 2001 +From: Nan Li +Date: Mon, 22 Jun 2026 10:08:35 +0100 +Subject: afs: handle CB.InitCallBackState3 requests without a server record + +From: Nan Li + +commit f3cf725cd284b7912d5522babb44721bf38c8887 upstream. + +The cache manager callback path now attaches the server record to an +incoming call through the rxrpc peer's app data. That association is +not guaranteed to exist for every callback request, and most callback +handlers already tolerate that case. + +Make CB.InitCallBackState3 follow the same pattern by checking whether a +server record was attached before using it. If the peer is not mapped +to a server record, trace the request and ignore it, matching the +existing behaviour for other unmatched callback requests. + +This keeps the callback handler consistent with the rest of the cache +manager service and avoids depending on peer state that may not be +available for a given request. + +Fixes: 40e8b52fe8c8 ("afs: Use the per-peer app data provided by rxrpc") +Cc: stable@kernel.org +Reported-by: Yuan Tan +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Reported-by: Xin Liu +Signed-off-by: Nan Li +Signed-off-by: Ren Wei +Signed-off-by: David Howells +Link: https://patch.msgid.link/20260622090856.2746629-2-dhowells@redhat.com +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Christian Brauner (Amutable) +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/cmservice.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/afs/cmservice.c ++++ b/fs/afs/cmservice.c +@@ -364,6 +364,11 @@ static int afs_deliver_cb_init_call_back + if (!afs_check_call_state(call, AFS_CALL_SV_REPLYING)) + return afs_io_error(call, afs_io_error_cm_reply); + ++ if (!call->server) { ++ trace_afs_cm_no_server_u(call, call->request); ++ return 0; ++ } ++ + if (memcmp(call->request, &call->server->_uuid, sizeof(call->server->_uuid)) != 0) { + pr_notice("Callback UUID does not match fileserver UUID\n"); + trace_afs_cm_no_server_u(call, call->request); diff --git a/queue-7.1/alsa-hda-conexant-remove-mic-bias-threshold-override.patch b/queue-7.1/alsa-hda-conexant-remove-mic-bias-threshold-override.patch new file mode 100644 index 0000000000..232b33e776 --- /dev/null +++ b/queue-7.1/alsa-hda-conexant-remove-mic-bias-threshold-override.patch @@ -0,0 +1,43 @@ +From f52524da7084c1a54683ae9fbc73e93fff19dd64 Mon Sep 17 00:00:00 2001 +From: Zhang Heng +Date: Mon, 13 Jul 2026 18:03:29 +0800 +Subject: ALSA: hda: conexant: Remove mic bias threshold override + +From: Zhang Heng + +commit f52524da7084c1a54683ae9fbc73e93fff19dd64 upstream. + +Remove the mic bias current comparator threshold override (NID 0x1c, +verb 0x320, value 0x010) from Conexant codec driver. + +This override was originally intended to support volume up/down controls on +headsets with inline remote controls, but it causes microphone detection +failures on some headsets with impedance less than 1k ohm. + +After consulting with the vendor's engineers, it was confirmed that this +setting is board-specific and should be handled by BIOS/firmware rather +than the generic codec driver, especially since inline remote support +is not currently implemented. + +Fixes: 7aeb25908648 ("ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140") +Cc: stable@vger.kernel.org +Signed-off-by: Zhang Heng +Link: https://patch.msgid.link/20260713100329.306892-1-zhangheng@kylinos.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/hda/codecs/conexant.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/sound/hda/codecs/conexant.c ++++ b/sound/hda/codecs/conexant.c +@@ -162,9 +162,6 @@ static void cx_fixup_headset_recog(struc + { + unsigned int mic_present; + +- /* fix some headset type recognize fail issue, such as EDIFIER headset */ +- /* set micbias output current comparator threshold from 66% to 55%. */ +- snd_hda_codec_write(codec, 0x1c, 0, 0x320, 0x010); + /* set OFF voltage for DFET from -1.2V to -0.8V, set headset micbias register + * value adjustment trim from 2.2K ohms to 2.0K ohms. + */ diff --git a/queue-7.1/alsa-hda-fix-cached-processing-coefficient-verbs.patch b/queue-7.1/alsa-hda-fix-cached-processing-coefficient-verbs.patch new file mode 100644 index 0000000000..6c0fd27776 --- /dev/null +++ b/queue-7.1/alsa-hda-fix-cached-processing-coefficient-verbs.patch @@ -0,0 +1,58 @@ +From f67be28fdf8b5d31ac1cc1152bb17250f9f8f513 Mon Sep 17 00:00:00 2001 +From: Xu Rao +Date: Tue, 7 Jul 2026 21:24:19 +0800 +Subject: ALSA: hda: Fix cached processing coefficient verbs + +From: Xu Rao + +commit f67be28fdf8b5d31ac1cc1152bb17250f9f8f513 upstream. + +Intel HD Audio defines Coefficient Index and Processing Coefficient as +separate audio widget controls in the Audio Widget Verb Definitions: +Coefficient Index selects the coefficient slot, while Processing +Coefficient accesses the value at the selected slot. + +hda_reg_read_coef() selects the slot with AC_VERB_SET_COEF_INDEX, but +then uses AC_VERB_GET_COEF_INDEX for the value read. That reads back the +selected index instead of the coefficient value. hda_reg_write_coef() +has the same issue and builds the value write from AC_VERB_GET_COEF_INDEX +instead of AC_VERB_SET_PROC_COEF. + +This only affects the regmap coefficient cache path used by codecs that +set codec->cache_coef. Direct coefficient helpers already use the normal +SET_COEF_INDEX followed by GET_PROC_COEF or SET_PROC_COEF sequence, which +is likely why this has not been noticed widely. + +Use AC_VERB_GET_PROC_COEF for cached coefficient reads and +AC_VERB_SET_PROC_COEF for cached coefficient writes. + +Fixes: 40ba66a702b8 ("ALSA: hda - Add cache support for COEF read/write") +Cc: stable@vger.kernel.org +Signed-off-by: Xu Rao +Link: https://patch.msgid.link/DB9023BF2920BA99+20260707132419.1731342-1-raoxu@uniontech.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/hda/core/regmap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/hda/core/regmap.c ++++ b/sound/hda/core/regmap.c +@@ -214,7 +214,7 @@ static int hda_reg_read_coef(struct hdac + err = snd_hdac_exec_verb(codec, verb, 0, NULL); + if (err < 0) + return err; +- verb = (reg & ~0xfffff) | (AC_VERB_GET_COEF_INDEX << 8); ++ verb = (reg & ~0xfffff) | (AC_VERB_GET_PROC_COEF << 8); + return snd_hdac_exec_verb(codec, verb, 0, val); + } + +@@ -232,7 +232,7 @@ static int hda_reg_write_coef(struct hda + err = snd_hdac_exec_verb(codec, verb, 0, NULL); + if (err < 0) + return err; +- verb = (reg & ~0xfffff) | (AC_VERB_GET_COEF_INDEX << 8) | ++ verb = (reg & ~0xfffff) | (AC_VERB_SET_PROC_COEF << 8) | + (val & 0xffff); + return snd_hdac_exec_verb(codec, verb, 0, NULL); + } diff --git a/queue-7.1/alsa-hda-realtek-add-quirk-for-tongfang-x6xx45xu.patch b/queue-7.1/alsa-hda-realtek-add-quirk-for-tongfang-x6xx45xu.patch new file mode 100644 index 0000000000..d08b30259b --- /dev/null +++ b/queue-7.1/alsa-hda-realtek-add-quirk-for-tongfang-x6xx45xu.patch @@ -0,0 +1,31 @@ +From d595255241e5fec0c94adeebf2565524398e37c5 Mon Sep 17 00:00:00 2001 +From: Eckhart Mohr +Date: Wed, 8 Jul 2026 15:21:06 +0200 +Subject: ALSA: hda/realtek: Add quirk for TongFang X6xx45xU + +From: Eckhart Mohr + +commit d595255241e5fec0c94adeebf2565524398e37c5 upstream. + +Fix microphone detection on built in headphone jack for some devices. + +Signed-off-by: Eckhart Mohr +Cc: stable@vger.kernel.org +Signed-off-by: Werner Sembach +Link: https://patch.msgid.link/20260708132135.102680-1-wse@tuxedocomputers.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/hda/codecs/realtek/alc269.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -7840,6 +7840,7 @@ static const struct hda_quirk alc269_fix + SND_PCI_QUIRK(0x1d05, 0x300f, "TongFang X6AR5xxY", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1d05, 0x3019, "TongFang X6FR5xxY", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1d05, 0x3031, "TongFang X6AR55xU", ALC2XX_FIXUP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1d05, 0x3034, "TongFang X6xx45xU", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1d17, 0x3288, "Haier Boyue G42", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS), + SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE), diff --git a/queue-7.1/alsa-hda-realtek-fix-speakers-on-legion-pro-7-16arx8h-with-codec-ssid-17aa-38a7.patch b/queue-7.1/alsa-hda-realtek-fix-speakers-on-legion-pro-7-16arx8h-with-codec-ssid-17aa-38a7.patch new file mode 100644 index 0000000000..148243d38b --- /dev/null +++ b/queue-7.1/alsa-hda-realtek-fix-speakers-on-legion-pro-7-16arx8h-with-codec-ssid-17aa-38a7.patch @@ -0,0 +1,43 @@ +From d35dfb6329accfe1cfa0b57e35214b5cbbe0f9ae Mon Sep 17 00:00:00 2001 +From: Damien Laine +Date: Sun, 12 Jul 2026 23:37:08 +0200 +Subject: ALSA: hda/realtek: Fix speakers on Legion Pro 7 16ARX8H with codec SSID 17aa:38a7 + +From: Damien Laine + +commit d35dfb6329accfe1cfa0b57e35214b5cbbe0f9ae upstream. + +Some units of the Lenovo Legion Pro 7 16ARX8H (82WS) report codec +subsystem ID 17aa:38a7 instead of 17aa:38a8. Since only 38a8 has a +codec SSID quirk, these machines fall through to the PCI SSID match +17aa:386f (Legion Pro 7i 16IAX7) and get ALC287_FIXUP_CS35L41_I2C_2, +which probes the Cirrus amplifiers of the Intel variant. The TI +TAS2781 amplifier (ACPI TIAS2781:00) present on this AMD variant is +never bound and the internal speakers remain silent. + +Add a codec SSID quirk for 17aa:38a7 pointing to +ALC287_FIXUP_TAS2781_I2C, mirroring the existing 38a8 entry. + +Tested on a Legion Pro 7 16ARX8H (82WS, BIOS LPCN62WW): with the codec +SSID overridden to 17aa:38a8 via the HDA patch loader, the TAS2781 +amplifier binds and the internal speakers work. + +Cc: +Signed-off-by: Damien Laine +Link: https://patch.msgid.link/20260712213708.1835469-1-damien.laine@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/hda/codecs/realtek/alc269.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/hda/codecs/realtek/alc269.c ++++ b/sound/hda/codecs/realtek/alc269.c +@@ -7723,6 +7723,7 @@ static const struct hda_quirk alc269_fix + HDA_CODEC_QUIRK(0x17aa, 0x386e, "Legion Y9000X 2022 IAH7", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x17aa, 0x386e, "Yoga Pro 7 14ARP8", ALC285_FIXUP_SPEAKER2_TO_DAC1), + HDA_CODEC_QUIRK(0x17aa, 0x38a8, "Legion Pro 7 16ARX8H", ALC287_FIXUP_TAS2781_I2C), /* this must match before PCI SSID 17aa:386f below */ ++ HDA_CODEC_QUIRK(0x17aa, 0x38a7, "Legion Pro 7 16ARX8H", ALC287_FIXUP_TAS2781_I2C), /* this must match before PCI SSID 17aa:386f below */ + SND_PCI_QUIRK(0x17aa, 0x386f, "Legion Pro 7i 16IAX7", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x17aa, 0x3870, "Lenovo Yoga 7 14ARB7", ALC287_FIXUP_YOGA7_14ARB7_I2C), + SND_PCI_QUIRK(0x17aa, 0x3877, "Lenovo Legion 7 Slim 16ARHA7", ALC287_FIXUP_CS35L41_I2C_2), diff --git a/queue-7.1/dt-bindings-media-sun4i-a10-video-engine-add-interconnect-properties.patch b/queue-7.1/dt-bindings-media-sun4i-a10-video-engine-add-interconnect-properties.patch new file mode 100644 index 0000000000..bd014307bf --- /dev/null +++ b/queue-7.1/dt-bindings-media-sun4i-a10-video-engine-add-interconnect-properties.patch @@ -0,0 +1,45 @@ +From 018f2dc3a42098d3b04edd1480adc51d268adb14 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Thu, 25 Dec 2025 18:36:12 +0800 +Subject: dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties + +From: Chen-Yu Tsai + +commit 018f2dc3a42098d3b04edd1480adc51d268adb14 upstream. + +The Allwinner video engine sits behind the MBUS that is represented as +an interconnect. + +Make sure that the interconnect properties are valid in the binding. + +Fixes: d41662e52a03 ("media: dt-bindings: media: allwinner,sun4i-a10-video-engine: Add R40 compatible") +Cc: stable@vger.kernel.org +Signed-off-by: Chen-Yu Tsai +Acked-by: Rob Herring (Arm) +Acked-by: Jernej Skrabec +Signed-off-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/media/allwinner,sun4i-a10-video-engine.yaml | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/Documentation/devicetree/bindings/media/allwinner,sun4i-a10-video-engine.yaml ++++ b/Documentation/devicetree/bindings/media/allwinner,sun4i-a10-video-engine.yaml +@@ -63,6 +63,16 @@ properties: + CMA pool to use for buffers allocation instead of the default + CMA pool. + ++ # FIXME: This should be made required eventually once every SoC will ++ # have the MBUS declared. ++ interconnects: ++ maxItems: 1 ++ ++ # FIXME: This should be made required eventually once every SoC will ++ # have the MBUS declared. ++ interconnect-names: ++ const: dma-mem ++ + required: + - compatible + - reg diff --git a/queue-7.1/dt-bindings-power-imx93-add-mipi-phy-power-domain.patch b/queue-7.1/dt-bindings-power-imx93-add-mipi-phy-power-domain.patch new file mode 100644 index 0000000000..28be91b1bd --- /dev/null +++ b/queue-7.1/dt-bindings-power-imx93-add-mipi-phy-power-domain.patch @@ -0,0 +1,33 @@ +From 6aa38ef0eab32df5409b72d62509de6ba09cea50 Mon Sep 17 00:00:00 2001 +From: Guoniu Zhou +Date: Tue, 9 Jun 2026 14:26:40 +0800 +Subject: dt-bindings: power: imx93: Add MIPI PHY power domain + +From: Guoniu Zhou + +commit 6aa38ef0eab32df5409b72d62509de6ba09cea50 upstream. + +Add MIPI PHY power domain for shared PHY resources used by both +MIPI DSI and CSI blocks. + +Signed-off-by: Guoniu Zhou +Reviewed-by: Frank Li +Acked-by: Krzysztof Kozlowski +Reviewed-by: Peng Fan +Fixes: e9aa77d413c9 ("soc: imx: add i.MX93 media blk ctrl driver") +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + include/dt-bindings/power/fsl,imx93-power.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/dt-bindings/power/fsl,imx93-power.h ++++ b/include/dt-bindings/power/fsl,imx93-power.h +@@ -11,5 +11,6 @@ + #define IMX93_MEDIABLK_PD_PXP 2 + #define IMX93_MEDIABLK_PD_LCDIF 3 + #define IMX93_MEDIABLK_PD_ISI 4 ++#define IMX93_MEDIABLK_PD_MIPI_PHY 5 + + #endif diff --git a/queue-7.1/fbcon-fix-null-pointer-dereference-for-a-console-without-vc_data.patch b/queue-7.1/fbcon-fix-null-pointer-dereference-for-a-console-without-vc_data.patch new file mode 100644 index 0000000000..21beff8c69 --- /dev/null +++ b/queue-7.1/fbcon-fix-null-pointer-dereference-for-a-console-without-vc_data.patch @@ -0,0 +1,61 @@ +From 5fae9a928482d4845bca169a3a098789203a1ca4 Mon Sep 17 00:00:00 2001 +From: Ian Bridges +Date: Wed, 24 Jun 2026 16:11:36 -0500 +Subject: fbcon: fix NULL pointer dereference for a console without vc_data + +From: Ian Bridges + +commit 5fae9a928482d4845bca169a3a098789203a1ca4 upstream. + +fbcon_new_modelist() runs when a framebuffer's modelist changes. For each +console mapped to it with fb_display[i].mode set, it reads vc_cons[i].d and +passes the vc_num to fbcon_set_disp(). This assumes a console with a mode +set has a vc_data, but it can be NULL. fbcon_set_disp() sets +fb_display[i].mode before it checks vc_data, and fbcon_deinit() leaves the +mode set after the vc_data is freed. fbcon_new_modelist() then dereferences +the NULL vc_data. + +Keep fb_display[i].mode set only while the console has a vc_data. Check +vc_data before setting the mode in fbcon_set_disp(), and clear the mode in +fbcon_deinit(). The existing mode check in fbcon_new_modelist() then skips +such consoles. + +Reported-by: syzbot+42525d636f430fd5d983@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=42525d636f430fd5d983 +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: Ian Bridges +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/core/fbcon.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -1274,6 +1274,7 @@ static void fbcon_deinit(struct vc_data + int idx; + + fbcon_free_font(p); ++ p->mode = NULL; + idx = con2fb_map[vc->vc_num]; + + if (idx == -1) +@@ -1445,14 +1446,14 @@ static void fbcon_set_disp(struct fb_inf + + p = &fb_display[unit]; + +- if (var_to_display(p, var, info)) +- return; +- + vc = vc_cons[unit].d; + + if (!vc) + return; + ++ if (var_to_display(p, var, info)) ++ return; ++ + default_mode = vc->vc_display_fg; + svc = *default_mode; + t = &fb_display[svc->vc_num]; diff --git a/queue-7.1/fbcon-use-correct-type-for-vc_resize-return-value.patch b/queue-7.1/fbcon-use-correct-type-for-vc_resize-return-value.patch new file mode 100644 index 0000000000..bd95d800e8 --- /dev/null +++ b/queue-7.1/fbcon-use-correct-type-for-vc_resize-return-value.patch @@ -0,0 +1,41 @@ +From 84202754fb1727dc3ee87f47104e4162ecc8ba3a Mon Sep 17 00:00:00 2001 +From: Jiacheng Yu +Date: Thu, 14 May 2026 17:19:18 +0800 +Subject: fbcon: Use correct type for vc_resize() return value + +From: Jiacheng Yu + +commit 84202754fb1727dc3ee87f47104e4162ecc8ba3a upstream. + +The return value of vc_resize() is int, but fbcon_set_disp() stores it +in an unsigned long variable. While the !ret check happens to work +correctly by coincidence (negative values become large positive values), +the types should match. Use int instead. + +Eliminates the following W=3 warning: + + drivers/video/fbdev/core/fbcon.c: In function 'fbcon_set_disp': + drivers/video/fbdev/core/fbcon.c:1494:14: warning: implicit conversion from 'int' to 'unsigned long' [-Wconversion] + +Fixes: af0db3c1f898 ("fbdev: Fix vmalloc out-of-bounds write in fast_imageblit") +Cc: stable@vger.kernel.org # v6.17+ +Signed-off-by: Jiacheng Yu +Reviewed-by: Thomas Zimmermann +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/core/fbcon.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -1441,8 +1441,7 @@ static void fbcon_set_disp(struct fb_inf + struct vc_data **default_mode, *vc; + struct vc_data *svc; + struct fbcon_par *par = info->fbcon_par; +- int rows, cols; +- unsigned long ret = 0; ++ int rows, cols, ret; + + p = &fb_display[unit]; + diff --git a/queue-7.1/iommu-vt-d-clear-present-bit-before-tearing-down-sca.patch b/queue-7.1/iommu-vt-d-clear-present-bit-before-tearing-down-sca.patch index 829cda45d2..39d6fcac8d 100644 --- a/queue-7.1/iommu-vt-d-clear-present-bit-before-tearing-down-sca.patch +++ b/queue-7.1/iommu-vt-d-clear-present-bit-before-tearing-down-sca.patch @@ -39,14 +39,12 @@ Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel Signed-off-by: Sasha Levin --- - drivers/iommu/intel/pasid.c | 4 +++- + drivers/iommu/intel/pasid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c -index 89541b74ab8ca3..40910dc7363b13 100644 --- a/drivers/iommu/intel/pasid.c +++ b/drivers/iommu/intel/pasid.c -@@ -748,10 +748,12 @@ static void device_pasid_table_teardown(struct device *dev, u8 bus, u8 devfn) +@@ -748,10 +748,12 @@ static void device_pasid_table_teardown( } did = context_domain_id(context); @@ -60,6 +58,3 @@ index 89541b74ab8ca3..40910dc7363b13 100644 } static int pci_pasid_table_teardown(struct pci_dev *pdev, u16 alias, void *data) --- -2.53.0 - diff --git a/queue-7.1/media-uvcvideo-avoid-partial-metadata-buffers.patch b/queue-7.1/media-uvcvideo-avoid-partial-metadata-buffers.patch new file mode 100644 index 0000000000..c85058e406 --- /dev/null +++ b/queue-7.1/media-uvcvideo-avoid-partial-metadata-buffers.patch @@ -0,0 +1,82 @@ +From a15b773fe4ffa450b56347cc506b2d1405600f5d Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Fri, 17 Apr 2026 05:19:29 +0000 +Subject: media: uvcvideo: Avoid partial metadata buffers + +From: Ricardo Ribalda + +commit a15b773fe4ffa450b56347cc506b2d1405600f5d upstream. + +If the metadata queue that is empty receives a new buffer while we are +in the middle of processing a frame, the first metadata buffer will +contain partial information. + +Avoid this by tracking the state of the metadata buffer and making sure +that it is in sync with the data buffer. + +Now that we are at it, make sure that we skip buffers of size 1 or 0. +They are not allowed by the spec... but it is a simple check to add and +better be safe than sorry. + +Fixes: 088ead255245 ("media: uvcvideo: Add a metadata device node") +Cc: stable@vger.kernel.org +Signed-off-by: Ricardo Ribalda +Link: https://patch.msgid.link/20260417-uvc-meta-partial-v2-2-31d274af7d2d@chromium.org +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_video.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -1156,7 +1156,9 @@ static void uvc_video_stats_stop(struct + * uvc_video_decode_end will never be called with a NULL buffer. + */ + static int uvc_video_decode_start(struct uvc_streaming *stream, +- struct uvc_buffer *buf, const u8 *data, int len) ++ struct uvc_buffer *buf, ++ struct uvc_buffer *meta_buf, ++ const u8 *data, int len) + { + u8 header_len; + u8 fid; +@@ -1229,6 +1231,8 @@ static int uvc_video_decode_start(struct + + /* TODO: Handle PTS and SCR. */ + buf->state = UVC_BUF_STATE_ACTIVE; ++ if (meta_buf) ++ meta_buf->state = UVC_BUF_STATE_ACTIVE; + } + + /* +@@ -1431,7 +1435,7 @@ static void uvc_video_decode_meta(struct + ktime_t time; + const u8 *scr; + +- if (!meta_buf || length == 2) ++ if (length <= 2 || !meta_buf || meta_buf->state != UVC_BUF_STATE_ACTIVE) + return; + + has_pts = mem[1] & UVC_STREAM_PTS; +@@ -1548,7 +1552,7 @@ static void uvc_video_decode_isoc(struct + /* Decode the payload header. */ + mem = urb->transfer_buffer + urb->iso_frame_desc[i].offset; + do { +- ret = uvc_video_decode_start(stream, buf, mem, ++ ret = uvc_video_decode_start(stream, buf, meta_buf, mem, + urb->iso_frame_desc[i].actual_length); + if (ret == -EAGAIN) + uvc_video_next_buffers(stream, &buf, &meta_buf); +@@ -1597,7 +1601,8 @@ static void uvc_video_decode_bulk(struct + */ + if (stream->bulk.header_size == 0 && !stream->bulk.skip_payload) { + do { +- ret = uvc_video_decode_start(stream, buf, mem, len); ++ ret = uvc_video_decode_start(stream, buf, meta_buf, mem, ++ len); + if (ret == -EAGAIN) + uvc_video_next_buffers(stream, &buf, &meta_buf); + } while (ret == -EAGAIN); diff --git a/queue-7.1/media-uvcvideo-do-not-add-clock-samples-with-small-sof-delta.patch b/queue-7.1/media-uvcvideo-do-not-add-clock-samples-with-small-sof-delta.patch new file mode 100644 index 0000000000..104f1d4cc9 --- /dev/null +++ b/queue-7.1/media-uvcvideo-do-not-add-clock-samples-with-small-sof-delta.patch @@ -0,0 +1,66 @@ +From ba649fff36c1fe68489a86d00285224907edd436 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Wed, 13 May 2026 11:49:23 +0000 +Subject: media: uvcvideo: Do not add clock samples with small sof delta + +From: Ricardo Ribalda + +commit ba649fff36c1fe68489a86d00285224907edd436 upstream. + +Some UVC 1.1 cameras running in fast isochronous mode tend to spam the +USB host with a lot of empty packets. These packets contain clock +information and are added to the clock buffer but do not add any +accuracy to the calculation. In fact, it is quite the opposite, in our +calculations, only the first and the last timestamp is used, and we only +have 32 slots. + +Ignore the samples that will produce less than MIN_HW_TIMESTAMP_DIFF +data. + +Fixes: 141270bd95d4 ("media: uvcvideo: Refactor clock circular buffer") +Cc: stable@vger.kernel.org +Tested-by: Yunke Cao +Reviewed-by: Hans de Goede +Signed-off-by: Ricardo Ribalda +Link: https://patch.msgid.link/20260513-uvc-hwtimestamp-v3-4-7a64838b0b02@chromium.org +Signed-off-by: Hans de Goede +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_video.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -537,6 +537,15 @@ static void uvc_video_clock_add_sample(s + spin_unlock_irqrestore(&clock->lock, flags); + } + ++static inline u16 sof_diff(u16 a, u16 b) ++{ ++ /* ++ * Because the result is modulo 2048 (via & 2047), we do not need a ++ * special case for a < b. ++ */ ++ return (a - b) & 2047; ++} ++ + static void + uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf, + const u8 *data, int len) +@@ -657,12 +666,13 @@ uvc_video_clock_decode(struct uvc_stream + sample.dev_sof = (sample.dev_sof + stream->clock.sof_offset) & 2047; + + /* +- * To limit the amount of data, drop SCRs with an SOF identical to the ++ * To limit the amount of data, drop SCRs with an SOF similar to the + * previous one. This filtering is also needed to support UVC 1.5, where + * all the data packets of the same frame contains the same SOF. In that + * case only the first one will match the host_sof. + */ +- if (sample.dev_sof == stream->clock.last_sof) ++ if (sof_diff(sample.dev_sof, stream->clock.last_sof) <= ++ (UVC_MIN_HW_TIMESTAMP_DIFF / stream->clock.size)) + return; + + uvc_video_clock_add_sample(&stream->clock, &sample); diff --git a/queue-7.1/media-uvcvideo-fix-buffer-sequence-in-frame-gaps.patch b/queue-7.1/media-uvcvideo-fix-buffer-sequence-in-frame-gaps.patch new file mode 100644 index 0000000000..e4b75e92f3 --- /dev/null +++ b/queue-7.1/media-uvcvideo-fix-buffer-sequence-in-frame-gaps.patch @@ -0,0 +1,67 @@ +From 2f24ac8dd87983a55f0498898f34a5f2b735b802 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Mon, 23 Mar 2026 09:53:53 +0000 +Subject: media: uvcvideo: Fix buffer sequence in frame gaps + +From: Ricardo Ribalda + +commit 2f24ac8dd87983a55f0498898f34a5f2b735b802 upstream. + +In UVC, the FID flips with every frame. For every FID flip, we increase +the stream sequence number. + +Now, if a FID flips multiple times and there is no data transferred between +the flips, the buffer sequence number will be set to the value of the +stream sequence number after the first flip. + +Userspace uses the buffer sequence number to determine if there have been +missing frames. With the current behaviour, userspace will think that the +gap is in the wrong location. + +This patch modifies uvc_video_decode_start() to provide the correct buffer +sequence number and timestamp. + +Cc: stable@kernel.org +Fixes: 650b95feee35 ("[media] uvcvideo: Generate discontinuous sequence numbers when frames are lost") +Signed-off-by: Ricardo Ribalda +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_video.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -1185,6 +1185,19 @@ static int uvc_video_decode_start(struct + stream->sequence++; + if (stream->sequence) + uvc_video_stats_update(stream); ++ ++ /* ++ * On a FID flip initialize sequence number and timestamp. ++ * ++ * The driver already takes care of injecting FID flips for ++ * UVC_QUIRK_STREAM_NO_FID and UVC_QUIRK_MJPEG_NO_EOF. ++ */ ++ if (buf) { ++ buf->buf.field = V4L2_FIELD_NONE; ++ buf->buf.sequence = stream->sequence; ++ buf->buf.vb2_buf.timestamp = ++ ktime_to_ns(uvc_video_get_time()); ++ } + } + + uvc_video_clock_decode(stream, buf, data, len); +@@ -1225,10 +1238,6 @@ static int uvc_video_decode_start(struct + return -ENODATA; + } + +- buf->buf.field = V4L2_FIELD_NONE; +- buf->buf.sequence = stream->sequence; +- buf->buf.vb2_buf.timestamp = ktime_to_ns(uvc_video_get_time()); +- + /* TODO: Handle PTS and SCR. */ + buf->state = UVC_BUF_STATE_ACTIVE; + if (meta_buf) diff --git a/queue-7.1/media-uvcvideo-fix-deadlock-if-uvc_status_stop-is-called-from-async_ctrl.work.patch b/queue-7.1/media-uvcvideo-fix-deadlock-if-uvc_status_stop-is-called-from-async_ctrl.work.patch new file mode 100644 index 0000000000..1692f2c865 --- /dev/null +++ b/queue-7.1/media-uvcvideo-fix-deadlock-if-uvc_status_stop-is-called-from-async_ctrl.work.patch @@ -0,0 +1,99 @@ +From 6d27f92c54ce28cfbd2a8a479a96d6f4a781b7d2 Mon Sep 17 00:00:00 2001 +From: Sean Anderson +Date: Mon, 16 Mar 2026 11:58:22 -0400 +Subject: media: uvcvideo: Fix deadlock if uvc_status_stop is called from async_ctrl.work + +From: Sean Anderson + +commit 6d27f92c54ce28cfbd2a8a479a96d6f4a781b7d2 upstream. + +If a UVC camera has an asynchronous control, uvc_status_stop may be +called from async_ctrl.work: + +uvc_ctrl_status_event_work() + uvc_ctrl_status_event() + uvc_ctrl_clear_handle() + uvc_pm_put() + uvc_status_put() + uvc_status_stop() + cancel_work_sync() + +This will cause a deadlock, since cancel_work_sync will wait for +uvc_ctrl_status_event_work to complete before returning. + +Fix this by returning early from uvc_status_stop if we are currently in +the work function. flush_status now remains false until uvc_status_start +is called again, ensuring that uvc_ctrl_status_event_work won't resubmit +the URB. + +Fixes: a32d9c41bdb8 ("media: uvcvideo: Make power management granular") +Cc: stable@vger.kernel.org +Closes: https://lore.kernel.org/all/6733bdfb-3e88-479f-8956-ab09c04c433e@linux.dev/ +Signed-off-by: Sean Anderson +Link: https://patch.msgid.link/20260316155823.1855434-1-sean.anderson@linux.dev +Reviewed-by: Ricardo Ribalda +Tested-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans de Goede +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_status.c | 28 +++++++++++++++++++--------- + 1 file changed, 19 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_status.c b/drivers/media/usb/uvc/uvc_status.c +index 65f5356bebb3..b632cf5e3fe9 100644 +--- a/drivers/media/usb/uvc/uvc_status.c ++++ b/drivers/media/usb/uvc/uvc_status.c +@@ -316,6 +316,16 @@ static int uvc_status_start(struct uvc_device *dev, gfp_t flags) + if (!dev->int_urb) + return 0; + ++ /* ++ * If the previous uvc_status_stop() call was from the async work, ++ * the work may still be running. Wait for it to finish before we submit ++ * the urb. ++ */ ++ flush_work(&dev->async_ctrl.work); ++ ++ /* Clear the flush status if we were previously stopped. */ ++ smp_store_release(&dev->flush_status, false); ++ + return usb_submit_urb(dev->int_urb, flags); + } + +@@ -336,6 +346,15 @@ static void uvc_status_stop(struct uvc_device *dev) + */ + smp_store_release(&dev->flush_status, true); + ++ /* ++ * If we are called from the event work function, the URB is guaranteed ++ * to not be in flight as it has completed and has not been resubmitted. ++ * There's no need to cancel the work (which would deadlock), or to kill ++ * the URB. ++ */ ++ if (current_work() == &w->work) ++ return; ++ + /* + * Cancel any pending asynchronous work. If any status event was queued, + * process it synchronously. +@@ -354,15 +373,6 @@ static void uvc_status_stop(struct uvc_device *dev) + */ + if (cancel_work_sync(&w->work)) + uvc_ctrl_status_event(w->chain, w->ctrl, w->data); +- +- /* +- * From this point, there are no events on the queue and the status URB +- * is dead. No events will be queued until uvc_status_start() is called. +- * The barrier is needed to make sure that flush_status is visible to +- * uvc_ctrl_status_event_work() when uvc_status_start() will be called +- * again. +- */ +- smp_store_release(&dev->flush_status, false); + } + + int uvc_status_resume(struct uvc_device *dev) +-- +2.55.0 + diff --git a/queue-7.1/media-uvcvideo-fix-dev_sof-filtering-in-hw-timestamp.patch b/queue-7.1/media-uvcvideo-fix-dev_sof-filtering-in-hw-timestamp.patch new file mode 100644 index 0000000000..1734b3ba23 --- /dev/null +++ b/queue-7.1/media-uvcvideo-fix-dev_sof-filtering-in-hw-timestamp.patch @@ -0,0 +1,67 @@ +From edc1917599c5339aedc83135cade66517e0a2972 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Wed, 13 May 2026 11:49:20 +0000 +Subject: media: uvcvideo: Fix dev_sof filtering in hw timestamp + +From: Ricardo Ribalda + +commit edc1917599c5339aedc83135cade66517e0a2972 upstream. + +To avoid filling the clock circular buffer with duplicated data we only +add it if the new value sof is different than the last added sof. + +The issue is that we compare the unprocess sof with the processed sof. +If there is a sof_offset, or UVC_QUIRK_INVALID_DEVICE_SOF is enabled, +the comparison will not work as expected. + +This patch moves the comparison to the right place. + +Fixes: 141270bd95d4 ("media: uvcvideo: Refactor clock circular buffer") +Cc: stable@vger.kernel.org +Reviewed-by: Hans de Goede +Tested-by: Yunke Cao +Signed-off-by: Ricardo Ribalda +Link: https://patch.msgid.link/20260513-uvc-hwtimestamp-v3-1-7a64838b0b02@chromium.org +Signed-off-by: Hans de Goede +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_video.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -583,16 +583,7 @@ uvc_video_clock_decode(struct uvc_stream + if (!has_scr) + return; + +- /* +- * To limit the amount of data, drop SCRs with an SOF identical to the +- * previous one. This filtering is also needed to support UVC 1.5, where +- * all the data packets of the same frame contains the same SOF. In that +- * case only the first one will match the host_sof. +- */ + sample.dev_sof = get_unaligned_le16(&data[header_size - 2]); +- if (sample.dev_sof == stream->clock.last_sof) +- return; +- + sample.dev_stc = get_unaligned_le32(&data[header_size - 6]); + + /* +@@ -664,6 +655,16 @@ uvc_video_clock_decode(struct uvc_stream + } + + sample.dev_sof = (sample.dev_sof + stream->clock.sof_offset) & 2047; ++ ++ /* ++ * To limit the amount of data, drop SCRs with an SOF identical to the ++ * previous one. This filtering is also needed to support UVC 1.5, where ++ * all the data packets of the same frame contains the same SOF. In that ++ * case only the first one will match the host_sof. ++ */ ++ if (sample.dev_sof == stream->clock.last_sof) ++ return; ++ + uvc_video_clock_add_sample(&stream->clock, &sample); + stream->clock.last_sof = sample.dev_sof; + } diff --git a/queue-7.1/media-uvcvideo-fix-sequence-number-when-no-eof.patch b/queue-7.1/media-uvcvideo-fix-sequence-number-when-no-eof.patch new file mode 100644 index 0000000000..fb4ca3bc04 --- /dev/null +++ b/queue-7.1/media-uvcvideo-fix-sequence-number-when-no-eof.patch @@ -0,0 +1,149 @@ +From f078966ca1fb1b3865d8e6bbe2705cfd277fc637 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Mon, 23 Mar 2026 09:53:52 +0000 +Subject: media: uvcvideo: Fix sequence number when no EOF + +From: Ricardo Ribalda + +commit f078966ca1fb1b3865d8e6bbe2705cfd277fc637 upstream. + +If the driver could not detect the EOF, the sequence number is increased +twice: + 1) When we enter uvc_video_decode_start() with the old buffer and FID has + flipped => We return -EAGAIN and last_fid is not flipped + 2) When we enter uvc_video_decode_start() with the new buffer. + +Fix this issue by moving the new frame detection logic earlier in +uvc_video_decode_start(). + +This also has some nice side affects: + +- The error status from the new packet will no longer get propagated + to the previous frame-buffer. +- uvc_video_clock_decode() will no longer update the previous frame + buf->stf with info from the new packet. +- uvc_video_clock_decode() and uvc_video_stats_decode() will no longer + get called twice for the same packet. + +Cc: stable@kernel.org +Fixes: 650b95feee35 ("[media] uvcvideo: Generate discontinuous sequence numbers when frames are lost") +Reported-by: Hans de Goede +Closes: https://lore.kernel.org/linux-media/CANiDSCuj4cPuB5_v2xyvAagA5FjoN8V5scXiFFOeD3aKDMqkCg@mail.gmail.com/T/#me39fb134e8c2c085567a31548c3403eb639625e4 +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_video.c | 92 +++++++++++++++++++------------------- + 1 file changed, 47 insertions(+), 45 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -1196,6 +1196,53 @@ static int uvc_video_decode_start(struct + fid = data[1] & UVC_STREAM_FID; + + /* ++ * Mark the buffer as done if we're at the beginning of a new frame. ++ * End of frame detection is better implemented by checking the EOF ++ * bit (FID bit toggling is delayed by one frame compared to the EOF ++ * bit), but some devices don't set the bit at end of frame (and the ++ * last payload can be lost anyway). We thus must check if the FID has ++ * been toggled. ++ * ++ * stream->last_fid is initialized to -1, and buf->bytesused to 0, ++ * so the first isochronous frame will never trigger an end of frame ++ * detection. ++ * ++ * Empty buffers (bytesused == 0) don't trigger end of frame detection ++ * as it doesn't make sense to return an empty buffer. This also ++ * avoids detecting end of frame conditions at FID toggling if the ++ * previous payload had the EOF bit set. ++ */ ++ if (fid != stream->last_fid && buf && buf->bytesused != 0) { ++ uvc_dbg(stream->dev, FRAME, ++ "Frame complete (FID bit toggled)\n"); ++ buf->state = UVC_BUF_STATE_READY; ++ ++ return -EAGAIN; ++ } ++ ++ /* ++ * Some cameras, when running two parallel streams (one MJPEG alongside ++ * another non-MJPEG stream), are known to lose the EOF packet for a frame. ++ * We can detect the end of a frame by checking for a new SOI marker, as ++ * the SOI always lies on the packet boundary between two frames for ++ * these devices. ++ */ ++ if (stream->dev->quirks & UVC_QUIRK_MJPEG_NO_EOF && ++ (stream->cur_format->fcc == V4L2_PIX_FMT_MJPEG || ++ stream->cur_format->fcc == V4L2_PIX_FMT_JPEG) && ++ buf && buf->bytesused != 0) { ++ const u8 *packet = data + header_len; ++ ++ if (len >= header_len + 2 && ++ packet[0] == 0xff && packet[1] == JPEG_MARKER_SOI) { ++ buf->state = UVC_BUF_STATE_READY; ++ buf->error = 1; ++ stream->last_fid ^= UVC_STREAM_FID; ++ return -EAGAIN; ++ } ++ } ++ ++ /* + * Increase the sequence number regardless of any buffer states, so + * that discontinuous sequence numbers always indicate lost frames. + */ +@@ -1262,51 +1309,6 @@ static int uvc_video_decode_start(struct + meta_buf->state = UVC_BUF_STATE_ACTIVE; + } + +- /* +- * Mark the buffer as done if we're at the beginning of a new frame. +- * End of frame detection is better implemented by checking the EOF +- * bit (FID bit toggling is delayed by one frame compared to the EOF +- * bit), but some devices don't set the bit at end of frame (and the +- * last payload can be lost anyway). We thus must check if the FID has +- * been toggled. +- * +- * stream->last_fid is initialized to -1, so the first isochronous +- * frame will never trigger an end of frame detection. +- * +- * Empty buffers (bytesused == 0) don't trigger end of frame detection +- * as it doesn't make sense to return an empty buffer. This also +- * avoids detecting end of frame conditions at FID toggling if the +- * previous payload had the EOF bit set. +- */ +- if (fid != stream->last_fid && buf->bytesused != 0) { +- uvc_dbg(stream->dev, FRAME, +- "Frame complete (FID bit toggled)\n"); +- buf->state = UVC_BUF_STATE_READY; +- return -EAGAIN; +- } +- +- /* +- * Some cameras, when running two parallel streams (one MJPEG alongside +- * another non-MJPEG stream), are known to lose the EOF packet for a frame. +- * We can detect the end of a frame by checking for a new SOI marker, as +- * the SOI always lies on the packet boundary between two frames for +- * these devices. +- */ +- if (stream->dev->quirks & UVC_QUIRK_MJPEG_NO_EOF && +- (stream->cur_format->fcc == V4L2_PIX_FMT_MJPEG || +- stream->cur_format->fcc == V4L2_PIX_FMT_JPEG)) { +- const u8 *packet = data + header_len; +- +- if (len >= header_len + 2 && +- packet[0] == 0xff && packet[1] == JPEG_MARKER_SOI && +- buf->bytesused != 0) { +- buf->state = UVC_BUF_STATE_READY; +- buf->error = 1; +- stream->last_fid ^= UVC_STREAM_FID; +- return -EAGAIN; +- } +- } +- + stream->last_fid = fid; + + return header_len; diff --git a/queue-7.1/media-uvcvideo-relax-the-constrains-for-interpolating-the-hw-clock.patch b/queue-7.1/media-uvcvideo-relax-the-constrains-for-interpolating-the-hw-clock.patch new file mode 100644 index 0000000000..238498a8af --- /dev/null +++ b/queue-7.1/media-uvcvideo-relax-the-constrains-for-interpolating-the-hw-clock.patch @@ -0,0 +1,62 @@ +From 1719d78f832dda8dd3f09a867ba74e05d6f11308 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Wed, 13 May 2026 11:49:22 +0000 +Subject: media: uvcvideo: Relax the constrains for interpolating the hw clock + +From: Ricardo Ribalda + +commit 1719d78f832dda8dd3f09a867ba74e05d6f11308 upstream. + +In the initial version we set the min value to 250msec. Looks like +100msec can also provide a good value. + +Now that we are at it, add a macro to make it cleaner. + +Fixes: 6243c83be6ee8 ("media: uvcvideo: Allow hw clock updates with buffers not full") +Cc: stable@vger.kernel.org +Reviewed-by: Hans de Goede +Tested-by: Yunke Cao +Signed-off-by: Ricardo Ribalda +Link: https://patch.msgid.link/20260513-uvc-hwtimestamp-v3-3-7a64838b0b02@chromium.org +Signed-off-by: Hans de Goede +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_video.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -494,6 +494,13 @@ static int uvc_commit_video(struct uvc_s + * Clocks and timestamps + */ + ++/* ++ * The accuracy of the hardware timestamping depends on having enough data to ++ * interpolate between the different clock domains. This value is sof cycles, ++ * this is, milliseconds. ++ */ ++#define UVC_MIN_HW_TIMESTAMP_DIFF 100 ++ + static inline ktime_t uvc_video_get_time(void) + { + if (uvc_clock_param == CLOCK_MONOTONIC) +@@ -853,13 +860,13 @@ void uvc_video_clock_update(struct uvc_s + * buffer, but RAM is expensive these days, specially the infinitely + * big. + * +- * The value of 1/4th of a second was determined by running Android's +- * CTS on different devices. ++ * The value of UVC_MIN_HW_TIMESTAMP_DIFF was determined by running ++ * Android's CTS on different devices. + * +- * dev_sof runs at 1KHz, and we have a fixed point precision of +- * 16 bits. ++ * y1 and y2 are dev_sof with a fixed point precision of 16 bits. + */ +- if (clock->size != clock->count && (y2 - y1) < ((1000 / 4) << 16)) ++ if (clock->size != clock->count && ++ (y2 - y1) < (UVC_MIN_HW_TIMESTAMP_DIFF << 16)) + goto done; + + y = (u64)(y2 - y1) * (1ULL << 31) + (u64)y1 * (u64)x2 diff --git a/queue-7.1/media-uvcvideo-use-hw-timestaming-if-the-clock-buffer-is-full.patch b/queue-7.1/media-uvcvideo-use-hw-timestaming-if-the-clock-buffer-is-full.patch new file mode 100644 index 0000000000..4fc8933e48 --- /dev/null +++ b/queue-7.1/media-uvcvideo-use-hw-timestaming-if-the-clock-buffer-is-full.patch @@ -0,0 +1,60 @@ +From ede7de6e6b3db552d10ac50557d69c50d1b08486 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Wed, 13 May 2026 11:49:21 +0000 +Subject: media: uvcvideo: Use hw timestaming if the clock buffer is full + +From: Ricardo Ribalda + +commit ede7de6e6b3db552d10ac50557d69c50d1b08486 upstream. + +In some situations, even with a full clock buffer, it does not contain +250msec of data. This results in the driver jumping back from software +to hardware timestapsing creating a nasty artifact in the video. + +If the clock buffer is full, use it to calculate the timestamp instead +of defaulting to software stamps, the reduced accuracy is less visible +than jumping from one timestamping mechanism to the other. + +Fixes: 6243c83be6ee8 ("media: uvcvideo: Allow hw clock updates with buffers not full") +Cc: stable@vger.kernel.org +Reviewed-by: Hans de Goede +Tested-by: Yunke Cao +Signed-off-by: Ricardo Ribalda +Link: https://patch.msgid.link/20260513-uvc-hwtimestamp-v3-2-7a64838b0b02@chromium.org +Signed-off-by: Hans de Goede +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_video.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -833,15 +833,22 @@ void uvc_video_clock_update(struct uvc_s + y2 += 2048 << 16; + + /* +- * Have at least 1/4 of a second of timestamps before we +- * try to do any calculation. Otherwise we do not have enough +- * precision. This value was determined by running Android CTS +- * on different devices. ++ * If the buffer is not full, we want to gather at least 1/4th of ++ * timestamps before using HW timestamping. We do this to avoid jitter ++ * on the initial frames. ++ * ++ * If the buffer is full we would use it regardless of how much data ++ * it represents. This could be solved with an infinite big circular ++ * buffer, but RAM is expensive these days, specially the infinitely ++ * big. ++ * ++ * The value of 1/4th of a second was determined by running Android's ++ * CTS on different devices. + * + * dev_sof runs at 1KHz, and we have a fixed point precision of + * 16 bits. + */ +- if ((y2 - y1) < ((1000 / 4) << 16)) ++ if (clock->size != clock->count && (y2 - y1) < ((1000 / 4) << 16)) + goto done; + + y = (u64)(y2 - y1) * (1ULL << 31) + (u64)y1 * (u64)x2 diff --git a/queue-7.1/rxrpc-don-t-move-a-peeked-oob-message-onto-the-pending-queue.patch b/queue-7.1/rxrpc-don-t-move-a-peeked-oob-message-onto-the-pending-queue.patch new file mode 100644 index 0000000000..2fecf4e6fa --- /dev/null +++ b/queue-7.1/rxrpc-don-t-move-a-peeked-oob-message-onto-the-pending-queue.patch @@ -0,0 +1,67 @@ +From 5801cff7d5d7b4e9d877dfb627b23eb63167f02c Mon Sep 17 00:00:00 2001 +From: Hyunwoo Kim +Date: Tue, 9 Jun 2026 15:09:06 +0100 +Subject: rxrpc: Don't move a peeked OOB message onto the pending queue + +From: Hyunwoo Kim + +commit 5801cff7d5d7b4e9d877dfb627b23eb63167f02c upstream. + +rxrpc_recvmsg_oob() takes a received oob message off recvmsg_oobq and, +if a response is needed, moves it onto the pending_oobq tree. However, +only the unlink from recvmsg_oobq is guarded by MSG_PEEK; the move onto +pending_oobq always runs. + +As a result, reading a challenge with MSG_PEEK leaves the skb on +recvmsg_oobq while also adding it to pending_oobq. Since struct +sk_buff's rbnode shares storage with its next and prev pointers, +rb_insert_color() overwrites the list linkage, and the skb, which holds +a single reference, becomes reachable from both queues at once. + +When the socket is closed both queues are drained in turn. While +draining recvmsg_oobq, __skb_unlink() follows the next and prev +pointers that rbnode has overwritten and writes to a bad address. Also, +as the skb holds a single reference but is freed from each queue, both +the skb and the connection reference it holds are released twice. This +leads to memory corruption and to a use-after-free caused by the +connection refcount underflow. + +MSG_PEEK does not consume the message from the queue, so only unlink it +from recvmsg_oobq and then move it onto pending_oobq or free it when +the message is actually consumed. + +Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE") +Signed-off-by: Hyunwoo Kim +Signed-off-by: David Howells +cc: Marc Dionne +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260609140911.838677-3-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/recvmsg.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/net/rxrpc/recvmsg.c ++++ b/net/rxrpc/recvmsg.c +@@ -262,12 +262,13 @@ static int rxrpc_recvmsg_oob(struct sock + break; + } + +- if (!(flags & MSG_PEEK)) ++ if (!(flags & MSG_PEEK)) { + skb_unlink(skb, &rx->recvmsg_oobq); +- if (need_response) +- rxrpc_add_pending_oob(rx, skb); +- else +- rxrpc_free_skb(skb, rxrpc_skb_put_oob); ++ if (need_response) ++ rxrpc_add_pending_oob(rx, skb); ++ else ++ rxrpc_free_skb(skb, rxrpc_skb_put_oob); ++ } + return ret; + } + diff --git a/queue-7.1/rxrpc-fix-ackall-packet-handling.patch b/queue-7.1/rxrpc-fix-ackall-packet-handling.patch new file mode 100644 index 0000000000..146649930d --- /dev/null +++ b/queue-7.1/rxrpc-fix-ackall-packet-handling.patch @@ -0,0 +1,216 @@ +From 9b6ce594808580b2a19e6e1aa459ef56c0153ac1 Mon Sep 17 00:00:00 2001 +From: Wyatt Feng +Date: Wed, 24 Jun 2026 17:38:08 +0100 +Subject: rxrpc: Fix ACKALL packet handling + +From: Wyatt Feng + +commit 9b6ce594808580b2a19e6e1aa459ef56c0153ac1 upstream. + +rxrpc_input_ackall() accepts ACKALL packets without checking whether the +call is in a state that can legitimately have outstanding transmit buffers. +A forged ACKALL can therefore reach a new service call in +RXRPC_CALL_SERVER_RECV_REQUEST before any reply packets have been queued. + +In that state call->tx_top is zero and call->tx_queue is NULL, so +rxrpc_rotate_tx_window() dereferences a NULL txqueue and triggers a +null-pointer dereference. + +Fix the handling of ACKALL packets by the following means: + + (1) Add two new call states: RXRPC_CALL_CLIENT_PRE_SEND which indicates + that the client call is connected, but nothing has been transmitted as + yet; and RXRPC_CALL_CLIENT_AWAIT_ACK, which indicates that everything + has been transmitted at least once, but we're now waiting for the + stuff remaining in the Tx buffer to be ACK'd (retransmissions may + still happen). + + The RXRPC_CALL_CLIENT_PRE_SEND state is set when the call is assigned + a channel and transitions to RXRPC_CALL_CLIENT_SEND_REQUEST when the + first packet is transmitted. + + RXRPC_CALL_CLIENT_AWAIT_REPLY is then narrowed in scope to indicate + that all Tx packets have been ACK'd and we're now waiting for the + reply to be received. + + (2) As per Wyatt Feng's original patch[1], the ACKALL handler then checks + that the call state is one in which there might be stuff in the Tx + buffer to ACK, but now this includes AWAIT_ACK rather than + AWAIT_REPLY. ACKALL packets are ignored if received in the wrong + state. + + Note that unlike Wyatt Feng's patch, it's no longer necessary to check + to see if the Tx buffer exists as this the state set now covers this. + + (3) Make the ACKALL handler use call->tx_transmitted rather than + call->tx_top as the former is explicitly the highest packet seq number + transmitted, whereas the latter has a looser definition. + +Thanks to Jeffrey Altman for a description of the history of the ACKALL +packet[1]. + +Fixes: b341a0263b1b ("rxrpc: Implement progressive transmission queue struct") +Reported-by: Yuan Tan +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Reported-by: Zhengchuan Liang +Reported-by: Xin Liu +Signed-off-by: Wyatt Feng +Co-developed-by: David Howells +Signed-off-by: David Howells +cc: Ren Wei +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20260616155749.2125907-2-dhowells@redhat.com/ [1] +Link: https://lore.kernel.org/r/c0fd4fec-1576-4070-b31e-a37d5506f5ed@auristor.com/ [2] +Reviewed-by: Jeffrey Altman +Link: https://patch.msgid.link/20260624163819.3017002-2-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/ar-internal.h | 2 ++ + net/rxrpc/call_event.c | 5 ++++- + net/rxrpc/call_object.c | 2 ++ + net/rxrpc/conn_client.c | 2 +- + net/rxrpc/input.c | 23 +++++++++++++++++++---- + net/rxrpc/sendmsg.c | 3 ++- + 6 files changed, 30 insertions(+), 7 deletions(-) + +--- a/net/rxrpc/ar-internal.h ++++ b/net/rxrpc/ar-internal.h +@@ -650,7 +650,9 @@ enum rxrpc_call_event { + enum rxrpc_call_state { + RXRPC_CALL_UNINITIALISED, + RXRPC_CALL_CLIENT_AWAIT_CONN, /* - client waiting for connection to become available */ ++ RXRPC_CALL_CLIENT_PRE_SEND, /* - client is connected, but hasn't sent anything yet */ + RXRPC_CALL_CLIENT_SEND_REQUEST, /* - client sending request phase */ ++ RXRPC_CALL_CLIENT_AWAIT_ACK, /* - client awaiting ACKs of request */ + RXRPC_CALL_CLIENT_AWAIT_REPLY, /* - client awaiting reply */ + RXRPC_CALL_CLIENT_RECV_REPLY, /* - client receiving reply phase */ + RXRPC_CALL_SERVER_PREALLOC, /* - service preallocation */ +--- a/net/rxrpc/call_event.c ++++ b/net/rxrpc/call_event.c +@@ -178,7 +178,7 @@ static void rxrpc_close_tx_phase(struct + + switch (__rxrpc_call_state(call)) { + case RXRPC_CALL_CLIENT_SEND_REQUEST: +- rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_AWAIT_REPLY); ++ rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_AWAIT_ACK); + break; + case RXRPC_CALL_SERVER_SEND_REPLY: + rxrpc_set_call_state(call, RXRPC_CALL_SERVER_AWAIT_ACK); +@@ -244,6 +244,8 @@ static void rxrpc_transmit_fresh_data(st + break; + } while (req.n < limit && before(seq, send_top)); + ++ if (__rxrpc_call_state(call) == RXRPC_CALL_CLIENT_PRE_SEND) ++ rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_SEND_REQUEST); + if (txb->flags & RXRPC_LAST_PACKET) { + rxrpc_close_tx_phase(call); + tq = NULL; +@@ -267,6 +269,7 @@ void rxrpc_transmit_some_data(struct rxr + fallthrough; + + case RXRPC_CALL_SERVER_SEND_REPLY: ++ case RXRPC_CALL_CLIENT_PRE_SEND: + case RXRPC_CALL_CLIENT_SEND_REQUEST: + if (!rxrpc_tx_window_space(call)) + return; +--- a/net/rxrpc/call_object.c ++++ b/net/rxrpc/call_object.c +@@ -18,7 +18,9 @@ + const char *const rxrpc_call_states[NR__RXRPC_CALL_STATES] = { + [RXRPC_CALL_UNINITIALISED] = "Uninit ", + [RXRPC_CALL_CLIENT_AWAIT_CONN] = "ClWtConn", ++ [RXRPC_CALL_CLIENT_PRE_SEND] = "ClPreSnd", + [RXRPC_CALL_CLIENT_SEND_REQUEST] = "ClSndReq", ++ [RXRPC_CALL_CLIENT_AWAIT_ACK] = "ClAwtAck", + [RXRPC_CALL_CLIENT_AWAIT_REPLY] = "ClAwtRpl", + [RXRPC_CALL_CLIENT_RECV_REPLY] = "ClRcvRpl", + [RXRPC_CALL_SERVER_PREALLOC] = "SvPrealc", +--- a/net/rxrpc/conn_client.c ++++ b/net/rxrpc/conn_client.c +@@ -449,7 +449,7 @@ static void rxrpc_activate_one_channel(s + trace_rxrpc_connect_call(call); + call->tx_last_sent = ktime_get_real(); + rxrpc_start_call_timer(call); +- rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_SEND_REQUEST); ++ rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_PRE_SEND); + wake_up(&call->waitq); + } + +--- a/net/rxrpc/input.c ++++ b/net/rxrpc/input.c +@@ -181,7 +181,8 @@ void rxrpc_congestion_degrade(struct rxr + if (call->cong_ca_state != RXRPC_CA_SLOW_START && + call->cong_ca_state != RXRPC_CA_CONGEST_AVOIDANCE) + return; +- if (__rxrpc_call_state(call) == RXRPC_CALL_CLIENT_AWAIT_REPLY) ++ if (__rxrpc_call_state(call) == RXRPC_CALL_CLIENT_AWAIT_ACK || ++ __rxrpc_call_state(call) == RXRPC_CALL_CLIENT_AWAIT_REPLY) + return; + + rtt = ns_to_ktime(call->srtt_us * (NSEC_PER_USEC / 8)); +@@ -359,6 +360,7 @@ static void rxrpc_end_tx_phase(struct rx + + switch (__rxrpc_call_state(call)) { + case RXRPC_CALL_CLIENT_SEND_REQUEST: ++ case RXRPC_CALL_CLIENT_AWAIT_ACK: + case RXRPC_CALL_CLIENT_AWAIT_REPLY: + if (reply_begun) { + rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_RECV_REPLY); +@@ -697,6 +699,7 @@ static void rxrpc_input_data(struct rxrp + + switch (__rxrpc_call_state(call)) { + case RXRPC_CALL_CLIENT_SEND_REQUEST: ++ case RXRPC_CALL_CLIENT_AWAIT_ACK: + case RXRPC_CALL_CLIENT_AWAIT_REPLY: + /* Received data implicitly ACKs all of the request + * packets we sent when we're acting as a client. +@@ -1157,10 +1160,12 @@ static void rxrpc_input_ack(struct rxrpc + if (hard_ack + 1 == 0) + return rxrpc_proto_abort(call, 0, rxrpc_eproto_ackr_zero); + +- /* Ignore ACKs unless we are or have just been transmitting. */ ++ /* Ignore ACKs unless we are transmitting or are waiting for ++ * acknowledgement of the packets we've just been transmitting. ++ */ + switch (__rxrpc_call_state(call)) { + case RXRPC_CALL_CLIENT_SEND_REQUEST: +- case RXRPC_CALL_CLIENT_AWAIT_REPLY: ++ case RXRPC_CALL_CLIENT_AWAIT_ACK: + case RXRPC_CALL_SERVER_SEND_REPLY: + case RXRPC_CALL_SERVER_AWAIT_ACK: + break; +@@ -1218,7 +1223,17 @@ static void rxrpc_input_ackall(struct rx + { + struct rxrpc_ack_summary summary = { 0 }; + +- if (rxrpc_rotate_tx_window(call, call->tx_top, &summary)) ++ switch (__rxrpc_call_state(call)) { ++ case RXRPC_CALL_CLIENT_SEND_REQUEST: ++ case RXRPC_CALL_CLIENT_AWAIT_ACK: ++ case RXRPC_CALL_SERVER_SEND_REPLY: ++ case RXRPC_CALL_SERVER_AWAIT_ACK: ++ break; ++ default: ++ return; ++ } ++ ++ if (rxrpc_rotate_tx_window(call, call->tx_transmitted, &summary)) + rxrpc_end_tx_phase(call, false, rxrpc_eproto_unexpected_ackall); + } + +--- a/net/rxrpc/sendmsg.c ++++ b/net/rxrpc/sendmsg.c +@@ -366,7 +366,8 @@ reload: + if (state >= RXRPC_CALL_COMPLETE) + goto maybe_error; + ret = -EPROTO; +- if (state != RXRPC_CALL_CLIENT_SEND_REQUEST && ++ if (state != RXRPC_CALL_CLIENT_PRE_SEND && ++ state != RXRPC_CALL_CLIENT_SEND_REQUEST && + state != RXRPC_CALL_SERVER_ACK_REQUEST && + state != RXRPC_CALL_SERVER_SEND_REPLY) { + /* Request phase complete for this client call */ diff --git a/queue-7.1/rxrpc-fix-double-unlock-in-rxrpc_recvmsg.patch b/queue-7.1/rxrpc-fix-double-unlock-in-rxrpc_recvmsg.patch new file mode 100644 index 0000000000..7b3465dd52 --- /dev/null +++ b/queue-7.1/rxrpc-fix-double-unlock-in-rxrpc_recvmsg.patch @@ -0,0 +1,36 @@ +From a2f299b4d5510147fa8629a6aba2869bbcc88aea Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Wed, 24 Jun 2026 17:38:10 +0100 +Subject: rxrpc: Fix double unlock in rxrpc_recvmsg() + +From: David Howells + +commit a2f299b4d5510147fa8629a6aba2869bbcc88aea upstream. + +Fix a double unlock in rxrpc_recvmsg() when dealing with OOB messages. + +Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE") +Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com +Signed-off-by: David Howells +cc: Marc Dionne +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260624163819.3017002-4-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/recvmsg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/rxrpc/recvmsg.c ++++ b/net/rxrpc/recvmsg.c +@@ -470,7 +470,7 @@ try_again: + release_sock(&rx->sk); + if (ret == -EAGAIN) + goto try_again; +- goto error_no_call; ++ goto error_trace; + } + + /* Find the next call and dequeue it if we're not just peeking. If we diff --git a/queue-7.1/rxrpc-fix-leak-of-connection-from-oob-challenge.patch b/queue-7.1/rxrpc-fix-leak-of-connection-from-oob-challenge.patch new file mode 100644 index 0000000000..55fd30ac1c --- /dev/null +++ b/queue-7.1/rxrpc-fix-leak-of-connection-from-oob-challenge.patch @@ -0,0 +1,40 @@ +From 4b28876e78fd60979afa91fd2ec6ad9cc8b7a6d0 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Wed, 24 Jun 2026 17:38:09 +0100 +Subject: rxrpc: Fix leak of connection from OOB challenge + +From: David Howells + +commit 4b28876e78fd60979afa91fd2ec6ad9cc8b7a6d0 upstream. + +Fix leak of connection object from OOB challenge queue when response is +provided by userspace. + +Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE") +Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com +Signed-off-by: David Howells +cc: Marc Dionne +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260624163819.3017002-3-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/oob.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/net/rxrpc/oob.c ++++ b/net/rxrpc/oob.c +@@ -213,6 +213,11 @@ static int rxrpc_respond_to_oob(struct r + break; + } + ++ switch (skb->mark) { ++ case RXRPC_OOB_CHALLENGE: ++ rxrpc_put_connection(sp->chall.conn, rxrpc_conn_put_oob); ++ break; ++ } + rxrpc_free_skb(skb, rxrpc_skb_put_oob); + return ret; + } diff --git a/queue-7.1/rxrpc-fix-leak-of-released-call-in-recvmsg-msg_peek.patch b/queue-7.1/rxrpc-fix-leak-of-released-call-in-recvmsg-msg_peek.patch new file mode 100644 index 0000000000..20504d8afa --- /dev/null +++ b/queue-7.1/rxrpc-fix-leak-of-released-call-in-recvmsg-msg_peek.patch @@ -0,0 +1,40 @@ +From 4bdb9e471f5b1ac9cbe4add5de7ff085a0ec303c Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Wed, 24 Jun 2026 17:38:17 +0100 +Subject: rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) + +From: David Howells + +commit 4bdb9e471f5b1ac9cbe4add5de7ff085a0ec303c upstream. + +Fix rxrpc_recvmsg() to also drop the ref it holds on an already-released +call if MSG_PEEK is in force (the function holds a ref on the call +irrespective of whether MSG_PEEK is specified or not). + +Fixes: 962fb1f651c2 ("rxrpc: Fix recv-recv race of completed call") +Link: https://sashiko.dev/#/patchset/20260616155749.2125907-1-dhowells%40redhat.com +Signed-off-by: David Howells +cc: Marc Dionne +cc: Jeffrey Altman +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260624163819.3017002-11-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/recvmsg.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/net/rxrpc/recvmsg.c ++++ b/net/rxrpc/recvmsg.c +@@ -528,8 +528,7 @@ try_again: + if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) { + rxrpc_see_call(call, rxrpc_call_see_already_released); + mutex_unlock(&call->user_mutex); +- if (!(flags & MSG_PEEK)) +- rxrpc_put_call(call, rxrpc_call_put_recvmsg); ++ rxrpc_put_call(call, rxrpc_call_put_recvmsg); + goto try_again; + } + diff --git a/queue-7.1/rxrpc-fix-oob-challenge-leak-in-cleanup-after-notification-failure.patch b/queue-7.1/rxrpc-fix-oob-challenge-leak-in-cleanup-after-notification-failure.patch new file mode 100644 index 0000000000..5ae9242f8c --- /dev/null +++ b/queue-7.1/rxrpc-fix-oob-challenge-leak-in-cleanup-after-notification-failure.patch @@ -0,0 +1,108 @@ +From 092275882aec4a70ba55c3efb66fff947c81656a Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Wed, 24 Jun 2026 17:38:14 +0100 +Subject: rxrpc: Fix oob challenge leak in cleanup after notification failure + +From: David Howells + +commit 092275882aec4a70ba55c3efb66fff947c81656a upstream. + +Fix rxrpc_notify_socket_oob() to return an indication of failure in the +event that it failed to queue a packet and fix rxrpc_post_challenge() to +clean up the connection ref in such an event. + +Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE") +Link: https://sashiko.dev/#/patchset/20260616155749.2125907-1-dhowells%40redhat.com +Signed-off-by: David Howells +cc: Marc Dionne +cc: Jeffrey Altman +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260624163819.3017002-8-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/ar-internal.h | 4 ++-- + net/rxrpc/conn_event.c | 9 +++++++-- + net/rxrpc/oob.c | 7 +++++-- + 3 files changed, 14 insertions(+), 6 deletions(-) + +--- a/net/rxrpc/ar-internal.h ++++ b/net/rxrpc/ar-internal.h +@@ -1355,9 +1355,9 @@ static inline struct rxrpc_net *rxrpc_ne + } + + /* +- * out_of_band.c ++ * oob.c + */ +-void rxrpc_notify_socket_oob(struct rxrpc_call *call, struct sk_buff *skb); ++bool rxrpc_notify_socket_oob(struct rxrpc_call *call, struct sk_buff *skb); + void rxrpc_add_pending_oob(struct rxrpc_sock *rx, struct sk_buff *skb); + int rxrpc_sendmsg_oob(struct rxrpc_sock *rx, struct msghdr *msg, size_t len); + +--- a/net/rxrpc/conn_event.c ++++ b/net/rxrpc/conn_event.c +@@ -436,7 +436,7 @@ static bool rxrpc_post_challenge(struct + struct rxrpc_skb_priv *sp = rxrpc_skb(skb); + struct rxrpc_call *call = NULL; + struct rxrpc_sock *rx; +- bool respond = false; ++ bool respond = false, queued = false; + + sp->chall.conn = + rxrpc_get_connection(conn, rxrpc_conn_get_challenge_input); +@@ -472,8 +472,13 @@ static bool rxrpc_post_challenge(struct + } + + if (call) +- rxrpc_notify_socket_oob(call, skb); ++ queued = rxrpc_notify_socket_oob(call, skb); + rcu_read_unlock(); ++ if (call && !queued) { ++ rxrpc_put_connection(conn, rxrpc_conn_put_challenge_input); ++ sp->chall.conn = NULL; ++ return false; ++ } + + if (!call) + rxrpc_post_packet_to_conn(conn, skb); +--- a/net/rxrpc/oob.c ++++ b/net/rxrpc/oob.c +@@ -32,11 +32,12 @@ struct rxrpc_oob_params { + * Post an out-of-band message for attention by the socket or kernel service + * associated with a reference call. + */ +-void rxrpc_notify_socket_oob(struct rxrpc_call *call, struct sk_buff *skb) ++bool rxrpc_notify_socket_oob(struct rxrpc_call *call, struct sk_buff *skb) + { + struct rxrpc_skb_priv *sp = rxrpc_skb(skb); + struct rxrpc_sock *rx; + struct sock *sk; ++ bool queued = false; + + rcu_read_lock(); + +@@ -49,6 +50,7 @@ void rxrpc_notify_socket_oob(struct rxrp + skb->skb_mstamp_ns = rx->oob_id_counter++; + rxrpc_get_skb(skb, rxrpc_skb_get_post_oob); + skb_queue_tail(&rx->recvmsg_oobq, skb); ++ queued = true; + + trace_rxrpc_notify_socket(call->debug_id, sp->hdr.serial); + if (rx->app_ops) +@@ -56,11 +58,12 @@ void rxrpc_notify_socket_oob(struct rxrp + } + + spin_unlock_irq(&rx->recvmsg_lock); +- if (!rx->app_ops && !sock_flag(sk, SOCK_DEAD)) ++ if (queued && !rx->app_ops && !sock_flag(sk, SOCK_DEAD)) + sk->sk_data_ready(sk); + } + + rcu_read_unlock(); ++ return queued; + } + + /* diff --git a/queue-7.1/rxrpc-fix-potential-infinite-loop-in-rxrpc_recvmsg.patch b/queue-7.1/rxrpc-fix-potential-infinite-loop-in-rxrpc_recvmsg.patch new file mode 100644 index 0000000000..d597a35bea --- /dev/null +++ b/queue-7.1/rxrpc-fix-potential-infinite-loop-in-rxrpc_recvmsg.patch @@ -0,0 +1,38 @@ +From 67a0332f442ef07713cd2d9c13d59db0f1c23648 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Wed, 24 Jun 2026 17:38:15 +0100 +Subject: rxrpc: Fix potential infinite loop in rxrpc_recvmsg() + +From: David Howells + +commit 67a0332f442ef07713cd2d9c13d59db0f1c23648 upstream. + +Fix the wait in rxrpc_recvmsg() also take check the oob queue. + +Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE") +Link: https://sashiko.dev/#/patchset/20260616155749.2125907-1-dhowells%40redhat.com +Signed-off-by: David Howells +cc: Marc Dionne +cc: Jeffrey Altman +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260624163819.3017002-9-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/recvmsg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/rxrpc/recvmsg.c ++++ b/net/rxrpc/recvmsg.c +@@ -436,7 +436,8 @@ try_again: + return -EAGAIN; + } + +- if (list_empty(&rx->recvmsg_q)) { ++ if (list_empty(&rx->recvmsg_q) && ++ skb_queue_empty_lockless(&rx->recvmsg_oobq)) { + ret = -EWOULDBLOCK; + if (timeo == 0) { + call = NULL; diff --git a/queue-7.1/rxrpc-fix-rxrpc_rotate_tx_rotate-to-check-there-s-something-to-rotate.patch b/queue-7.1/rxrpc-fix-rxrpc_rotate_tx_rotate-to-check-there-s-something-to-rotate.patch new file mode 100644 index 0000000000..cf61051d90 --- /dev/null +++ b/queue-7.1/rxrpc-fix-rxrpc_rotate_tx_rotate-to-check-there-s-something-to-rotate.patch @@ -0,0 +1,39 @@ +From a5462da5a349fc7f17ad5ebd899380260d03e7ed Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Wed, 24 Jun 2026 17:38:18 +0100 +Subject: rxrpc: Fix rxrpc_rotate_tx_rotate() to check there's something to rotate + +From: David Howells + +commit a5462da5a349fc7f17ad5ebd899380260d03e7ed upstream. + +Fix rxrpc_rotate_tx_rotate() to check that there's something in the +transmission buffer to be rotated before it attempts to rotate anything. + +Fixes: b341a0263b1b ("rxrpc: Implement progressive transmission queue struct") +Link: https://sashiko.dev/#/patchset/20260618134802.2477777-1-dhowells%40redhat.com +Signed-off-by: David Howells +cc: Marc Dionne +cc: Jeffrey Altman +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260624163819.3017002-12-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/input.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/rxrpc/input.c ++++ b/net/rxrpc/input.c +@@ -236,6 +236,9 @@ static bool rxrpc_rotate_tx_window(struc + call->acks_lowest_nak = to; + } + ++ if (after(seq, to)) ++ return false; ++ + /* We may have a left over fully-consumed buffer at the front that we + * couldn't drop before (rotate_and_keep below). + */ diff --git a/queue-7.1/rxrpc-fix-socket-notification-race.patch b/queue-7.1/rxrpc-fix-socket-notification-race.patch new file mode 100644 index 0000000000..9a782b082d --- /dev/null +++ b/queue-7.1/rxrpc-fix-socket-notification-race.patch @@ -0,0 +1,43 @@ +From e66f8f32f50116670dbbee5bc9e692cd2cd0c8f8 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Wed, 24 Jun 2026 17:38:16 +0100 +Subject: rxrpc: Fix socket notification race + +From: David Howells + +commit e66f8f32f50116670dbbee5bc9e692cd2cd0c8f8 upstream. + +There's a race between rxrpc_recvmsg() and rxrpc_notify_socket(), whereby +the latter's attempt to avoid disabling interrupts and taking the socket's +recvmsg_lock if the call is already queued may happen simultaneously with +the former's discarding of a call that has nothing queued. + +Fix this by removing the shortcut. Note that this only affects userspace's +use of AF_RXRPC; the AFS filesystem driver doesn't use the socket queue. + +Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") +Link: https://sashiko.dev/#/patchset/20260616155749.2125907-1-dhowells%40redhat.com +Signed-off-by: David Howells +cc: Marc Dionne +cc: Jeffrey Altman +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260624163819.3017002-10-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/recvmsg.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/net/rxrpc/recvmsg.c ++++ b/net/rxrpc/recvmsg.c +@@ -27,8 +27,6 @@ void rxrpc_notify_socket(struct rxrpc_ca + + _enter("%d", call->debug_id); + +- if (!list_empty(&call->recvmsg_link)) +- return; + if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) { + rxrpc_see_call(call, rxrpc_call_see_notify_released); + return; diff --git a/queue-7.1/rxrpc-fix-the-reception-of-a-reply-packet-before-data-transmission.patch b/queue-7.1/rxrpc-fix-the-reception-of-a-reply-packet-before-data-transmission.patch new file mode 100644 index 0000000000..5e936b0a83 --- /dev/null +++ b/queue-7.1/rxrpc-fix-the-reception-of-a-reply-packet-before-data-transmission.patch @@ -0,0 +1,72 @@ +From a58e33405acd2584e730c1da72635f822ada6b49 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Wed, 24 Jun 2026 17:38:13 +0100 +Subject: rxrpc: Fix the reception of a reply packet before data transmission + +From: David Howells + +commit a58e33405acd2584e730c1da72635f822ada6b49 upstream. + +Fix rxrpc_receiving_reply() to handle the reception of an apparent reply +DATA packet before rxrpc has had a chance to send any request DATA packets +on a client call by checking to see if the call has been exposed yet by +sending the first packet. + +Without this, rxrpc_rotate_tx_window() might oops. + +Also fix rxrpc_rotate_tx_window() to handle the Tx queue being empty by +changing the do...while loop into a while loop, just in case a call is +abnormally terminated by an early reply before the last request packet is +transmitted. + +Fixes: b341a0263b1b ("rxrpc: Implement progressive transmission queue struct") +Link: https://sashiko.dev/#/patchset/20260616155749.2125907-1-dhowells%40redhat.com +Signed-off-by: David Howells +cc: Marc Dionne +cc: Jeffrey Altman +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260624163819.3017002-7-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/input.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/net/rxrpc/input.c ++++ b/net/rxrpc/input.c +@@ -251,7 +251,7 @@ static bool rxrpc_rotate_tx_window(struc + tq = call->tx_queue; + } + +- do { ++ while (before_eq(seq, to)) { + unsigned int ix = seq - call->tx_qbase; + + _debug("tq=%x seq=%x i=%d f=%x", tq->qbase, seq, ix, tq->bufs[ix]->flags); +@@ -321,8 +321,7 @@ static bool rxrpc_rotate_tx_window(struc + break; + } + } +- +- } while (before_eq(seq, to)); ++ } + + if (trace) + trace_rxrpc_rack_update(call, summary); +@@ -397,6 +396,14 @@ static bool rxrpc_receiving_reply(struct + trace_rxrpc_timer_can(call, rxrpc_timer_trace_delayed_ack); + } + ++ /* Deal with an apparent reply coming in before we've got the request ++ * queued or transmitted. ++ */ ++ if (!test_bit(RXRPC_CALL_EXPOSED, &call->flags)) { ++ rxrpc_proto_abort(call, top, rxrpc_eproto_early_reply); ++ return false; ++ } ++ + if (!test_bit(RXRPC_CALL_TX_LAST, &call->flags)) { + if (!rxrpc_rotate_tx_window(call, top, &summary)) { + rxrpc_proto_abort(call, top, rxrpc_eproto_early_reply); diff --git a/queue-7.1/rxrpc-fix-uaf-in-rxgk_issue_challenge.patch b/queue-7.1/rxrpc-fix-uaf-in-rxgk_issue_challenge.patch new file mode 100644 index 0000000000..76388a8c5b --- /dev/null +++ b/queue-7.1/rxrpc-fix-uaf-in-rxgk_issue_challenge.patch @@ -0,0 +1,47 @@ +From 107a4cb0d47e735830f852d83970d5c81f8e1e08 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 9 Jun 2026 15:09:07 +0100 +Subject: rxrpc: Fix UAF in rxgk_issue_challenge() + +From: David Howells + +commit 107a4cb0d47e735830f852d83970d5c81f8e1e08 upstream. + +Fix rxgk_issue_challenge() to free the page containing the challenge +content after invoking the tracepoint as the whdr passed to the tracepoint +points into the page just freed. + +Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)") +Reported-by: Marc Dionne +Signed-off-by: David Howells +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260609140911.838677-4-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/rxgk.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/rxrpc/rxgk.c ++++ b/net/rxrpc/rxgk.c +@@ -687,16 +687,17 @@ static int rxgk_issue_challenge(struct r + ret = do_udp_sendmsg(conn->local->socket, &msg, len); + if (ret > 0) + rxrpc_peer_mark_tx(conn->peer); +- __free_page(page); + + if (ret < 0) { + trace_rxrpc_tx_fail(conn->debug_id, serial, ret, + rxrpc_tx_point_rxgk_challenge); ++ __free_page(page); + return -EAGAIN; + } + + trace_rxrpc_tx_packet(conn->debug_id, whdr, + rxrpc_tx_point_rxgk_challenge); ++ __free_page(page); + _leave(" = 0"); + return 0; + } diff --git a/queue-7.1/rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch b/queue-7.1/rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch new file mode 100644 index 0000000000..672928d785 --- /dev/null +++ b/queue-7.1/rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch @@ -0,0 +1,52 @@ +From 16c8ae9735c5bd7e54dd7478d6348e0fc860842d Mon Sep 17 00:00:00 2001 +From: Jeffrey Altman +Date: Tue, 9 Jun 2026 15:09:05 +0100 +Subject: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc + +From: Jeffrey Altman + +commit 16c8ae9735c5bd7e54dd7478d6348e0fc860842d upstream. + +rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the +rxrpc_call.rx_dec_buffer is unallocated and assumes that upon +successful return that rx_dec_buffer must be allocated. +However, rxrpc_verify_data() does not request an allocation if +the rxrpc_skb_priv.len is zero. + +In addition, failure to allocate rx_dec_buffer will result in a +call to skb_copy_bits() with a NULL destination which can +trigger a NULL pointer dereference. + +To prevent these issues rxrpc_verify_data() is modified to +always attempt to allocate the rxrpc_call.rx_dec_buffer if it +is NULL. + +This issue was identified with assistance of a private +sashiko instance. + +Fixes: d2bc90cf6c75cb ("rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg") +Reported-by: Simon Horman +Signed-off-by: Jeffrey Altman +Signed-off-by: David Howells +cc: Jiayuan Chen +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260609140911.838677-2-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/recvmsg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/rxrpc/recvmsg.c ++++ b/net/rxrpc/recvmsg.c +@@ -161,7 +161,7 @@ static int rxrpc_verify_data(struct rxrp + struct rxrpc_skb_priv *sp = rxrpc_skb(skb); + int ret; + +- if (sp->len > call->rx_dec_bsize) { ++ if (sp->len > call->rx_dec_bsize || !call->rx_dec_buffer) { + /* Make sure we can hold a 1412-byte jumbo subpacket and make + * sure that the buffer size is aligned to a crypto blocksize. + */ diff --git a/queue-7.1/rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch b/queue-7.1/rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch new file mode 100644 index 0000000000..4e0bb7470d --- /dev/null +++ b/queue-7.1/rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch @@ -0,0 +1,75 @@ +From dc175389b18c29a5303ee83169ec653adfae3e17 Mon Sep 17 00:00:00 2001 +From: Li Daming +Date: Tue, 9 Jun 2026 15:09:09 +0100 +Subject: rxrpc: serialize kernel accept preallocation with socket teardown + +From: Li Daming + +commit dc175389b18c29a5303ee83169ec653adfae3e17 upstream. + +rxrpc_kernel_charge_accept() reads rx->backlog without any +socket/backlog synchronization and passes that raw pointer into +rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc() +sets rx->backlog = NULL and frees the backlog rings, so a kernel +preallocation worker can keep using a freed struct rxrpc_backlog +while updating *_backlog_head/tail and array slots. + +Serialize the state check and backlog lookup with the socket lock, +and reject kernel preallocation once teardown has disabled +listening or discarded the service backlog. + +Fixes: 00e907127e6f ("rxrpc: Preallocate peers, conns and calls for incoming service requests") +Reported-by: Yuan Tan +Reported-by: Yifan Wu +Reported-by: Juefei Pu +Reported-by: Xin Liu +Signed-off-by: Li Daming +Signed-off-by: Ren Wei +Signed-off-by: David Howells +cc: Marc Dionne +cc: Jeffrey Altman +cc: Simon Horman +cc: linux-afs@lists.infradead.org +cc: stable@kernel.org +Link: https://patch.msgid.link/20260609140911.838677-6-dhowells@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/call_accept.c | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +--- a/net/rxrpc/call_accept.c ++++ b/net/rxrpc/call_accept.c +@@ -471,13 +471,26 @@ int rxrpc_kernel_charge_accept(struct so + unsigned long user_call_ID, gfp_t gfp, + unsigned int debug_id) + { +- struct rxrpc_sock *rx = rxrpc_sk(sock->sk); +- struct rxrpc_backlog *b = rx->backlog; ++ struct rxrpc_backlog *b; ++ struct rxrpc_sock *rx; ++ struct sock *sk; ++ int ret; + +- if (sock->sk->sk_state == RXRPC_CLOSE) +- return -ESHUTDOWN; ++ sk = sock->sk; ++ rx = rxrpc_sk(sk); + +- return rxrpc_service_prealloc_one(rx, b, notify_rx, user_call_ID, +- gfp, debug_id); ++ lock_sock(sk); ++ if (sk->sk_state != RXRPC_SERVER_LISTENING || !rx->backlog) { ++ ret = -ESHUTDOWN; ++ goto out; ++ } ++ ++ b = rx->backlog; ++ ret = rxrpc_service_prealloc_one(rx, b, notify_rx, user_call_ID, ++ gfp, debug_id); ++ ++out: ++ release_sock(sk); ++ return ret; + } + EXPORT_SYMBOL(rxrpc_kernel_charge_accept); diff --git a/queue-7.1/serial-8250_omap-clear-rx_running-on-zero-length-dma-completes.patch b/queue-7.1/serial-8250_omap-clear-rx_running-on-zero-length-dma-completes.patch new file mode 100644 index 0000000000..6fba625ab9 --- /dev/null +++ b/queue-7.1/serial-8250_omap-clear-rx_running-on-zero-length-dma-completes.patch @@ -0,0 +1,50 @@ +From 061b627ba534230a18ec4d7251562af12325d06a Mon Sep 17 00:00:00 2001 +From: Matthias Feser +Date: Tue, 26 May 2026 07:35:09 +0000 +Subject: serial: 8250_omap: clear rx_running on zero-length DMA completes + +From: Matthias Feser + +commit 061b627ba534230a18ec4d7251562af12325d06a upstream. + +On AM33xx RX DMA only triggers when the FIFO reaches the +configured threshold (typically 48 bytes). For smaller bursts +no DMA request is issued and the FIFO is drained by RX timeout. + +In this case __dma_rx_do_complete() can legitimately see count == 0. + +The current code exits early in this case and does not clear +dma->rx_running, leaving the DMA state inconsistent. This can +prevent RX DMA from restarting and may cause +omap_8250_rx_dma_flush() to fail, marking DMA as broken. + +Fix this by clearing dma->rx_running once the DMA transfer has +completed or been terminated, even if no data was transferred. + +Fixes: a5fd8945a478 ("serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done") +Cc: stable +Signed-off-by: Matthias Feser +Reviewed-by: Moteen Shah +Link: https://patch.msgid.link/BE3P281MB55155F2F5795E411F5A65282EE0B2@BE3P281MB5515.DEUP281.PROD.OUTLOOK.COM +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_omap.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -944,11 +944,12 @@ static void __dma_rx_do_complete(struct + dev_err(p->port.dev, "teardown incomplete\n"); + } + } ++ ++ dma->rx_running = 0; + if (!count) + goto out; + ret = tty_insert_flip_string(tty_port, dma->rx_buf, count); + +- dma->rx_running = 0; + p->port.icount.rx += ret; + p->port.icount.buf_overrun += count - ret; + out: diff --git a/queue-7.1/serial-max310x-implement-gpio_chip-get_direction.patch b/queue-7.1/serial-max310x-implement-gpio_chip-get_direction.patch new file mode 100644 index 0000000000..6e0b7fc747 --- /dev/null +++ b/queue-7.1/serial-max310x-implement-gpio_chip-get_direction.patch @@ -0,0 +1,59 @@ +From a483b1a91b33b7533280e7c3efd2bc1275caef18 Mon Sep 17 00:00:00 2001 +From: Tapio Reijonen +Date: Mon, 15 Jun 2026 06:38:40 +0000 +Subject: serial: max310x: implement gpio_chip::get_direction() + +From: Tapio Reijonen + +commit a483b1a91b33b7533280e7c3efd2bc1275caef18 upstream. + +It's strongly recommended for GPIO drivers to always implement the +.get_direction() callback - even when the direction is tracked in +software. The GPIO core emits a warning when the callback is missing +and a user reads the direction of a line, e.g. via +/sys/kernel/debug/gpio. + +The MAX310X keeps the GPIO direction in the GPIOCFG register (a set bit +selects output), which the existing direction_input/output callbacks +already program, so the current direction can be read back directly. + +Fixes: f65444187a66 ("serial: New serial driver MAX310X") +Cc: stable +Signed-off-by: Tapio Reijonen +Reviewed-by: Linus Walleij +Reviewed-by: Bartosz Golaszewski +Reviewed-by: Hugo Villeneuve +Link: https://patch.msgid.link/20260615-b4-serial-max310x-gpio-get-direction-v2-1-4704ba2b181a@vaisala.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/max310x.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1212,6 +1212,17 @@ static int max310x_gpio_set(struct gpio_ + return 0; + } + ++static int max310x_gpio_get_direction(struct gpio_chip *chip, unsigned int offset) ++{ ++ struct max310x_port *s = gpiochip_get_data(chip); ++ struct uart_port *port = &s->p[offset / 4].port; ++ unsigned int val; ++ ++ val = max310x_port_read(port, MAX310X_GPIOCFG_REG); ++ ++ return val & BIT(offset % 4) ? GPIO_LINE_DIRECTION_OUT : GPIO_LINE_DIRECTION_IN; ++} ++ + static int max310x_gpio_direction_input(struct gpio_chip *chip, unsigned int offset) + { + struct max310x_port *s = gpiochip_get_data(chip); +@@ -1421,6 +1432,7 @@ static int max310x_probe(struct device * + s->gpio.owner = THIS_MODULE; + s->gpio.parent = dev; + s->gpio.label = devtype->name; ++ s->gpio.get_direction = max310x_gpio_get_direction; + s->gpio.direction_input = max310x_gpio_direction_input; + s->gpio.get = max310x_gpio_get; + s->gpio.direction_output= max310x_gpio_direction_output; diff --git a/queue-7.1/serial-msm-disable-dma-for-kernel-console-uart.patch b/queue-7.1/serial-msm-disable-dma-for-kernel-console-uart.patch new file mode 100644 index 0000000000..31c400d517 --- /dev/null +++ b/queue-7.1/serial-msm-disable-dma-for-kernel-console-uart.patch @@ -0,0 +1,52 @@ +From 22dd2777e6c180e1c945b00f6d18550979436324 Mon Sep 17 00:00:00 2001 +From: Stephan Gerhold +Date: Mon, 6 Jul 2026 20:03:32 +0200 +Subject: serial: msm: Disable DMA for kernel console UART + +From: Stephan Gerhold + +commit 22dd2777e6c180e1c945b00f6d18550979436324 upstream. + +At the moment, concurrent writes from userspace and the kernel to the +console can trigger a race condition that results in an infinite loop of +the same messages printed over and over again. This is most likely to +happen during system startup or shutdown when the init system starts/stops +a large number of system services that interact with various kernel code. + +When userspace writes to the TTY device, the driver initiates an +asynchronous DMA transfer and releases the port lock. At the same moment, +the kernel printk path might grab the port lock and re-configure the UART +controller for PIO, without waiting for the DMA operation to complete. It +seems like this collision results in zero progress being reported for the +DMA engine, so the same text is printed to the console over and over again. + +For the kernel console, we want a reliable output path that will be +functional even during crashes etc. So rather than implementing complex +code to synchronize the kernel console write routines with the userspace +DMA write routines, simply disable DMA for the console UART instance. + +Similar checks exist in many other serial drivers, e.g. 8250_port.c, +imx.c, sh-sci.c etc. + +Cc: stable +Fixes: 3a878c430fd6 ("tty: serial: msm: Add TX DMA support") +Signed-off-by: Stephan Gerhold +Acked-by: Konrad Dybcio +Link: https://patch.msgid.link/20260706-serial-msm-console-dma-collision-v1-1-3179b8cb1d89@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/msm_serial.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -1228,7 +1228,8 @@ static int msm_startup(struct uart_port + data |= MSM_UART_MR1_AUTO_RFR_LEVEL0 & rfr_level; + msm_write(port, data, MSM_UART_MR1); + +- if (msm_port->is_uartdm) { ++ /* Disable DMA for console to prevent PIO/DMA collisions */ ++ if (msm_port->is_uartdm && !uart_console(port)) { + msm_request_tx_dma(msm_port, msm_port->uart.mapbase); + msm_request_rx_dma(msm_port, msm_port->uart.mapbase); + } diff --git a/queue-7.1/series b/queue-7.1/series index f5353d34da..e8cd169b35 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -2,3 +2,40 @@ crypto-algif_skcipher-force-synchronous-processing.patch iommu-vt-d-clear-present-bit-before-tearing-down-sca.patch crypto-sun4i-ss-remove-insecure-and-unused-rng_alg.patch media-uvcvideo-fix-deadlock-if-uvc_status_stop-is-ca.patch +alsa-hda-realtek-add-quirk-for-tongfang-x6xx45xu.patch +alsa-hda-conexant-remove-mic-bias-threshold-override.patch +alsa-hda-fix-cached-processing-coefficient-verbs.patch +alsa-hda-realtek-fix-speakers-on-legion-pro-7-16arx8h-with-codec-ssid-17aa-38a7.patch +media-uvcvideo-use-hw-timestaming-if-the-clock-buffer-is-full.patch +media-uvcvideo-avoid-partial-metadata-buffers.patch +media-uvcvideo-fix-buffer-sequence-in-frame-gaps.patch +media-uvcvideo-fix-dev_sof-filtering-in-hw-timestamp.patch +media-uvcvideo-do-not-add-clock-samples-with-small-sof-delta.patch +media-uvcvideo-relax-the-constrains-for-interpolating-the-hw-clock.patch +media-uvcvideo-fix-sequence-number-when-no-eof.patch +dt-bindings-media-sun4i-a10-video-engine-add-interconnect-properties.patch +dt-bindings-power-imx93-add-mipi-phy-power-domain.patch +serial-msm-disable-dma-for-kernel-console-uart.patch +serial-max310x-implement-gpio_chip-get_direction.patch +serial-8250_omap-clear-rx_running-on-zero-length-dma-completes.patch +rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch +rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch +rxrpc-don-t-move-a-peeked-oob-message-onto-the-pending-queue.patch +rxrpc-fix-uaf-in-rxgk_issue_challenge.patch +rxrpc-fix-socket-notification-race.patch +rxrpc-fix-leak-of-released-call-in-recvmsg-msg_peek.patch +rxrpc-fix-potential-infinite-loop-in-rxrpc_recvmsg.patch +rxrpc-fix-rxrpc_rotate_tx_rotate-to-check-there-s-something-to-rotate.patch +rxrpc-fix-oob-challenge-leak-in-cleanup-after-notification-failure.patch +rxrpc-fix-ackall-packet-handling.patch +rxrpc-fix-the-reception-of-a-reply-packet-before-data-transmission.patch +rxrpc-fix-leak-of-connection-from-oob-challenge.patch +rxrpc-fix-double-unlock-in-rxrpc_recvmsg.patch +afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch +afs-fix-null-pointer-dereference-in-afs_get_tree.patch +afs-handle-cb.initcallbackstate3-requests-without-a-server-record.patch +afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch +afs-fix-uncancelled-rxrpc-oob-message-handler.patch +fbcon-fix-null-pointer-dereference-for-a-console-without-vc_data.patch +fbcon-use-correct-type-for-vc_resize-return-value.patch +media-uvcvideo-fix-deadlock-if-uvc_status_stop-is-called-from-async_ctrl.work.patch