--- /dev/null
+From 80d8a9ad1587b64c545d515ab6cb7ecb9908e1b3 Mon Sep 17 00:00:00 2001
+From: Yifan Zha <Yifan.Zha@amd.com>
+Date: Fri, 14 Nov 2025 17:48:58 +0800
+Subject: drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled
+
+From: Yifan Zha <Yifan.Zha@amd.com>
+
+commit 80d8a9ad1587b64c545d515ab6cb7ecb9908e1b3 upstream.
+
+[Why]
+Accoreding to CP updated to RS64 on gfx11,
+WRITE_DATA with PREEMPTION_META_MEMORY(dst_sel=8) is illegal for CP FW.
+That packet is used for MCBP on F32 based system.
+So it would lead to incorrect GRBM write and FW is not handling that
+extra case correctly.
+
+[How]
+With gfx11 rs64 enabled, skip emit de meta data.
+
+Signed-off-by: Yifan Zha <Yifan.Zha@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 8366cd442d226463e673bed5d199df916f4ecbcf)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+@@ -5392,9 +5392,9 @@ static void gfx_v11_0_ring_emit_ib_gfx(s
+ if (flags & AMDGPU_IB_PREEMPTED)
+ control |= INDIRECT_BUFFER_PRE_RESUME(1);
+
+- if (vmid)
++ if (vmid && !ring->adev->gfx.rs64_enable)
+ gfx_v11_0_ring_emit_de_meta(ring,
+- (!amdgpu_sriov_vf(ring->adev) && flags & AMDGPU_IB_PREEMPTED) ? true : false);
++ !amdgpu_sriov_vf(ring->adev) && (flags & AMDGPU_IB_PREEMPTED));
+ }
+
+ if (ring->is_mes_queue)
--- /dev/null
+From 4c5376b4b143c4834ebd392aef2215847752b16a Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Wed, 22 Oct 2025 19:47:20 +0800
+Subject: drm/tegra: dc: Fix reference leak in tegra_dc_couple()
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit 4c5376b4b143c4834ebd392aef2215847752b16a upstream.
+
+driver_find_device() calls get_device() to increment the reference
+count once a matching device is found, but there is no put_device() to
+balance the reference count. To avoid reference count leakage, add
+put_device() to decrease the reference count.
+
+Found by code review.
+
+Cc: stable@vger.kernel.org
+Fixes: a31500fe7055 ("drm/tegra: dc: Restore coupling of display controllers")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Acked-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patch.msgid.link/20251022114720.24937-1-make24@iscas.ac.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/tegra/dc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/tegra/dc.c
++++ b/drivers/gpu/drm/tegra/dc.c
+@@ -3141,6 +3141,7 @@ static int tegra_dc_couple(struct tegra_
+ dc->client.parent = &parent->client;
+
+ dev_dbg(dc->dev, "coupled to %s\n", dev_name(companion));
++ put_device(companion);
+ }
+
+ return 0;
--- /dev/null
+From 4f102d747cadd8f595f2b25882eed9bec1675fb1 Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Tue, 18 Nov 2025 08:20:20 +0100
+Subject: mptcp: avoid unneeded subflow-level drops
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 4f102d747cadd8f595f2b25882eed9bec1675fb1 upstream.
+
+The rcv window is shared among all the subflows. Currently, MPTCP sync
+the TCP-level rcv window with the MPTCP one at tcp_transmit_skb() time.
+
+The above means that incoming data may sporadically observe outdated
+TCP-level rcv window and being wrongly dropped by TCP.
+
+Address the issue checking for the edge condition before queuing the
+data at TCP level, and eventually syncing the rcv window as needed.
+
+Note that the issue is actually present from the very first MPTCP
+implementation, but backports older than the blamed commit below will
+range from impossible to useless.
+
+Before:
+
+ $ nstat -n; sleep 1; nstat -z TcpExtBeyondWindow
+ TcpExtBeyondWindow 14 0.0
+
+After:
+
+ $ nstat -n; sleep 1; nstat -z TcpExtBeyondWindow
+ TcpExtBeyondWindow 0 0.0
+
+Fixes: fa3fe2b15031 ("mptcp: track window announced to peer")
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-2-806d3781c95f@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/options.c | 31 +++++++++++++++++++++++++++++++
+ net/mptcp/protocol.h | 1 +
+ 2 files changed, 32 insertions(+)
+
+--- a/net/mptcp/options.c
++++ b/net/mptcp/options.c
+@@ -1028,6 +1028,31 @@ u64 __mptcp_expand_seq(u64 old_seq, u64
+ return cur_seq;
+ }
+
++static void rwin_update(struct mptcp_sock *msk, struct sock *ssk,
++ struct sk_buff *skb)
++{
++ struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
++ struct tcp_sock *tp = tcp_sk(ssk);
++ u64 mptcp_rcv_wnd;
++
++ /* Avoid touching extra cachelines if TCP is going to accept this
++ * skb without filling the TCP-level window even with a possibly
++ * outdated mptcp-level rwin.
++ */
++ if (!skb->len || skb->len < tcp_receive_window(tp))
++ return;
++
++ mptcp_rcv_wnd = atomic64_read(&msk->rcv_wnd_sent);
++ if (!after64(mptcp_rcv_wnd, subflow->rcv_wnd_sent))
++ return;
++
++ /* Some other subflow grew the mptcp-level rwin since rcv_wup,
++ * resync.
++ */
++ tp->rcv_wnd += mptcp_rcv_wnd - subflow->rcv_wnd_sent;
++ subflow->rcv_wnd_sent = mptcp_rcv_wnd;
++}
++
+ static void ack_update_msk(struct mptcp_sock *msk,
+ struct sock *ssk,
+ struct mptcp_options_received *mp_opt)
+@@ -1188,6 +1213,7 @@ bool mptcp_incoming_options(struct sock
+ */
+ if (mp_opt.use_ack)
+ ack_update_msk(msk, sk, &mp_opt);
++ rwin_update(msk, sk, skb);
+
+ /* Zero-data-length packets are dropped by the caller and not
+ * propagated to the MPTCP layer, so the skb extension does not
+@@ -1274,6 +1300,10 @@ static void mptcp_set_rwin(struct tcp_so
+
+ if (rcv_wnd_new != rcv_wnd_old) {
+ raise_win:
++ /* The msk-level rcv wnd is after the tcp level one,
++ * sync the latter.
++ */
++ rcv_wnd_new = rcv_wnd_old;
+ win = rcv_wnd_old - ack_seq;
+ tp->rcv_wnd = min_t(u64, win, U32_MAX);
+ new_win = tp->rcv_wnd;
+@@ -1297,6 +1327,7 @@ raise_win:
+
+ update_wspace:
+ WRITE_ONCE(msk->old_wspace, tp->rcv_wnd);
++ subflow->rcv_wnd_sent = rcv_wnd_new;
+ }
+
+ static void mptcp_track_rwin(struct tcp_sock *tp)
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -458,6 +458,7 @@ struct mptcp_subflow_context {
+ u64 remote_key;
+ u64 idsn;
+ u64 map_seq;
++ u64 rcv_wnd_sent;
+ u32 snd_isn;
+ u32 token;
+ u32 rel_write_seq;
--- /dev/null
+From 1bba3f219c5e8c29e63afa3c1fc24f875ebec119 Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Tue, 18 Nov 2025 08:20:22 +0100
+Subject: mptcp: do not fallback when OoO is present
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 1bba3f219c5e8c29e63afa3c1fc24f875ebec119 upstream.
+
+In case of DSS corruption, the MPTCP protocol tries to avoid the subflow
+reset if fallback is possible. Such corruptions happen in the receive
+path; to ensure fallback is possible the stack additionally needs to
+check for OoO data, otherwise the fallback will break the data stream.
+
+Fixes: e32d262c89e2 ("mptcp: handle consistently DSS corruption")
+Cc: stable@vger.kernel.org
+Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/598
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-4-806d3781c95f@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -911,6 +911,13 @@ static bool __mptcp_finish_join(struct m
+ if (sk->sk_state != TCP_ESTABLISHED)
+ return false;
+
++ /* The caller possibly is not holding the msk socket lock, but
++ * in the fallback case only the current subflow is touching
++ * the OoO queue.
++ */
++ if (!RB_EMPTY_ROOT(&msk->out_of_order_queue))
++ return false;
++
+ spin_lock_bh(&msk->fallback_lock);
+ if (!msk->allow_subflows) {
+ spin_unlock_bh(&msk->fallback_lock);
--- /dev/null
+From 5e15395f6d9ec07395866c5511f4b4ac566c0c9b Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Tue, 18 Nov 2025 08:20:19 +0100
+Subject: mptcp: fix ack generation for fallback msk
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 5e15395f6d9ec07395866c5511f4b4ac566c0c9b upstream.
+
+mptcp_cleanup_rbuf() needs to know the last most recent, mptcp-level
+rcv_wnd sent, and such information is tracked into the msk->old_wspace
+field, updated at ack transmission time by mptcp_write_options().
+
+Fallback socket do not add any mptcp options, such helper is never
+invoked, and msk->old_wspace value remain stale. That in turn makes
+ack generation at recvmsg() time quite random.
+
+Address the issue ensuring mptcp_write_options() is invoked even for
+fallback sockets, and just update the needed info in such a case.
+
+The issue went unnoticed for a long time, as mptcp currently overshots
+the fallback socket receive buffer autotune significantly. It is going
+to change in the near future.
+
+Fixes: e3859603ba13 ("mptcp: better msk receive window updates")
+Cc: stable@vger.kernel.org
+Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/594
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-1-806d3781c95f@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/options.c | 23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+--- a/net/mptcp/options.c
++++ b/net/mptcp/options.c
+@@ -834,8 +834,11 @@ bool mptcp_established_options(struct so
+
+ opts->suboptions = 0;
+
++ /* Force later mptcp_write_options(), but do not use any actual
++ * option space.
++ */
+ if (unlikely(__mptcp_check_fallback(msk) && !mptcp_check_infinite_map(skb)))
+- return false;
++ return true;
+
+ if (unlikely(skb && TCP_SKB_CB(skb)->tcp_flags & TCPHDR_RST)) {
+ if (mptcp_established_options_fastclose(sk, &opt_size, remaining, opts) ||
+@@ -1296,6 +1299,20 @@ update_wspace:
+ WRITE_ONCE(msk->old_wspace, tp->rcv_wnd);
+ }
+
++static void mptcp_track_rwin(struct tcp_sock *tp)
++{
++ const struct sock *ssk = (const struct sock *)tp;
++ struct mptcp_subflow_context *subflow;
++ struct mptcp_sock *msk;
++
++ if (!ssk)
++ return;
++
++ subflow = mptcp_subflow_ctx(ssk);
++ msk = mptcp_sk(subflow->conn);
++ WRITE_ONCE(msk->old_wspace, tp->rcv_wnd);
++}
++
+ __sum16 __mptcp_make_csum(u64 data_seq, u32 subflow_seq, u16 data_len, __wsum sum)
+ {
+ struct csum_pseudo_header header;
+@@ -1588,6 +1605,10 @@ mp_rst:
+ opts->reset_transient,
+ opts->reset_reason);
+ return;
++ } else if (unlikely(!opts->suboptions)) {
++ /* Fallback to TCP */
++ mptcp_track_rwin(tp);
++ return;
+ }
+
+ if (OPTION_MPTCP_PRIO & opts->suboptions) {
--- /dev/null
+From 17393fa7b7086664be519e7230cb6ed7ec7d9462 Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Tue, 18 Nov 2025 08:20:21 +0100
+Subject: mptcp: fix premature close in case of fallback
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 17393fa7b7086664be519e7230cb6ed7ec7d9462 upstream.
+
+I'm observing very frequent self-tests failures in case of fallback when
+running on a CONFIG_PREEMPT kernel.
+
+The root cause is that subflow_sched_work_if_closed() closes any subflow
+as soon as it is half-closed and has no incoming data pending.
+
+That works well for regular subflows - MPTCP needs bi-directional
+connectivity to operate on a given subflow - but for fallback socket is
+race prone.
+
+When TCP peer closes the connection before the MPTCP one,
+subflow_sched_work_if_closed() will schedule the MPTCP worker to
+gracefully close the subflow, and shortly after will do another schedule
+to inject and process a dummy incoming DATA_FIN.
+
+On CONFIG_PREEMPT kernel, the MPTCP worker can kick-in and close the
+fallback subflow before subflow_sched_work_if_closed() is able to create
+the dummy DATA_FIN, unexpectedly interrupting the transfer.
+
+Address the issue explicitly avoiding closing fallback subflows on when
+the peer is only half-closed.
+
+Note that, when the subflow is able to create the DATA_FIN before the
+worker invocation, the worker will change the msk state before trying to
+close the subflow and will skip the latter operation as the msk will not
+match anymore the precondition in __mptcp_close_subflow().
+
+Fixes: f09b0ad55a11 ("mptcp: close subflow when receiving TCP+FIN")
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-3-806d3781c95f@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -2598,7 +2598,8 @@ static void __mptcp_close_subflow(struct
+
+ if (ssk_state != TCP_CLOSE &&
+ (ssk_state != TCP_CLOSE_WAIT ||
+- inet_sk_state_load(sk) != TCP_ESTABLISHED))
++ inet_sk_state_load(sk) != TCP_ESTABLISHED ||
++ __mptcp_check_fallback(msk)))
+ continue;
+
+ /* 'subflow_data_ready' will re-sched once rx queue is empty */
mips-malta-fix-eva-soc-it-pci-mmio.patch
loongarch-don-t-panic-if-no-valid-cache-info-for-pci.patch
mptcp-fix-race-condition-in-mptcp_schedule_work.patch
+mptcp-fix-ack-generation-for-fallback-msk.patch
+mptcp-fix-premature-close-in-case-of-fallback.patch
+mptcp-avoid-unneeded-subflow-level-drops.patch
+mptcp-do-not-fallback-when-ooo-is-present.patch
+drm-tegra-dc-fix-reference-leak-in-tegra_dc_couple.patch
+drm-amdgpu-skip-emit-de-meta-data-on-gfx11-with-rs64-enabled.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
