--- /dev/null
+From 18696d904dcae80ab4fb39c9af11001a1919fe2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jul 2026 22:23:34 +0800
+Subject: drm/amd/display: Add AV mute wait frames to dce110_set_avmute
+
+From: Ray Wu <ray.wu@amd.com>
+
+[ Upstream commit 443290d70b01e9c35830c300e3247c06581b594c ]
+
+Port the three-frame wait logic from dcn30_set_avmute to
+dce110_set_avmute so that older DCN versions (1.0, 2.0) also
+wait for GCP packets to be sent out before proceeding.
+
+This ensures HDMI sinks properly process the mute state,
+preventing garbled display after link re-establishment.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5167
+Reviewed-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 414da24137ace80d8c59fefd43ba3ec9f5f854ba)
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 21 ++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index 551638d9ff613..a4f092eb0857b 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -1256,8 +1256,27 @@ void dce110_blank_stream(struct pipe_ctx *pipe_ctx)
+
+ void dce110_set_avmute(struct pipe_ctx *pipe_ctx, bool enable)
+ {
+- if (pipe_ctx != NULL && pipe_ctx->stream_res.stream_enc != NULL)
++ if (pipe_ctx == NULL || pipe_ctx->stream_res.stream_enc == NULL)
++ return;
++
++ if (dc_is_hdmi_signal(pipe_ctx->stream->signal)) {
+ pipe_ctx->stream_res.stream_enc->funcs->set_avmute(pipe_ctx->stream_res.stream_enc, enable);
++
++ /* Wait for three frames to make sure AV mute is sent out.
++ * Some HDMI sinks need additional GCP packets to properly
++ * process the mute state, especially after link re-establishment
++ * with HDMI 2.0 scrambling enabled.
++ */
++ if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) {
++ int i;
++
++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
++ for (i = 0; i < 3; i++) {
++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK);
++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
++ }
++ }
++ }
+ }
+
+ static enum audio_dto_source translate_to_dto_source(enum controller_id crtc_id)
+--
+2.53.0
+
--- /dev/null
+From cfbf561b4bec4ac0335c273fa6e1275cb6f8d231 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2026 09:47:17 +0800
+Subject: drm/amd/display: Check for tg ops in dce110_set_avmute
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ray Wu <ray.wu@amd.com>
+
+[ Upstream commit 3141e3d61469bba2624a91c5e2407f110b33b29e ]
+
+Some older DCE timing generators do not implement is_tg_enabled in
+their ops table. Calling it unconditionally when waiting for AV mute
+frames causes a NULL pointer dereference on Southern Islands dGPUs
+when turning the display off over HDMI.
+
+Check that tg and the required ops exist before waiting for frames.
+
+Fixes: 414da24137ac ("drm/amd/display: Add AV mute wait frames to dce110_set_avmute")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5557
+Tested-by: Viktor Jägersküpper <viktor_jaegerskuepper@freenet.de>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 2686a0c0aaa07bec2e24131835cf27b5fd4935a5)
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index a4f092eb0857b..dcc78244dd7c3 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -1267,7 +1267,10 @@ void dce110_set_avmute(struct pipe_ctx *pipe_ctx, bool enable)
+ * process the mute state, especially after link re-establishment
+ * with HDMI 2.0 scrambling enabled.
+ */
+- if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) {
++ if (enable && pipe_ctx->stream_res.tg &&
++ pipe_ctx->stream_res.tg->funcs->is_tg_enabled &&
++ pipe_ctx->stream_res.tg->funcs->wait_for_state &&
++ pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) {
+ int i;
+
+ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
+--
+2.53.0
+
--- /dev/null
+From 8565065b6242bcb9994465253a66a1642066f37a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Aug 2026 09:41:11 -0300
+Subject: selftests/bpf: Fail unbound UDP on sockmap update
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Luczaj <mhal@rbox.co>
+
+[ Upstream commit 203b06932777b9ad5085319389dea566f5c2ca63 ]
+
+sockmap now rejects unbound UDP sockets. Adjust test_maps. While at it,
+check socket()'s return value.
+
+This effectively reverts commit c39aa2159974 ("bpf, selftests: Fix
+test_maps now that sockmap supports UDP").
+
+Signed-off-by: Michal Luczaj <mhal@rbox.co>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/20260707-sockmap-lookup-udp-leak-v4-4-f878346f27ab@rbox.co
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Signed-off-by: Ricardo B. Marlière (SUSE) <ricardo@marliere.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_maps.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
+index 905d5981ace1b..6f080cc7eb96d 100644
+--- a/tools/testing/selftests/bpf/test_maps.c
++++ b/tools/testing/selftests/bpf/test_maps.c
+@@ -752,16 +752,15 @@ static void test_sockmap(unsigned int tasks, void *data)
+ goto out_sockmap;
+ }
+
+- /* Test update with unsupported UDP socket */
++ /* Test update with unsupported unbound UDP socket */
+ udp = socket(AF_INET, SOCK_DGRAM, 0);
+- i = 0;
+- err = bpf_map_update_elem(fd, &i, &udp, BPF_ANY);
+- if (err) {
+- printf("Failed socket update SOCK_DGRAM '%i:%i'\n",
+- i, udp);
++ CHECK(udp < 0, "socket(AF_INET, SOCK_DGRAM)", "errno:%d\n", errno);
++ err = bpf_map_update_elem(fd, &(int){0}, &udp, BPF_ANY);
++ close(udp);
++ if (!err) {
++ printf("Unexpectedly succeeded unbound UDP update '0:%i'\n", udp);
+ goto out_sockmap;
+ }
+- close(udp);
+
+ /* Test update without programs */
+ for (i = 0; i < 6; i++) {
+--
+2.53.0
+
mount-honour-sb_nouser-in-the-new-mount-api.patch
+selftests-bpf-fail-unbound-udp-on-sockmap-update.patch
+drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch
+drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch
--- /dev/null
+From ae07e397635c225c3f8deb7bd7defcfcfaa20f33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jul 2026 22:23:34 +0800
+Subject: drm/amd/display: Add AV mute wait frames to dce110_set_avmute
+
+From: Ray Wu <ray.wu@amd.com>
+
+[ Upstream commit 443290d70b01e9c35830c300e3247c06581b594c ]
+
+Port the three-frame wait logic from dcn30_set_avmute to
+dce110_set_avmute so that older DCN versions (1.0, 2.0) also
+wait for GCP packets to be sent out before proceeding.
+
+This ensures HDMI sinks properly process the mute state,
+preventing garbled display after link re-establishment.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5167
+Reviewed-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 414da24137ace80d8c59fefd43ba3ec9f5f854ba)
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 21 ++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index 8f86177de48dc..13ae93b945a33 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -1266,8 +1266,27 @@ void dce110_blank_stream(struct pipe_ctx *pipe_ctx)
+
+ void dce110_set_avmute(struct pipe_ctx *pipe_ctx, bool enable)
+ {
+- if (pipe_ctx != NULL && pipe_ctx->stream_res.stream_enc != NULL)
++ if (pipe_ctx == NULL || pipe_ctx->stream_res.stream_enc == NULL)
++ return;
++
++ if (dc_is_hdmi_signal(pipe_ctx->stream->signal)) {
+ pipe_ctx->stream_res.stream_enc->funcs->set_avmute(pipe_ctx->stream_res.stream_enc, enable);
++
++ /* Wait for three frames to make sure AV mute is sent out.
++ * Some HDMI sinks need additional GCP packets to properly
++ * process the mute state, especially after link re-establishment
++ * with HDMI 2.0 scrambling enabled.
++ */
++ if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) {
++ int i;
++
++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
++ for (i = 0; i < 3; i++) {
++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK);
++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
++ }
++ }
++ }
+ }
+
+ enum audio_dto_source translate_to_dto_source(enum controller_id crtc_id)
+--
+2.53.0
+
--- /dev/null
+From e3fac42870588d55cdcb432fab7b0789f4a1e117 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2026 09:47:17 +0800
+Subject: drm/amd/display: Check for tg ops in dce110_set_avmute
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ray Wu <ray.wu@amd.com>
+
+[ Upstream commit 3141e3d61469bba2624a91c5e2407f110b33b29e ]
+
+Some older DCE timing generators do not implement is_tg_enabled in
+their ops table. Calling it unconditionally when waiting for AV mute
+frames causes a NULL pointer dereference on Southern Islands dGPUs
+when turning the display off over HDMI.
+
+Check that tg and the required ops exist before waiting for frames.
+
+Fixes: 414da24137ac ("drm/amd/display: Add AV mute wait frames to dce110_set_avmute")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5557
+Tested-by: Viktor Jägersküpper <viktor_jaegerskuepper@freenet.de>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 2686a0c0aaa07bec2e24131835cf27b5fd4935a5)
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index 13ae93b945a33..fe02dc4e97e4a 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -1277,7 +1277,10 @@ void dce110_set_avmute(struct pipe_ctx *pipe_ctx, bool enable)
+ * process the mute state, especially after link re-establishment
+ * with HDMI 2.0 scrambling enabled.
+ */
+- if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) {
++ if (enable && pipe_ctx->stream_res.tg &&
++ pipe_ctx->stream_res.tg->funcs->is_tg_enabled &&
++ pipe_ctx->stream_res.tg->funcs->wait_for_state &&
++ pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) {
+ int i;
+
+ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
+--
+2.53.0
+
--- /dev/null
+From 6d68e023eae3fdf2fb59ec3df4c89f5297d0d7a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Apr 2026 21:10:53 +0000
+Subject: sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity
+ placement bug causing scheduling lag")
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 101f3498b4bdfef97152a444847948de1543f692 ]
+
+Zicheng Qu reported that, because avg_vruntime() always includes
+cfs_rq->curr, when ->on_rq, place_entity() doesn't work right.
+
+Specifically, the lag scaling in place_entity() relies on
+avg_vruntime() being the state *before* placement of the new entity.
+However in this case avg_vruntime() will actually already include the
+entity, which breaks things.
+
+Also, Zicheng Qu argues that avg_vruntime should be invariant under
+reweight. IOW commit 6d71a9c61604 ("sched/fair: Fix EEVDF entity
+placement bug causing scheduling lag") was wrong!
+
+The issue reported in 6d71a9c61604 could possibly be explained by
+rounding artifacts -- notably the extreme weight '2' is outside of the
+range of avg_vruntime/sum_w_vruntime, since that uses
+scale_load_down(). By scaling vruntime by the real weight, but
+accounting it in vruntime with a factor 1024 more, the average moves
+significantly. However, that is now cured.
+
+Tested by reverting 66951e4860d3 ("sched/fair: Fix update_cfs_group()
+vs DELAY_DEQUEUE") and tracing vruntime and vlag figures again.
+
+Reported-by: Zicheng Qu <quzicheng@huawei.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Tested-by: Shubhang Kaushik <shubhang@os.amperecomputing.com>
+Link: https://patch.msgid.link/20260219080625.066102672%40infradead.org
+(cherry picked from commit 101f3498b4bdfef97152a444847948de1543f692)
+[jstultz: Resolved minor collision in the revert against 6.18-stable]
+Signed-off-by: John Stultz <jstultz@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 148 +++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 124 insertions(+), 24 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index ac5f08cd01a83..aed035aaece1d 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -764,17 +764,22 @@ static inline u64 cfs_rq_max_slice(struct cfs_rq *cfs_rq);
+ *
+ * -r_max < lag < max(r_max, q)
+ */
+-static void update_entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se)
++static s64 entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se, u64 avruntime)
+ {
+ u64 max_slice = cfs_rq_max_slice(cfs_rq) + TICK_NSEC;
+ s64 vlag, limit;
+
+- WARN_ON_ONCE(!se->on_rq);
+-
+- vlag = avg_vruntime(cfs_rq) - se->vruntime;
++ vlag = avruntime - se->vruntime;
+ limit = calc_delta_fair(max_slice, se);
+
+- se->vlag = clamp(vlag, -limit, limit);
++ return clamp(vlag, -limit, limit);
++}
++
++static void update_entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se)
++{
++ WARN_ON_ONCE(!se->on_rq);
++
++ se->vlag = entity_lag(cfs_rq, se, avg_vruntime(cfs_rq));
+ }
+
+ /*
+@@ -3838,23 +3843,125 @@ dequeue_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se)
+ cfs_rq->avg.load_avg * PELT_MIN_DIVIDER);
+ }
+
+-static void place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags);
++static void
++rescale_entity(struct sched_entity *se, unsigned long weight, bool rel_vprot)
++{
++ unsigned long old_weight = se->load.weight;
++
++ /*
++ * VRUNTIME
++ * --------
++ *
++ * COROLLARY #1: The virtual runtime of the entity needs to be
++ * adjusted if re-weight at !0-lag point.
++ *
++ * Proof: For contradiction assume this is not true, so we can
++ * re-weight without changing vruntime at !0-lag point.
++ *
++ * Weight VRuntime Avg-VRuntime
++ * before w v V
++ * after w' v' V'
++ *
++ * Since lag needs to be preserved through re-weight:
++ *
++ * lag = (V - v)*w = (V'- v')*w', where v = v'
++ * ==> V' = (V - v)*w/w' + v (1)
++ *
++ * Let W be the total weight of the entities before reweight,
++ * since V' is the new weighted average of entities:
++ *
++ * V' = (WV + w'v - wv) / (W + w' - w) (2)
++ *
++ * by using (1) & (2) we obtain:
++ *
++ * (WV + w'v - wv) / (W + w' - w) = (V - v)*w/w' + v
++ * ==> (WV-Wv+Wv+w'v-wv)/(W+w'-w) = (V - v)*w/w' + v
++ * ==> (WV - Wv)/(W + w' - w) + v = (V - v)*w/w' + v
++ * ==> (V - v)*W/(W + w' - w) = (V - v)*w/w' (3)
++ *
++ * Since we are doing at !0-lag point which means V != v, we
++ * can simplify (3):
++ *
++ * ==> W / (W + w' - w) = w / w'
++ * ==> Ww' = Ww + ww' - ww
++ * ==> W * (w' - w) = w * (w' - w)
++ * ==> W = w (re-weight indicates w' != w)
++ *
++ * So the cfs_rq contains only one entity, hence vruntime of
++ * the entity @v should always equal to the cfs_rq's weighted
++ * average vruntime @V, which means we will always re-weight
++ * at 0-lag point, thus breach assumption. Proof completed.
++ *
++ *
++ * COROLLARY #2: Re-weight does NOT affect weighted average
++ * vruntime of all the entities.
++ *
++ * Proof: According to corollary #1, Eq. (1) should be:
++ *
++ * (V - v)*w = (V' - v')*w'
++ * ==> v' = V' - (V - v)*w/w' (4)
++ *
++ * According to the weighted average formula, we have:
++ *
++ * V' = (WV - wv + w'v') / (W - w + w')
++ * = (WV - wv + w'(V' - (V - v)w/w')) / (W - w + w')
++ * = (WV - wv + w'V' - Vw + wv) / (W - w + w')
++ * = (WV + w'V' - Vw) / (W - w + w')
++ *
++ * ==> V'*(W - w + w') = WV + w'V' - Vw
++ * ==> V' * (W - w) = (W - w) * V (5)
++ *
++ * If the entity is the only one in the cfs_rq, then reweight
++ * always occurs at 0-lag point, so V won't change. Or else
++ * there are other entities, hence W != w, then Eq. (5) turns
++ * into V' = V. So V won't change in either case, proof done.
++ *
++ *
++ * So according to corollary #1 & #2, the effect of re-weight
++ * on vruntime should be:
++ *
++ * v' = V' - (V - v) * w / w' (4)
++ * = V - (V - v) * w / w'
++ * = V - vl * w / w'
++ * = V - vl'
++ */
++ se->vlag = div64_long(se->vlag * old_weight, weight);
++
++ /*
++ * DEADLINE
++ * --------
++ *
++ * When the weight changes, the virtual time slope changes and
++ * we should adjust the relative virtual deadline accordingly.
++ *
++ * d' = v' + (d - v)*w/w'
++ * = V' - (V - v)*w/w' + (d - v)*w/w'
++ * = V - (V - v)*w/w' + (d - v)*w/w'
++ * = V + (d - V)*w/w'
++ */
++ if (se->rel_deadline)
++ se->deadline = div64_long(se->deadline * old_weight, weight);
++
++ if (rel_vprot)
++ se->vprot = div64_long(se->vprot * old_weight, weight);
++}
+
+ static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se,
+ unsigned long weight)
+ {
+ bool curr = cfs_rq->curr == se;
+ bool rel_vprot = false;
+- u64 vprot;
++ u64 avruntime = 0;
+
+ if (se->on_rq) {
+ /* commit outstanding execution time */
+ update_curr(cfs_rq);
+- update_entity_lag(cfs_rq, se);
+- se->deadline -= se->vruntime;
++ avruntime = avg_vruntime(cfs_rq);
++ se->vlag = entity_lag(cfs_rq, se, avruntime);
++ se->deadline -= avruntime;
+ se->rel_deadline = 1;
+ if (curr && protect_slice(se)) {
+- vprot = se->vprot - se->vruntime;
++ se->vprot -= avruntime;
+ rel_vprot = true;
+ }
+
+@@ -3865,30 +3972,23 @@ static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se,
+ }
+ dequeue_load_avg(cfs_rq, se);
+
+- /*
+- * Because we keep se->vlag = V - v_i, while: lag_i = w_i*(V - v_i),
+- * we need to scale se->vlag when w_i changes.
+- */
+- se->vlag = div_s64(se->vlag * se->load.weight, weight);
+- if (se->rel_deadline)
+- se->deadline = div_s64(se->deadline * se->load.weight, weight);
+-
+- if (rel_vprot)
+- vprot = div_s64(vprot * se->load.weight, weight);
++ rescale_entity(se, weight, rel_vprot);
+
+ update_load_set(&se->load, weight);
+
+ do {
+ u32 divider = get_pelt_divider(&se->avg);
+-
+ se->avg.load_avg = div_u64(se_weight(se) * se->avg.load_sum, divider);
+ } while (0);
+
+ enqueue_load_avg(cfs_rq, se);
+ if (se->on_rq) {
+- place_entity(cfs_rq, se, 0);
+ if (rel_vprot)
+- se->vprot = se->vruntime + vprot;
++ se->vprot += avruntime;
++ se->deadline += avruntime;
++ se->rel_deadline = 0;
++ se->vruntime = avruntime - se->vlag;
++
+ update_load_add(&cfs_rq->load, se->load.weight);
+ if (!curr)
+ __enqueue_entity(cfs_rq, se);
+@@ -5288,7 +5388,7 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
+
+ se->vruntime = vruntime - lag;
+
+- if (se->rel_deadline) {
++ if (sched_feat(PLACE_REL_DEADLINE) && se->rel_deadline) {
+ se->deadline += se->vruntime;
+ se->rel_deadline = 0;
+ return;
+--
+2.53.0
+
--- /dev/null
+From dd2a31312368368ed38664a232c4e197e12c3a8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Aug 2026 09:41:11 -0300
+Subject: selftests/bpf: Fail unbound UDP on sockmap update
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Luczaj <mhal@rbox.co>
+
+[ Upstream commit 203b06932777b9ad5085319389dea566f5c2ca63 ]
+
+sockmap now rejects unbound UDP sockets. Adjust test_maps. While at it,
+check socket()'s return value.
+
+This effectively reverts commit c39aa2159974 ("bpf, selftests: Fix
+test_maps now that sockmap supports UDP").
+
+Signed-off-by: Michal Luczaj <mhal@rbox.co>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/20260707-sockmap-lookup-udp-leak-v4-4-f878346f27ab@rbox.co
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Signed-off-by: Ricardo B. Marlière (SUSE) <ricardo@marliere.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_maps.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
+index 3fae9ce46ca9b..cea33b94d06f8 100644
+--- a/tools/testing/selftests/bpf/test_maps.c
++++ b/tools/testing/selftests/bpf/test_maps.c
+@@ -748,16 +748,15 @@ static void test_sockmap(unsigned int tasks, void *data)
+ goto out_sockmap;
+ }
+
+- /* Test update with unsupported UDP socket */
++ /* Test update with unsupported unbound UDP socket */
+ udp = socket(AF_INET, SOCK_DGRAM, 0);
+- i = 0;
+- err = bpf_map_update_elem(fd, &i, &udp, BPF_ANY);
+- if (err) {
+- printf("Failed socket update SOCK_DGRAM '%i:%i'\n",
+- i, udp);
++ CHECK(udp < 0, "socket(AF_INET, SOCK_DGRAM)", "errno:%d\n", errno);
++ err = bpf_map_update_elem(fd, &(int){0}, &udp, BPF_ANY);
++ close(udp);
++ if (!err) {
++ printf("Unexpectedly succeeded unbound UDP update '0:%i'\n", udp);
+ goto out_sockmap;
+ }
+- close(udp);
+
+ /* Test update without programs */
+ for (i = 0; i < 6; i++) {
+--
+2.53.0
+
kvm-s390-pci-fix-resource-leak-on-irq-registration-f.patch
mount-honour-sb_nouser-in-the-new-mount-api.patch
+sched-fair-revert-6d71a9c61604-sched-fair-fix-eevdf-.patch
+selftests-bpf-fail-unbound-udp-on-sockmap-update.patch
+drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch
+drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch
--- /dev/null
+From 23bd0d4f46ae8135b052a6d887aa627a9727c534 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Aug 2026 09:41:11 -0300
+Subject: selftests/bpf: Fail unbound UDP on sockmap update
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Luczaj <mhal@rbox.co>
+
+[ Upstream commit 203b06932777b9ad5085319389dea566f5c2ca63 ]
+
+sockmap now rejects unbound UDP sockets. Adjust test_maps. While at it,
+check socket()'s return value.
+
+This effectively reverts commit c39aa2159974 ("bpf, selftests: Fix
+test_maps now that sockmap supports UDP").
+
+Signed-off-by: Michal Luczaj <mhal@rbox.co>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/20260707-sockmap-lookup-udp-leak-v4-4-f878346f27ab@rbox.co
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Signed-off-by: Ricardo B. Marlière (SUSE) <ricardo@marliere.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_maps.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
+index e0dd101c9f2bd..f2a27143edc34 100644
+--- a/tools/testing/selftests/bpf/test_maps.c
++++ b/tools/testing/selftests/bpf/test_maps.c
+@@ -752,16 +752,15 @@ static void test_sockmap(unsigned int tasks, void *data)
+ goto out_sockmap;
+ }
+
+- /* Test update with unsupported UDP socket */
++ /* Test update with unsupported unbound UDP socket */
+ udp = socket(AF_INET, SOCK_DGRAM, 0);
+- i = 0;
+- err = bpf_map_update_elem(fd, &i, &udp, BPF_ANY);
+- if (err) {
+- printf("Failed socket update SOCK_DGRAM '%i:%i'\n",
+- i, udp);
++ CHECK(udp < 0, "socket(AF_INET, SOCK_DGRAM)", "errno:%d\n", errno);
++ err = bpf_map_update_elem(fd, &(int){0}, &udp, BPF_ANY);
++ close(udp);
++ if (!err) {
++ printf("Unexpectedly succeeded unbound UDP update '0:%i'\n", udp);
+ goto out_sockmap;
+ }
+- close(udp);
+
+ /* Test update without programs */
+ for (i = 0; i < 6; i++) {
+--
+2.53.0
+
mount-honour-sb_nouser-in-the-new-mount-api.patch
+selftests-bpf-fail-unbound-udp-on-sockmap-update.patch
--- /dev/null
+From 1b51524ae4a7b0ead79dc38c9f2115dc539f64fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jul 2026 22:23:34 +0800
+Subject: drm/amd/display: Add AV mute wait frames to dce110_set_avmute
+
+From: Ray Wu <ray.wu@amd.com>
+
+[ Upstream commit 443290d70b01e9c35830c300e3247c06581b594c ]
+
+Port the three-frame wait logic from dcn30_set_avmute to
+dce110_set_avmute so that older DCN versions (1.0, 2.0) also
+wait for GCP packets to be sent out before proceeding.
+
+This ensures HDMI sinks properly process the mute state,
+preventing garbled display after link re-establishment.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5167
+Reviewed-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 414da24137ace80d8c59fefd43ba3ec9f5f854ba)
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/hwss/dce110/dce110_hwseq.c | 21 ++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index f0abbb7c2cb24..d2a27aca6cd76 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -1320,8 +1320,27 @@ void dce110_blank_stream(struct pipe_ctx *pipe_ctx)
+
+ void dce110_set_avmute(struct pipe_ctx *pipe_ctx, bool enable)
+ {
+- if (pipe_ctx != NULL && pipe_ctx->stream_res.stream_enc != NULL)
++ if (pipe_ctx == NULL || pipe_ctx->stream_res.stream_enc == NULL)
++ return;
++
++ if (dc_is_hdmi_signal(pipe_ctx->stream->signal)) {
+ pipe_ctx->stream_res.stream_enc->funcs->set_avmute(pipe_ctx->stream_res.stream_enc, enable);
++
++ /* Wait for three frames to make sure AV mute is sent out.
++ * Some HDMI sinks need additional GCP packets to properly
++ * process the mute state, especially after link re-establishment
++ * with HDMI 2.0 scrambling enabled.
++ */
++ if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) {
++ int i;
++
++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
++ for (i = 0; i < 3; i++) {
++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK);
++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
++ }
++ }
++ }
+ }
+
+ enum audio_dto_source translate_to_dto_source(enum controller_id crtc_id)
+--
+2.53.0
+
--- /dev/null
+From 57fc0811228fa9c744167a361a43f772a72cdb27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2026 09:47:17 +0800
+Subject: drm/amd/display: Check for tg ops in dce110_set_avmute
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ray Wu <ray.wu@amd.com>
+
+[ Upstream commit 3141e3d61469bba2624a91c5e2407f110b33b29e ]
+
+Some older DCE timing generators do not implement is_tg_enabled in
+their ops table. Calling it unconditionally when waiting for AV mute
+frames causes a NULL pointer dereference on Southern Islands dGPUs
+when turning the display off over HDMI.
+
+Check that tg and the required ops exist before waiting for frames.
+
+Fixes: 414da24137ac ("drm/amd/display: Add AV mute wait frames to dce110_set_avmute")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5557
+Tested-by: Viktor Jägersküpper <viktor_jaegerskuepper@freenet.de>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 2686a0c0aaa07bec2e24131835cf27b5fd4935a5)
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index d2a27aca6cd76..3b26229eff2b6 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -1331,7 +1331,10 @@ void dce110_set_avmute(struct pipe_ctx *pipe_ctx, bool enable)
+ * process the mute state, especially after link re-establishment
+ * with HDMI 2.0 scrambling enabled.
+ */
+- if (enable && pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) {
++ if (enable && pipe_ctx->stream_res.tg &&
++ pipe_ctx->stream_res.tg->funcs->is_tg_enabled &&
++ pipe_ctx->stream_res.tg->funcs->wait_for_state &&
++ pipe_ctx->stream_res.tg->funcs->is_tg_enabled(pipe_ctx->stream_res.tg)) {
+ int i;
+
+ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
+--
+2.53.0
+
--- /dev/null
+From c589ba7924f5c00a67368efd81a3c071adcbb24c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2026 12:51:44 +1200
+Subject: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
+
+From: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
+
+[ Upstream commit 9dc325327babe7f159e84cbe9380a45342da0585 ]
+
+Locking is disabled in the regmap config as this driver uses its own
+lock. This means that all calls to regmap functions (read or write) must
+hold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do
+this, and it was therefore possible that multiple threads could cause an
+incorrect register to be read/written.
+
+A previous patch partly fixed this, but only protected the write to the
+interrupt mask register, and not the read from the direction register.
+
+Fixes: bfc6444b57dc ("gpio: pca953x: fix pca953x_irq_bus_sync_unlock race")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
+Link: https://patch.msgid.link/20260709045116.2304246-1-mark.tomlinson@alliedtelesis.co.nz
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+(cherry picked from commit 9dc325327babe7f159e84cbe9380a45342da0585)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca953x.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index 69c5bd9aaee7c..cb282b35fb58d 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -605,20 +605,28 @@ static int pca953x_read_regs(struct pca953x_chip *chip, int reg, unsigned long *
+ return 0;
+ }
+
+-static int pca953x_gpio_direction_input(struct gpio_chip *gc, unsigned off)
++static int pca953x_gpio_direction_input_unlocked(struct gpio_chip *gc,
++ unsigned int off)
+ {
+ struct pca953x_chip *chip = gpiochip_get_data(gc);
+ u8 dirreg = chip->recalc_addr(chip, chip->regs->direction, off);
+ u8 bit = pca953x_get_bit_mask(chip, off);
+
+- guard(mutex)(&chip->i2c_lock);
+-
+ if (PCA_CHIP_TYPE(chip->driver_data) == TCA6418_TYPE)
+ return regmap_update_bits(chip->regmap, dirreg, bit, 0);
+
+ return regmap_update_bits(chip->regmap, dirreg, bit, bit);
+ }
+
++static int pca953x_gpio_direction_input(struct gpio_chip *gc, unsigned int off)
++{
++ struct pca953x_chip *chip = gpiochip_get_data(gc);
++
++ guard(mutex)(&chip->i2c_lock);
++
++ return pca953x_gpio_direction_input_unlocked(gc, off);
++}
++
+ static int pca953x_gpio_direction_output(struct gpio_chip *gc,
+ unsigned off, int val)
+ {
+@@ -856,9 +864,10 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
+ DECLARE_BITMAP(reg_direction, MAX_LINE);
+ int level;
+
++ guard(mutex)(&chip->i2c_lock);
++
+ if (chip->driver_data & PCA_PCAL) {
+ DECLARE_BITMAP(latched_inputs, MAX_LINE);
+- guard(mutex)(&chip->i2c_lock);
+
+ /* Enable latch on edge-triggered interrupt-enabled inputs */
+ bitmap_or(latched_inputs, chip->irq_trig_fall, chip->irq_trig_raise, gc->ngpio);
+@@ -882,7 +891,7 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
+
+ /* Look for any newly setup interrupt */
+ for_each_set_bit(level, irq_mask, gc->ngpio)
+- pca953x_gpio_direction_input(&chip->gpio_chip, level);
++ pca953x_gpio_direction_input_unlocked(&chip->gpio_chip, level);
+
+ mutex_unlock(&chip->irq_lock);
+ }
+--
+2.53.0
+
--- /dev/null
+From 3e20903c64673df4b6e5c7e64746c116553f8e25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Aug 2026 09:42:11 -0300
+Subject: selftests/bpf: Add tests for sleepable tracepoint programs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mykyta Yatsenko <yatsenko@meta.com>
+
+[ Upstream commit 8a20655749c625dcc4debdfdeeaa0cf8bb85c203 ]
+
+Cover all three sleepable tracepoint types (tp_btf.s, raw_tp.s, tp.s)
+and sys_exit (via bpf_task_pt_regs) with functional tests using
+bpf_copy_from_user() on getcwd. Verify alias and bare SEC variants,
+bpf_prog_test_run_raw_tp() with BPF_F_TEST_RUN_ON_CPU rejection,
+attach-time rejection on non-faultable tracepoints, and load-time
+rejection for sleepable tp_btf on non-faultable tracepoints.
+
+[ rbm: Removed hunks from (new) files:
+ tools/testing/selftests/bpf/prog_tests/sleepable_tracepoints.c
+ tools/testing/selftests/bpf/progs/test_sleepable_tracepoints.c
+ tools/testing/selftests/bpf/progs/test_sleepable_tracepoints_fail.c
+ These rely on libbpf's ".s" tracepoint section handlers
+ (0cd420a6f40c7) and on kernel-side sleepable tracepoint runtime
+ support (439ebd5b5708, 12628ffaf98b, 57918341dd19), none of which
+ are backported here; kept only the verifier/sleepable.c hunk, which
+ is correct and needed on its own. ]
+
+Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
+Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Link: https://lore.kernel.org/bpf/20260422-sleepable_tracepoints-v13-6-99005dff21ef@meta.com
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Signed-off-by: Ricardo B. Marlière (SUSE) <ricardo@marliere.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../testing/selftests/bpf/verifier/sleepable.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/verifier/sleepable.c b/tools/testing/selftests/bpf/verifier/sleepable.c
+index c2b7f5ebf168c..6dabc55229455 100644
+--- a/tools/testing/selftests/bpf/verifier/sleepable.c
++++ b/tools/testing/selftests/bpf/verifier/sleepable.c
+@@ -76,7 +76,20 @@
+ .runs = -1,
+ },
+ {
+- "sleepable raw tracepoint reject",
++ "sleepable raw tracepoint accept",
++ .insns = {
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++ BPF_EXIT_INSN(),
++ },
++ .prog_type = BPF_PROG_TYPE_TRACING,
++ .expected_attach_type = BPF_TRACE_RAW_TP,
++ .kfunc = "sys_enter",
++ .result = ACCEPT,
++ .flags = BPF_F_SLEEPABLE,
++ .runs = -1,
++},
++{
++ "sleepable raw tracepoint reject non-faultable",
+ .insns = {
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+@@ -85,7 +98,7 @@
+ .expected_attach_type = BPF_TRACE_RAW_TP,
+ .kfunc = "sched_switch",
+ .result = REJECT,
+- .errstr = "Only fentry/fexit/fsession/fmod_ret, lsm, iter, uprobe, and struct_ops programs can be sleepable",
++ .errstr = "Sleepable program cannot attach to non-faultable tracepoint",
+ .flags = BPF_F_SLEEPABLE,
+ .runs = -1,
+ },
+--
+2.53.0
+
--- /dev/null
+From 257aa48ccad5edfe837604a41ef43a613f41dd91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Aug 2026 09:41:11 -0300
+Subject: selftests/bpf: Fail unbound UDP on sockmap update
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Luczaj <mhal@rbox.co>
+
+[ Upstream commit 203b06932777b9ad5085319389dea566f5c2ca63 ]
+
+sockmap now rejects unbound UDP sockets. Adjust test_maps. While at it,
+check socket()'s return value.
+
+This effectively reverts commit c39aa2159974 ("bpf, selftests: Fix
+test_maps now that sockmap supports UDP").
+
+Signed-off-by: Michal Luczaj <mhal@rbox.co>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/20260707-sockmap-lookup-udp-leak-v4-4-f878346f27ab@rbox.co
+Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
+Signed-off-by: Ricardo B. Marlière (SUSE) <ricardo@marliere.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_maps.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
+index ccc5acd55ff9d..d194b44ff8be8 100644
+--- a/tools/testing/selftests/bpf/test_maps.c
++++ b/tools/testing/selftests/bpf/test_maps.c
+@@ -748,16 +748,15 @@ static void test_sockmap(unsigned int tasks, void *data)
+ goto out_sockmap;
+ }
+
+- /* Test update with unsupported UDP socket */
++ /* Test update with unsupported unbound UDP socket */
+ udp = socket(AF_INET, SOCK_DGRAM, 0);
+- i = 0;
+- err = bpf_map_update_elem(fd, &i, &udp, BPF_ANY);
+- if (err) {
+- printf("Failed socket update SOCK_DGRAM '%i:%i'\n",
+- i, udp);
++ CHECK(udp < 0, "socket(AF_INET, SOCK_DGRAM)", "errno:%d\n", errno);
++ err = bpf_map_update_elem(fd, &(int){0}, &udp, BPF_ANY);
++ close(udp);
++ if (!err) {
++ printf("Unexpectedly succeeded unbound UDP update '0:%i'\n", udp);
+ goto out_sockmap;
+ }
+- close(udp);
+
+ /* Test update without programs */
+ for (i = 0; i < 6; i++) {
+--
+2.53.0
+
mount-honour-sb_nouser-in-the-new-mount-api.patch
+selftests-bpf-fail-unbound-udp-on-sockmap-update.patch
+selftests-bpf-add-tests-for-sleepable-tracepoint-pro.patch
+gpio-pca953x-fix-pca953x_irq_bus_sync_unlock-regmap-.patch
+drm-amd-display-add-av-mute-wait-frames-to-dce110_se.patch
+drm-amd-display-check-for-tg-ops-in-dce110_set_avmut.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
