--- /dev/null
+From 3ece5815f17f093b27b062f8a3a983761f5560f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 11:56:05 +0200
+Subject: ARM: dts: imx6q-ba16: fix RTC interrupt level
+
+From: Ian Ray <ian.ray@gehealthcare.com>
+
+[ Upstream commit e6a4eedd49ce27c16a80506c66a04707e0ee0116 ]
+
+RTC interrupt level should be set to "LOW". This was revealed by the
+introduction of commit:
+
+ f181987ef477 ("rtc: m41t80: use IRQ flags obtained from fwnode")
+
+which changed the way IRQ type is obtained.
+
+Fixes: 56c27310c1b4 ("ARM: dts: imx: Add Advantech BA-16 Qseven module")
+Signed-off-by: Ian Ray <ian.ray@gehealthcare.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6q-ba16.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6q-ba16.dtsi b/arch/arm/boot/dts/imx6q-ba16.dtsi
+index 133991ca8c633..6147d1ff4515e 100644
+--- a/arch/arm/boot/dts/imx6q-ba16.dtsi
++++ b/arch/arm/boot/dts/imx6q-ba16.dtsi
+@@ -320,7 +320,7 @@ rtc@32 {
+ pinctrl-0 = <&pinctrl_rtc>;
+ reg = <0x32>;
+ interrupt-parent = <&gpio4>;
+- interrupts = <10 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <10 IRQ_TYPE_LEVEL_LOW>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From e2ac71fa372da78a59f3f6d2b7ff354df2ae08ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 21:22:50 +0000
+Subject: arp: do not assume dev_hard_header() does not change skb->head
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit c92510f5e3f82ba11c95991824a41e59a9c5ed81 ]
+
+arp_create() is the only dev_hard_header() caller
+making assumption about skb->head being unchanged.
+
+A recent commit broke this assumption.
+
+Initialize @arp pointer after dev_hard_header() call.
+
+Fixes: db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust")
+Reported-by: syzbot+58b44a770a1585795351@syzkaller.appspotmail.com
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260107212250.384552-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/arp.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
+index 6879e0b70c769..5f2788b87dfd5 100644
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -542,7 +542,7 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
+
+ skb_reserve(skb, hlen);
+ skb_reset_network_header(skb);
+- arp = skb_put(skb, arp_hdr_len(dev));
++ skb_put(skb, arp_hdr_len(dev));
+ skb->dev = dev;
+ skb->protocol = htons(ETH_P_ARP);
+ if (!src_hw)
+@@ -550,12 +550,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
+ if (!dest_hw)
+ dest_hw = dev->broadcast;
+
+- /*
+- * Fill the device header for the ARP frame
++ /* Fill the device header for the ARP frame.
++ * Note: skb->head can be changed.
+ */
+ if (dev_hard_header(skb, dev, ptype, dest_hw, src_hw, skb->len) < 0)
+ goto out;
+
++ arp = arp_hdr(skb);
+ /*
+ * Fill out the arp protocol part.
+ *
+--
+2.51.0
+
--- /dev/null
+From 34775c6d96774467f74d1dc0e0173d26ad75752d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Dec 2025 00:36:25 -0800
+Subject: bnxt_en: Fix potential data corruption with HW GRO/LRO
+
+From: Srijit Bose <srijit.bose@broadcom.com>
+
+[ Upstream commit ffeafa65b2b26df2f5b5a6118d3174f17bd12ec5 ]
+
+Fix the max number of bits passed to find_first_zero_bit() in
+bnxt_alloc_agg_idx(). We were incorrectly passing the number of
+long words. find_first_zero_bit() may fail to find a zero bit and
+cause a wrong ID to be used. If the wrong ID is already in use, this
+can cause data corruption. Sometimes an error like this can also be
+seen:
+
+bnxt_en 0000:83:00.0 enp131s0np0: TPA end agg_buf 2 != expected agg_bufs 1
+
+Fix it by passing the correct number of bits MAX_TPA_P5. Use
+DECLARE_BITMAP() to more cleanly define the bitmap. Add a sanity
+check to warn if a bit cannot be found and reset the ring [MChan].
+
+Fixes: ec4d8e7cf024 ("bnxt_en: Add TPA ID mapping logic for 57500 chips.")
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Srijit Bose <srijit.bose@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20251231083625.3911652-1-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 15 ++++++++++++---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 +---
+ 2 files changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 7fa215b320603..fd54a194a5e5f 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1218,9 +1218,11 @@ static u16 bnxt_alloc_agg_idx(struct bnxt_rx_ring_info *rxr, u16 agg_id)
+ struct bnxt_tpa_idx_map *map = rxr->rx_tpa_idx_map;
+ u16 idx = agg_id & MAX_TPA_P5_MASK;
+
+- if (test_bit(idx, map->agg_idx_bmap))
+- idx = find_first_zero_bit(map->agg_idx_bmap,
+- BNXT_AGG_IDX_BMAP_SIZE);
++ if (test_bit(idx, map->agg_idx_bmap)) {
++ idx = find_first_zero_bit(map->agg_idx_bmap, MAX_TPA_P5);
++ if (idx >= MAX_TPA_P5)
++ return INVALID_HW_RING_ID;
++ }
+ __set_bit(idx, map->agg_idx_bmap);
+ map->agg_id_tbl[agg_id] = idx;
+ return idx;
+@@ -1253,6 +1255,13 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
+ if (bp->flags & BNXT_FLAG_CHIP_P5) {
+ agg_id = TPA_START_AGG_ID_P5(tpa_start);
+ agg_id = bnxt_alloc_agg_idx(rxr, agg_id);
++ if (unlikely(agg_id == INVALID_HW_RING_ID)) {
++ netdev_warn(bp->dev, "Unable to allocate agg ID for ring %d, agg 0x%x\n",
++ rxr->bnapi->index,
++ TPA_START_AGG_ID_P5(tpa_start));
++ bnxt_sched_reset_rxr(bp, rxr);
++ return;
++ }
+ } else {
+ agg_id = TPA_START_AGG_ID(tpa_start);
+ }
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index b7b07beb17ffb..c2122d5cda622 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -870,11 +870,9 @@ struct bnxt_tpa_info {
+ struct rx_agg_cmp *agg_arr;
+ };
+
+-#define BNXT_AGG_IDX_BMAP_SIZE (MAX_TPA_P5 / BITS_PER_LONG)
+-
+ struct bnxt_tpa_idx_map {
+ u16 agg_id_tbl[1024];
+- unsigned long agg_idx_bmap[BNXT_AGG_IDX_BMAP_SIZE];
++ DECLARE_BITMAP(agg_idx_bmap, MAX_TPA_P5);
+ };
+
+ struct bnxt_rx_ring_info {
+--
+2.51.0
+
--- /dev/null
+From 8eb4bae0d3edd30d8035162870c3f59d9b615f97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Dec 2025 03:00:57 +0100
+Subject: bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
+
+From: Alexandre Knecht <knecht.alexandre@gmail.com>
+
+[ Upstream commit 3128df6be147768fe536986fbb85db1d37806a9f ]
+
+When using an 802.1ad bridge with vlan_tunnel, the C-VLAN tag is
+incorrectly stripped from frames during egress processing.
+
+br_handle_egress_vlan_tunnel() uses skb_vlan_pop() to remove the S-VLAN
+from hwaccel before VXLAN encapsulation. However, skb_vlan_pop() also
+moves any "next" VLAN from the payload into hwaccel:
+
+ /* move next vlan tag to hw accel tag */
+ __skb_vlan_pop(skb, &vlan_tci);
+ __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);
+
+For QinQ frames where the C-VLAN sits in the payload, this moves it to
+hwaccel where it gets lost during VXLAN encapsulation.
+
+Fix by calling __vlan_hwaccel_clear_tag() directly, which clears only
+the hwaccel S-VLAN and leaves the payload untouched.
+
+This path is only taken when vlan_tunnel is enabled and tunnel_info
+is configured, so 802.1Q bridges are unaffected.
+
+Tested with 802.1ad bridge + VXLAN vlan_tunnel, verified C-VLAN
+preserved in VXLAN payload via tcpdump.
+
+Fixes: 11538d039ac6 ("bridge: vlan dst_metadata hooks in ingress and egress paths")
+Signed-off-by: Alexandre Knecht <knecht.alexandre@gmail.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20251228020057.2788865-1-knecht.alexandre@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_vlan_tunnel.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/net/bridge/br_vlan_tunnel.c b/net/bridge/br_vlan_tunnel.c
+index debe167202782..9e960e2ab3fa9 100644
+--- a/net/bridge/br_vlan_tunnel.c
++++ b/net/bridge/br_vlan_tunnel.c
+@@ -189,7 +189,6 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,
+ {
+ struct metadata_dst *tunnel_dst;
+ __be64 tunnel_id;
+- int err;
+
+ if (!vlan)
+ return 0;
+@@ -199,9 +198,13 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,
+ return 0;
+
+ skb_dst_drop(skb);
+- err = skb_vlan_pop(skb);
+- if (err)
+- return err;
++ /* For 802.1ad (QinQ), skb_vlan_pop() incorrectly moves the C-VLAN
++ * from payload to hwaccel after clearing S-VLAN. We only need to
++ * clear the hwaccel S-VLAN; the C-VLAN must stay in payload for
++ * correct VXLAN encapsulation. This is also correct for 802.1Q
++ * where no C-VLAN exists in payload.
++ */
++ __vlan_hwaccel_clear_tag(skb);
+
+ tunnel_dst = rcu_dereference(vlan->tinfo.tunnel_dst);
+ if (tunnel_dst && dst_hold_safe(&tunnel_dst->dst))
+--
+2.51.0
+
--- /dev/null
+From 6844fe03d6160903224de0d78460079dc858e042 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jul 2023 18:04:38 -0700
+Subject: eth: bnxt: move and rename reset helpers
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit fea2993aecd74d5d11ede1ebbd60e478ebfed996 ]
+
+Move the reset helpers, subsequent patches will need some
+of them on the Tx path.
+
+While at it rename bnxt_sched_reset(), on more recent chips
+it schedules a queue reset, instead of a fuller reset.
+
+Link: https://lore.kernel.org/r/20230720010440.1967136-2-kuba@kernel.org
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: ffeafa65b2b2 ("bnxt_en: Fix potential data corruption with HW GRO/LRO")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 72 +++++++++++------------
+ 1 file changed, 36 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 40c53404bccbb..7fa215b320603 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -330,6 +330,38 @@ static void bnxt_db_cq(struct bnxt *bp, struct bnxt_db_info *db, u32 idx)
+ BNXT_DB_CQ(db, idx);
+ }
+
++static void bnxt_queue_fw_reset_work(struct bnxt *bp, unsigned long delay)
++{
++ if (!(test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)))
++ return;
++
++ if (BNXT_PF(bp))
++ queue_delayed_work(bnxt_pf_wq, &bp->fw_reset_task, delay);
++ else
++ schedule_delayed_work(&bp->fw_reset_task, delay);
++}
++
++static void bnxt_queue_sp_work(struct bnxt *bp)
++{
++ if (BNXT_PF(bp))
++ queue_work(bnxt_pf_wq, &bp->sp_task);
++ else
++ schedule_work(&bp->sp_task);
++}
++
++static void bnxt_sched_reset_rxr(struct bnxt *bp, struct bnxt_rx_ring_info *rxr)
++{
++ if (!rxr->bnapi->in_reset) {
++ rxr->bnapi->in_reset = true;
++ if (bp->flags & BNXT_FLAG_CHIP_P5)
++ set_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event);
++ else
++ set_bit(BNXT_RST_RING_SP_EVENT, &bp->sp_event);
++ bnxt_queue_sp_work(bp);
++ }
++ rxr->rx_next_cons = 0xffff;
++}
++
+ const u16 bnxt_lhint_arr[] = {
+ TX_BD_FLAGS_LHINT_512_AND_SMALLER,
+ TX_BD_FLAGS_LHINT_512_TO_1023,
+@@ -1181,38 +1213,6 @@ static int bnxt_discard_rx(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+ return 0;
+ }
+
+-static void bnxt_queue_fw_reset_work(struct bnxt *bp, unsigned long delay)
+-{
+- if (!(test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)))
+- return;
+-
+- if (BNXT_PF(bp))
+- queue_delayed_work(bnxt_pf_wq, &bp->fw_reset_task, delay);
+- else
+- schedule_delayed_work(&bp->fw_reset_task, delay);
+-}
+-
+-static void bnxt_queue_sp_work(struct bnxt *bp)
+-{
+- if (BNXT_PF(bp))
+- queue_work(bnxt_pf_wq, &bp->sp_task);
+- else
+- schedule_work(&bp->sp_task);
+-}
+-
+-static void bnxt_sched_reset(struct bnxt *bp, struct bnxt_rx_ring_info *rxr)
+-{
+- if (!rxr->bnapi->in_reset) {
+- rxr->bnapi->in_reset = true;
+- if (bp->flags & BNXT_FLAG_CHIP_P5)
+- set_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event);
+- else
+- set_bit(BNXT_RST_RING_SP_EVENT, &bp->sp_event);
+- bnxt_queue_sp_work(bp);
+- }
+- rxr->rx_next_cons = 0xffff;
+-}
+-
+ static u16 bnxt_alloc_agg_idx(struct bnxt_rx_ring_info *rxr, u16 agg_id)
+ {
+ struct bnxt_tpa_idx_map *map = rxr->rx_tpa_idx_map;
+@@ -1267,7 +1267,7 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
+ netdev_warn(bp->dev, "TPA cons %x, expected cons %x, error code %x\n",
+ cons, rxr->rx_next_cons,
+ TPA_START_ERROR_CODE(tpa_start1));
+- bnxt_sched_reset(bp, rxr);
++ bnxt_sched_reset_rxr(bp, rxr);
+ return;
+ }
+ /* Store cfa_code in tpa_info to use in tpa_end
+@@ -1785,7 +1785,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+ if (rxr->rx_next_cons != 0xffff)
+ netdev_warn(bp->dev, "RX cons %x != expected cons %x\n",
+ cons, rxr->rx_next_cons);
+- bnxt_sched_reset(bp, rxr);
++ bnxt_sched_reset_rxr(bp, rxr);
+ if (rc1)
+ return rc1;
+ goto next_rx_no_prod_no_len;
+@@ -1823,7 +1823,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+ !(bp->fw_cap & BNXT_FW_CAP_RING_MONITOR)) {
+ netdev_warn_once(bp->dev, "RX buffer error %x\n",
+ rx_err);
+- bnxt_sched_reset(bp, rxr);
++ bnxt_sched_reset_rxr(bp, rxr);
+ }
+ }
+ goto next_rx_no_len;
+@@ -2165,7 +2165,7 @@ static int bnxt_async_event_process(struct bnxt *bp,
+ goto async_event_process_exit;
+ }
+ rxr = bp->bnapi[grp_idx]->rx_ring;
+- bnxt_sched_reset(bp, rxr);
++ bnxt_sched_reset_rxr(bp, rxr);
+ goto async_event_process_exit;
+ }
+ default:
+--
+2.51.0
+
--- /dev/null
+From 62c4f6b80e47670ab41660ec7d07a76849199f8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 13:46:41 +0100
+Subject: HID: quirks: work around VID/PID conflict for appledisplay
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit c7fabe4ad9219866c203164a214c474c95b36bf2 ]
+
+For years I wondered why the Apple Cinema Display driver would not
+just work for me. Turns out the hidraw driver instantly takes it
+over. Fix by adding appledisplay VID/PIDs to hid_have_special_driver.
+
+Fixes: 069e8a65cd79 ("Driver for Apple Cinema Display")
+Signed-off-by: René Rebe <rene@exactco.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-quirks.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index ee99f5b3342da..0d15148d52533 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -220,6 +220,15 @@ static const struct hid_device_id hid_quirks[] = {
+ * used as a driver. See hid_scan_report().
+ */
+ static const struct hid_device_id hid_have_special_driver[] = {
++#if IS_ENABLED(CONFIG_APPLEDISPLAY)
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9218) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9219) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x921c) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x921d) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9222) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9226) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9236) },
++#endif
+ #if IS_ENABLED(CONFIG_HID_A4TECH)
+ { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
+--
+2.51.0
+
--- /dev/null
+From a4166883a8d0eb393bad0fd89d35fd73d0fd0707 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 14:31:45 +0800
+Subject: inet: ping: Fix icmp out counting
+
+From: yuan.gao <yuan.gao@ucloud.cn>
+
+[ Upstream commit 4c0856c225b39b1def6c9a6bc56faca79550da13 ]
+
+When the ping program uses an IPPROTO_ICMP socket to send ICMP_ECHO
+messages, ICMP_MIB_OUTMSGS is counted twice.
+
+ ping_v4_sendmsg
+ ping_v4_push_pending_frames
+ ip_push_pending_frames
+ ip_finish_skb
+ __ip_make_skb
+ icmp_out_count(net, icmp_type); // first count
+ icmp_out_count(sock_net(sk), user_icmph.type); // second count
+
+However, when the ping program uses an IPPROTO_RAW socket,
+ICMP_MIB_OUTMSGS is counted correctly only once.
+
+Therefore, the first count should be removed.
+
+Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
+Signed-off-by: yuan.gao <yuan.gao@ucloud.cn>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Tested-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20251224063145.3615282-1-yuan.gao@ucloud.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ping.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 1bad851b3fc35..69612770006e2 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -842,10 +842,8 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ out_free:
+ if (free)
+ kfree(ipc.opt);
+- if (!err) {
+- icmp_out_count(sock_net(sk), user_icmph.type);
++ if (!err)
+ return len;
+- }
+ return err;
+
+ do_confirm:
+--
+2.51.0
+
--- /dev/null
+From 4a80d214030ae0ea9b91e26b522bee93e25df321 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Dec 2025 15:27:16 +0200
+Subject: net/mlx5e: Don't print error message due to invalid module
+
+From: Gal Pressman <gal@nvidia.com>
+
+[ Upstream commit 144297e2a24e3e54aee1180ec21120ea38822b97 ]
+
+Dumping module EEPROM on newer modules is supported through the netlink
+interface only.
+
+Querying with old userspace ethtool (or other tools, such as 'lshw')
+which still uses the ioctl interface results in an error message that
+could flood dmesg (in addition to the expected error return value).
+The original message was added under the assumption that the driver
+should be able to handle all module types, but now that such flows are
+easily triggered from userspace, it doesn't serve its purpose.
+
+Change the log level of the print in mlx5_query_module_eeprom() to
+debug.
+
+Fixes: bb64143eee8c ("net/mlx5e: Add ethtool support for dump module EEPROM")
+Signed-off-by: Gal Pressman <gal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Link: https://patch.msgid.link/20251225132717.358820-5-mbloch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/port.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+index 4bb219565c58e..b62c3514ddf14 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+@@ -381,7 +381,8 @@ int mlx5_query_module_eeprom(struct mlx5_core_dev *dev,
+ mlx5_qsfp_eeprom_params_set(&i2c_addr, &page_num, &offset);
+ break;
+ default:
+- mlx5_core_err(dev, "Module ID not recognized: 0x%x\n", module_id);
++ mlx5_core_dbg(dev, "Module ID not recognized: 0x%x\n",
++ module_id);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f4aededb0e3888475188bf6fd4fa2d0719014557 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 20:41:00 -0700
+Subject: net/sched: sch_qfq: Fix NULL deref when deactivating inactive
+ aggregate in qfq_reset
+
+From: Xiang Mei <xmei5@asu.edu>
+
+[ Upstream commit c1d73b1480235731e35c81df70b08f4714a7d095 ]
+
+`qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class
+itself is active.
+
+Two qfq_class objects may point to the same leaf_qdisc. This happens
+when:
+
+1. one QFQ qdisc is attached to the dev as the root qdisc, and
+
+2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()
+/ qdisc_put()) and is pending to be destroyed, as in function
+tc_new_tfilter.
+
+When packets are enqueued through the root QFQ qdisc, the shared
+leaf_qdisc->q.qlen increases. At the same time, the second QFQ
+qdisc triggers qdisc_put and qdisc_destroy: the qdisc enters
+qfq_reset() with its own q->q.qlen == 0, but its class's leaf
+qdisc->q.qlen > 0. Therefore, the qfq_reset would wrongly deactivate
+an inactive aggregate and trigger a null-deref in qfq_deactivate_agg:
+
+[ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[ 0.903571] #PF: supervisor write access in kernel mode
+[ 0.903860] #PF: error_code(0x0002) - not-present page
+[ 0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0
+[ 0.904502] Oops: Oops: 0002 [#1] SMP NOPTI
+[ 0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE
+[ 0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
+[ 0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))
+[ 0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0
+
+Code starting with the faulting instruction
+===========================================
+ 0: 0f 84 4d 01 00 00 je 0x153
+ 6: 48 89 70 18 mov %rsi,0x18(%rax)
+ a: 8b 4b 10 mov 0x10(%rbx),%ecx
+ d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx
+ 14: 48 8b 78 08 mov 0x8(%rax),%rdi
+ 18: 48 d3 e2 shl %cl,%rdx
+ 1b: 48 21 f2 and %rsi,%rdx
+ 1e: 48 2b 13 sub (%rbx),%rdx
+ 21: 48 8b 30 mov (%rax),%rsi
+ 24: 48 d3 ea shr %cl,%rdx
+ 27: 8b 4b 18 mov 0x18(%rbx),%ecx
+ ...
+[ 0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246
+[ 0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000
+[ 0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+[ 0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000
+[ 0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000
+[ 0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880
+[ 0.909179] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000
+[ 0.909572] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0
+[ 0.910247] PKRU: 55555554
+[ 0.910391] Call Trace:
+[ 0.910527] <TASK>
+[ 0.910638] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)
+[ 0.910826] qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)
+[ 0.911040] __qdisc_destroy (net/sched/sch_generic.c:1076)
+[ 0.911236] tc_new_tfilter (net/sched/cls_api.c:2447)
+[ 0.911447] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)
+[ 0.911663] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)
+[ 0.911894] netlink_rcv_skb (net/netlink/af_netlink.c:2550)
+[ 0.912100] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)
+[ 0.912296] ? __alloc_skb (net/core/skbuff.c:706)
+[ 0.912484] netlink_sendmsg (net/netlink/af_netlink.c:1894)
+[ 0.912682] sock_write_iter (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1) net/socket.c:1195 (discriminator 1))
+[ 0.912880] vfs_write (fs/read_write.c:593 fs/read_write.c:686)
+[ 0.913077] ksys_write (fs/read_write.c:738)
+[ 0.913252] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
+[ 0.913438] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)
+[ 0.913687] RIP: 0033:0x424c34
+[ 0.913844] Code: 89 02 48 c7 c0 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d 2d 44 09 00 00 74 13 b8 01 00 00 00 0f 05 9
+
+Code starting with the faulting instruction
+===========================================
+ 0: 89 02 mov %eax,(%rdx)
+ 2: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
+ 9: eb bd jmp 0xffffffffffffffc8
+ b: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
+ 12: 00 00 00
+ 15: 90 nop
+ 16: f3 0f 1e fa endbr64
+ 1a: 80 3d 2d 44 09 00 00 cmpb $0x0,0x9442d(%rip) # 0x9444e
+ 21: 74 13 je 0x36
+ 23: b8 01 00 00 00 mov $0x1,%eax
+ 28: 0f 05 syscall
+ 2a: 09 .byte 0x9
+[ 0.914807] RSP: 002b:00007ffea1938b78 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
+[ 0.915197] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000424c34
+[ 0.915556] RDX: 000000000000003c RSI: 000000002af378c0 RDI: 0000000000000003
+[ 0.915912] RBP: 00007ffea1938bc0 R08: 00000000004b8820 R09: 0000000000000000
+[ 0.916297] R10: 0000000000000001 R11: 0000000000000202 R12: 00007ffea1938d28
+[ 0.916652] R13: 00007ffea1938d38 R14: 00000000004b3828 R15: 0000000000000001
+[ 0.917039] </TASK>
+[ 0.917158] Modules linked in:
+[ 0.917316] CR2: 0000000000000000
+[ 0.917484] ---[ end trace 0000000000000000 ]---
+[ 0.917717] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))
+[ 0.917978] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0
+
+Code starting with the faulting instruction
+===========================================
+ 0: 0f 84 4d 01 00 00 je 0x153
+ 6: 48 89 70 18 mov %rsi,0x18(%rax)
+ a: 8b 4b 10 mov 0x10(%rbx),%ecx
+ d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx
+ 14: 48 8b 78 08 mov 0x8(%rax),%rdi
+ 18: 48 d3 e2 shl %cl,%rdx
+ 1b: 48 21 f2 and %rsi,%rdx
+ 1e: 48 2b 13 sub (%rbx),%rdx
+ 21: 48 8b 30 mov (%rax),%rsi
+ 24: 48 d3 ea shr %cl,%rdx
+ 27: 8b 4b 18 mov 0x18(%rbx),%ecx
+ ...
+[ 0.918902] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246
+[ 0.919198] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000
+[ 0.919559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+[ 0.919908] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000
+[ 0.920289] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000
+[ 0.920648] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880
+[ 0.921014] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000
+[ 0.921424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 0.921710] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0
+[ 0.922097] PKRU: 55555554
+[ 0.922240] Kernel panic - not syncing: Fatal exception
+[ 0.922590] Kernel Offset: disabled
+
+Fixes: 0545a3037773 ("pkt_sched: QFQ - quick fair queue scheduler")
+Signed-off-by: Xiang Mei <xmei5@asu.edu>
+Link: https://patch.msgid.link/20260106034100.1780779-1-xmei5@asu.edu
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_qfq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index 3d793ace2b5bf..34a6c4ec9a157 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -1490,7 +1490,7 @@ static void qfq_reset_qdisc(struct Qdisc *sch)
+
+ for (i = 0; i < q->clhash.hashsize; i++) {
+ hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
+- if (cl->qdisc->q.qlen > 0)
++ if (cl_is_active(cl))
+ qfq_deactivate_class(q, cl);
+
+ qdisc_reset(cl->qdisc);
+--
+2.51.0
+
--- /dev/null
+From 46c458c2af8b79d14a42a5978652132a5c3f13ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 04:35:35 +0800
+Subject: net: sock: fix hardened usercopy panic in sock_recv_errqueue
+
+From: Weiming Shi <bestswngs@gmail.com>
+
+[ Upstream commit 2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20 ]
+
+skbuff_fclone_cache was created without defining a usercopy region,
+[1] unlike skbuff_head_cache which properly whitelists the cb[] field.
+[2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is
+enabled and the kernel attempts to copy sk_buff.cb data to userspace
+via sock_recv_errqueue() -> put_cmsg().
+
+The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone()
+ (from skbuff_fclone_cache) [1]
+2. The skb is cloned via skb_clone() using the pre-allocated fclone
+[3] 3. The cloned skb is queued to sk_error_queue for timestamp
+reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE)
+5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb
+[4] 6. __check_heap_object() fails because skbuff_fclone_cache has no
+ usercopy whitelist [5]
+
+When cloned skbs allocated from skbuff_fclone_cache are used in the
+socket error queue, accessing the sock_exterr_skb structure in skb->cb
+via put_cmsg() triggers a usercopy hardening violation:
+
+[ 5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' (offset 296, size 16)!
+[ 5.382796] kernel BUG at mm/usercopy.c:102!
+[ 5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
+[ 5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7
+[ 5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
+[ 5.384903] RIP: 0010:usercopy_abort+0x6c/0x80
+[ 5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff <0f> 0b 490
+[ 5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246
+[ 5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74
+[ 5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0
+[ 5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74
+[ 5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001
+[ 5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00
+[ 5.384903] FS: 0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000
+[ 5.384903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0
+[ 5.384903] PKRU: 55555554
+[ 5.384903] Call Trace:
+[ 5.384903] <TASK>
+[ 5.384903] __check_heap_object+0x9a/0xd0
+[ 5.384903] __check_object_size+0x46c/0x690
+[ 5.384903] put_cmsg+0x129/0x5e0
+[ 5.384903] sock_recv_errqueue+0x22f/0x380
+[ 5.384903] tls_sw_recvmsg+0x7ed/0x1960
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5.384903] ? schedule+0x6d/0x270
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5.384903] ? mutex_unlock+0x81/0xd0
+[ 5.384903] ? __pfx_mutex_unlock+0x10/0x10
+[ 5.384903] ? __pfx_tls_sw_recvmsg+0x10/0x10
+[ 5.384903] ? _raw_spin_lock_irqsave+0x8f/0xf0
+[ 5.384903] ? _raw_read_unlock_irqrestore+0x20/0x40
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+
+The crash offset 296 corresponds to skb2->cb within skbuff_fclones:
+ - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 -
+ offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 =
+ 272 + 24 (inside sock_exterr_skb.ee)
+
+This patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure.
+
+[1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885
+[2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104
+[3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566
+[4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491
+[5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719
+
+Fixes: 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0")
+Reported-by: Xiang Mei <xmei5@asu.edu>
+Signed-off-by: Weiming Shi <bestswngs@gmail.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20251223203534.1392218-2-bestswngs@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 6c93381cf0bdf..963ea323362ad 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3226,7 +3226,7 @@ void sock_enable_timestamp(struct sock *sk, enum sock_flags flag)
+ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+ int level, int type)
+ {
+- struct sock_exterr_skb *serr;
++ struct sock_extended_err ee;
+ struct sk_buff *skb;
+ int copied, err;
+
+@@ -3246,8 +3246,9 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+
+ sock_recv_timestamp(msg, sk, skb);
+
+- serr = SKB_EXT_ERR(skb);
+- put_cmsg(msg, level, type, sizeof(serr->ee), &serr->ee);
++ /* We must use a bounce buffer for CONFIG_HARDENED_USERCOPY=y */
++ ee = SKB_EXT_ERR(skb)->ee;
++ put_cmsg(msg, level, type, sizeof(ee), &ee);
+
+ msg->msg_flags |= MSG_ERRQUEUE;
+ err = copied;
+--
+2.51.0
+
--- /dev/null
+From e3d41f35738fab35a7cfc6ab3ace5ac87126c4a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 10:48:21 +0200
+Subject: net: usb: pegasus: fix memory leak in update_eth_regs_async()
+
+From: Petko Manolov <petkan@nucleusys.com>
+
+[ Upstream commit afa27621a28af317523e0836dad430bec551eb54 ]
+
+When asynchronously writing to the device registers and if usb_submit_urb()
+fail, the code fail to release allocated to this point resources.
+
+Fixes: 323b34963d11 ("drivers: net: usb: pegasus: fix control urb submission")
+Signed-off-by: Petko Manolov <petkan@nucleusys.com>
+Link: https://patch.msgid.link/20260106084821.3746677-1-petko.manolov@konsulko.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/pegasus.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
+index 138279bbb544b..e3ddb990dc543 100644
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -193,6 +193,8 @@ static int update_eth_regs_async(pegasus_t *pegasus)
+ netif_device_detach(pegasus->net);
+ netif_err(pegasus, drv, pegasus->net,
+ "%s returned %d\n", __func__, ret);
++ usb_free_urb(async_urb);
++ kfree(req);
+ }
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 8a21fbac7d2a39b023eb4cf3a544f2ba5d99387a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 09:22:24 +0800
+Subject: netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
+
+From: Di Zhu <zhud@hygon.cn>
+
+[ Upstream commit 02d1e1a3f9239cdb3ecf2c6d365fb959d1bf39df ]
+
+Directly increment the TSO features incurs a side effect: it will also
+directly clear the flags in NETIF_F_ALL_FOR_ALL on the master device,
+which can cause issues such as the inability to enable the nocache copy
+feature on the bonding driver.
+
+The fix is to include NETIF_F_ALL_FOR_ALL in the update mask, thereby
+preventing it from being cleared.
+
+Fixes: b0ce3508b25e ("bonding: allow TSO being set on bonding master")
+Signed-off-by: Di Zhu <zhud@hygon.cn>
+Link: https://patch.msgid.link/20251224012224.56185-1-zhud@hygon.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netdevice.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index c9f2a88a6c83e..934ecac171ccb 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -4894,7 +4894,8 @@ netdev_features_t netdev_increment_features(netdev_features_t all,
+ static inline netdev_features_t netdev_add_tso_features(netdev_features_t features,
+ netdev_features_t mask)
+ {
+- return netdev_increment_features(features, NETIF_F_ALL_TSO, mask);
++ return netdev_increment_features(features, NETIF_F_ALL_TSO |
++ NETIF_F_ALL_FOR_ALL, mask);
+ }
+
+ int __netdev_update_features(struct net_device *dev);
+--
+2.51.0
+
--- /dev/null
+From 12cb49a5aa40d8fde99f00b5fb95bf50da42a90c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 15:46:40 +0100
+Subject: netfilter: nf_conncount: update last_gc only when GC has been
+ performed
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 7811ba452402d58628e68faedf38745b3d485e3c ]
+
+Currently last_gc is being updated everytime a new connection is
+tracked, that means that it is updated even if a GC wasn't performed.
+With a sufficiently high packet rate, it is possible to always bypass
+the GC, causing the list to grow infinitely.
+
+Update the last_gc value only when a GC has been actually performed.
+
+Fixes: d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conncount.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
+index c00b8e522c5a7..a2c5a7ba0c6fc 100644
+--- a/net/netfilter/nf_conncount.c
++++ b/net/netfilter/nf_conncount.c
+@@ -229,6 +229,7 @@ static int __nf_conncount_add(struct net *net,
+
+ nf_ct_put(found_ct);
+ }
++ list->last_gc = (u32)jiffies;
+
+ add_new_node:
+ if (WARN_ON_ONCE(list->count > INT_MAX)) {
+@@ -248,7 +249,6 @@ static int __nf_conncount_add(struct net *net,
+ conn->jiffies32 = (u32)jiffies;
+ list_add_tail(&conn->node, &list->head);
+ list->count++;
+- list->last_gc = (u32)jiffies;
+
+ out_put:
+ if (refcounted)
+--
+2.51.0
+
--- /dev/null
+From be5f9053e8de84b294bf60adbbb9298ff8809459 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 21:21:59 +0100
+Subject: netfilter: nft_synproxy: avoid possible data-race on update operation
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 36a3200575642846a96436d503d46544533bb943 ]
+
+During nft_synproxy eval we are reading nf_synproxy_info struct which
+can be modified on update operation concurrently. As nf_synproxy_info
+struct fits in 32 bits, use READ_ONCE/WRITE_ONCE annotations.
+
+Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_synproxy.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
+index 0806813d3a767..46d2eefb0b218 100644
+--- a/net/netfilter/nft_synproxy.c
++++ b/net/netfilter/nft_synproxy.c
+@@ -48,7 +48,7 @@ static void nft_synproxy_eval_v4(const struct nft_synproxy *priv,
+ struct tcphdr *_tcph,
+ struct synproxy_options *opts)
+ {
+- struct nf_synproxy_info info = priv->info;
++ struct nf_synproxy_info info = READ_ONCE(priv->info);
+ struct net *net = nft_net(pkt);
+ struct synproxy_net *snet = synproxy_pernet(net);
+ struct sk_buff *skb = pkt->skb;
+@@ -79,7 +79,7 @@ static void nft_synproxy_eval_v6(const struct nft_synproxy *priv,
+ struct tcphdr *_tcph,
+ struct synproxy_options *opts)
+ {
+- struct nf_synproxy_info info = priv->info;
++ struct nf_synproxy_info info = READ_ONCE(priv->info);
+ struct net *net = nft_net(pkt);
+ struct synproxy_net *snet = synproxy_pernet(net);
+ struct sk_buff *skb = pkt->skb;
+@@ -339,7 +339,7 @@ static void nft_synproxy_obj_update(struct nft_object *obj,
+ struct nft_synproxy *newpriv = nft_obj_data(newobj);
+ struct nft_synproxy *priv = nft_obj_data(obj);
+
+- priv->info = newpriv->info;
++ WRITE_ONCE(priv->info, newpriv->info);
+ }
+
+ static struct nft_object_type nft_synproxy_obj_type;
+--
+2.51.0
+
nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch
scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch
scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch
+arm-dts-imx6q-ba16-fix-rtc-interrupt-level.patch
+netfilter-nft_synproxy-avoid-possible-data-race-on-u.patch
+netfilter-nf_conncount-update-last_gc-only-when-gc-h.patch
+bridge-fix-c-vlan-preservation-in-802.1ad-vlan_tunne.patch
+inet-ping-fix-icmp-out-counting.patch
+net-sock-fix-hardened-usercopy-panic-in-sock_recv_er.patch
+netdev-preserve-netif_f_all_for_all-across-tso-updat.patch
+net-mlx5e-don-t-print-error-message-due-to-invalid-m.patch
+eth-bnxt-move-and-rename-reset-helpers.patch
+bnxt_en-fix-potential-data-corruption-with-hw-gro-lr.patch
+hid-quirks-work-around-vid-pid-conflict-for-appledis.patch
+net-sched-sch_qfq-fix-null-deref-when-deactivating-i.patch
+net-usb-pegasus-fix-memory-leak-in-update_eth_regs_a.patch
+arp-do-not-assume-dev_hard_header-does-not-change-sk.patch
--- /dev/null
+From 6831a40624109e2ca70ae09f874707a466e607bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 11:56:05 +0200
+Subject: ARM: dts: imx6q-ba16: fix RTC interrupt level
+
+From: Ian Ray <ian.ray@gehealthcare.com>
+
+[ Upstream commit e6a4eedd49ce27c16a80506c66a04707e0ee0116 ]
+
+RTC interrupt level should be set to "LOW". This was revealed by the
+introduction of commit:
+
+ f181987ef477 ("rtc: m41t80: use IRQ flags obtained from fwnode")
+
+which changed the way IRQ type is obtained.
+
+Fixes: 56c27310c1b4 ("ARM: dts: imx: Add Advantech BA-16 Qseven module")
+Signed-off-by: Ian Ray <ian.ray@gehealthcare.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6q-ba16.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6q-ba16.dtsi b/arch/arm/boot/dts/imx6q-ba16.dtsi
+index f266f1b7e0cfc..0c033e69ecc04 100644
+--- a/arch/arm/boot/dts/imx6q-ba16.dtsi
++++ b/arch/arm/boot/dts/imx6q-ba16.dtsi
+@@ -335,7 +335,7 @@ rtc@32 {
+ pinctrl-0 = <&pinctrl_rtc>;
+ reg = <0x32>;
+ interrupt-parent = <&gpio4>;
+- interrupts = <10 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <10 IRQ_TYPE_LEVEL_LOW>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From bd8027fac0a636ee75d358332811215037452d85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 11:22:40 +0800
+Subject: arm64: dts: add off-on-delay-us for usdhc2 regulator
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+[ Upstream commit ca643894a37a25713029b36cfe7d1bae515cac08 ]
+
+For SD card, according to the spec requirement, for sd card power reset
+operation, it need sd card supply voltage to be lower than 0.5v and keep
+over 1ms, otherwise, next time power back the sd card supply voltage to
+3.3v, sd card can't support SD3.0 mode again.
+
+To match such requirement on imx8qm-mek board, add 4.8ms delay between
+sd power off and power on.
+
+Fixes: 307fd14d4b14 ("arm64: dts: imx: add imx8qm mek support")
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+index 470e4e4aa8c78..059f8c0ab93d9 100644
+--- a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
++++ b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+@@ -34,6 +34,7 @@ reg_usdhc2_vmmc: usdhc2-vmmc {
+ regulator-max-microvolt = <3000000>;
+ gpio = <&lsio_gpio4 7 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
++ off-on-delay-us = <4800>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From bc0b3b19633cfd208732fc1d7106c00da7c7a5bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 21:22:50 +0000
+Subject: arp: do not assume dev_hard_header() does not change skb->head
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit c92510f5e3f82ba11c95991824a41e59a9c5ed81 ]
+
+arp_create() is the only dev_hard_header() caller
+making assumption about skb->head being unchanged.
+
+A recent commit broke this assumption.
+
+Initialize @arp pointer after dev_hard_header() call.
+
+Fixes: db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust")
+Reported-by: syzbot+58b44a770a1585795351@syzkaller.appspotmail.com
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260107212250.384552-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/arp.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
+index ef69321886798..5a76164980344 100644
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -542,7 +542,7 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
+
+ skb_reserve(skb, hlen);
+ skb_reset_network_header(skb);
+- arp = skb_put(skb, arp_hdr_len(dev));
++ skb_put(skb, arp_hdr_len(dev));
+ skb->dev = dev;
+ skb->protocol = htons(ETH_P_ARP);
+ if (!src_hw)
+@@ -550,12 +550,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
+ if (!dest_hw)
+ dest_hw = dev->broadcast;
+
+- /*
+- * Fill the device header for the ARP frame
++ /* Fill the device header for the ARP frame.
++ * Note: skb->head can be changed.
+ */
+ if (dev_hard_header(skb, dev, ptype, dest_hw, src_hw, skb->len) < 0)
+ goto out;
+
++ arp = arp_hdr(skb);
+ /*
+ * Fill out the arp protocol part.
+ *
+--
+2.51.0
+
--- /dev/null
+From 920a281106a803876690e6adc5222ca484ab6f1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Dec 2025 00:36:25 -0800
+Subject: bnxt_en: Fix potential data corruption with HW GRO/LRO
+
+From: Srijit Bose <srijit.bose@broadcom.com>
+
+[ Upstream commit ffeafa65b2b26df2f5b5a6118d3174f17bd12ec5 ]
+
+Fix the max number of bits passed to find_first_zero_bit() in
+bnxt_alloc_agg_idx(). We were incorrectly passing the number of
+long words. find_first_zero_bit() may fail to find a zero bit and
+cause a wrong ID to be used. If the wrong ID is already in use, this
+can cause data corruption. Sometimes an error like this can also be
+seen:
+
+bnxt_en 0000:83:00.0 enp131s0np0: TPA end agg_buf 2 != expected agg_bufs 1
+
+Fix it by passing the correct number of bits MAX_TPA_P5. Use
+DECLARE_BITMAP() to more cleanly define the bitmap. Add a sanity
+check to warn if a bit cannot be found and reset the ring [MChan].
+
+Fixes: ec4d8e7cf024 ("bnxt_en: Add TPA ID mapping logic for 57500 chips.")
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Srijit Bose <srijit.bose@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20251231083625.3911652-1-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 15 ++++++++++++---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 +---
+ 2 files changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 90719916184db..74344722d63d1 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1264,9 +1264,11 @@ static u16 bnxt_alloc_agg_idx(struct bnxt_rx_ring_info *rxr, u16 agg_id)
+ struct bnxt_tpa_idx_map *map = rxr->rx_tpa_idx_map;
+ u16 idx = agg_id & MAX_TPA_P5_MASK;
+
+- if (test_bit(idx, map->agg_idx_bmap))
+- idx = find_first_zero_bit(map->agg_idx_bmap,
+- BNXT_AGG_IDX_BMAP_SIZE);
++ if (test_bit(idx, map->agg_idx_bmap)) {
++ idx = find_first_zero_bit(map->agg_idx_bmap, MAX_TPA_P5);
++ if (idx >= MAX_TPA_P5)
++ return INVALID_HW_RING_ID;
++ }
+ __set_bit(idx, map->agg_idx_bmap);
+ map->agg_id_tbl[agg_id] = idx;
+ return idx;
+@@ -1299,6 +1301,13 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
+ if (bp->flags & BNXT_FLAG_CHIP_P5) {
+ agg_id = TPA_START_AGG_ID_P5(tpa_start);
+ agg_id = bnxt_alloc_agg_idx(rxr, agg_id);
++ if (unlikely(agg_id == INVALID_HW_RING_ID)) {
++ netdev_warn(bp->dev, "Unable to allocate agg ID for ring %d, agg 0x%x\n",
++ rxr->bnapi->index,
++ TPA_START_AGG_ID_P5(tpa_start));
++ bnxt_sched_reset_rxr(bp, rxr);
++ return;
++ }
+ } else {
+ agg_id = TPA_START_AGG_ID(tpa_start);
+ }
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index ae4695fc067d5..56aae0d654e8a 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -872,11 +872,9 @@ struct bnxt_tpa_info {
+ struct rx_agg_cmp *agg_arr;
+ };
+
+-#define BNXT_AGG_IDX_BMAP_SIZE (MAX_TPA_P5 / BITS_PER_LONG)
+-
+ struct bnxt_tpa_idx_map {
+ u16 agg_id_tbl[1024];
+- unsigned long agg_idx_bmap[BNXT_AGG_IDX_BMAP_SIZE];
++ DECLARE_BITMAP(agg_idx_bmap, MAX_TPA_P5);
+ };
+
+ struct bnxt_rx_ring_info {
+--
+2.51.0
+
--- /dev/null
+From 9f311baaf054db58126358aa11c0440ea59c0f37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Dec 2025 03:00:57 +0100
+Subject: bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
+
+From: Alexandre Knecht <knecht.alexandre@gmail.com>
+
+[ Upstream commit 3128df6be147768fe536986fbb85db1d37806a9f ]
+
+When using an 802.1ad bridge with vlan_tunnel, the C-VLAN tag is
+incorrectly stripped from frames during egress processing.
+
+br_handle_egress_vlan_tunnel() uses skb_vlan_pop() to remove the S-VLAN
+from hwaccel before VXLAN encapsulation. However, skb_vlan_pop() also
+moves any "next" VLAN from the payload into hwaccel:
+
+ /* move next vlan tag to hw accel tag */
+ __skb_vlan_pop(skb, &vlan_tci);
+ __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);
+
+For QinQ frames where the C-VLAN sits in the payload, this moves it to
+hwaccel where it gets lost during VXLAN encapsulation.
+
+Fix by calling __vlan_hwaccel_clear_tag() directly, which clears only
+the hwaccel S-VLAN and leaves the payload untouched.
+
+This path is only taken when vlan_tunnel is enabled and tunnel_info
+is configured, so 802.1Q bridges are unaffected.
+
+Tested with 802.1ad bridge + VXLAN vlan_tunnel, verified C-VLAN
+preserved in VXLAN payload via tcpdump.
+
+Fixes: 11538d039ac6 ("bridge: vlan dst_metadata hooks in ingress and egress paths")
+Signed-off-by: Alexandre Knecht <knecht.alexandre@gmail.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20251228020057.2788865-1-knecht.alexandre@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_vlan_tunnel.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/net/bridge/br_vlan_tunnel.c b/net/bridge/br_vlan_tunnel.c
+index 6399a8a69d076..0f03572d89d09 100644
+--- a/net/bridge/br_vlan_tunnel.c
++++ b/net/bridge/br_vlan_tunnel.c
+@@ -187,7 +187,6 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,
+ {
+ struct metadata_dst *tunnel_dst;
+ __be64 tunnel_id;
+- int err;
+
+ if (!vlan)
+ return 0;
+@@ -197,9 +196,13 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,
+ return 0;
+
+ skb_dst_drop(skb);
+- err = skb_vlan_pop(skb);
+- if (err)
+- return err;
++ /* For 802.1ad (QinQ), skb_vlan_pop() incorrectly moves the C-VLAN
++ * from payload to hwaccel after clearing S-VLAN. We only need to
++ * clear the hwaccel S-VLAN; the C-VLAN must stay in payload for
++ * correct VXLAN encapsulation. This is also correct for 802.1Q
++ * where no C-VLAN exists in payload.
++ */
++ __vlan_hwaccel_clear_tag(skb);
+
+ tunnel_dst = rcu_dereference(vlan->tinfo.tunnel_dst);
+ if (tunnel_dst && dst_hold_safe(&tunnel_dst->dst))
+--
+2.51.0
+
--- /dev/null
+From 219494c191eae84237e4ff72a7fa91efd3f19250 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jul 2023 18:04:38 -0700
+Subject: eth: bnxt: move and rename reset helpers
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit fea2993aecd74d5d11ede1ebbd60e478ebfed996 ]
+
+Move the reset helpers, subsequent patches will need some
+of them on the Tx path.
+
+While at it rename bnxt_sched_reset(), on more recent chips
+it schedules a queue reset, instead of a fuller reset.
+
+Link: https://lore.kernel.org/r/20230720010440.1967136-2-kuba@kernel.org
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: ffeafa65b2b2 ("bnxt_en: Fix potential data corruption with HW GRO/LRO")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 72 +++++++++++------------
+ 1 file changed, 36 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 127f7d238a041..90719916184db 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -340,6 +340,38 @@ static void bnxt_db_cq(struct bnxt *bp, struct bnxt_db_info *db, u32 idx)
+ BNXT_DB_CQ(db, idx);
+ }
+
++static void bnxt_queue_fw_reset_work(struct bnxt *bp, unsigned long delay)
++{
++ if (!(test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)))
++ return;
++
++ if (BNXT_PF(bp))
++ queue_delayed_work(bnxt_pf_wq, &bp->fw_reset_task, delay);
++ else
++ schedule_delayed_work(&bp->fw_reset_task, delay);
++}
++
++static void bnxt_queue_sp_work(struct bnxt *bp)
++{
++ if (BNXT_PF(bp))
++ queue_work(bnxt_pf_wq, &bp->sp_task);
++ else
++ schedule_work(&bp->sp_task);
++}
++
++static void bnxt_sched_reset_rxr(struct bnxt *bp, struct bnxt_rx_ring_info *rxr)
++{
++ if (!rxr->bnapi->in_reset) {
++ rxr->bnapi->in_reset = true;
++ if (bp->flags & BNXT_FLAG_CHIP_P5)
++ set_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event);
++ else
++ set_bit(BNXT_RST_RING_SP_EVENT, &bp->sp_event);
++ bnxt_queue_sp_work(bp);
++ }
++ rxr->rx_next_cons = 0xffff;
++}
++
+ const u16 bnxt_lhint_arr[] = {
+ TX_BD_FLAGS_LHINT_512_AND_SMALLER,
+ TX_BD_FLAGS_LHINT_512_TO_1023,
+@@ -1227,38 +1259,6 @@ static int bnxt_discard_rx(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+ return 0;
+ }
+
+-static void bnxt_queue_fw_reset_work(struct bnxt *bp, unsigned long delay)
+-{
+- if (!(test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)))
+- return;
+-
+- if (BNXT_PF(bp))
+- queue_delayed_work(bnxt_pf_wq, &bp->fw_reset_task, delay);
+- else
+- schedule_delayed_work(&bp->fw_reset_task, delay);
+-}
+-
+-static void bnxt_queue_sp_work(struct bnxt *bp)
+-{
+- if (BNXT_PF(bp))
+- queue_work(bnxt_pf_wq, &bp->sp_task);
+- else
+- schedule_work(&bp->sp_task);
+-}
+-
+-static void bnxt_sched_reset(struct bnxt *bp, struct bnxt_rx_ring_info *rxr)
+-{
+- if (!rxr->bnapi->in_reset) {
+- rxr->bnapi->in_reset = true;
+- if (bp->flags & BNXT_FLAG_CHIP_P5)
+- set_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event);
+- else
+- set_bit(BNXT_RST_RING_SP_EVENT, &bp->sp_event);
+- bnxt_queue_sp_work(bp);
+- }
+- rxr->rx_next_cons = 0xffff;
+-}
+-
+ static u16 bnxt_alloc_agg_idx(struct bnxt_rx_ring_info *rxr, u16 agg_id)
+ {
+ struct bnxt_tpa_idx_map *map = rxr->rx_tpa_idx_map;
+@@ -1313,7 +1313,7 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
+ netdev_warn(bp->dev, "TPA cons %x, expected cons %x, error code %x\n",
+ cons, rxr->rx_next_cons,
+ TPA_START_ERROR_CODE(tpa_start1));
+- bnxt_sched_reset(bp, rxr);
++ bnxt_sched_reset_rxr(bp, rxr);
+ return;
+ }
+ /* Store cfa_code in tpa_info to use in tpa_end
+@@ -1835,7 +1835,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+ if (rxr->rx_next_cons != 0xffff)
+ netdev_warn(bp->dev, "RX cons %x != expected cons %x\n",
+ cons, rxr->rx_next_cons);
+- bnxt_sched_reset(bp, rxr);
++ bnxt_sched_reset_rxr(bp, rxr);
+ if (rc1)
+ return rc1;
+ goto next_rx_no_prod_no_len;
+@@ -1873,7 +1873,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+ !(bp->fw_cap & BNXT_FW_CAP_RING_MONITOR)) {
+ netdev_warn_once(bp->dev, "RX buffer error %x\n",
+ rx_err);
+- bnxt_sched_reset(bp, rxr);
++ bnxt_sched_reset_rxr(bp, rxr);
+ }
+ }
+ goto next_rx_no_len;
+@@ -2254,7 +2254,7 @@ static int bnxt_async_event_process(struct bnxt *bp,
+ goto async_event_process_exit;
+ }
+ rxr = bp->bnapi[grp_idx]->rx_ring;
+- bnxt_sched_reset(bp, rxr);
++ bnxt_sched_reset_rxr(bp, rxr);
+ goto async_event_process_exit;
+ }
+ case ASYNC_EVENT_CMPL_EVENT_ID_ECHO_REQUEST: {
+--
+2.51.0
+
--- /dev/null
+From bd612be26b1be7c0fec61e2f53966d45aa3f4d28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 13:46:41 +0100
+Subject: HID: quirks: work around VID/PID conflict for appledisplay
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit c7fabe4ad9219866c203164a214c474c95b36bf2 ]
+
+For years I wondered why the Apple Cinema Display driver would not
+just work for me. Turns out the hidraw driver instantly takes it
+over. Fix by adding appledisplay VID/PIDs to hid_have_special_driver.
+
+Fixes: 069e8a65cd79 ("Driver for Apple Cinema Display")
+Signed-off-by: René Rebe <rene@exactco.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-quirks.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 4b645db5cd4bc..cc2f462fced27 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -220,6 +220,15 @@ static const struct hid_device_id hid_quirks[] = {
+ * used as a driver. See hid_scan_report().
+ */
+ static const struct hid_device_id hid_have_special_driver[] = {
++#if IS_ENABLED(CONFIG_APPLEDISPLAY)
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9218) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9219) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x921c) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x921d) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9222) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9226) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9236) },
++#endif
+ #if IS_ENABLED(CONFIG_HID_A4TECH)
+ { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
+--
+2.51.0
+
--- /dev/null
+From bd74c49fa451bffb4afe1e6d8dae1a708fa8b004 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 14:31:45 +0800
+Subject: inet: ping: Fix icmp out counting
+
+From: yuan.gao <yuan.gao@ucloud.cn>
+
+[ Upstream commit 4c0856c225b39b1def6c9a6bc56faca79550da13 ]
+
+When the ping program uses an IPPROTO_ICMP socket to send ICMP_ECHO
+messages, ICMP_MIB_OUTMSGS is counted twice.
+
+ ping_v4_sendmsg
+ ping_v4_push_pending_frames
+ ip_push_pending_frames
+ ip_finish_skb
+ __ip_make_skb
+ icmp_out_count(net, icmp_type); // first count
+ icmp_out_count(sock_net(sk), user_icmph.type); // second count
+
+However, when the ping program uses an IPPROTO_RAW socket,
+ICMP_MIB_OUTMSGS is counted correctly only once.
+
+Therefore, the first count should be removed.
+
+Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
+Signed-off-by: yuan.gao <yuan.gao@ucloud.cn>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Tested-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20251224063145.3615282-1-yuan.gao@ucloud.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ping.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index c4a2565da2806..069ac54ef7565 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -844,10 +844,8 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ out_free:
+ if (free)
+ kfree(ipc.opt);
+- if (!err) {
+- icmp_out_count(sock_net(sk), user_icmph.type);
++ if (!err)
+ return len;
+- }
+ return err;
+
+ do_confirm:
+--
+2.51.0
+
--- /dev/null
+From b8ed79ae8a9d8bb8cbd55ea5558d3d88b7b13ac7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 17:12:04 +0800
+Subject: net: enetc: fix build warning when PAGE_SIZE is greater than 128K
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit 4b5bdabb5449b652122e43f507f73789041d4abe ]
+
+The max buffer size of ENETC RX BD is 0xFFFF bytes, so if the PAGE_SIZE
+is greater than 128K, ENETC_RXB_DMA_SIZE and ENETC_RXB_DMA_SIZE_XDP will
+be greater than 0xFFFF, thus causing a build warning.
+
+This will not cause any practical issues because ENETC is currently only
+used on the ARM64 platform, and the max PAGE_SIZE is 64K. So this patch
+is only for fixing the build warning that occurs when compiling ENETC
+drivers for other platforms.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202601050637.kHEKKOG7-lkp@intel.com/
+Fixes: e59bc32df2e9 ("net: enetc: correct the value of ENETC_RXB_TRUESIZE")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260107091204.1980222-1-wei.fang@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h
+index 40c8f0f026a5b..adcb53167d3f9 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc.h
++++ b/drivers/net/ethernet/freescale/enetc/enetc.h
+@@ -40,9 +40,9 @@ struct enetc_tx_swbd {
+ #define ENETC_RXB_TRUESIZE (PAGE_SIZE >> 1)
+ #define ENETC_RXB_PAD NET_SKB_PAD /* add extra space if needed */
+ #define ENETC_RXB_DMA_SIZE \
+- (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD)
++ min(SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD, 0xffff)
+ #define ENETC_RXB_DMA_SIZE_XDP \
+- (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - XDP_PACKET_HEADROOM)
++ min(SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - XDP_PACKET_HEADROOM, 0xffff)
+
+ struct enetc_rx_swbd {
+ dma_addr_t dma;
+--
+2.51.0
+
--- /dev/null
+From 909018b53bfb408a9c65141adedb114d41ebe4ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Dec 2025 21:21:18 -0800
+Subject: net: marvell: prestera: fix NULL dereference on devlink_alloc()
+ failure
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit a428e0da1248c353557970848994f35fd3f005e2 ]
+
+devlink_alloc() may return NULL on allocation failure, but
+prestera_devlink_alloc() unconditionally calls devlink_priv() on
+the returned pointer.
+
+This leads to a NULL pointer dereference if devlink allocation fails.
+Add a check for a NULL devlink pointer and return NULL early to avoid
+the crash.
+
+Fixes: 34dd1710f5a3 ("net: marvell: prestera: Add basic devlink support")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Acked-by: Elad Nachman <enachman@marvell.com>
+Link: https://patch.msgid.link/20251230052124.897012-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/prestera/prestera_devlink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/prestera/prestera_devlink.c b/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
+index 68b442eb6d694..59e865df6cee0 100644
+--- a/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
++++ b/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
+@@ -396,6 +396,8 @@ struct prestera_switch *prestera_devlink_alloc(struct prestera_device *dev)
+
+ dl = devlink_alloc(&prestera_dl_ops, sizeof(struct prestera_switch),
+ dev->dev);
++ if (!dl)
++ return NULL;
+
+ return devlink_priv(dl);
+ }
+--
+2.51.0
+
--- /dev/null
+From cd162fd20d1ab3a7291fa922314bb4017e815d08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Dec 2025 15:27:16 +0200
+Subject: net/mlx5e: Don't print error message due to invalid module
+
+From: Gal Pressman <gal@nvidia.com>
+
+[ Upstream commit 144297e2a24e3e54aee1180ec21120ea38822b97 ]
+
+Dumping module EEPROM on newer modules is supported through the netlink
+interface only.
+
+Querying with old userspace ethtool (or other tools, such as 'lshw')
+which still uses the ioctl interface results in an error message that
+could flood dmesg (in addition to the expected error return value).
+The original message was added under the assumption that the driver
+should be able to handle all module types, but now that such flows are
+easily triggered from userspace, it doesn't serve its purpose.
+
+Change the log level of the print in mlx5_query_module_eeprom() to
+debug.
+
+Fixes: bb64143eee8c ("net/mlx5e: Add ethtool support for dump module EEPROM")
+Signed-off-by: Gal Pressman <gal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Link: https://patch.msgid.link/20251225132717.358820-5-mbloch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/port.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+index fd79860de723b..fdf708d642887 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+@@ -414,7 +414,8 @@ int mlx5_query_module_eeprom(struct mlx5_core_dev *dev,
+ mlx5_qsfp_eeprom_params_set(&query.i2c_address, &query.page, &offset);
+ break;
+ default:
+- mlx5_core_err(dev, "Module ID not recognized: 0x%x\n", module_id);
++ mlx5_core_dbg(dev, "Module ID not recognized: 0x%x\n",
++ module_id);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 48a02c2b3dd668a4db240f9dab4f6ff01cf3e7ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Dec 2025 20:36:17 +0000
+Subject: net: mscc: ocelot: Fix crash when adding interface under a lag
+
+From: Jerry Wu <w.7erry@foxmail.com>
+
+[ Upstream commit 34f3ff52cb9fa7dbf04f5c734fcc4cb6ed5d1a95 ]
+
+Commit 15faa1f67ab4 ("lan966x: Fix crash when adding interface under a lag")
+fixed a similar issue in the lan966x driver caused by a NULL pointer dereference.
+The ocelot_set_aggr_pgids() function in the ocelot driver has similar logic
+and is susceptible to the same crash.
+
+This issue specifically affects the ocelot_vsc7514.c frontend, which leaves
+unused ports as NULL pointers. The felix_vsc9959.c frontend is unaffected as
+it uses the DSA framework which registers all ports.
+
+Fix this by checking if the port pointer is valid before accessing it.
+
+Fixes: 528d3f190c98 ("net: mscc: ocelot: drop the use of the "lags" array")
+Signed-off-by: Jerry Wu <w.7erry@foxmail.com>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/tencent_75EF812B305E26B0869C673DD1160866C90A@qq.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index 96b1e394a397f..f3bf7757302c0 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -1718,14 +1718,16 @@ static void ocelot_set_aggr_pgids(struct ocelot *ocelot)
+
+ /* Now, set PGIDs for each active LAG */
+ for (lag = 0; lag < ocelot->num_phys_ports; lag++) {
+- struct net_device *bond = ocelot->ports[lag]->bond;
++ struct ocelot_port *ocelot_port = ocelot->ports[lag];
+ int num_active_ports = 0;
++ struct net_device *bond;
+ unsigned long bond_mask;
+ u8 aggr_idx[16];
+
+- if (!bond || (visited & BIT(lag)))
++ if (!ocelot_port || !ocelot_port->bond || (visited & BIT(lag)))
+ continue;
+
++ bond = ocelot_port->bond;
+ bond_mask = ocelot_get_bond_mask(ocelot, bond);
+
+ for_each_set_bit(port, &bond_mask, ocelot->num_phys_ports) {
+--
+2.51.0
+
--- /dev/null
+From c2764c525e3ec1bcd33c8a17f6650d886d9ba828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 20:41:00 -0700
+Subject: net/sched: sch_qfq: Fix NULL deref when deactivating inactive
+ aggregate in qfq_reset
+
+From: Xiang Mei <xmei5@asu.edu>
+
+[ Upstream commit c1d73b1480235731e35c81df70b08f4714a7d095 ]
+
+`qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class
+itself is active.
+
+Two qfq_class objects may point to the same leaf_qdisc. This happens
+when:
+
+1. one QFQ qdisc is attached to the dev as the root qdisc, and
+
+2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()
+/ qdisc_put()) and is pending to be destroyed, as in function
+tc_new_tfilter.
+
+When packets are enqueued through the root QFQ qdisc, the shared
+leaf_qdisc->q.qlen increases. At the same time, the second QFQ
+qdisc triggers qdisc_put and qdisc_destroy: the qdisc enters
+qfq_reset() with its own q->q.qlen == 0, but its class's leaf
+qdisc->q.qlen > 0. Therefore, the qfq_reset would wrongly deactivate
+an inactive aggregate and trigger a null-deref in qfq_deactivate_agg:
+
+[ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[ 0.903571] #PF: supervisor write access in kernel mode
+[ 0.903860] #PF: error_code(0x0002) - not-present page
+[ 0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0
+[ 0.904502] Oops: Oops: 0002 [#1] SMP NOPTI
+[ 0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE
+[ 0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
+[ 0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))
+[ 0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0
+
+Code starting with the faulting instruction
+===========================================
+ 0: 0f 84 4d 01 00 00 je 0x153
+ 6: 48 89 70 18 mov %rsi,0x18(%rax)
+ a: 8b 4b 10 mov 0x10(%rbx),%ecx
+ d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx
+ 14: 48 8b 78 08 mov 0x8(%rax),%rdi
+ 18: 48 d3 e2 shl %cl,%rdx
+ 1b: 48 21 f2 and %rsi,%rdx
+ 1e: 48 2b 13 sub (%rbx),%rdx
+ 21: 48 8b 30 mov (%rax),%rsi
+ 24: 48 d3 ea shr %cl,%rdx
+ 27: 8b 4b 18 mov 0x18(%rbx),%ecx
+ ...
+[ 0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246
+[ 0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000
+[ 0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+[ 0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000
+[ 0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000
+[ 0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880
+[ 0.909179] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000
+[ 0.909572] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0
+[ 0.910247] PKRU: 55555554
+[ 0.910391] Call Trace:
+[ 0.910527] <TASK>
+[ 0.910638] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)
+[ 0.910826] qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)
+[ 0.911040] __qdisc_destroy (net/sched/sch_generic.c:1076)
+[ 0.911236] tc_new_tfilter (net/sched/cls_api.c:2447)
+[ 0.911447] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)
+[ 0.911663] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)
+[ 0.911894] netlink_rcv_skb (net/netlink/af_netlink.c:2550)
+[ 0.912100] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)
+[ 0.912296] ? __alloc_skb (net/core/skbuff.c:706)
+[ 0.912484] netlink_sendmsg (net/netlink/af_netlink.c:1894)
+[ 0.912682] sock_write_iter (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1) net/socket.c:1195 (discriminator 1))
+[ 0.912880] vfs_write (fs/read_write.c:593 fs/read_write.c:686)
+[ 0.913077] ksys_write (fs/read_write.c:738)
+[ 0.913252] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
+[ 0.913438] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)
+[ 0.913687] RIP: 0033:0x424c34
+[ 0.913844] Code: 89 02 48 c7 c0 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d 2d 44 09 00 00 74 13 b8 01 00 00 00 0f 05 9
+
+Code starting with the faulting instruction
+===========================================
+ 0: 89 02 mov %eax,(%rdx)
+ 2: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
+ 9: eb bd jmp 0xffffffffffffffc8
+ b: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
+ 12: 00 00 00
+ 15: 90 nop
+ 16: f3 0f 1e fa endbr64
+ 1a: 80 3d 2d 44 09 00 00 cmpb $0x0,0x9442d(%rip) # 0x9444e
+ 21: 74 13 je 0x36
+ 23: b8 01 00 00 00 mov $0x1,%eax
+ 28: 0f 05 syscall
+ 2a: 09 .byte 0x9
+[ 0.914807] RSP: 002b:00007ffea1938b78 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
+[ 0.915197] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000424c34
+[ 0.915556] RDX: 000000000000003c RSI: 000000002af378c0 RDI: 0000000000000003
+[ 0.915912] RBP: 00007ffea1938bc0 R08: 00000000004b8820 R09: 0000000000000000
+[ 0.916297] R10: 0000000000000001 R11: 0000000000000202 R12: 00007ffea1938d28
+[ 0.916652] R13: 00007ffea1938d38 R14: 00000000004b3828 R15: 0000000000000001
+[ 0.917039] </TASK>
+[ 0.917158] Modules linked in:
+[ 0.917316] CR2: 0000000000000000
+[ 0.917484] ---[ end trace 0000000000000000 ]---
+[ 0.917717] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))
+[ 0.917978] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0
+
+Code starting with the faulting instruction
+===========================================
+ 0: 0f 84 4d 01 00 00 je 0x153
+ 6: 48 89 70 18 mov %rsi,0x18(%rax)
+ a: 8b 4b 10 mov 0x10(%rbx),%ecx
+ d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx
+ 14: 48 8b 78 08 mov 0x8(%rax),%rdi
+ 18: 48 d3 e2 shl %cl,%rdx
+ 1b: 48 21 f2 and %rsi,%rdx
+ 1e: 48 2b 13 sub (%rbx),%rdx
+ 21: 48 8b 30 mov (%rax),%rsi
+ 24: 48 d3 ea shr %cl,%rdx
+ 27: 8b 4b 18 mov 0x18(%rbx),%ecx
+ ...
+[ 0.918902] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246
+[ 0.919198] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000
+[ 0.919559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+[ 0.919908] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000
+[ 0.920289] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000
+[ 0.920648] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880
+[ 0.921014] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000
+[ 0.921424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 0.921710] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0
+[ 0.922097] PKRU: 55555554
+[ 0.922240] Kernel panic - not syncing: Fatal exception
+[ 0.922590] Kernel Offset: disabled
+
+Fixes: 0545a3037773 ("pkt_sched: QFQ - quick fair queue scheduler")
+Signed-off-by: Xiang Mei <xmei5@asu.edu>
+Link: https://patch.msgid.link/20260106034100.1780779-1-xmei5@asu.edu
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_qfq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index 649cf7a7dce46..aa049dd33a74e 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -1491,7 +1491,7 @@ static void qfq_reset_qdisc(struct Qdisc *sch)
+
+ for (i = 0; i < q->clhash.hashsize; i++) {
+ hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
+- if (cl->qdisc->q.qlen > 0)
++ if (cl_is_active(cl))
+ qfq_deactivate_class(q, cl);
+
+ qdisc_reset(cl->qdisc);
+--
+2.51.0
+
--- /dev/null
+From 225311978f40818fef2e4ca3889628b0659be309 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 04:35:35 +0800
+Subject: net: sock: fix hardened usercopy panic in sock_recv_errqueue
+
+From: Weiming Shi <bestswngs@gmail.com>
+
+[ Upstream commit 2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20 ]
+
+skbuff_fclone_cache was created without defining a usercopy region,
+[1] unlike skbuff_head_cache which properly whitelists the cb[] field.
+[2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is
+enabled and the kernel attempts to copy sk_buff.cb data to userspace
+via sock_recv_errqueue() -> put_cmsg().
+
+The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone()
+ (from skbuff_fclone_cache) [1]
+2. The skb is cloned via skb_clone() using the pre-allocated fclone
+[3] 3. The cloned skb is queued to sk_error_queue for timestamp
+reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE)
+5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb
+[4] 6. __check_heap_object() fails because skbuff_fclone_cache has no
+ usercopy whitelist [5]
+
+When cloned skbs allocated from skbuff_fclone_cache are used in the
+socket error queue, accessing the sock_exterr_skb structure in skb->cb
+via put_cmsg() triggers a usercopy hardening violation:
+
+[ 5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' (offset 296, size 16)!
+[ 5.382796] kernel BUG at mm/usercopy.c:102!
+[ 5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
+[ 5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7
+[ 5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
+[ 5.384903] RIP: 0010:usercopy_abort+0x6c/0x80
+[ 5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff <0f> 0b 490
+[ 5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246
+[ 5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74
+[ 5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0
+[ 5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74
+[ 5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001
+[ 5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00
+[ 5.384903] FS: 0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000
+[ 5.384903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0
+[ 5.384903] PKRU: 55555554
+[ 5.384903] Call Trace:
+[ 5.384903] <TASK>
+[ 5.384903] __check_heap_object+0x9a/0xd0
+[ 5.384903] __check_object_size+0x46c/0x690
+[ 5.384903] put_cmsg+0x129/0x5e0
+[ 5.384903] sock_recv_errqueue+0x22f/0x380
+[ 5.384903] tls_sw_recvmsg+0x7ed/0x1960
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5.384903] ? schedule+0x6d/0x270
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5.384903] ? mutex_unlock+0x81/0xd0
+[ 5.384903] ? __pfx_mutex_unlock+0x10/0x10
+[ 5.384903] ? __pfx_tls_sw_recvmsg+0x10/0x10
+[ 5.384903] ? _raw_spin_lock_irqsave+0x8f/0xf0
+[ 5.384903] ? _raw_read_unlock_irqrestore+0x20/0x40
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+
+The crash offset 296 corresponds to skb2->cb within skbuff_fclones:
+ - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 -
+ offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 =
+ 272 + 24 (inside sock_exterr_skb.ee)
+
+This patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure.
+
+[1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885
+[2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104
+[3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566
+[4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491
+[5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719
+
+Fixes: 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0")
+Reported-by: Xiang Mei <xmei5@asu.edu>
+Signed-off-by: Weiming Shi <bestswngs@gmail.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20251223203534.1392218-2-bestswngs@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index b4e605ac79c9f..bf2bec10d5d6a 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3377,7 +3377,7 @@ void sock_enable_timestamp(struct sock *sk, enum sock_flags flag)
+ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+ int level, int type)
+ {
+- struct sock_exterr_skb *serr;
++ struct sock_extended_err ee;
+ struct sk_buff *skb;
+ int copied, err;
+
+@@ -3397,8 +3397,9 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+
+ sock_recv_timestamp(msg, sk, skb);
+
+- serr = SKB_EXT_ERR(skb);
+- put_cmsg(msg, level, type, sizeof(serr->ee), &serr->ee);
++ /* We must use a bounce buffer for CONFIG_HARDENED_USERCOPY=y */
++ ee = SKB_EXT_ERR(skb)->ee;
++ put_cmsg(msg, level, type, sizeof(ee), &ee);
+
+ msg->msg_flags |= MSG_ERRQUEUE;
+ err = copied;
+--
+2.51.0
+
--- /dev/null
+From f31f5dfcbd75ac2fb7654c86e8e928496800a8e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 10:48:21 +0200
+Subject: net: usb: pegasus: fix memory leak in update_eth_regs_async()
+
+From: Petko Manolov <petkan@nucleusys.com>
+
+[ Upstream commit afa27621a28af317523e0836dad430bec551eb54 ]
+
+When asynchronously writing to the device registers and if usb_submit_urb()
+fail, the code fail to release allocated to this point resources.
+
+Fixes: 323b34963d11 ("drivers: net: usb: pegasus: fix control urb submission")
+Signed-off-by: Petko Manolov <petkan@nucleusys.com>
+Link: https://patch.msgid.link/20260106084821.3746677-1-petko.manolov@konsulko.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/pegasus.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
+index cd063f45785b7..fd7b9776b4824 100644
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -168,6 +168,8 @@ static int update_eth_regs_async(pegasus_t *pegasus)
+ netif_device_detach(pegasus->net);
+ netif_err(pegasus, drv, pegasus->net,
+ "%s returned %d\n", __func__, ret);
++ usb_free_urb(async_urb);
++ kfree(req);
+ }
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 2f17e797bd179a85edbb045cff28393bf45b16e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 09:22:24 +0800
+Subject: netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
+
+From: Di Zhu <zhud@hygon.cn>
+
+[ Upstream commit 02d1e1a3f9239cdb3ecf2c6d365fb959d1bf39df ]
+
+Directly increment the TSO features incurs a side effect: it will also
+directly clear the flags in NETIF_F_ALL_FOR_ALL on the master device,
+which can cause issues such as the inability to enable the nocache copy
+feature on the bonding driver.
+
+The fix is to include NETIF_F_ALL_FOR_ALL in the update mask, thereby
+preventing it from being cleared.
+
+Fixes: b0ce3508b25e ("bonding: allow TSO being set on bonding master")
+Signed-off-by: Di Zhu <zhud@hygon.cn>
+Link: https://patch.msgid.link/20251224012224.56185-1-zhud@hygon.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netdevice.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 83bb0f21b1b02..dddb866d88075 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -5093,7 +5093,8 @@ netdev_features_t netdev_increment_features(netdev_features_t all,
+ static inline netdev_features_t netdev_add_tso_features(netdev_features_t features,
+ netdev_features_t mask)
+ {
+- return netdev_increment_features(features, NETIF_F_ALL_TSO, mask);
++ return netdev_increment_features(features, NETIF_F_ALL_TSO |
++ NETIF_F_ALL_FOR_ALL, mask);
+ }
+
+ int __netdev_update_features(struct net_device *dev);
+--
+2.51.0
+
--- /dev/null
+From fa984ee0dc407a0d9c026ccb546c9c0425a95221 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 15:46:40 +0100
+Subject: netfilter: nf_conncount: update last_gc only when GC has been
+ performed
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 7811ba452402d58628e68faedf38745b3d485e3c ]
+
+Currently last_gc is being updated everytime a new connection is
+tracked, that means that it is updated even if a GC wasn't performed.
+With a sufficiently high packet rate, it is possible to always bypass
+the GC, causing the list to grow infinitely.
+
+Update the last_gc value only when a GC has been actually performed.
+
+Fixes: d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conncount.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
+index c00b8e522c5a7..a2c5a7ba0c6fc 100644
+--- a/net/netfilter/nf_conncount.c
++++ b/net/netfilter/nf_conncount.c
+@@ -229,6 +229,7 @@ static int __nf_conncount_add(struct net *net,
+
+ nf_ct_put(found_ct);
+ }
++ list->last_gc = (u32)jiffies;
+
+ add_new_node:
+ if (WARN_ON_ONCE(list->count > INT_MAX)) {
+@@ -248,7 +249,6 @@ static int __nf_conncount_add(struct net *net,
+ conn->jiffies32 = (u32)jiffies;
+ list_add_tail(&conn->node, &list->head);
+ list->count++;
+- list->last_gc = (u32)jiffies;
+
+ out_put:
+ if (refcounted)
+--
+2.51.0
+
--- /dev/null
+From 31879d04bba81b3b61c3b2ac8e3c1ca805b9cff7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 12:48:26 +0000
+Subject: netfilter: nf_tables: fix memory leak in nf_tables_newrule()
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit d077e8119ddbb4fca67540f1a52453631a47f221 ]
+
+In nf_tables_newrule(), if nft_use_inc() fails, the function jumps to
+the err_release_rule label without freeing the allocated flow, leading
+to a memory leak.
+
+Fix this by adding a new label err_destroy_flow and jumping to it when
+nft_use_inc() fails. This ensures that the flow is properly released
+in this error case.
+
+Fixes: 1689f25924ada ("netfilter: nf_tables: report use refcount overflow")
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 91b012e476be6..e37d2ef9538e5 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3741,7 +3741,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
+
+ if (!nft_use_inc(&chain->use)) {
+ err = -EMFILE;
+- goto err_release_rule;
++ goto err_destroy_flow;
+ }
+
+ if (info->nlh->nlmsg_flags & NLM_F_REPLACE) {
+@@ -3791,6 +3791,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
+
+ err_destroy_flow_rule:
+ nft_use_dec_restore(&chain->use);
++err_destroy_flow:
+ if (flow)
+ nft_flow_rule_destroy(flow);
+ err_release_rule:
+--
+2.51.0
+
--- /dev/null
+From b6c3426ec07173474e65ec62c2f554e43d5925de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 21:21:59 +0100
+Subject: netfilter: nft_synproxy: avoid possible data-race on update operation
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 36a3200575642846a96436d503d46544533bb943 ]
+
+During nft_synproxy eval we are reading nf_synproxy_info struct which
+can be modified on update operation concurrently. As nf_synproxy_info
+struct fits in 32 bits, use READ_ONCE/WRITE_ONCE annotations.
+
+Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_synproxy.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
+index 0806813d3a767..46d2eefb0b218 100644
+--- a/net/netfilter/nft_synproxy.c
++++ b/net/netfilter/nft_synproxy.c
+@@ -48,7 +48,7 @@ static void nft_synproxy_eval_v4(const struct nft_synproxy *priv,
+ struct tcphdr *_tcph,
+ struct synproxy_options *opts)
+ {
+- struct nf_synproxy_info info = priv->info;
++ struct nf_synproxy_info info = READ_ONCE(priv->info);
+ struct net *net = nft_net(pkt);
+ struct synproxy_net *snet = synproxy_pernet(net);
+ struct sk_buff *skb = pkt->skb;
+@@ -79,7 +79,7 @@ static void nft_synproxy_eval_v6(const struct nft_synproxy *priv,
+ struct tcphdr *_tcph,
+ struct synproxy_options *opts)
+ {
+- struct nf_synproxy_info info = priv->info;
++ struct nf_synproxy_info info = READ_ONCE(priv->info);
+ struct net *net = nft_net(pkt);
+ struct synproxy_net *snet = synproxy_pernet(net);
+ struct sk_buff *skb = pkt->skb;
+@@ -339,7 +339,7 @@ static void nft_synproxy_obj_update(struct nft_object *obj,
+ struct nft_synproxy *newpriv = nft_obj_data(newobj);
+ struct nft_synproxy *priv = nft_obj_data(obj);
+
+- priv->info = newpriv->info;
++ WRITE_ONCE(priv->info, newpriv->info);
+ }
+
+ static struct nft_object_type nft_synproxy_obj_type;
+--
+2.51.0
+
nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch
scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch
scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch
+arm64-dts-add-off-on-delay-us-for-usdhc2-regulator.patch
+arm-dts-imx6q-ba16-fix-rtc-interrupt-level.patch
+netfilter-nft_synproxy-avoid-possible-data-race-on-u.patch
+netfilter-nf_tables-fix-memory-leak-in-nf_tables_new.patch
+netfilter-nf_conncount-update-last_gc-only-when-gc-h.patch
+net-marvell-prestera-fix-null-dereference-on-devlink.patch
+bridge-fix-c-vlan-preservation-in-802.1ad-vlan_tunne.patch
+net-mscc-ocelot-fix-crash-when-adding-interface-unde.patch
+inet-ping-fix-icmp-out-counting.patch
+net-sock-fix-hardened-usercopy-panic-in-sock_recv_er.patch
+netdev-preserve-netif_f_all_for_all-across-tso-updat.patch
+net-mlx5e-don-t-print-error-message-due-to-invalid-m.patch
+eth-bnxt-move-and-rename-reset-helpers.patch
+bnxt_en-fix-potential-data-corruption-with-hw-gro-lr.patch
+hid-quirks-work-around-vid-pid-conflict-for-appledis.patch
+net-sched-sch_qfq-fix-null-deref-when-deactivating-i.patch
+net-usb-pegasus-fix-memory-leak-in-update_eth_regs_a.patch
+net-enetc-fix-build-warning-when-page_size-is-greate.patch
+arp-do-not-assume-dev_hard_header-does-not-change-sk.patch
--- /dev/null
+From 6e648fa1a777456a1ede39683686e8c850563cb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 11:56:05 +0200
+Subject: ARM: dts: imx6q-ba16: fix RTC interrupt level
+
+From: Ian Ray <ian.ray@gehealthcare.com>
+
+[ Upstream commit e6a4eedd49ce27c16a80506c66a04707e0ee0116 ]
+
+RTC interrupt level should be set to "LOW". This was revealed by the
+introduction of commit:
+
+ f181987ef477 ("rtc: m41t80: use IRQ flags obtained from fwnode")
+
+which changed the way IRQ type is obtained.
+
+Fixes: 56c27310c1b4 ("ARM: dts: imx: Add Advantech BA-16 Qseven module")
+Signed-off-by: Ian Ray <ian.ray@gehealthcare.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6q-ba16.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6q-ba16.dtsi b/arch/arm/boot/dts/imx6q-ba16.dtsi
+index f266f1b7e0cfc..0c033e69ecc04 100644
+--- a/arch/arm/boot/dts/imx6q-ba16.dtsi
++++ b/arch/arm/boot/dts/imx6q-ba16.dtsi
+@@ -335,7 +335,7 @@ rtc@32 {
+ pinctrl-0 = <&pinctrl_rtc>;
+ reg = <0x32>;
+ interrupt-parent = <&gpio4>;
+- interrupts = <10 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <10 IRQ_TYPE_LEVEL_LOW>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 48cfa7beeeade128ed1e865141c3c5d297d7a17f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 11:22:40 +0800
+Subject: arm64: dts: add off-on-delay-us for usdhc2 regulator
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+[ Upstream commit ca643894a37a25713029b36cfe7d1bae515cac08 ]
+
+For SD card, according to the spec requirement, for sd card power reset
+operation, it need sd card supply voltage to be lower than 0.5v and keep
+over 1ms, otherwise, next time power back the sd card supply voltage to
+3.3v, sd card can't support SD3.0 mode again.
+
+To match such requirement on imx8qm-mek board, add 4.8ms delay between
+sd power off and power on.
+
+Fixes: 307fd14d4b14 ("arm64: dts: imx: add imx8qm mek support")
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+index 470e4e4aa8c78..059f8c0ab93d9 100644
+--- a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
++++ b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+@@ -34,6 +34,7 @@ reg_usdhc2_vmmc: usdhc2-vmmc {
+ regulator-max-microvolt = <3000000>;
+ gpio = <&lsio_gpio4 7 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
++ off-on-delay-us = <4800>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 3b50f9a43e026492144f5cc4a697259ee731bcc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 14:41:51 +0100
+Subject: arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH
+ electronics i.MX8M Plus DHCOM
+
+From: Marek Vasut <marek.vasut@mailbox.org>
+
+[ Upstream commit c63749a7ddc59ac6ec0b05abfa0a21af9f2c1d38 ]
+
+Add missing 'clocks' property to LAN8740Ai PHY node, to allow the PHY driver
+to manage LAN8740Ai CLKIN reference clock supply. This fixes sporadic link
+bouncing caused by interruptions on the PHY reference clock, by letting the
+PHY driver manage the reference clock and assure there are no interruptions.
+
+This follows the matching PHY driver recommendation described in commit
+bedd8d78aba3 ("net: phy: smsc: LAN8710/20: add phy refclk in support")
+
+Fixes: 8d6712695bc8 ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2")
+Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
+Tested-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi
+index 2fd50b5890afa..0b81b85887f40 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi
+@@ -97,6 +97,7 @@ mdio {
+ ethphy0f: ethernet-phy@1 { /* SMSC LAN8740Ai */
+ compatible = "ethernet-phy-id0007.c110",
+ "ethernet-phy-ieee802.3-c22";
++ clocks = <&clk IMX8MP_CLK_ENET_QOS>;
+ interrupt-parent = <&gpio3>;
+ interrupts = <19 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-0 = <&pinctrl_ethphy0>;
+--
+2.51.0
+
--- /dev/null
+From a66f255e41b19617e828dce7343710adc3498c1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 21:22:50 +0000
+Subject: arp: do not assume dev_hard_header() does not change skb->head
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit c92510f5e3f82ba11c95991824a41e59a9c5ed81 ]
+
+arp_create() is the only dev_hard_header() caller
+making assumption about skb->head being unchanged.
+
+A recent commit broke this assumption.
+
+Initialize @arp pointer after dev_hard_header() call.
+
+Fixes: db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust")
+Reported-by: syzbot+58b44a770a1585795351@syzkaller.appspotmail.com
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260107212250.384552-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/arp.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
+index 50e2b4939d8e9..fc8c7a34b53e6 100644
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -563,7 +563,7 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
+
+ skb_reserve(skb, hlen);
+ skb_reset_network_header(skb);
+- arp = skb_put(skb, arp_hdr_len(dev));
++ skb_put(skb, arp_hdr_len(dev));
+ skb->dev = dev;
+ skb->protocol = htons(ETH_P_ARP);
+ if (!src_hw)
+@@ -571,12 +571,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
+ if (!dest_hw)
+ dest_hw = dev->broadcast;
+
+- /*
+- * Fill the device header for the ARP frame
++ /* Fill the device header for the ARP frame.
++ * Note: skb->head can be changed.
+ */
+ if (dev_hard_header(skb, dev, ptype, dest_hw, src_hw, skb->len) < 0)
+ goto out;
+
++ arp = arp_hdr(skb);
+ /*
+ * Fill out the arp protocol part.
+ *
+--
+2.51.0
+
--- /dev/null
+From bcc4b86c8e8d8379c06f4120fdbeb12c8d426a86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Dec 2025 00:36:25 -0800
+Subject: bnxt_en: Fix potential data corruption with HW GRO/LRO
+
+From: Srijit Bose <srijit.bose@broadcom.com>
+
+[ Upstream commit ffeafa65b2b26df2f5b5a6118d3174f17bd12ec5 ]
+
+Fix the max number of bits passed to find_first_zero_bit() in
+bnxt_alloc_agg_idx(). We were incorrectly passing the number of
+long words. find_first_zero_bit() may fail to find a zero bit and
+cause a wrong ID to be used. If the wrong ID is already in use, this
+can cause data corruption. Sometimes an error like this can also be
+seen:
+
+bnxt_en 0000:83:00.0 enp131s0np0: TPA end agg_buf 2 != expected agg_bufs 1
+
+Fix it by passing the correct number of bits MAX_TPA_P5. Use
+DECLARE_BITMAP() to more cleanly define the bitmap. Add a sanity
+check to warn if a bit cannot be found and reset the ring [MChan].
+
+Fixes: ec4d8e7cf024 ("bnxt_en: Add TPA ID mapping logic for 57500 chips.")
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Srijit Bose <srijit.bose@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20251231083625.3911652-1-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 15 ++++++++++++---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 +---
+ 2 files changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 2540402030bf1..a70870393b65c 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1306,9 +1306,11 @@ static u16 bnxt_alloc_agg_idx(struct bnxt_rx_ring_info *rxr, u16 agg_id)
+ struct bnxt_tpa_idx_map *map = rxr->rx_tpa_idx_map;
+ u16 idx = agg_id & MAX_TPA_P5_MASK;
+
+- if (test_bit(idx, map->agg_idx_bmap))
+- idx = find_first_zero_bit(map->agg_idx_bmap,
+- BNXT_AGG_IDX_BMAP_SIZE);
++ if (test_bit(idx, map->agg_idx_bmap)) {
++ idx = find_first_zero_bit(map->agg_idx_bmap, MAX_TPA_P5);
++ if (idx >= MAX_TPA_P5)
++ return INVALID_HW_RING_ID;
++ }
+ __set_bit(idx, map->agg_idx_bmap);
+ map->agg_id_tbl[agg_id] = idx;
+ return idx;
+@@ -1341,6 +1343,13 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
+ if (bp->flags & BNXT_FLAG_CHIP_P5) {
+ agg_id = TPA_START_AGG_ID_P5(tpa_start);
+ agg_id = bnxt_alloc_agg_idx(rxr, agg_id);
++ if (unlikely(agg_id == INVALID_HW_RING_ID)) {
++ netdev_warn(bp->dev, "Unable to allocate agg ID for ring %d, agg 0x%x\n",
++ rxr->bnapi->index,
++ TPA_START_AGG_ID_P5(tpa_start));
++ bnxt_sched_reset_rxr(bp, rxr);
++ return;
++ }
+ } else {
+ agg_id = TPA_START_AGG_ID(tpa_start);
+ }
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index 111098b4b6062..4d27636aa200d 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -897,11 +897,9 @@ struct bnxt_tpa_info {
+ struct rx_agg_cmp *agg_arr;
+ };
+
+-#define BNXT_AGG_IDX_BMAP_SIZE (MAX_TPA_P5 / BITS_PER_LONG)
+-
+ struct bnxt_tpa_idx_map {
+ u16 agg_id_tbl[1024];
+- unsigned long agg_idx_bmap[BNXT_AGG_IDX_BMAP_SIZE];
++ DECLARE_BITMAP(agg_idx_bmap, MAX_TPA_P5);
+ };
+
+ struct bnxt_rx_ring_info {
+--
+2.51.0
+
--- /dev/null
+From 418c739efe236f56f8fcba18adb1d6fc69ea9d93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Dec 2025 03:00:57 +0100
+Subject: bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
+
+From: Alexandre Knecht <knecht.alexandre@gmail.com>
+
+[ Upstream commit 3128df6be147768fe536986fbb85db1d37806a9f ]
+
+When using an 802.1ad bridge with vlan_tunnel, the C-VLAN tag is
+incorrectly stripped from frames during egress processing.
+
+br_handle_egress_vlan_tunnel() uses skb_vlan_pop() to remove the S-VLAN
+from hwaccel before VXLAN encapsulation. However, skb_vlan_pop() also
+moves any "next" VLAN from the payload into hwaccel:
+
+ /* move next vlan tag to hw accel tag */
+ __skb_vlan_pop(skb, &vlan_tci);
+ __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);
+
+For QinQ frames where the C-VLAN sits in the payload, this moves it to
+hwaccel where it gets lost during VXLAN encapsulation.
+
+Fix by calling __vlan_hwaccel_clear_tag() directly, which clears only
+the hwaccel S-VLAN and leaves the payload untouched.
+
+This path is only taken when vlan_tunnel is enabled and tunnel_info
+is configured, so 802.1Q bridges are unaffected.
+
+Tested with 802.1ad bridge + VXLAN vlan_tunnel, verified C-VLAN
+preserved in VXLAN payload via tcpdump.
+
+Fixes: 11538d039ac6 ("bridge: vlan dst_metadata hooks in ingress and egress paths")
+Signed-off-by: Alexandre Knecht <knecht.alexandre@gmail.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20251228020057.2788865-1-knecht.alexandre@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_vlan_tunnel.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/net/bridge/br_vlan_tunnel.c b/net/bridge/br_vlan_tunnel.c
+index 6399a8a69d076..0f03572d89d09 100644
+--- a/net/bridge/br_vlan_tunnel.c
++++ b/net/bridge/br_vlan_tunnel.c
+@@ -187,7 +187,6 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,
+ {
+ struct metadata_dst *tunnel_dst;
+ __be64 tunnel_id;
+- int err;
+
+ if (!vlan)
+ return 0;
+@@ -197,9 +196,13 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,
+ return 0;
+
+ skb_dst_drop(skb);
+- err = skb_vlan_pop(skb);
+- if (err)
+- return err;
++ /* For 802.1ad (QinQ), skb_vlan_pop() incorrectly moves the C-VLAN
++ * from payload to hwaccel after clearing S-VLAN. We only need to
++ * clear the hwaccel S-VLAN; the C-VLAN must stay in payload for
++ * correct VXLAN encapsulation. This is also correct for 802.1Q
++ * where no C-VLAN exists in payload.
++ */
++ __vlan_hwaccel_clear_tag(skb);
+
+ tunnel_dst = rcu_dereference(vlan->tinfo.tunnel_dst);
+ if (tunnel_dst && dst_hold_safe(&tunnel_dst->dst))
+--
+2.51.0
+
--- /dev/null
+From 574e5cd67d0fbe235ef3d775ff322e6bf9f6c929 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jul 2023 18:04:38 -0700
+Subject: eth: bnxt: move and rename reset helpers
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit fea2993aecd74d5d11ede1ebbd60e478ebfed996 ]
+
+Move the reset helpers, subsequent patches will need some
+of them on the Tx path.
+
+While at it rename bnxt_sched_reset(), on more recent chips
+it schedules a queue reset, instead of a fuller reset.
+
+Link: https://lore.kernel.org/r/20230720010440.1967136-2-kuba@kernel.org
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: ffeafa65b2b2 ("bnxt_en: Fix potential data corruption with HW GRO/LRO")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 72 +++++++++++------------
+ 1 file changed, 36 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 6b1245a3ab4b1..2540402030bf1 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -293,6 +293,38 @@ static void bnxt_db_cq(struct bnxt *bp, struct bnxt_db_info *db, u32 idx)
+ BNXT_DB_CQ(db, idx);
+ }
+
++static void bnxt_queue_fw_reset_work(struct bnxt *bp, unsigned long delay)
++{
++ if (!(test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)))
++ return;
++
++ if (BNXT_PF(bp))
++ queue_delayed_work(bnxt_pf_wq, &bp->fw_reset_task, delay);
++ else
++ schedule_delayed_work(&bp->fw_reset_task, delay);
++}
++
++static void bnxt_queue_sp_work(struct bnxt *bp)
++{
++ if (BNXT_PF(bp))
++ queue_work(bnxt_pf_wq, &bp->sp_task);
++ else
++ schedule_work(&bp->sp_task);
++}
++
++static void bnxt_sched_reset_rxr(struct bnxt *bp, struct bnxt_rx_ring_info *rxr)
++{
++ if (!rxr->bnapi->in_reset) {
++ rxr->bnapi->in_reset = true;
++ if (bp->flags & BNXT_FLAG_CHIP_P5)
++ set_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event);
++ else
++ set_bit(BNXT_RST_RING_SP_EVENT, &bp->sp_event);
++ bnxt_queue_sp_work(bp);
++ }
++ rxr->rx_next_cons = 0xffff;
++}
++
+ const u16 bnxt_lhint_arr[] = {
+ TX_BD_FLAGS_LHINT_512_AND_SMALLER,
+ TX_BD_FLAGS_LHINT_512_TO_1023,
+@@ -1269,38 +1301,6 @@ static int bnxt_discard_rx(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+ return 0;
+ }
+
+-static void bnxt_queue_fw_reset_work(struct bnxt *bp, unsigned long delay)
+-{
+- if (!(test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)))
+- return;
+-
+- if (BNXT_PF(bp))
+- queue_delayed_work(bnxt_pf_wq, &bp->fw_reset_task, delay);
+- else
+- schedule_delayed_work(&bp->fw_reset_task, delay);
+-}
+-
+-static void bnxt_queue_sp_work(struct bnxt *bp)
+-{
+- if (BNXT_PF(bp))
+- queue_work(bnxt_pf_wq, &bp->sp_task);
+- else
+- schedule_work(&bp->sp_task);
+-}
+-
+-static void bnxt_sched_reset(struct bnxt *bp, struct bnxt_rx_ring_info *rxr)
+-{
+- if (!rxr->bnapi->in_reset) {
+- rxr->bnapi->in_reset = true;
+- if (bp->flags & BNXT_FLAG_CHIP_P5)
+- set_bit(BNXT_RESET_TASK_SP_EVENT, &bp->sp_event);
+- else
+- set_bit(BNXT_RST_RING_SP_EVENT, &bp->sp_event);
+- bnxt_queue_sp_work(bp);
+- }
+- rxr->rx_next_cons = 0xffff;
+-}
+-
+ static u16 bnxt_alloc_agg_idx(struct bnxt_rx_ring_info *rxr, u16 agg_id)
+ {
+ struct bnxt_tpa_idx_map *map = rxr->rx_tpa_idx_map;
+@@ -1355,7 +1355,7 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
+ netdev_warn(bp->dev, "TPA cons %x, expected cons %x, error code %x\n",
+ cons, rxr->rx_next_cons,
+ TPA_START_ERROR_CODE(tpa_start1));
+- bnxt_sched_reset(bp, rxr);
++ bnxt_sched_reset_rxr(bp, rxr);
+ return;
+ }
+ /* Store cfa_code in tpa_info to use in tpa_end
+@@ -1895,7 +1895,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+ if (rxr->rx_next_cons != 0xffff)
+ netdev_warn(bp->dev, "RX cons %x != expected cons %x\n",
+ cons, rxr->rx_next_cons);
+- bnxt_sched_reset(bp, rxr);
++ bnxt_sched_reset_rxr(bp, rxr);
+ if (rc1)
+ return rc1;
+ goto next_rx_no_prod_no_len;
+@@ -1933,7 +1933,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
+ !(bp->fw_cap & BNXT_FW_CAP_RING_MONITOR)) {
+ netdev_warn_once(bp->dev, "RX buffer error %x\n",
+ rx_err);
+- bnxt_sched_reset(bp, rxr);
++ bnxt_sched_reset_rxr(bp, rxr);
+ }
+ }
+ goto next_rx_no_len;
+@@ -2371,7 +2371,7 @@ static int bnxt_async_event_process(struct bnxt *bp,
+ goto async_event_process_exit;
+ }
+ rxr = bp->bnapi[grp_idx]->rx_ring;
+- bnxt_sched_reset(bp, rxr);
++ bnxt_sched_reset_rxr(bp, rxr);
+ goto async_event_process_exit;
+ }
+ case ASYNC_EVENT_CMPL_EVENT_ID_ECHO_REQUEST: {
+--
+2.51.0
+
--- /dev/null
+From a9921b8ea072bc7a32b3470c2052388e39188a01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 13:46:41 +0100
+Subject: HID: quirks: work around VID/PID conflict for appledisplay
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit c7fabe4ad9219866c203164a214c474c95b36bf2 ]
+
+For years I wondered why the Apple Cinema Display driver would not
+just work for me. Turns out the hidraw driver instantly takes it
+over. Fix by adding appledisplay VID/PIDs to hid_have_special_driver.
+
+Fixes: 069e8a65cd79 ("Driver for Apple Cinema Display")
+Signed-off-by: René Rebe <rene@exactco.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-quirks.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 249e626d1c6a3..b6bec3614cfea 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -220,6 +220,15 @@ static const struct hid_device_id hid_quirks[] = {
+ * used as a driver. See hid_scan_report().
+ */
+ static const struct hid_device_id hid_have_special_driver[] = {
++#if IS_ENABLED(CONFIG_APPLEDISPLAY)
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9218) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9219) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x921c) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x921d) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9222) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9226) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9236) },
++#endif
+ #if IS_ENABLED(CONFIG_HID_A4TECH)
+ { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
+--
+2.51.0
+
--- /dev/null
+From f25b11857bbbf306e8f6db9df772409aa29ecfb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 14:31:45 +0800
+Subject: inet: ping: Fix icmp out counting
+
+From: yuan.gao <yuan.gao@ucloud.cn>
+
+[ Upstream commit 4c0856c225b39b1def6c9a6bc56faca79550da13 ]
+
+When the ping program uses an IPPROTO_ICMP socket to send ICMP_ECHO
+messages, ICMP_MIB_OUTMSGS is counted twice.
+
+ ping_v4_sendmsg
+ ping_v4_push_pending_frames
+ ip_push_pending_frames
+ ip_finish_skb
+ __ip_make_skb
+ icmp_out_count(net, icmp_type); // first count
+ icmp_out_count(sock_net(sk), user_icmph.type); // second count
+
+However, when the ping program uses an IPPROTO_RAW socket,
+ICMP_MIB_OUTMSGS is counted correctly only once.
+
+Therefore, the first count should be removed.
+
+Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
+Signed-off-by: yuan.gao <yuan.gao@ucloud.cn>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Tested-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20251224063145.3615282-1-yuan.gao@ucloud.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ping.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 5178a3f3cb537..cadf743ab4f52 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -848,10 +848,8 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ out_free:
+ if (free)
+ kfree(ipc.opt);
+- if (!err) {
+- icmp_out_count(sock_net(sk), user_icmph.type);
++ if (!err)
+ return len;
+- }
+ return err;
+
+ do_confirm:
+--
+2.51.0
+
--- /dev/null
+From 5624243f72b0eb7b7fdf810afeb1ff0b476cf50a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 17:12:04 +0800
+Subject: net: enetc: fix build warning when PAGE_SIZE is greater than 128K
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit 4b5bdabb5449b652122e43f507f73789041d4abe ]
+
+The max buffer size of ENETC RX BD is 0xFFFF bytes, so if the PAGE_SIZE
+is greater than 128K, ENETC_RXB_DMA_SIZE and ENETC_RXB_DMA_SIZE_XDP will
+be greater than 0xFFFF, thus causing a build warning.
+
+This will not cause any practical issues because ENETC is currently only
+used on the ARM64 platform, and the max PAGE_SIZE is 64K. So this patch
+is only for fixing the build warning that occurs when compiling ENETC
+drivers for other platforms.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202601050637.kHEKKOG7-lkp@intel.com/
+Fixes: e59bc32df2e9 ("net: enetc: correct the value of ENETC_RXB_TRUESIZE")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260107091204.1980222-1-wei.fang@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h
+index aacdfe98b65ab..d2ad5be02a0d8 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc.h
++++ b/drivers/net/ethernet/freescale/enetc/enetc.h
+@@ -43,9 +43,9 @@ struct enetc_tx_swbd {
+ #define ENETC_RXB_TRUESIZE (PAGE_SIZE >> 1)
+ #define ENETC_RXB_PAD NET_SKB_PAD /* add extra space if needed */
+ #define ENETC_RXB_DMA_SIZE \
+- (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD)
++ min(SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD, 0xffff)
+ #define ENETC_RXB_DMA_SIZE_XDP \
+- (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - XDP_PACKET_HEADROOM)
++ min(SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - XDP_PACKET_HEADROOM, 0xffff)
+
+ struct enetc_rx_swbd {
+ dma_addr_t dma;
+--
+2.51.0
+
--- /dev/null
+From 6a249a4aa5ce6e197d900ac66f5b0e3f7460389b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jan 2026 23:31:01 +0200
+Subject: net: fix memory leak in skb_segment_list for GRO packets
+
+From: Mohammad Heib <mheib@redhat.com>
+
+[ Upstream commit 238e03d0466239410b72294b79494e43d4fabe77 ]
+
+When skb_segment_list() is called during packet forwarding, it handles
+packets that were aggregated by the GRO engine.
+
+Historically, the segmentation logic in skb_segment_list assumes that
+individual segments are split from a parent SKB and may need to carry
+their own socket memory accounting. Accordingly, the code transfers
+truesize from the parent to the newly created segments.
+
+Prior to commit ed4cccef64c1 ("gro: fix ownership transfer"), this
+truesize subtraction in skb_segment_list() was valid because fragments
+still carry a reference to the original socket.
+
+However, commit ed4cccef64c1 ("gro: fix ownership transfer") changed
+this behavior by ensuring that fraglist entries are explicitly
+orphaned (skb->sk = NULL) to prevent illegal orphaning later in the
+stack. This change meant that the entire socket memory charge remained
+with the head SKB, but the corresponding accounting logic in
+skb_segment_list() was never updated.
+
+As a result, the current code unconditionally adds each fragment's
+truesize to delta_truesize and subtracts it from the parent SKB. Since
+the fragments are no longer charged to the socket, this subtraction
+results in an effective under-count of memory when the head is freed.
+This causes sk_wmem_alloc to remain non-zero, preventing socket
+destruction and leading to a persistent memory leak.
+
+The leak can be observed via KMEMLEAK when tearing down the networking
+environment:
+
+unreferenced object 0xffff8881e6eb9100 (size 2048):
+ comm "ping", pid 6720, jiffies 4295492526
+ backtrace:
+ kmem_cache_alloc_noprof+0x5c6/0x800
+ sk_prot_alloc+0x5b/0x220
+ sk_alloc+0x35/0xa00
+ inet6_create.part.0+0x303/0x10d0
+ __sock_create+0x248/0x640
+ __sys_socket+0x11b/0x1d0
+
+Since skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST
+packets constructed by GRO, the truesize adjustment is removed.
+
+The call to skb_release_head_state() must be preserved. As documented in
+commit cf673ed0e057 ("net: fix fraglist segmentation reference count
+leak"), it is still required to correctly drop references to SKB
+extensions that may be overwritten during __copy_skb_header().
+
+Fixes: ed4cccef64c1 ("gro: fix ownership transfer")
+Signed-off-by: Mohammad Heib <mheib@redhat.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Link: https://patch.msgid.link/20260104213101.352887-1-mheib@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skbuff.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index d8a3ada886ffb..ef24911af05a8 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4045,12 +4045,14 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
+ {
+ struct sk_buff *list_skb = skb_shinfo(skb)->frag_list;
+ unsigned int tnl_hlen = skb_tnl_header_len(skb);
+- unsigned int delta_truesize = 0;
+ unsigned int delta_len = 0;
+ struct sk_buff *tail = NULL;
+ struct sk_buff *nskb, *tmp;
+ int len_diff, err;
+
++ /* Only skb_gro_receive_list generated skbs arrive here */
++ DEBUG_NET_WARN_ON_ONCE(!(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST));
++
+ skb_push(skb, -skb_network_offset(skb) + offset);
+
+ /* Ensure the head is writeable before touching the shared info */
+@@ -4064,8 +4066,9 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
+ nskb = list_skb;
+ list_skb = list_skb->next;
+
++ DEBUG_NET_WARN_ON_ONCE(nskb->sk);
++
+ err = 0;
+- delta_truesize += nskb->truesize;
+ if (skb_shared(nskb)) {
+ tmp = skb_clone(nskb, GFP_ATOMIC);
+ if (tmp) {
+@@ -4108,7 +4111,6 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
+ goto err_linearize;
+ }
+
+- skb->truesize = skb->truesize - delta_truesize;
+ skb->data_len = skb->data_len - delta_len;
+ skb->len = skb->len - delta_len;
+
+--
+2.51.0
+
--- /dev/null
+From bb4879700aef5556d51b55df198f9fcea483927c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Dec 2025 21:21:18 -0800
+Subject: net: marvell: prestera: fix NULL dereference on devlink_alloc()
+ failure
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit a428e0da1248c353557970848994f35fd3f005e2 ]
+
+devlink_alloc() may return NULL on allocation failure, but
+prestera_devlink_alloc() unconditionally calls devlink_priv() on
+the returned pointer.
+
+This leads to a NULL pointer dereference if devlink allocation fails.
+Add a check for a NULL devlink pointer and return NULL early to avoid
+the crash.
+
+Fixes: 34dd1710f5a3 ("net: marvell: prestera: Add basic devlink support")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Acked-by: Elad Nachman <enachman@marvell.com>
+Link: https://patch.msgid.link/20251230052124.897012-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/prestera/prestera_devlink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/prestera/prestera_devlink.c b/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
+index 06279cd6da674..8f0ae62d4a893 100644
+--- a/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
++++ b/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
+@@ -392,6 +392,8 @@ struct prestera_switch *prestera_devlink_alloc(struct prestera_device *dev)
+
+ dl = devlink_alloc(&prestera_dl_ops, sizeof(struct prestera_switch),
+ dev->dev);
++ if (!dl)
++ return NULL;
+
+ return devlink_priv(dl);
+ }
+--
+2.51.0
+
--- /dev/null
+From ad0628601bcd2dd7b7d4367e5f9ffc402e4b5811 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Dec 2025 15:27:16 +0200
+Subject: net/mlx5e: Don't print error message due to invalid module
+
+From: Gal Pressman <gal@nvidia.com>
+
+[ Upstream commit 144297e2a24e3e54aee1180ec21120ea38822b97 ]
+
+Dumping module EEPROM on newer modules is supported through the netlink
+interface only.
+
+Querying with old userspace ethtool (or other tools, such as 'lshw')
+which still uses the ioctl interface results in an error message that
+could flood dmesg (in addition to the expected error return value).
+The original message was added under the assumption that the driver
+should be able to handle all module types, but now that such flows are
+easily triggered from userspace, it doesn't serve its purpose.
+
+Change the log level of the print in mlx5_query_module_eeprom() to
+debug.
+
+Fixes: bb64143eee8c ("net/mlx5e: Add ethtool support for dump module EEPROM")
+Signed-off-by: Gal Pressman <gal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Link: https://patch.msgid.link/20251225132717.358820-5-mbloch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/port.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+index a1548e6bfb35d..28ec31722ec2f 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+@@ -432,7 +432,8 @@ int mlx5_query_module_eeprom(struct mlx5_core_dev *dev,
+ mlx5_qsfp_eeprom_params_set(&query.i2c_address, &query.page, &offset);
+ break;
+ default:
+- mlx5_core_err(dev, "Module ID not recognized: 0x%x\n", module_id);
++ mlx5_core_dbg(dev, "Module ID not recognized: 0x%x\n",
++ module_id);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From fe9cf2c48c0ae4dd14edcd3f80adbac54fcff449 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Dec 2025 20:36:17 +0000
+Subject: net: mscc: ocelot: Fix crash when adding interface under a lag
+
+From: Jerry Wu <w.7erry@foxmail.com>
+
+[ Upstream commit 34f3ff52cb9fa7dbf04f5c734fcc4cb6ed5d1a95 ]
+
+Commit 15faa1f67ab4 ("lan966x: Fix crash when adding interface under a lag")
+fixed a similar issue in the lan966x driver caused by a NULL pointer dereference.
+The ocelot_set_aggr_pgids() function in the ocelot driver has similar logic
+and is susceptible to the same crash.
+
+This issue specifically affects the ocelot_vsc7514.c frontend, which leaves
+unused ports as NULL pointers. The felix_vsc9959.c frontend is unaffected as
+it uses the DSA framework which registers all ports.
+
+Fix this by checking if the port pointer is valid before accessing it.
+
+Fixes: 528d3f190c98 ("net: mscc: ocelot: drop the use of the "lags" array")
+Signed-off-by: Jerry Wu <w.7erry@foxmail.com>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/tencent_75EF812B305E26B0869C673DD1160866C90A@qq.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index 203cb4978544a..01417c2a61e23 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -2202,14 +2202,16 @@ static void ocelot_set_aggr_pgids(struct ocelot *ocelot)
+
+ /* Now, set PGIDs for each active LAG */
+ for (lag = 0; lag < ocelot->num_phys_ports; lag++) {
+- struct net_device *bond = ocelot->ports[lag]->bond;
++ struct ocelot_port *ocelot_port = ocelot->ports[lag];
+ int num_active_ports = 0;
++ struct net_device *bond;
+ unsigned long bond_mask;
+ u8 aggr_idx[16];
+
+- if (!bond || (visited & BIT(lag)))
++ if (!ocelot_port || !ocelot_port->bond || (visited & BIT(lag)))
+ continue;
+
++ bond = ocelot_port->bond;
+ bond_mask = ocelot_get_bond_mask(ocelot, bond);
+
+ for_each_set_bit(port, &bond_mask, ocelot->num_phys_ports) {
+--
+2.51.0
+
--- /dev/null
+From 2ca383e2b950899e122a2d4176402948ef6818d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 20:41:00 -0700
+Subject: net/sched: sch_qfq: Fix NULL deref when deactivating inactive
+ aggregate in qfq_reset
+
+From: Xiang Mei <xmei5@asu.edu>
+
+[ Upstream commit c1d73b1480235731e35c81df70b08f4714a7d095 ]
+
+`qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class
+itself is active.
+
+Two qfq_class objects may point to the same leaf_qdisc. This happens
+when:
+
+1. one QFQ qdisc is attached to the dev as the root qdisc, and
+
+2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()
+/ qdisc_put()) and is pending to be destroyed, as in function
+tc_new_tfilter.
+
+When packets are enqueued through the root QFQ qdisc, the shared
+leaf_qdisc->q.qlen increases. At the same time, the second QFQ
+qdisc triggers qdisc_put and qdisc_destroy: the qdisc enters
+qfq_reset() with its own q->q.qlen == 0, but its class's leaf
+qdisc->q.qlen > 0. Therefore, the qfq_reset would wrongly deactivate
+an inactive aggregate and trigger a null-deref in qfq_deactivate_agg:
+
+[ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[ 0.903571] #PF: supervisor write access in kernel mode
+[ 0.903860] #PF: error_code(0x0002) - not-present page
+[ 0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0
+[ 0.904502] Oops: Oops: 0002 [#1] SMP NOPTI
+[ 0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE
+[ 0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
+[ 0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))
+[ 0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0
+
+Code starting with the faulting instruction
+===========================================
+ 0: 0f 84 4d 01 00 00 je 0x153
+ 6: 48 89 70 18 mov %rsi,0x18(%rax)
+ a: 8b 4b 10 mov 0x10(%rbx),%ecx
+ d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx
+ 14: 48 8b 78 08 mov 0x8(%rax),%rdi
+ 18: 48 d3 e2 shl %cl,%rdx
+ 1b: 48 21 f2 and %rsi,%rdx
+ 1e: 48 2b 13 sub (%rbx),%rdx
+ 21: 48 8b 30 mov (%rax),%rsi
+ 24: 48 d3 ea shr %cl,%rdx
+ 27: 8b 4b 18 mov 0x18(%rbx),%ecx
+ ...
+[ 0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246
+[ 0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000
+[ 0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+[ 0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000
+[ 0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000
+[ 0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880
+[ 0.909179] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000
+[ 0.909572] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0
+[ 0.910247] PKRU: 55555554
+[ 0.910391] Call Trace:
+[ 0.910527] <TASK>
+[ 0.910638] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)
+[ 0.910826] qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)
+[ 0.911040] __qdisc_destroy (net/sched/sch_generic.c:1076)
+[ 0.911236] tc_new_tfilter (net/sched/cls_api.c:2447)
+[ 0.911447] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)
+[ 0.911663] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)
+[ 0.911894] netlink_rcv_skb (net/netlink/af_netlink.c:2550)
+[ 0.912100] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)
+[ 0.912296] ? __alloc_skb (net/core/skbuff.c:706)
+[ 0.912484] netlink_sendmsg (net/netlink/af_netlink.c:1894)
+[ 0.912682] sock_write_iter (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1) net/socket.c:1195 (discriminator 1))
+[ 0.912880] vfs_write (fs/read_write.c:593 fs/read_write.c:686)
+[ 0.913077] ksys_write (fs/read_write.c:738)
+[ 0.913252] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
+[ 0.913438] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)
+[ 0.913687] RIP: 0033:0x424c34
+[ 0.913844] Code: 89 02 48 c7 c0 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d 2d 44 09 00 00 74 13 b8 01 00 00 00 0f 05 9
+
+Code starting with the faulting instruction
+===========================================
+ 0: 89 02 mov %eax,(%rdx)
+ 2: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
+ 9: eb bd jmp 0xffffffffffffffc8
+ b: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
+ 12: 00 00 00
+ 15: 90 nop
+ 16: f3 0f 1e fa endbr64
+ 1a: 80 3d 2d 44 09 00 00 cmpb $0x0,0x9442d(%rip) # 0x9444e
+ 21: 74 13 je 0x36
+ 23: b8 01 00 00 00 mov $0x1,%eax
+ 28: 0f 05 syscall
+ 2a: 09 .byte 0x9
+[ 0.914807] RSP: 002b:00007ffea1938b78 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
+[ 0.915197] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000424c34
+[ 0.915556] RDX: 000000000000003c RSI: 000000002af378c0 RDI: 0000000000000003
+[ 0.915912] RBP: 00007ffea1938bc0 R08: 00000000004b8820 R09: 0000000000000000
+[ 0.916297] R10: 0000000000000001 R11: 0000000000000202 R12: 00007ffea1938d28
+[ 0.916652] R13: 00007ffea1938d38 R14: 00000000004b3828 R15: 0000000000000001
+[ 0.917039] </TASK>
+[ 0.917158] Modules linked in:
+[ 0.917316] CR2: 0000000000000000
+[ 0.917484] ---[ end trace 0000000000000000 ]---
+[ 0.917717] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))
+[ 0.917978] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0
+
+Code starting with the faulting instruction
+===========================================
+ 0: 0f 84 4d 01 00 00 je 0x153
+ 6: 48 89 70 18 mov %rsi,0x18(%rax)
+ a: 8b 4b 10 mov 0x10(%rbx),%ecx
+ d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx
+ 14: 48 8b 78 08 mov 0x8(%rax),%rdi
+ 18: 48 d3 e2 shl %cl,%rdx
+ 1b: 48 21 f2 and %rsi,%rdx
+ 1e: 48 2b 13 sub (%rbx),%rdx
+ 21: 48 8b 30 mov (%rax),%rsi
+ 24: 48 d3 ea shr %cl,%rdx
+ 27: 8b 4b 18 mov 0x18(%rbx),%ecx
+ ...
+[ 0.918902] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246
+[ 0.919198] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000
+[ 0.919559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+[ 0.919908] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000
+[ 0.920289] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000
+[ 0.920648] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880
+[ 0.921014] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000
+[ 0.921424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 0.921710] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0
+[ 0.922097] PKRU: 55555554
+[ 0.922240] Kernel panic - not syncing: Fatal exception
+[ 0.922590] Kernel Offset: disabled
+
+Fixes: 0545a3037773 ("pkt_sched: QFQ - quick fair queue scheduler")
+Signed-off-by: Xiang Mei <xmei5@asu.edu>
+Link: https://patch.msgid.link/20260106034100.1780779-1-xmei5@asu.edu
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_qfq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index 896ff7c741110..80a7173843b90 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -1483,7 +1483,7 @@ static void qfq_reset_qdisc(struct Qdisc *sch)
+
+ for (i = 0; i < q->clhash.hashsize; i++) {
+ hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
+- if (cl->qdisc->q.qlen > 0)
++ if (cl_is_active(cl))
+ qfq_deactivate_class(q, cl);
+
+ qdisc_reset(cl->qdisc);
+--
+2.51.0
+
--- /dev/null
+From 97ff4703c10a8fa9fca74a198eecc7de71379ce7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 04:35:35 +0800
+Subject: net: sock: fix hardened usercopy panic in sock_recv_errqueue
+
+From: Weiming Shi <bestswngs@gmail.com>
+
+[ Upstream commit 2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20 ]
+
+skbuff_fclone_cache was created without defining a usercopy region,
+[1] unlike skbuff_head_cache which properly whitelists the cb[] field.
+[2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is
+enabled and the kernel attempts to copy sk_buff.cb data to userspace
+via sock_recv_errqueue() -> put_cmsg().
+
+The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone()
+ (from skbuff_fclone_cache) [1]
+2. The skb is cloned via skb_clone() using the pre-allocated fclone
+[3] 3. The cloned skb is queued to sk_error_queue for timestamp
+reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE)
+5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb
+[4] 6. __check_heap_object() fails because skbuff_fclone_cache has no
+ usercopy whitelist [5]
+
+When cloned skbs allocated from skbuff_fclone_cache are used in the
+socket error queue, accessing the sock_exterr_skb structure in skb->cb
+via put_cmsg() triggers a usercopy hardening violation:
+
+[ 5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' (offset 296, size 16)!
+[ 5.382796] kernel BUG at mm/usercopy.c:102!
+[ 5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
+[ 5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7
+[ 5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
+[ 5.384903] RIP: 0010:usercopy_abort+0x6c/0x80
+[ 5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff <0f> 0b 490
+[ 5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246
+[ 5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74
+[ 5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0
+[ 5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74
+[ 5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001
+[ 5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00
+[ 5.384903] FS: 0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000
+[ 5.384903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0
+[ 5.384903] PKRU: 55555554
+[ 5.384903] Call Trace:
+[ 5.384903] <TASK>
+[ 5.384903] __check_heap_object+0x9a/0xd0
+[ 5.384903] __check_object_size+0x46c/0x690
+[ 5.384903] put_cmsg+0x129/0x5e0
+[ 5.384903] sock_recv_errqueue+0x22f/0x380
+[ 5.384903] tls_sw_recvmsg+0x7ed/0x1960
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5.384903] ? schedule+0x6d/0x270
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5.384903] ? mutex_unlock+0x81/0xd0
+[ 5.384903] ? __pfx_mutex_unlock+0x10/0x10
+[ 5.384903] ? __pfx_tls_sw_recvmsg+0x10/0x10
+[ 5.384903] ? _raw_spin_lock_irqsave+0x8f/0xf0
+[ 5.384903] ? _raw_read_unlock_irqrestore+0x20/0x40
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+
+The crash offset 296 corresponds to skb2->cb within skbuff_fclones:
+ - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 -
+ offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 =
+ 272 + 24 (inside sock_exterr_skb.ee)
+
+This patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure.
+
+[1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885
+[2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104
+[3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566
+[4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491
+[5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719
+
+Fixes: 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0")
+Reported-by: Xiang Mei <xmei5@asu.edu>
+Signed-off-by: Weiming Shi <bestswngs@gmail.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20251223203534.1392218-2-bestswngs@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 7702033680e7b..6c178b4742666 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3614,7 +3614,7 @@ void sock_enable_timestamp(struct sock *sk, enum sock_flags flag)
+ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+ int level, int type)
+ {
+- struct sock_exterr_skb *serr;
++ struct sock_extended_err ee;
+ struct sk_buff *skb;
+ int copied, err;
+
+@@ -3634,8 +3634,9 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+
+ sock_recv_timestamp(msg, sk, skb);
+
+- serr = SKB_EXT_ERR(skb);
+- put_cmsg(msg, level, type, sizeof(serr->ee), &serr->ee);
++ /* We must use a bounce buffer for CONFIG_HARDENED_USERCOPY=y */
++ ee = SKB_EXT_ERR(skb)->ee;
++ put_cmsg(msg, level, type, sizeof(ee), &ee);
+
+ msg->msg_flags |= MSG_ERRQUEUE;
+ err = copied;
+--
+2.51.0
+
--- /dev/null
+From 32b948eba20db349a345d3fe51587683a328ba32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 10:48:21 +0200
+Subject: net: usb: pegasus: fix memory leak in update_eth_regs_async()
+
+From: Petko Manolov <petkan@nucleusys.com>
+
+[ Upstream commit afa27621a28af317523e0836dad430bec551eb54 ]
+
+When asynchronously writing to the device registers and if usb_submit_urb()
+fail, the code fail to release allocated to this point resources.
+
+Fixes: 323b34963d11 ("drivers: net: usb: pegasus: fix control urb submission")
+Signed-off-by: Petko Manolov <petkan@nucleusys.com>
+Link: https://patch.msgid.link/20260106084821.3746677-1-petko.manolov@konsulko.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/pegasus.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
+index 81ca64debc5b9..c514483134f05 100644
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -168,6 +168,8 @@ static int update_eth_regs_async(pegasus_t *pegasus)
+ netif_device_detach(pegasus->net);
+ netif_err(pegasus, drv, pegasus->net,
+ "%s returned %d\n", __func__, ret);
++ usb_free_urb(async_urb);
++ kfree(req);
+ }
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 219d846710d0b0e27f78cb96bdaa444960671288 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Dec 2025 07:18:53 +0000
+Subject: net: wwan: iosm: Fix memory leak in ipc_mux_deinit()
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit 92e6e0a87f6860a4710f9494f8c704d498ae60f8 ]
+
+Commit 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support")
+allocated memory for pp_qlt in ipc_mux_init() but did not free it in
+ipc_mux_deinit(). This results in a memory leak when the driver is
+unloaded.
+
+Free the allocated memory in ipc_mux_deinit() to fix the leak.
+
+Fixes: 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support")
+Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
+Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Link: https://patch.msgid.link/20251230071853.1062223-1-zilin@seu.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wwan/iosm/iosm_ipc_mux.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wwan/iosm/iosm_ipc_mux.c b/drivers/net/wwan/iosm/iosm_ipc_mux.c
+index fc928b298a984..b846889fcb099 100644
+--- a/drivers/net/wwan/iosm/iosm_ipc_mux.c
++++ b/drivers/net/wwan/iosm/iosm_ipc_mux.c
+@@ -456,6 +456,7 @@ void ipc_mux_deinit(struct iosm_mux *ipc_mux)
+ struct sk_buff_head *free_list;
+ union mux_msg mux_msg;
+ struct sk_buff *skb;
++ int i;
+
+ if (!ipc_mux->initialized)
+ return;
+@@ -479,5 +480,10 @@ void ipc_mux_deinit(struct iosm_mux *ipc_mux)
+ ipc_mux->channel->dl_pipe.is_open = false;
+ }
+
++ if (ipc_mux->protocol != MUX_LITE) {
++ for (i = 0; i < IPC_MEM_MUX_IP_SESSION_ENTRIES; i++)
++ kfree(ipc_mux->ul_adb.pp_qlt[i]);
++ }
++
+ kfree(ipc_mux);
+ }
+--
+2.51.0
+
--- /dev/null
+From d6148642186b4e84419bf8fe80da61bcb925319f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 09:22:24 +0800
+Subject: netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
+
+From: Di Zhu <zhud@hygon.cn>
+
+[ Upstream commit 02d1e1a3f9239cdb3ecf2c6d365fb959d1bf39df ]
+
+Directly increment the TSO features incurs a side effect: it will also
+directly clear the flags in NETIF_F_ALL_FOR_ALL on the master device,
+which can cause issues such as the inability to enable the nocache copy
+feature on the bonding driver.
+
+The fix is to include NETIF_F_ALL_FOR_ALL in the update mask, thereby
+preventing it from being cleared.
+
+Fixes: b0ce3508b25e ("bonding: allow TSO being set on bonding master")
+Signed-off-by: Di Zhu <zhud@hygon.cn>
+Link: https://patch.msgid.link/20251224012224.56185-1-zhud@hygon.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netdevice.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index f44701b82ea80..1c47ab59a2c7f 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -4951,7 +4951,8 @@ netdev_features_t netdev_increment_features(netdev_features_t all,
+ static inline netdev_features_t netdev_add_tso_features(netdev_features_t features,
+ netdev_features_t mask)
+ {
+- return netdev_increment_features(features, NETIF_F_ALL_TSO, mask);
++ return netdev_increment_features(features, NETIF_F_ALL_TSO |
++ NETIF_F_ALL_FOR_ALL, mask);
+ }
+
+ int __netdev_update_features(struct net_device *dev);
+--
+2.51.0
+
--- /dev/null
+From 21ff6824681476425aacd973d1fd115653e873cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 15:46:40 +0100
+Subject: netfilter: nf_conncount: update last_gc only when GC has been
+ performed
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 7811ba452402d58628e68faedf38745b3d485e3c ]
+
+Currently last_gc is being updated everytime a new connection is
+tracked, that means that it is updated even if a GC wasn't performed.
+With a sufficiently high packet rate, it is possible to always bypass
+the GC, causing the list to grow infinitely.
+
+Update the last_gc value only when a GC has been actually performed.
+
+Fixes: d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conncount.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
+index c00b8e522c5a7..a2c5a7ba0c6fc 100644
+--- a/net/netfilter/nf_conncount.c
++++ b/net/netfilter/nf_conncount.c
+@@ -229,6 +229,7 @@ static int __nf_conncount_add(struct net *net,
+
+ nf_ct_put(found_ct);
+ }
++ list->last_gc = (u32)jiffies;
+
+ add_new_node:
+ if (WARN_ON_ONCE(list->count > INT_MAX)) {
+@@ -248,7 +249,6 @@ static int __nf_conncount_add(struct net *net,
+ conn->jiffies32 = (u32)jiffies;
+ list_add_tail(&conn->node, &list->head);
+ list->count++;
+- list->last_gc = (u32)jiffies;
+
+ out_put:
+ if (refcounted)
+--
+2.51.0
+
--- /dev/null
+From c2a2de39a808c4079b5e5e2bea26e4c5893b6df1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 12:48:26 +0000
+Subject: netfilter: nf_tables: fix memory leak in nf_tables_newrule()
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit d077e8119ddbb4fca67540f1a52453631a47f221 ]
+
+In nf_tables_newrule(), if nft_use_inc() fails, the function jumps to
+the err_release_rule label without freeing the allocated flow, leading
+to a memory leak.
+
+Fix this by adding a new label err_destroy_flow and jumping to it when
+nft_use_inc() fails. This ensures that the flow is properly released
+in this error case.
+
+Fixes: 1689f25924ada ("netfilter: nf_tables: report use refcount overflow")
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index b278f493cc93c..d154e3e0c9803 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -3811,7 +3811,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
+
+ if (!nft_use_inc(&chain->use)) {
+ err = -EMFILE;
+- goto err_release_rule;
++ goto err_destroy_flow;
+ }
+
+ if (info->nlh->nlmsg_flags & NLM_F_REPLACE) {
+@@ -3861,6 +3861,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
+
+ err_destroy_flow_rule:
+ nft_use_dec_restore(&chain->use);
++err_destroy_flow:
+ if (flow)
+ nft_flow_rule_destroy(flow);
+ err_release_rule:
+--
+2.51.0
+
--- /dev/null
+From 75f05cc2b5fe98882df346d699367b5c90b98f38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 21:21:59 +0100
+Subject: netfilter: nft_synproxy: avoid possible data-race on update operation
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 36a3200575642846a96436d503d46544533bb943 ]
+
+During nft_synproxy eval we are reading nf_synproxy_info struct which
+can be modified on update operation concurrently. As nf_synproxy_info
+struct fits in 32 bits, use READ_ONCE/WRITE_ONCE annotations.
+
+Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_synproxy.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
+index a450f28a5ef60..0cc638553aef2 100644
+--- a/net/netfilter/nft_synproxy.c
++++ b/net/netfilter/nft_synproxy.c
+@@ -48,7 +48,7 @@ static void nft_synproxy_eval_v4(const struct nft_synproxy *priv,
+ struct tcphdr *_tcph,
+ struct synproxy_options *opts)
+ {
+- struct nf_synproxy_info info = priv->info;
++ struct nf_synproxy_info info = READ_ONCE(priv->info);
+ struct net *net = nft_net(pkt);
+ struct synproxy_net *snet = synproxy_pernet(net);
+ struct sk_buff *skb = pkt->skb;
+@@ -79,7 +79,7 @@ static void nft_synproxy_eval_v6(const struct nft_synproxy *priv,
+ struct tcphdr *_tcph,
+ struct synproxy_options *opts)
+ {
+- struct nf_synproxy_info info = priv->info;
++ struct nf_synproxy_info info = READ_ONCE(priv->info);
+ struct net *net = nft_net(pkt);
+ struct synproxy_net *snet = synproxy_pernet(net);
+ struct sk_buff *skb = pkt->skb;
+@@ -340,7 +340,7 @@ static void nft_synproxy_obj_update(struct nft_object *obj,
+ struct nft_synproxy *newpriv = nft_obj_data(newobj);
+ struct nft_synproxy *priv = nft_obj_data(obj);
+
+- priv->info = newpriv->info;
++ WRITE_ONCE(priv->info, newpriv->info);
+ }
+
+ static struct nft_object_type nft_synproxy_obj_type;
+--
+2.51.0
+
scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch
scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch
scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch
+arm64-dts-add-off-on-delay-us-for-usdhc2-regulator.patch
+arm-dts-imx6q-ba16-fix-rtc-interrupt-level.patch
+arm64-dts-imx8mp-fix-lan8740ai-phy-reference-clock-o.patch
+netfilter-nft_synproxy-avoid-possible-data-race-on-u.patch
+netfilter-nf_tables-fix-memory-leak-in-nf_tables_new.patch
+netfilter-nf_conncount-update-last_gc-only-when-gc-h.patch
+net-marvell-prestera-fix-null-dereference-on-devlink.patch
+bridge-fix-c-vlan-preservation-in-802.1ad-vlan_tunne.patch
+net-mscc-ocelot-fix-crash-when-adding-interface-unde.patch
+inet-ping-fix-icmp-out-counting.patch
+net-sock-fix-hardened-usercopy-panic-in-sock_recv_er.patch
+netdev-preserve-netif_f_all_for_all-across-tso-updat.patch
+net-mlx5e-don-t-print-error-message-due-to-invalid-m.patch
+net-wwan-iosm-fix-memory-leak-in-ipc_mux_deinit.patch
+eth-bnxt-move-and-rename-reset-helpers.patch
+bnxt_en-fix-potential-data-corruption-with-hw-gro-lr.patch
+net-fix-memory-leak-in-skb_segment_list-for-gro-pack.patch
+hid-quirks-work-around-vid-pid-conflict-for-appledis.patch
+net-sched-sch_qfq-fix-null-deref-when-deactivating-i.patch
+net-usb-pegasus-fix-memory-leak-in-update_eth_regs_a.patch
+net-enetc-fix-build-warning-when-page_size-is-greate.patch
+arp-do-not-assume-dev_hard_header-does-not-change-sk.patch
--- /dev/null
+From b7bcf21c2fe12200529a85d113ebe5bafb75acd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 11:56:05 +0200
+Subject: ARM: dts: imx6q-ba16: fix RTC interrupt level
+
+From: Ian Ray <ian.ray@gehealthcare.com>
+
+[ Upstream commit e6a4eedd49ce27c16a80506c66a04707e0ee0116 ]
+
+RTC interrupt level should be set to "LOW". This was revealed by the
+introduction of commit:
+
+ f181987ef477 ("rtc: m41t80: use IRQ flags obtained from fwnode")
+
+which changed the way IRQ type is obtained.
+
+Fixes: 56c27310c1b4 ("ARM: dts: imx: Add Advantech BA-16 Qseven module")
+Signed-off-by: Ian Ray <ian.ray@gehealthcare.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi b/arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi
+index 09d9ca0cb3324..0f28b140ec811 100644
+--- a/arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi
++++ b/arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi
+@@ -335,7 +335,7 @@ rtc@32 {
+ pinctrl-0 = <&pinctrl_rtc>;
+ reg = <0x32>;
+ interrupt-parent = <&gpio4>;
+- interrupts = <10 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <10 IRQ_TYPE_LEVEL_LOW>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 572c930dd4d4433f809060583c94ba928011345d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 11:22:40 +0800
+Subject: arm64: dts: add off-on-delay-us for usdhc2 regulator
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+[ Upstream commit ca643894a37a25713029b36cfe7d1bae515cac08 ]
+
+For SD card, according to the spec requirement, for sd card power reset
+operation, it need sd card supply voltage to be lower than 0.5v and keep
+over 1ms, otherwise, next time power back the sd card supply voltage to
+3.3v, sd card can't support SD3.0 mode again.
+
+To match such requirement on imx8qm-mek board, add 4.8ms delay between
+sd power off and power on.
+
+Fixes: 307fd14d4b14 ("arm64: dts: imx: add imx8qm mek support")
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+index 9d031f6334965..19c8d7ce1d409 100644
+--- a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
++++ b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+@@ -132,6 +132,7 @@ reg_usdhc2_vmmc: usdhc2-vmmc {
+ regulator-max-microvolt = <3000000>;
+ gpio = <&lsio_gpio4 7 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
++ off-on-delay-us = <4800>;
+ };
+
+ reg_fec2_supply: regulator-fec2-nvcc {
+--
+2.51.0
+
--- /dev/null
+From 3549b7f0488d04079ea312dc4af46567a0469845 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 14:41:51 +0100
+Subject: arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH
+ electronics i.MX8M Plus DHCOM
+
+From: Marek Vasut <marek.vasut@mailbox.org>
+
+[ Upstream commit c63749a7ddc59ac6ec0b05abfa0a21af9f2c1d38 ]
+
+Add missing 'clocks' property to LAN8740Ai PHY node, to allow the PHY driver
+to manage LAN8740Ai CLKIN reference clock supply. This fixes sporadic link
+bouncing caused by interruptions on the PHY reference clock, by letting the
+PHY driver manage the reference clock and assure there are no interruptions.
+
+This follows the matching PHY driver recommendation described in commit
+bedd8d78aba3 ("net: phy: smsc: LAN8710/20: add phy refclk in support")
+
+Fixes: 8d6712695bc8 ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2")
+Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
+Tested-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi
+index 6835f28c1e3c5..1141b26d6b6f9 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi
+@@ -113,6 +113,7 @@ mdio {
+ ethphy0f: ethernet-phy@1 { /* SMSC LAN8740Ai */
+ compatible = "ethernet-phy-id0007.c110",
+ "ethernet-phy-ieee802.3-c22";
++ clocks = <&clk IMX8MP_CLK_ENET_QOS>;
+ interrupt-parent = <&gpio3>;
+ interrupts = <19 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-0 = <&pinctrl_ethphy0>;
+--
+2.51.0
+
--- /dev/null
+From f033bb5c547ffe89000eadd3a462e4266be0b04c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 09:59:56 +0800
+Subject: arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart
+
+From: Sherry Sun <sherry.sun@nxp.com>
+
+[ Upstream commit a988caeed9d918452aa0a68de2c6e94d86aa43ba ]
+
+The commit 616effc0272b5 ("arm64: dts: imx8: Fix lpuart DMA channel
+order") swap uart rx and tx channel at common imx8-ss-dma.dtsi. But miss
+update imx8qm-ss-dma.dtsi.
+
+The commit 5a8e9b022e569 ("arm64: dts: imx8qm-ss-dma: Pass lpuart
+dma-names") just simple add dma-names as binding doc requirement.
+
+Correct lpuart0 - lpuart3 dma rx and tx channels, and use defines for
+the FSL_EDMA_RX flag.
+
+Fixes: 5a8e9b022e56 ("arm64: dts: imx8qm-ss-dma: Pass lpuart dma-names")
+Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi b/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi
+index aa9f28c4431d0..f381e2636c3ad 100644
+--- a/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi
+@@ -168,25 +168,25 @@ &flexcan3 {
+
+ &lpuart0 {
+ compatible = "fsl,imx8qm-lpuart", "fsl,imx8qxp-lpuart";
+- dmas = <&edma2 13 0 0>, <&edma2 12 0 1>;
++ dmas = <&edma2 12 0 FSL_EDMA_RX>, <&edma2 13 0 0>;
+ dma-names = "rx","tx";
+ };
+
+ &lpuart1 {
+ compatible = "fsl,imx8qm-lpuart", "fsl,imx8qxp-lpuart";
+- dmas = <&edma2 15 0 0>, <&edma2 14 0 1>;
++ dmas = <&edma2 14 0 FSL_EDMA_RX>, <&edma2 15 0 0>;
+ dma-names = "rx","tx";
+ };
+
+ &lpuart2 {
+ compatible = "fsl,imx8qm-lpuart", "fsl,imx8qxp-lpuart";
+- dmas = <&edma2 17 0 0>, <&edma2 16 0 1>;
++ dmas = <&edma2 16 0 FSL_EDMA_RX>, <&edma2 17 0 0>;
+ dma-names = "rx","tx";
+ };
+
+ &lpuart3 {
+ compatible = "fsl,imx8qm-lpuart", "fsl,imx8qxp-lpuart";
+- dmas = <&edma2 19 0 0>, <&edma2 18 0 1>;
++ dmas = <&edma2 18 0 FSL_EDMA_RX>, <&edma2 19 0 0>;
+ dma-names = "rx","tx";
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 34c8d60e871b4422ee1f863628c29a3c242cfb53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 14:15:28 +0100
+Subject: arm64: dts: mba8mx: Fix Ethernet PHY IRQ support
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 89e87d0dc87eb3654c9ae01afc4a18c1c6d1e523 ]
+
+Ethernet PHY interrupt mode is level triggered. Adjust the mode
+accordingly.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Fixes: 70cf622bb16e ("arm64: dts: mba8mx: Add Ethernet PHY IRQ support")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/mba8mx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/mba8mx.dtsi b/arch/arm64/boot/dts/freescale/mba8mx.dtsi
+index c60c7a9e54aff..66f927198fe94 100644
+--- a/arch/arm64/boot/dts/freescale/mba8mx.dtsi
++++ b/arch/arm64/boot/dts/freescale/mba8mx.dtsi
+@@ -186,7 +186,7 @@ ethphy0: ethernet-phy@e {
+ reset-assert-us = <500000>;
+ reset-deassert-us = <500>;
+ interrupt-parent = <&expander2>;
+- interrupts = <6 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <6 IRQ_TYPE_LEVEL_LOW>;
+ };
+ };
+ };
+--
+2.51.0
+
--- /dev/null
+From ec71a3cdebe391ec733b6f1ead4ebe9b4a34d547 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 13:27:33 +0100
+Subject: arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema
+ warnings
+
+From: Wadim Egorov <w.egorov@phytec.de>
+
+[ Upstream commit cf5e8adebe77917a4cc95e43e461cdbd857591ce ]
+
+Rename pinctrl nodes to comply with naming conventions required by
+pinctrl-single schema.
+
+Fixes: e569152274fec ("arm64: dts: ti: am62-lp-sk: Add overlay for NAND expansion card")
+Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
+Link: https://patch.msgid.link/20251127122733.2523367-3-w.egorov@phytec.de
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62-lp-sk-nand.dtso | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62-lp-sk-nand.dtso b/arch/arm64/boot/dts/ti/k3-am62-lp-sk-nand.dtso
+index 173ac60723b64..b4daa674eaa1e 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62-lp-sk-nand.dtso
++++ b/arch/arm64/boot/dts/ti/k3-am62-lp-sk-nand.dtso
+@@ -14,7 +14,7 @@
+ };
+
+ &main_pmx0 {
+- gpmc0_pins_default: gpmc0-pins-default {
++ gpmc0_pins_default: gpmc0-default-pins {
+ pinctrl-single,pins = <
+ AM62X_IOPAD(0x003c, PIN_INPUT, 0) /* (K19) GPMC0_AD0 */
+ AM62X_IOPAD(0x0040, PIN_INPUT, 0) /* (L19) GPMC0_AD1 */
+--
+2.51.0
+
--- /dev/null
+From 97f2ec3249c44d5a15c9180f87780c1ff4237c83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 21:22:50 +0000
+Subject: arp: do not assume dev_hard_header() does not change skb->head
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit c92510f5e3f82ba11c95991824a41e59a9c5ed81 ]
+
+arp_create() is the only dev_hard_header() caller
+making assumption about skb->head being unchanged.
+
+A recent commit broke this assumption.
+
+Initialize @arp pointer after dev_hard_header() call.
+
+Fixes: db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust")
+Reported-by: syzbot+58b44a770a1585795351@syzkaller.appspotmail.com
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260107212250.384552-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/arp.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
+index 8fb48f42581ce..7822b21445148 100644
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -564,7 +564,7 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
+
+ skb_reserve(skb, hlen);
+ skb_reset_network_header(skb);
+- arp = skb_put(skb, arp_hdr_len(dev));
++ skb_put(skb, arp_hdr_len(dev));
+ skb->dev = dev;
+ skb->protocol = htons(ETH_P_ARP);
+ if (!src_hw)
+@@ -572,12 +572,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
+ if (!dest_hw)
+ dest_hw = dev->broadcast;
+
+- /*
+- * Fill the device header for the ARP frame
++ /* Fill the device header for the ARP frame.
++ * Note: skb->head can be changed.
+ */
+ if (dev_hard_header(skb, dev, ptype, dest_hw, src_hw, skb->len) < 0)
+ goto out;
+
++ arp = arp_hdr(skb);
+ /*
+ * Fill out the arp protocol part.
+ *
+--
+2.51.0
+
--- /dev/null
+From ee9802d1f30ffb7f2f8aa66e80a9f3ea07d75d4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Dec 2025 00:36:25 -0800
+Subject: bnxt_en: Fix potential data corruption with HW GRO/LRO
+
+From: Srijit Bose <srijit.bose@broadcom.com>
+
+[ Upstream commit ffeafa65b2b26df2f5b5a6118d3174f17bd12ec5 ]
+
+Fix the max number of bits passed to find_first_zero_bit() in
+bnxt_alloc_agg_idx(). We were incorrectly passing the number of
+long words. find_first_zero_bit() may fail to find a zero bit and
+cause a wrong ID to be used. If the wrong ID is already in use, this
+can cause data corruption. Sometimes an error like this can also be
+seen:
+
+bnxt_en 0000:83:00.0 enp131s0np0: TPA end agg_buf 2 != expected agg_bufs 1
+
+Fix it by passing the correct number of bits MAX_TPA_P5. Use
+DECLARE_BITMAP() to more cleanly define the bitmap. Add a sanity
+check to warn if a bit cannot be found and reset the ring [MChan].
+
+Fixes: ec4d8e7cf024 ("bnxt_en: Add TPA ID mapping logic for 57500 chips.")
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Srijit Bose <srijit.bose@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20251231083625.3911652-1-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 15 ++++++++++++---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 +---
+ 2 files changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index a3491b8383f5a..1f5149d45b089 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1412,9 +1412,11 @@ static u16 bnxt_alloc_agg_idx(struct bnxt_rx_ring_info *rxr, u16 agg_id)
+ struct bnxt_tpa_idx_map *map = rxr->rx_tpa_idx_map;
+ u16 idx = agg_id & MAX_TPA_P5_MASK;
+
+- if (test_bit(idx, map->agg_idx_bmap))
+- idx = find_first_zero_bit(map->agg_idx_bmap,
+- BNXT_AGG_IDX_BMAP_SIZE);
++ if (test_bit(idx, map->agg_idx_bmap)) {
++ idx = find_first_zero_bit(map->agg_idx_bmap, MAX_TPA_P5);
++ if (idx >= MAX_TPA_P5)
++ return INVALID_HW_RING_ID;
++ }
+ __set_bit(idx, map->agg_idx_bmap);
+ map->agg_id_tbl[agg_id] = idx;
+ return idx;
+@@ -1478,6 +1480,13 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
+ if (bp->flags & BNXT_FLAG_CHIP_P5_PLUS) {
+ agg_id = TPA_START_AGG_ID_P5(tpa_start);
+ agg_id = bnxt_alloc_agg_idx(rxr, agg_id);
++ if (unlikely(agg_id == INVALID_HW_RING_ID)) {
++ netdev_warn(bp->dev, "Unable to allocate agg ID for ring %d, agg 0x%x\n",
++ rxr->bnapi->index,
++ TPA_START_AGG_ID_P5(tpa_start));
++ bnxt_sched_reset_rxr(bp, rxr);
++ return;
++ }
+ } else {
+ agg_id = TPA_START_AGG_ID(tpa_start);
+ }
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index 37bb9091bf771..38690fdc3c46c 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1070,11 +1070,9 @@ struct bnxt_tpa_info {
+ struct rx_agg_cmp *agg_arr;
+ };
+
+-#define BNXT_AGG_IDX_BMAP_SIZE (MAX_TPA_P5 / BITS_PER_LONG)
+-
+ struct bnxt_tpa_idx_map {
+ u16 agg_id_tbl[1024];
+- unsigned long agg_idx_bmap[BNXT_AGG_IDX_BMAP_SIZE];
++ DECLARE_BITMAP(agg_idx_bmap, MAX_TPA_P5);
+ };
+
+ struct bnxt_rx_ring_info {
+--
+2.51.0
+
--- /dev/null
+From c1d35a52cc2bc23f2080b7dff017473b3578ba7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Dec 2025 03:00:57 +0100
+Subject: bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
+
+From: Alexandre Knecht <knecht.alexandre@gmail.com>
+
+[ Upstream commit 3128df6be147768fe536986fbb85db1d37806a9f ]
+
+When using an 802.1ad bridge with vlan_tunnel, the C-VLAN tag is
+incorrectly stripped from frames during egress processing.
+
+br_handle_egress_vlan_tunnel() uses skb_vlan_pop() to remove the S-VLAN
+from hwaccel before VXLAN encapsulation. However, skb_vlan_pop() also
+moves any "next" VLAN from the payload into hwaccel:
+
+ /* move next vlan tag to hw accel tag */
+ __skb_vlan_pop(skb, &vlan_tci);
+ __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);
+
+For QinQ frames where the C-VLAN sits in the payload, this moves it to
+hwaccel where it gets lost during VXLAN encapsulation.
+
+Fix by calling __vlan_hwaccel_clear_tag() directly, which clears only
+the hwaccel S-VLAN and leaves the payload untouched.
+
+This path is only taken when vlan_tunnel is enabled and tunnel_info
+is configured, so 802.1Q bridges are unaffected.
+
+Tested with 802.1ad bridge + VXLAN vlan_tunnel, verified C-VLAN
+preserved in VXLAN payload via tcpdump.
+
+Fixes: 11538d039ac6 ("bridge: vlan dst_metadata hooks in ingress and egress paths")
+Signed-off-by: Alexandre Knecht <knecht.alexandre@gmail.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20251228020057.2788865-1-knecht.alexandre@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_vlan_tunnel.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/net/bridge/br_vlan_tunnel.c b/net/bridge/br_vlan_tunnel.c
+index a966a6ec82634..257cae9f15698 100644
+--- a/net/bridge/br_vlan_tunnel.c
++++ b/net/bridge/br_vlan_tunnel.c
+@@ -189,7 +189,6 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,
+ IP_TUNNEL_DECLARE_FLAGS(flags) = { };
+ struct metadata_dst *tunnel_dst;
+ __be64 tunnel_id;
+- int err;
+
+ if (!vlan)
+ return 0;
+@@ -199,9 +198,13 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,
+ return 0;
+
+ skb_dst_drop(skb);
+- err = skb_vlan_pop(skb);
+- if (err)
+- return err;
++ /* For 802.1ad (QinQ), skb_vlan_pop() incorrectly moves the C-VLAN
++ * from payload to hwaccel after clearing S-VLAN. We only need to
++ * clear the hwaccel S-VLAN; the C-VLAN must stay in payload for
++ * correct VXLAN encapsulation. This is also correct for 802.1Q
++ * where no C-VLAN exists in payload.
++ */
++ __vlan_hwaccel_clear_tag(skb);
+
+ if (BR_INPUT_SKB_CB(skb)->backup_nhid) {
+ __set_bit(IP_TUNNEL_KEY_BIT, flags);
+--
+2.51.0
+
--- /dev/null
+From 19a1512a8281578ddf02448735cc854fdaffe60d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 15:15:28 +1030
+Subject: btrfs: only enforce free space tree if v1 cache is required for bs <
+ ps cases
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 30bcf4e824aa37d305502f52e1527c7b1eabef3d ]
+
+[BUG]
+Since the introduction of btrfs bs < ps support, v1 cache was never on
+the plan due to its hard coded PAGE_SIZE usage, and the future plan to
+properly deprecate it.
+
+However for bs < ps cases, even if 'nospace_cache,clear_cache' mount
+option is specified, it's never respected and free space tree is always
+enabled:
+
+ mkfs.btrfs -f -O ^bgt,fst $dev
+ mount $dev $mnt -o clear_cache,nospace_cache
+ umount $mnt
+ btrfs ins dump-super $dev
+ ...
+ compat_ro_flags 0x3
+ ( FREE_SPACE_TREE |
+ FREE_SPACE_TREE_VALID )
+ ...
+
+This means a different behavior compared to bs >= ps cases.
+
+[CAUSE]
+The forcing usage of v2 space cache is done inside
+btrfs_set_free_space_cache_settings(), however it never checks if we're
+even using space cache but always enabling v2 cache.
+
+[FIX]
+Instead unconditionally enable v2 cache, only forcing v2 cache if the
+old v1 cache is required.
+
+Now v2 space cache can be properly disabled on bs < ps cases:
+
+ mkfs.btrfs -f -O ^bgt,fst $dev
+ mount $dev $mnt -o clear_cache,nospace_cache
+ umount $mnt
+ btrfs ins dump-super $dev
+ ...
+ compat_ro_flags 0x0
+ ...
+
+Fixes: 9f73f1aef98b ("btrfs: force v2 space cache usage for subpage mount")
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/super.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index b0d4ad7fbe489..833602511f62d 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -722,14 +722,12 @@ bool btrfs_check_options(const struct btrfs_fs_info *info,
+ */
+ void btrfs_set_free_space_cache_settings(struct btrfs_fs_info *fs_info)
+ {
+- if (fs_info->sectorsize < PAGE_SIZE) {
++ if (fs_info->sectorsize < PAGE_SIZE && btrfs_test_opt(fs_info, SPACE_CACHE)) {
++ btrfs_info(fs_info,
++ "forcing free space tree for sector size %u with page size %lu",
++ fs_info->sectorsize, PAGE_SIZE);
+ btrfs_clear_opt(fs_info->mount_opt, SPACE_CACHE);
+- if (!btrfs_test_opt(fs_info, FREE_SPACE_TREE)) {
+- btrfs_info(fs_info,
+- "forcing free space tree for sector size %u with page size %lu",
+- fs_info->sectorsize, PAGE_SIZE);
+- btrfs_set_opt(fs_info->mount_opt, FREE_SPACE_TREE);
+- }
++ btrfs_set_opt(fs_info->mount_opt, FREE_SPACE_TREE);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From a843de87709ad255854694b504ac1d021aa71162 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 11:16:06 +0530
+Subject: crypto: qat - fix duplicate restarting msg during AER error
+
+From: Harshita Bhilwaria <harshita.bhilwaria@intel.com>
+
+[ Upstream commit 961ac9d97be72267255f1ed841aabf6694b17454 ]
+
+The restarting message from PF to VF is sent twice during AER error
+handling: once from adf_error_detected() and again from
+adf_disable_sriov().
+This causes userspace subservices to shutdown unexpectedly when they
+receive a duplicate restarting message after already being restarted.
+
+Avoid calling adf_pf2vf_notify_restarting() and
+adf_pf2vf_wait_for_restarting_complete() from adf_error_detected() so
+that the restarting msg is sent only once from PF to VF.
+
+Fixes: 9567d3dc760931 ("crypto: qat - improve aer error reset handling")
+Signed-off-by: Harshita Bhilwaria <harshita.bhilwaria@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
+Reviewed-by: Ravikumar PM <ravikumar.pm@intel.com>
+Reviewed-by: Srikanth Thokala <srikanth.thokala@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_aer.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_aer.c b/drivers/crypto/intel/qat/qat_common/adf_aer.c
+index 4cb8bd83f5707..bd19d3a14422a 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_aer.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_aer.c
+@@ -41,8 +41,6 @@ static pci_ers_result_t adf_error_detected(struct pci_dev *pdev,
+ adf_error_notifier(accel_dev);
+ adf_pf2vf_notify_fatal_error(accel_dev);
+ adf_dev_restarting_notify(accel_dev);
+- adf_pf2vf_notify_restarting(accel_dev);
+- adf_pf2vf_wait_for_restarting_complete(accel_dev);
+ pci_clear_master(pdev);
+ adf_dev_down(accel_dev);
+
+--
+2.51.0
+
--- /dev/null
+From 4a3ccf8d35bd75083d63e0b9fc04447851a71995 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Dec 2025 15:16:43 +0900
+Subject: drm/amd/display: Apply e4479aecf658 to dml
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 70740454377f1ba3ff32f5df4acd965db99d055b ]
+
+After an innocuous optimization change in clang-22, allmodconfig (which
+enables CONFIG_KASAN and CONFIG_WERROR) breaks with:
+
+ drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_mode_vba_32.c:1724:6: error: stack frame size (3144) exceeds limit (3072) in 'dml32_ModeSupportAndSystemConfigurationFull' [-Werror,-Wframe-larger-than]
+ 1724 | void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib)
+ | ^
+
+With clang-21, this function was already pretty close to the existing
+limit of 3072 bytes.
+
+ drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_mode_vba_32.c:1724:6: error: stack frame size (2904) exceeds limit (2048) in 'dml32_ModeSupportAndSystemConfigurationFull' [-Werror,-Wframe-larger-than]
+ 1724 | void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_lib)
+ | ^
+
+A similar situation occurred in dml2, which was resolved by
+commit e4479aecf658 ("drm/amd/display: Increase sanitizer frame larger
+than limit when compile testing with clang") by increasing the limit for
+clang when compile testing with certain sanitizer enabled, so that
+allmodconfig (an easy testing target) continues to work.
+
+Apply that same change to the dml folder to clear up the warning for
+allmodconfig, unbreaking the build.
+
+Closes: https://github.com/ClangBuiltLinux/linux/issues/2135
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 25314b453cf812150e9951a32007a32bba85707e)
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/Makefile | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/Makefile b/drivers/gpu/drm/amd/display/dc/dml/Makefile
+index e1d500633dfad..54a2af210b4c0 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/Makefile
++++ b/drivers/gpu/drm/amd/display/dc/dml/Makefile
+@@ -30,7 +30,11 @@ dml_rcflags := $(CC_FLAGS_NO_FPU)
+
+ ifneq ($(CONFIG_FRAME_WARN),0)
+ ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)),y)
+- frame_warn_limit := 3072
++ ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_COMPILE_TEST),yy)
++ frame_warn_limit := 4096
++ else
++ frame_warn_limit := 3072
++ endif
+ else
+ frame_warn_limit := 2048
+ endif
+--
+2.51.0
+
--- /dev/null
+From bcd7bdd0c494187cd12567bb893712cd0fee4f27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jan 2025 15:31:19 -0700
+Subject: drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 820ccf8cb2b145ab9fc12651f7f80339614fa46c ]
+
+Currently, there are several files in drm/amd/display that aim to have a
+higher -Wframe-larger-than value to avoid instances of that warning with
+a lower value from the user's configuration. However, with the way that
+it is currently implemented, it does not respect the user's request via
+CONFIG_FRAME_WARN for a higher stack frame limit, which can cause pain
+when new instances of the warning appear and break the build due to
+CONFIG_WERROR.
+
+Adjust the logic to switch from a hard coded -Wframe-larger-than value
+to only using the value as a minimum clamp and deferring to the
+requested value from CONFIG_FRAME_WARN if it is higher.
+
+Suggested-by: Harry Wentland <harry.wentland@amd.com>
+Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Closes: https://lore.kernel.org/2025013003-audience-opposing-7f95@gregkh/
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 70740454377f ("drm/amd/display: Apply e4479aecf658 to dml")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/Makefile | 14 ++++++++-----
+ drivers/gpu/drm/amd/display/dc/dml2/Makefile | 22 ++++++++++++--------
+ 2 files changed, 22 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/Makefile b/drivers/gpu/drm/amd/display/dc/dml/Makefile
+index 46f9c05de16e8..e1d500633dfad 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/Makefile
++++ b/drivers/gpu/drm/amd/display/dc/dml/Makefile
+@@ -29,11 +29,15 @@ dml_ccflags := $(CC_FLAGS_FPU)
+ dml_rcflags := $(CC_FLAGS_NO_FPU)
+
+ ifneq ($(CONFIG_FRAME_WARN),0)
+-ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)),y)
+-frame_warn_flag := -Wframe-larger-than=3072
+-else
+-frame_warn_flag := -Wframe-larger-than=2048
+-endif
++ ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)),y)
++ frame_warn_limit := 3072
++ else
++ frame_warn_limit := 2048
++ endif
++
++ ifeq ($(call test-lt, $(CONFIG_FRAME_WARN), $(frame_warn_limit)),y)
++ frame_warn_flag := -Wframe-larger-than=$(frame_warn_limit)
++ endif
+ endif
+
+ CFLAGS_$(AMDDALPATH)/dc/dml/display_mode_lib.o := $(dml_ccflags)
+diff --git a/drivers/gpu/drm/amd/display/dc/dml2/Makefile b/drivers/gpu/drm/amd/display/dc/dml2/Makefile
+index 986a69c5bd4bc..2a7669a1071e4 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml2/Makefile
++++ b/drivers/gpu/drm/amd/display/dc/dml2/Makefile
+@@ -28,15 +28,19 @@ dml2_ccflags := $(CC_FLAGS_FPU)
+ dml2_rcflags := $(CC_FLAGS_NO_FPU)
+
+ ifneq ($(CONFIG_FRAME_WARN),0)
+-ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)),y)
+-ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_COMPILE_TEST),yy)
+-frame_warn_flag := -Wframe-larger-than=4096
+-else
+-frame_warn_flag := -Wframe-larger-than=3072
+-endif
+-else
+-frame_warn_flag := -Wframe-larger-than=2048
+-endif
++ ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)),y)
++ ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_COMPILE_TEST),yy)
++ frame_warn_limit := 4096
++ else
++ frame_warn_limit := 3072
++ endif
++ else
++ frame_warn_limit := 2048
++ endif
++
++ ifeq ($(call test-lt, $(CONFIG_FRAME_WARN), $(frame_warn_limit)),y)
++ frame_warn_flag := -Wframe-larger-than=$(frame_warn_limit)
++ endif
+ endif
+
+ subdir-ccflags-y += -I$(FULL_AMD_DISPLAY_PATH)/dc/dml2
+--
+2.51.0
+
--- /dev/null
+From d5e2c299b9ab6a726028f3cbd61ed8003ad4578a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 10:38:31 +0800
+Subject: erofs: don't bother with s_stack_depth increasing for now
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 072a7c7cdbea4f91df854ee2bb216256cd619f2a ]
+
+Previously, commit d53cd891f0e4 ("erofs: limit the level of fs stacking
+for file-backed mounts") bumped `s_stack_depth` by one to avoid kernel
+stack overflow when stacking an unlimited number of EROFS on top of
+each other.
+
+This fix breaks composefs mounts, which need EROFS+ovl^2 sometimes
+(and such setups are already used in production for quite a long time).
+
+One way to fix this regression is to bump FILESYSTEM_MAX_STACK_DEPTH
+from 2 to 3, but proving that this is safe in general is a high bar.
+
+After a long discussion on GitHub issues [1] about possible solutions,
+one conclusion is that there is no need to support nesting file-backed
+EROFS mounts on stacked filesystems, because there is always the option
+to use loopback devices as a fallback.
+
+As a quick fix for the composefs regression for this cycle, instead of
+bumping `s_stack_depth` for file backed EROFS mounts, we disallow
+nesting file-backed EROFS over EROFS and over filesystems with
+`s_stack_depth` > 0.
+
+This works for all known file-backed mount use cases (composefs,
+containerd, and Android APEX for some Android vendors), and the fix is
+self-contained.
+
+Essentially, we are allowing one extra unaccounted fs stacking level of
+EROFS below stacking filesystems, but EROFS can only be used in the read
+path (i.e. overlayfs lower layers), which typically has much lower stack
+usage than the write path.
+
+We can consider increasing FILESYSTEM_MAX_STACK_DEPTH later, after more
+stack usage analysis or using alternative approaches, such as splitting
+the `s_stack_depth` limitation according to different combinations of
+stacking.
+
+Fixes: d53cd891f0e4 ("erofs: limit the level of fs stacking for file-backed mounts")
+Reported-and-tested-by: Dusty Mabe <dusty@dustymabe.com>
+Reported-by: Timothée Ravier <tim@siosm.fr>
+Closes: https://github.com/coreos/fedora-coreos-tracker/issues/2087 [1]
+Reported-by: "Alekséi Naidénov" <an@digitaltide.io>
+Closes: https://lore.kernel.org/r/CAFHtUiYv4+=+JP_-JjARWjo6OwcvBj1wtYN=z0QXwCpec9sXtg@mail.gmail.com
+Acked-by: Amir Goldstein <amir73il@gmail.com>
+Acked-by: Alexander Larsson <alexl@redhat.com>
+Reviewed-and-tested-by: Sheng Yong <shengyong1@xiaomi.com>
+Reviewed-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Cc: Christian Brauner <brauner@kernel.org>
+Cc: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/super.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/fs/erofs/super.c b/fs/erofs/super.c
+index 027fd567a4d9f..f0b83beec6b24 100644
+--- a/fs/erofs/super.c
++++ b/fs/erofs/super.c
+@@ -641,14 +641,20 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
+ * fs contexts (including its own) due to self-controlled RO
+ * accesses/contexts and no side-effect changes that need to
+ * context save & restore so it can reuse the current thread
+- * context. However, it still needs to bump `s_stack_depth` to
+- * avoid kernel stack overflow from nested filesystems.
++ * context.
++ * However, we still need to prevent kernel stack overflow due
++ * to filesystem nesting: just ensure that s_stack_depth is 0
++ * to disallow mounting EROFS on stacked filesystems.
++ * Note: s_stack_depth is not incremented here for now, since
++ * EROFS is the only fs supporting file-backed mounts for now.
++ * It MUST change if another fs plans to support them, which
++ * may also require adjusting FILESYSTEM_MAX_STACK_DEPTH.
+ */
+ if (erofs_is_fileio_mode(sbi)) {
+- sb->s_stack_depth =
+- file_inode(sbi->dif0.file)->i_sb->s_stack_depth + 1;
+- if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
+- erofs_err(sb, "maximum fs stacking depth exceeded");
++ inode = file_inode(sbi->dif0.file);
++ if ((inode->i_sb->s_op == &erofs_sops && !sb->s_bdev) ||
++ inode->i_sb->s_stack_depth) {
++ erofs_err(sb, "file-backed mounts cannot be applied to stacked fses");
+ return -ENOTBLK;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 6a9fdc860a6337ebb413c3c43f70f6b4d3a68aa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 19:47:03 +0800
+Subject: erofs: fix file-backed mounts no longer working on EROFS partitions
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 7893cc12251f6f19e7689a4cf3ba803bddbd8437 ]
+
+Sheng Yong reported [1] that Android APEX images didn't work with commit
+072a7c7cdbea ("erofs: don't bother with s_stack_depth increasing for
+now") because "EROFS-formatted APEX file images can be stored within an
+EROFS-formatted Android system partition."
+
+In response, I sent a quick fat-fingered [PATCH v3] to address the
+report. Unfortunately, the updated condition was incorrect:
+
+ if (erofs_is_fileio_mode(sbi)) {
+- sb->s_stack_depth =
+- file_inode(sbi->dif0.file)->i_sb->s_stack_depth + 1;
+- if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
+- erofs_err(sb, "maximum fs stacking depth exceeded");
++ inode = file_inode(sbi->dif0.file);
++ if ((inode->i_sb->s_op == &erofs_sops && !sb->s_bdev) ||
++ inode->i_sb->s_stack_depth) {
+
+The condition `!sb->s_bdev` is always true for all file-backed EROFS
+mounts, making the check effectively a no-op.
+
+The real fix tested and confirmed by Sheng Yong [2] at that time was
+[PATCH v3 RESEND], which correctly ensures the following EROFS^2 setup
+works:
+ EROFS (on a block device) + EROFS (file-backed mount)
+
+But sadly I screwed it up again by upstreaming the outdated [PATCH v3].
+
+This patch applies the same logic as the delta between the upstream
+[PATCH v3] and the real fix [PATCH v3 RESEND].
+
+Reported-by: Sheng Yong <shengyong1@xiaomi.com>
+Closes: https://lore.kernel.org/r/3acec686-4020-4609-aee4-5dae7b9b0093@gmail.com [1]
+Fixes: 072a7c7cdbea ("erofs: don't bother with s_stack_depth increasing for now")
+Link: https://lore.kernel.org/r/243f57b8-246f-47e7-9fb1-27a771e8e9e8@gmail.com [2]
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/super.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/erofs/super.c b/fs/erofs/super.c
+index f0b83beec6b24..bc968cf812bac 100644
+--- a/fs/erofs/super.c
++++ b/fs/erofs/super.c
+@@ -652,7 +652,8 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
+ */
+ if (erofs_is_fileio_mode(sbi)) {
+ inode = file_inode(sbi->dif0.file);
+- if ((inode->i_sb->s_op == &erofs_sops && !sb->s_bdev) ||
++ if ((inode->i_sb->s_op == &erofs_sops &&
++ !inode->i_sb->s_bdev) ||
+ inode->i_sb->s_stack_depth) {
+ erofs_err(sb, "file-backed mounts cannot be applied to stacked fses");
+ return -ENOTBLK;
+--
+2.51.0
+
--- /dev/null
+From dbe80d7eee72d2c41d9e9581f7099ef7dbf618be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 23:37:30 +0800
+Subject: gpio: pca953x: Add support for level-triggered interrupts
+
+From: Potin Lai <potin.lai.pt@gmail.com>
+
+[ Upstream commit 417b0f8d08f878615de9481c6e8827fbc8b57ed2 ]
+
+Adds support for level-triggered interrupts in the PCA953x GPIO
+expander driver. Previously, the driver only supported edge-triggered
+interrupts, which could lead to missed events in scenarios where an
+interrupt condition persists until it is explicitly cleared.
+
+By enabling level-triggered interrupts, the driver can now detect and
+respond to sustained interrupt conditions more reliably.
+
+Signed-off-by: Potin Lai <potin.lai.pt@gmail.com>
+Link: https://lore.kernel.org/r/20250409-gpio-pca953x-level-triggered-irq-v3-1-7f184d814934@gmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Stable-dep-of: 014a17deb412 ("gpio: pca953x: handle short interrupt pulses on PCAL devices")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca953x.c | 32 +++++++++++++++++++++++++++-----
+ 1 file changed, 27 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index bb7c1bf5f856e..76879dc6461c4 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -215,6 +215,8 @@ struct pca953x_chip {
+ DECLARE_BITMAP(irq_stat, MAX_LINE);
+ DECLARE_BITMAP(irq_trig_raise, MAX_LINE);
+ DECLARE_BITMAP(irq_trig_fall, MAX_LINE);
++ DECLARE_BITMAP(irq_trig_level_high, MAX_LINE);
++ DECLARE_BITMAP(irq_trig_level_low, MAX_LINE);
+ #endif
+ atomic_t wakeup_path;
+
+@@ -773,6 +775,8 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
+ pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+
+ bitmap_or(irq_mask, chip->irq_trig_fall, chip->irq_trig_raise, gc->ngpio);
++ bitmap_or(irq_mask, irq_mask, chip->irq_trig_level_high, gc->ngpio);
++ bitmap_or(irq_mask, irq_mask, chip->irq_trig_level_low, gc->ngpio);
+ bitmap_complement(reg_direction, reg_direction, gc->ngpio);
+ bitmap_and(irq_mask, irq_mask, reg_direction, gc->ngpio);
+
+@@ -790,13 +794,15 @@ static int pca953x_irq_set_type(struct irq_data *d, unsigned int type)
+ struct device *dev = &chip->client->dev;
+ irq_hw_number_t hwirq = irqd_to_hwirq(d);
+
+- if (!(type & IRQ_TYPE_EDGE_BOTH)) {
++ if (!(type & IRQ_TYPE_SENSE_MASK)) {
+ dev_err(dev, "irq %d: unsupported type %d\n", d->irq, type);
+ return -EINVAL;
+ }
+
+ assign_bit(hwirq, chip->irq_trig_fall, type & IRQ_TYPE_EDGE_FALLING);
+ assign_bit(hwirq, chip->irq_trig_raise, type & IRQ_TYPE_EDGE_RISING);
++ assign_bit(hwirq, chip->irq_trig_level_low, type & IRQ_TYPE_LEVEL_LOW);
++ assign_bit(hwirq, chip->irq_trig_level_high, type & IRQ_TYPE_LEVEL_HIGH);
+
+ return 0;
+ }
+@@ -809,6 +815,8 @@ static void pca953x_irq_shutdown(struct irq_data *d)
+
+ clear_bit(hwirq, chip->irq_trig_raise);
+ clear_bit(hwirq, chip->irq_trig_fall);
++ clear_bit(hwirq, chip->irq_trig_level_low);
++ clear_bit(hwirq, chip->irq_trig_level_high);
+ }
+
+ static void pca953x_irq_print_chip(struct irq_data *data, struct seq_file *p)
+@@ -839,6 +847,7 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
+ DECLARE_BITMAP(cur_stat, MAX_LINE);
+ DECLARE_BITMAP(new_stat, MAX_LINE);
+ DECLARE_BITMAP(trigger, MAX_LINE);
++ DECLARE_BITMAP(edges, MAX_LINE);
+ int ret;
+
+ ret = pca953x_read_regs(chip, chip->regs->input, cur_stat);
+@@ -856,13 +865,26 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
+
+ bitmap_copy(chip->irq_stat, new_stat, gc->ngpio);
+
+- if (bitmap_empty(trigger, gc->ngpio))
+- return false;
++ if (bitmap_empty(chip->irq_trig_level_high, gc->ngpio) &&
++ bitmap_empty(chip->irq_trig_level_low, gc->ngpio)) {
++ if (bitmap_empty(trigger, gc->ngpio))
++ return false;
++ }
+
+ bitmap_and(cur_stat, chip->irq_trig_fall, old_stat, gc->ngpio);
+ bitmap_and(old_stat, chip->irq_trig_raise, new_stat, gc->ngpio);
+- bitmap_or(new_stat, old_stat, cur_stat, gc->ngpio);
+- bitmap_and(pending, new_stat, trigger, gc->ngpio);
++ bitmap_or(edges, old_stat, cur_stat, gc->ngpio);
++ bitmap_and(pending, edges, trigger, gc->ngpio);
++
++ bitmap_and(cur_stat, new_stat, chip->irq_trig_level_high, gc->ngpio);
++ bitmap_and(cur_stat, cur_stat, chip->irq_mask, gc->ngpio);
++ bitmap_or(pending, pending, cur_stat, gc->ngpio);
++
++ bitmap_complement(cur_stat, new_stat, gc->ngpio);
++ bitmap_and(cur_stat, cur_stat, reg_direction, gc->ngpio);
++ bitmap_and(old_stat, cur_stat, chip->irq_trig_level_low, gc->ngpio);
++ bitmap_and(old_stat, old_stat, chip->irq_mask, gc->ngpio);
++ bitmap_or(pending, pending, old_stat, gc->ngpio);
+
+ return !bitmap_empty(pending, gc->ngpio);
+ }
+--
+2.51.0
+
--- /dev/null
+From 91fd61b4f648dcc38498cd20928766b99d682481 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 16:30:25 +0100
+Subject: gpio: pca953x: handle short interrupt pulses on PCAL devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ernest Van Hoecke <ernest.vanhoecke@toradex.com>
+
+[ Upstream commit 014a17deb41201449f76df2b20c857a9c3294a7c ]
+
+GPIO drivers with latch input support may miss short pulses on input
+pins even when input latching is enabled. The generic interrupt logic in
+the pca953x driver reports interrupts by comparing the current input
+value against the previously sampled one and only signals an event when
+a level change is observed between two reads.
+
+For short pulses, the first edge is captured when the input register is
+read, but if the signal returns to its previous level before the read,
+the second edge is not observed. As a result, successive pulses can
+produce identical input values at read time and no level change is
+detected, causing interrupts to be missed. Below timing diagram shows
+this situation where the top signal is the input pin level and the
+bottom signal indicates the latched value.
+
+─────┐ ┌──*───────────────┐ ┌──*─────────────────┐ ┌──*───
+ │ │ . │ │ . │ │ .
+ │ │ │ │ │ │ │ │ │
+ └──*──┘ │ └──*──┘ │ └──*──┘ │
+Input │ │ │ │ │ │
+ ▼ │ ▼ │ ▼ │
+ IRQ │ IRQ │ IRQ │
+ . . .
+─────┐ .┌──────────────┐ .┌────────────────┐ .┌──
+ │ │ │ │ │ │
+ │ │ │ │ │ │
+ └────────*┘ └────────*┘ └────────*┘
+Latched │ │ │
+ ▼ ▼ ▼
+ READ 0 READ 0 READ 0
+ NO CHANGE NO CHANGE
+
+PCAL variants provide an interrupt status register that records which
+pins triggered an interrupt, but the status and input registers cannot
+be read atomically. The interrupt status is only cleared when the input
+port is read, and the input value must also be read to determine the
+triggering edge. If another interrupt occurs on a different line after
+the status register has been read but before the input register is
+sampled, that event will not be reflected in the earlier status
+snapshot, so relying solely on the interrupt status register is also
+insufficient.
+
+Support for input latching and interrupt status handling was previously
+added by [1], but the interrupt status-based logic was reverted by [2]
+due to these issues. This patch addresses the original problem by
+combining both sources of information. Events indicated by the interrupt
+status register are merged with events detected through the existing
+level-change logic. As a result:
+
+* short pulses, whose second edges are invisible, are detected via the
+ interrupt status register, and
+* interrupts that occur between the status and input reads are still
+ caught by the generic level-change logic.
+
+This significantly improves robustness on devices that signal interrupts
+as short pulses, while avoiding the issues that led to the earlier
+reversion. In practice, even if only the first edge of a pulse is
+observable, the interrupt is reliably detected.
+
+This fixes missed interrupts from an Ilitek touch controller with its
+interrupt line connected to a PCAL6416A, where active-low pulses are
+approximately 200 us long.
+
+[1] commit 44896beae605 ("gpio: pca953x: add PCAL9535 interrupt support for Galileo Gen2")
+[2] commit d6179f6c6204 ("gpio: pca953x: Improve interrupt support")
+
+Fixes: d6179f6c6204 ("gpio: pca953x: Improve interrupt support")
+Signed-off-by: Ernest Van Hoecke <ernest.vanhoecke@toradex.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20251217153050.142057-1-ernestvanhoecke@gmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca953x.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index 76879dc6461c4..34000f699ba7f 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -846,14 +846,35 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
+ DECLARE_BITMAP(old_stat, MAX_LINE);
+ DECLARE_BITMAP(cur_stat, MAX_LINE);
+ DECLARE_BITMAP(new_stat, MAX_LINE);
++ DECLARE_BITMAP(int_stat, MAX_LINE);
+ DECLARE_BITMAP(trigger, MAX_LINE);
+ DECLARE_BITMAP(edges, MAX_LINE);
+ int ret;
+
++ if (chip->driver_data & PCA_PCAL) {
++ /* Read INT_STAT before it is cleared by the input-port read. */
++ ret = pca953x_read_regs(chip, PCAL953X_INT_STAT, int_stat);
++ if (ret)
++ return false;
++ }
++
+ ret = pca953x_read_regs(chip, chip->regs->input, cur_stat);
+ if (ret)
+ return false;
+
++ if (chip->driver_data & PCA_PCAL) {
++ /* Detect short pulses via INT_STAT. */
++ bitmap_and(trigger, int_stat, chip->irq_mask, gc->ngpio);
++
++ /* Apply filter for rising/falling edge selection. */
++ bitmap_replace(new_stat, chip->irq_trig_fall, chip->irq_trig_raise,
++ cur_stat, gc->ngpio);
++
++ bitmap_and(int_stat, new_stat, trigger, gc->ngpio);
++ } else {
++ bitmap_zero(int_stat, gc->ngpio);
++ }
++
+ /* Remove output pins from the equation */
+ pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+
+@@ -867,7 +888,8 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
+
+ if (bitmap_empty(chip->irq_trig_level_high, gc->ngpio) &&
+ bitmap_empty(chip->irq_trig_level_low, gc->ngpio)) {
+- if (bitmap_empty(trigger, gc->ngpio))
++ if (bitmap_empty(trigger, gc->ngpio) &&
++ bitmap_empty(int_stat, gc->ngpio))
+ return false;
+ }
+
+@@ -875,6 +897,7 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
+ bitmap_and(old_stat, chip->irq_trig_raise, new_stat, gc->ngpio);
+ bitmap_or(edges, old_stat, cur_stat, gc->ngpio);
+ bitmap_and(pending, edges, trigger, gc->ngpio);
++ bitmap_or(pending, pending, int_stat, gc->ngpio);
+
+ bitmap_and(cur_stat, new_stat, chip->irq_trig_level_high, gc->ngpio);
+ bitmap_and(cur_stat, cur_stat, chip->irq_mask, gc->ngpio);
+--
+2.51.0
+
--- /dev/null
+From a9a327af3244a579ae41793144086f5c4888f017 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 13:46:41 +0100
+Subject: HID: quirks: work around VID/PID conflict for appledisplay
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit c7fabe4ad9219866c203164a214c474c95b36bf2 ]
+
+For years I wondered why the Apple Cinema Display driver would not
+just work for me. Turns out the hidraw driver instantly takes it
+over. Fix by adding appledisplay VID/PIDs to hid_have_special_driver.
+
+Fixes: 069e8a65cd79 ("Driver for Apple Cinema Display")
+Signed-off-by: René Rebe <rene@exactco.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-quirks.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 2da21415e676c..192b8f63baaab 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -232,6 +232,15 @@ static const struct hid_device_id hid_quirks[] = {
+ * used as a driver. See hid_scan_report().
+ */
+ static const struct hid_device_id hid_have_special_driver[] = {
++#if IS_ENABLED(CONFIG_APPLEDISPLAY)
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9218) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9219) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x921c) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x921d) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9222) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9226) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9236) },
++#endif
+ #if IS_ENABLED(CONFIG_HID_A4TECH)
+ { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
+--
+2.51.0
+
--- /dev/null
+From bd5c311f450ad8cb5fbcd7ac7704b8ab60911de4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 13:20:36 -0800
+Subject: idpf: cap maximum Rx buffer size
+
+From: Joshua Hay <joshua.a.hay@intel.com>
+
+[ Upstream commit 086efe0a1ecc36cffe46640ce12649a4cd3ff171 ]
+
+The HW only supports a maximum Rx buffer size of 16K-128. On systems
+using large pages, the libeth logic can configure the buffer size to be
+larger than this. The upper bound is PAGE_SIZE while the lower bound is
+MTU rounded up to the nearest power of 2. For example, ARM systems with
+a 64K page size and an mtu of 9000 will set the Rx buffer size to 16K,
+which will cause the config Rx queues message to fail.
+
+Initialize the bufq/fill queue buf_len field to the maximum supported
+size. This will trigger the libeth logic to cap the maximum Rx buffer
+size by reducing the upper bound.
+
+Fixes: 74d1412ac8f37 ("idpf: use libeth Rx buffer management for payload buffer")
+Signed-off-by: Joshua Hay <joshua.a.hay@intel.com>
+Acked-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: David Decotigny <ddecotig@google.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_txrx.c | 8 +++++---
+ drivers/net/ethernet/intel/idpf/idpf_txrx.h | 1 +
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+index d03fb063a1efa..3ddf7b1e85ef4 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+@@ -655,9 +655,10 @@ static int idpf_rx_buf_alloc_singleq(struct idpf_rx_queue *rxq)
+ static int idpf_rx_bufs_init_singleq(struct idpf_rx_queue *rxq)
+ {
+ struct libeth_fq fq = {
+- .count = rxq->desc_count,
+- .type = LIBETH_FQE_MTU,
+- .nid = idpf_q_vector_to_mem(rxq->q_vector),
++ .count = rxq->desc_count,
++ .type = LIBETH_FQE_MTU,
++ .buf_len = IDPF_RX_MAX_BUF_SZ,
++ .nid = idpf_q_vector_to_mem(rxq->q_vector),
+ };
+ int ret;
+
+@@ -714,6 +715,7 @@ static int idpf_rx_bufs_init(struct idpf_buf_queue *bufq,
+ .truesize = bufq->truesize,
+ .count = bufq->desc_count,
+ .type = type,
++ .buf_len = IDPF_RX_MAX_BUF_SZ,
+ .hsplit = idpf_queue_has(HSPLIT_EN, bufq),
+ .nid = idpf_q_vector_to_mem(bufq->q_vector),
+ };
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.h b/drivers/net/ethernet/intel/idpf/idpf_txrx.h
+index 48d55b373425b..5f8a9b9f5d5d7 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.h
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.h
+@@ -96,6 +96,7 @@ do { \
+ idx = 0; \
+ } while (0)
+
++#define IDPF_RX_MAX_BUF_SZ (16384 - 128)
+ #define IDPF_RX_BUF_STRIDE 32
+ #define IDPF_RX_BUF_POST_STRIDE 16
+ #define IDPF_LOW_WATERMARK 64
+--
+2.51.0
+
--- /dev/null
+From a856addb4724dcb070ceb8e5df3fb2db2a79965b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:16 -0800
+Subject: idpf: fix memory leak in idpf_vport_rel()
+
+From: Emil Tantilov <emil.s.tantilov@intel.com>
+
+[ Upstream commit f6242b354605faff263ca45882b148200915a3f6 ]
+
+Free vport->rx_ptype_lkup in idpf_vport_rel() to avoid leaking memory
+during a reset. Reported by kmemleak:
+
+unreferenced object 0xff450acac838a000 (size 4096):
+ comm "kworker/u258:5", pid 7732, jiffies 4296830044
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 10 00 00 00 10 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 ................
+ backtrace (crc 3da81902):
+ __kmalloc_cache_noprof+0x469/0x7a0
+ idpf_send_get_rx_ptype_msg+0x90/0x570 [idpf]
+ idpf_init_task+0x1ec/0x8d0 [idpf]
+ process_one_work+0x226/0x6d0
+ worker_thread+0x19e/0x340
+ kthread+0x10f/0x250
+ ret_from_fork+0x251/0x2b0
+ ret_from_fork_asm+0x1a/0x30
+
+Fixes: 0fe45467a104 ("idpf: add create vport and netdev configuration")
+Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index 568b57cb2298e..a0677b3277839 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -968,6 +968,8 @@ static void idpf_vport_rel(struct idpf_vport *vport)
+ kfree(adapter->vport_config[idx]->req_qs_chunks);
+ adapter->vport_config[idx]->req_qs_chunks = NULL;
+ }
++ kfree(vport->rx_ptype_lkup);
++ vport->rx_ptype_lkup = NULL;
+ kfree(vport);
+ adapter->num_alloc_vports--;
+ }
+--
+2.51.0
+
--- /dev/null
+From 907e7665d61da1b19aae6972dd40a59e9b71fb66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:14 -0800
+Subject: idpf: keep the netdev when a reset fails
+
+From: Emil Tantilov <emil.s.tantilov@intel.com>
+
+[ Upstream commit 083029bd8b445595222a3cd14076b880781c1765 ]
+
+During a successful reset the driver would re-allocate vport resources
+while keeping the netdevs intact. However, in case of an error in the
+init task, the netdev of the failing vport will be unregistered,
+effectively removing the network interface:
+
+[ 121.211076] idpf 0000:83:00.0: enabling device (0100 -> 0102)
+[ 121.221976] idpf 0000:83:00.0: Device HW Reset initiated
+[ 124.161229] idpf 0000:83:00.0 ens801f0: renamed from eth0
+[ 124.163364] idpf 0000:83:00.0 ens801f0d1: renamed from eth1
+[ 125.934656] idpf 0000:83:00.0 ens801f0d2: renamed from eth2
+[ 128.218429] idpf 0000:83:00.0 ens801f0d3: renamed from eth3
+
+ip -br a
+ens801f0 UP
+ens801f0d1 UP
+ens801f0d2 UP
+ens801f0d3 UP
+echo 1 > /sys/class/net/ens801f0/device/reset
+
+[ 145.885537] idpf 0000:83:00.0: resetting
+[ 145.990280] idpf 0000:83:00.0: reset done
+[ 146.284766] idpf 0000:83:00.0: HW reset detected
+[ 146.296610] idpf 0000:83:00.0: Device HW Reset initiated
+[ 211.556719] idpf 0000:83:00.0: Transaction timed-out (op:526 cookie:7700 vc_op:526 salt:77 timeout:60000ms)
+[ 272.996705] idpf 0000:83:00.0: Transaction timed-out (op:502 cookie:7800 vc_op:502 salt:78 timeout:60000ms)
+
+ip -br a
+ens801f0d1 DOWN
+ens801f0d2 DOWN
+ens801f0d3 DOWN
+
+Re-shuffle the logic in the error path of the init task to make sure the
+netdevs remain intact. This will allow the driver to attempt recovery via
+subsequent resets, provided the FW is still functional.
+
+The main change is to make sure that idpf_decfg_netdev() is not called
+should the init task fail during a reset. The error handling is
+consolidated under unwind_vports, as the removed labels had the same
+cleanup logic split depending on the point of failure.
+
+Fixes: ce1b75d0635c ("idpf: add ptypes and MAC filter support")
+Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_lib.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index 173ddc2488678..568b57cb2298e 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -1500,6 +1500,10 @@ void idpf_init_task(struct work_struct *work)
+ goto unwind_vports;
+ }
+
++ err = idpf_send_get_rx_ptype_msg(vport);
++ if (err)
++ goto unwind_vports;
++
+ index = vport->idx;
+ vport_config = adapter->vport_config[index];
+
+@@ -1512,15 +1516,11 @@ void idpf_init_task(struct work_struct *work)
+ err = idpf_check_supported_desc_ids(vport);
+ if (err) {
+ dev_err(&pdev->dev, "failed to get required descriptor ids\n");
+- goto cfg_netdev_err;
++ goto unwind_vports;
+ }
+
+ if (idpf_cfg_netdev(vport))
+- goto cfg_netdev_err;
+-
+- err = idpf_send_get_rx_ptype_msg(vport);
+- if (err)
+- goto handle_err;
++ goto unwind_vports;
+
+ /* Once state is put into DOWN, driver is ready for dev_open */
+ np = netdev_priv(vport->netdev);
+@@ -1558,11 +1558,6 @@ void idpf_init_task(struct work_struct *work)
+
+ return;
+
+-handle_err:
+- idpf_decfg_netdev(vport);
+-cfg_netdev_err:
+- idpf_vport_rel(vport);
+- adapter->vports[index] = NULL;
+ unwind_vports:
+ if (default_vport) {
+ for (index = 0; index < adapter->max_vports; index++) {
+--
+2.51.0
+
--- /dev/null
+From 5d40c6e8edfba15ec6b6e85ee00104350466cba1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 14:31:45 +0800
+Subject: inet: ping: Fix icmp out counting
+
+From: yuan.gao <yuan.gao@ucloud.cn>
+
+[ Upstream commit 4c0856c225b39b1def6c9a6bc56faca79550da13 ]
+
+When the ping program uses an IPPROTO_ICMP socket to send ICMP_ECHO
+messages, ICMP_MIB_OUTMSGS is counted twice.
+
+ ping_v4_sendmsg
+ ping_v4_push_pending_frames
+ ip_push_pending_frames
+ ip_finish_skb
+ __ip_make_skb
+ icmp_out_count(net, icmp_type); // first count
+ icmp_out_count(sock_net(sk), user_icmph.type); // second count
+
+However, when the ping program uses an IPPROTO_RAW socket,
+ICMP_MIB_OUTMSGS is counted correctly only once.
+
+Therefore, the first count should be removed.
+
+Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
+Signed-off-by: yuan.gao <yuan.gao@ucloud.cn>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Tested-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20251224063145.3615282-1-yuan.gao@ucloud.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ping.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 37a3fa98d904f..f62b17f59bb4a 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -839,10 +839,8 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ out_free:
+ if (free)
+ kfree(ipc.opt);
+- if (!err) {
+- icmp_out_count(sock_net(sk), user_icmph.type);
++ if (!err)
+ return len;
+- }
+ return err;
+
+ do_confirm:
+--
+2.51.0
+
--- /dev/null
+From 286b69b5c713e4ddbb74e926cd35bdf0db6d37ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 17:12:04 +0800
+Subject: net: enetc: fix build warning when PAGE_SIZE is greater than 128K
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit 4b5bdabb5449b652122e43f507f73789041d4abe ]
+
+The max buffer size of ENETC RX BD is 0xFFFF bytes, so if the PAGE_SIZE
+is greater than 128K, ENETC_RXB_DMA_SIZE and ENETC_RXB_DMA_SIZE_XDP will
+be greater than 0xFFFF, thus causing a build warning.
+
+This will not cause any practical issues because ENETC is currently only
+used on the ARM64 platform, and the max PAGE_SIZE is 64K. So this patch
+is only for fixing the build warning that occurs when compiling ENETC
+drivers for other platforms.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202601050637.kHEKKOG7-lkp@intel.com/
+Fixes: e59bc32df2e9 ("net: enetc: correct the value of ENETC_RXB_TRUESIZE")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260107091204.1980222-1-wei.fang@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h
+index bf72b2825fa68..2b052bea78bc1 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc.h
++++ b/drivers/net/ethernet/freescale/enetc/enetc.h
+@@ -44,9 +44,9 @@ struct enetc_tx_swbd {
+ #define ENETC_RXB_TRUESIZE (PAGE_SIZE >> 1)
+ #define ENETC_RXB_PAD NET_SKB_PAD /* add extra space if needed */
+ #define ENETC_RXB_DMA_SIZE \
+- (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD)
++ min(SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD, 0xffff)
+ #define ENETC_RXB_DMA_SIZE_XDP \
+- (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - XDP_PACKET_HEADROOM)
++ min(SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - XDP_PACKET_HEADROOM, 0xffff)
+
+ struct enetc_rx_swbd {
+ dma_addr_t dma;
+--
+2.51.0
+
--- /dev/null
+From 854c810b6be4ffdab67e7558a4e4ebdb1c4f4ef8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jan 2026 23:31:01 +0200
+Subject: net: fix memory leak in skb_segment_list for GRO packets
+
+From: Mohammad Heib <mheib@redhat.com>
+
+[ Upstream commit 238e03d0466239410b72294b79494e43d4fabe77 ]
+
+When skb_segment_list() is called during packet forwarding, it handles
+packets that were aggregated by the GRO engine.
+
+Historically, the segmentation logic in skb_segment_list assumes that
+individual segments are split from a parent SKB and may need to carry
+their own socket memory accounting. Accordingly, the code transfers
+truesize from the parent to the newly created segments.
+
+Prior to commit ed4cccef64c1 ("gro: fix ownership transfer"), this
+truesize subtraction in skb_segment_list() was valid because fragments
+still carry a reference to the original socket.
+
+However, commit ed4cccef64c1 ("gro: fix ownership transfer") changed
+this behavior by ensuring that fraglist entries are explicitly
+orphaned (skb->sk = NULL) to prevent illegal orphaning later in the
+stack. This change meant that the entire socket memory charge remained
+with the head SKB, but the corresponding accounting logic in
+skb_segment_list() was never updated.
+
+As a result, the current code unconditionally adds each fragment's
+truesize to delta_truesize and subtracts it from the parent SKB. Since
+the fragments are no longer charged to the socket, this subtraction
+results in an effective under-count of memory when the head is freed.
+This causes sk_wmem_alloc to remain non-zero, preventing socket
+destruction and leading to a persistent memory leak.
+
+The leak can be observed via KMEMLEAK when tearing down the networking
+environment:
+
+unreferenced object 0xffff8881e6eb9100 (size 2048):
+ comm "ping", pid 6720, jiffies 4295492526
+ backtrace:
+ kmem_cache_alloc_noprof+0x5c6/0x800
+ sk_prot_alloc+0x5b/0x220
+ sk_alloc+0x35/0xa00
+ inet6_create.part.0+0x303/0x10d0
+ __sock_create+0x248/0x640
+ __sys_socket+0x11b/0x1d0
+
+Since skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST
+packets constructed by GRO, the truesize adjustment is removed.
+
+The call to skb_release_head_state() must be preserved. As documented in
+commit cf673ed0e057 ("net: fix fraglist segmentation reference count
+leak"), it is still required to correctly drop references to SKB
+extensions that may be overwritten during __copy_skb_header().
+
+Fixes: ed4cccef64c1 ("gro: fix ownership transfer")
+Signed-off-by: Mohammad Heib <mheib@redhat.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Link: https://patch.msgid.link/20260104213101.352887-1-mheib@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skbuff.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 6a92c03ee6f42..c3e1395d8ac5c 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4585,12 +4585,14 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
+ {
+ struct sk_buff *list_skb = skb_shinfo(skb)->frag_list;
+ unsigned int tnl_hlen = skb_tnl_header_len(skb);
+- unsigned int delta_truesize = 0;
+ unsigned int delta_len = 0;
+ struct sk_buff *tail = NULL;
+ struct sk_buff *nskb, *tmp;
+ int len_diff, err;
+
++ /* Only skb_gro_receive_list generated skbs arrive here */
++ DEBUG_NET_WARN_ON_ONCE(!(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST));
++
+ skb_push(skb, -skb_network_offset(skb) + offset);
+
+ /* Ensure the head is writeable before touching the shared info */
+@@ -4604,8 +4606,9 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
+ nskb = list_skb;
+ list_skb = list_skb->next;
+
++ DEBUG_NET_WARN_ON_ONCE(nskb->sk);
++
+ err = 0;
+- delta_truesize += nskb->truesize;
+ if (skb_shared(nskb)) {
+ tmp = skb_clone(nskb, GFP_ATOMIC);
+ if (tmp) {
+@@ -4648,7 +4651,6 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
+ goto err_linearize;
+ }
+
+- skb->truesize = skb->truesize - delta_truesize;
+ skb->data_len = skb->data_len - delta_len;
+ skb->len = skb->len - delta_len;
+
+--
+2.51.0
+
--- /dev/null
+From 3ed3d9389a3f11a563ca3299fdd917a0383cb77a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Dec 2025 21:21:18 -0800
+Subject: net: marvell: prestera: fix NULL dereference on devlink_alloc()
+ failure
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit a428e0da1248c353557970848994f35fd3f005e2 ]
+
+devlink_alloc() may return NULL on allocation failure, but
+prestera_devlink_alloc() unconditionally calls devlink_priv() on
+the returned pointer.
+
+This leads to a NULL pointer dereference if devlink allocation fails.
+Add a check for a NULL devlink pointer and return NULL early to avoid
+the crash.
+
+Fixes: 34dd1710f5a3 ("net: marvell: prestera: Add basic devlink support")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Acked-by: Elad Nachman <enachman@marvell.com>
+Link: https://patch.msgid.link/20251230052124.897012-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/prestera/prestera_devlink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/prestera/prestera_devlink.c b/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
+index 2a4c9df4eb797..e63d95c1842f3 100644
+--- a/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
++++ b/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
+@@ -387,6 +387,8 @@ struct prestera_switch *prestera_devlink_alloc(struct prestera_device *dev)
+
+ dl = devlink_alloc(&prestera_dl_ops, sizeof(struct prestera_switch),
+ dev->dev);
++ if (!dl)
++ return NULL;
+
+ return devlink_priv(dl);
+ }
+--
+2.51.0
+
--- /dev/null
+From fa4ce901855f54fc9619600ddcc8ce911acad5a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Dec 2025 15:27:16 +0200
+Subject: net/mlx5e: Don't print error message due to invalid module
+
+From: Gal Pressman <gal@nvidia.com>
+
+[ Upstream commit 144297e2a24e3e54aee1180ec21120ea38822b97 ]
+
+Dumping module EEPROM on newer modules is supported through the netlink
+interface only.
+
+Querying with old userspace ethtool (or other tools, such as 'lshw')
+which still uses the ioctl interface results in an error message that
+could flood dmesg (in addition to the expected error return value).
+The original message was added under the assumption that the driver
+should be able to handle all module types, but now that such flows are
+easily triggered from userspace, it doesn't serve its purpose.
+
+Change the log level of the print in mlx5_query_module_eeprom() to
+debug.
+
+Fixes: bb64143eee8c ("net/mlx5e: Add ethtool support for dump module EEPROM")
+Signed-off-by: Gal Pressman <gal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Link: https://patch.msgid.link/20251225132717.358820-5-mbloch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/port.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+index 389b34d56b751..79c477e05e46c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+@@ -430,7 +430,8 @@ int mlx5_query_module_eeprom(struct mlx5_core_dev *dev,
+ mlx5_qsfp_eeprom_params_set(&query.i2c_address, &query.page, &offset);
+ break;
+ default:
+- mlx5_core_err(dev, "Module ID not recognized: 0x%x\n", module_id);
++ mlx5_core_dbg(dev, "Module ID not recognized: 0x%x\n",
++ module_id);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6f6d219b22586a10ddd1ed17ebe4af215c383632 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Dec 2025 20:36:17 +0000
+Subject: net: mscc: ocelot: Fix crash when adding interface under a lag
+
+From: Jerry Wu <w.7erry@foxmail.com>
+
+[ Upstream commit 34f3ff52cb9fa7dbf04f5c734fcc4cb6ed5d1a95 ]
+
+Commit 15faa1f67ab4 ("lan966x: Fix crash when adding interface under a lag")
+fixed a similar issue in the lan966x driver caused by a NULL pointer dereference.
+The ocelot_set_aggr_pgids() function in the ocelot driver has similar logic
+and is susceptible to the same crash.
+
+This issue specifically affects the ocelot_vsc7514.c frontend, which leaves
+unused ports as NULL pointers. The felix_vsc9959.c frontend is unaffected as
+it uses the DSA framework which registers all ports.
+
+Fix this by checking if the port pointer is valid before accessing it.
+
+Fixes: 528d3f190c98 ("net: mscc: ocelot: drop the use of the "lags" array")
+Signed-off-by: Jerry Wu <w.7erry@foxmail.com>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/tencent_75EF812B305E26B0869C673DD1160866C90A@qq.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index 08bee56aea35f..c345d9b17c892 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -2307,14 +2307,16 @@ static void ocelot_set_aggr_pgids(struct ocelot *ocelot)
+
+ /* Now, set PGIDs for each active LAG */
+ for (lag = 0; lag < ocelot->num_phys_ports; lag++) {
+- struct net_device *bond = ocelot->ports[lag]->bond;
++ struct ocelot_port *ocelot_port = ocelot->ports[lag];
+ int num_active_ports = 0;
++ struct net_device *bond;
+ unsigned long bond_mask;
+ u8 aggr_idx[16];
+
+- if (!bond || (visited & BIT(lag)))
++ if (!ocelot_port || !ocelot_port->bond || (visited & BIT(lag)))
+ continue;
+
++ bond = ocelot_port->bond;
+ bond_mask = ocelot_get_bond_mask(ocelot, bond);
+
+ for_each_set_bit(port, &bond_mask, ocelot->num_phys_ports) {
+--
+2.51.0
+
--- /dev/null
+From 6fdaf470fc8829864475f5ed2697209aab582eab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 00:17:32 +0900
+Subject: net: netdevsim: fix inconsistent carrier state after link/unlink
+
+From: Yohei Kojima <yk@y-koj.net>
+
+[ Upstream commit d83dddffe1904e4a576d11a541878850a8e64cd2 ]
+
+This patch fixes the edge case behavior on ifup/ifdown and
+linking/unlinking two netdevsim interfaces:
+
+1. unlink two interfaces netdevsim1 and netdevsim2
+2. ifdown netdevsim1
+3. ifup netdevsim1
+4. link two interfaces netdevsim1 and netdevsim2
+5. (Now two interfaces are linked in terms of netdevsim peer, but
+ carrier state of the two interfaces remains DOWN.)
+
+This inconsistent behavior is caused by the current implementation,
+which only cares about the "link, then ifup" order, not "ifup, then
+link" order. This patch fixes the inconsistency by calling
+netif_carrier_on() when two netdevsim interfaces are linked.
+
+This patch fixes buggy behavior on NetworkManager-based systems which
+causes the netdevsim test to fail with the following error:
+
+ # timeout set to 600
+ # selftests: drivers/net/netdevsim: peer.sh
+ # 2025/12/25 00:54:03 socat[9115] W address is opened in read-write mode but only supports read-only
+ # 2025/12/25 00:56:17 socat[9115] W connect(7, AF=2 192.168.1.1:1234, 16): Connection timed out
+ # 2025/12/25 00:56:17 socat[9115] E TCP:192.168.1.1:1234: Connection timed out
+ # expected 3 bytes, got 0
+ # 2025/12/25 00:56:17 socat[9109] W exiting on signal 15
+ not ok 13 selftests: drivers/net/netdevsim: peer.sh # exit=1
+
+This patch also solves timeout on TCP Fast Open (TFO) test in
+NetworkManager-based systems because it also depends on netdevsim's
+carrier consistency.
+
+Fixes: 1a8fed52f7be ("netdevsim: set the carrier when the device goes up")
+Signed-off-by: Yohei Kojima <yk@y-koj.net>
+Reviewed-by: Breno Leitao <leitao@debian.org>
+Link: https://patch.msgid.link/602c9e1ba5bb2ee1997bb38b1d866c9c3b807ae9.1767624906.git.yk@y-koj.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/netdevsim/bus.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/netdevsim/bus.c b/drivers/net/netdevsim/bus.c
+index 64c0cdd31bf85..067cbf788da48 100644
+--- a/drivers/net/netdevsim/bus.c
++++ b/drivers/net/netdevsim/bus.c
+@@ -314,6 +314,11 @@ static ssize_t link_device_store(const struct bus_type *bus, const char *buf, si
+ rcu_assign_pointer(nsim_a->peer, nsim_b);
+ rcu_assign_pointer(nsim_b->peer, nsim_a);
+
++ if (netif_running(dev_a) && netif_running(dev_b)) {
++ netif_carrier_on(dev_a);
++ netif_carrier_on(dev_b);
++ }
++
+ out_err:
+ put_net(ns_b);
+ put_net(ns_a);
+@@ -363,6 +368,9 @@ static ssize_t unlink_device_store(const struct bus_type *bus, const char *buf,
+ if (!peer)
+ goto out_put_netns;
+
++ netif_carrier_off(dev);
++ netif_carrier_off(peer->netdev);
++
+ err = 0;
+ RCU_INIT_POINTER(nsim->peer, NULL);
+ RCU_INIT_POINTER(peer->peer, NULL);
+--
+2.51.0
+
--- /dev/null
+From b5fcf92cbc125f9fb834f9cf7103fc4da7de89e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 20:41:00 -0700
+Subject: net/sched: sch_qfq: Fix NULL deref when deactivating inactive
+ aggregate in qfq_reset
+
+From: Xiang Mei <xmei5@asu.edu>
+
+[ Upstream commit c1d73b1480235731e35c81df70b08f4714a7d095 ]
+
+`qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class
+itself is active.
+
+Two qfq_class objects may point to the same leaf_qdisc. This happens
+when:
+
+1. one QFQ qdisc is attached to the dev as the root qdisc, and
+
+2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()
+/ qdisc_put()) and is pending to be destroyed, as in function
+tc_new_tfilter.
+
+When packets are enqueued through the root QFQ qdisc, the shared
+leaf_qdisc->q.qlen increases. At the same time, the second QFQ
+qdisc triggers qdisc_put and qdisc_destroy: the qdisc enters
+qfq_reset() with its own q->q.qlen == 0, but its class's leaf
+qdisc->q.qlen > 0. Therefore, the qfq_reset would wrongly deactivate
+an inactive aggregate and trigger a null-deref in qfq_deactivate_agg:
+
+[ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[ 0.903571] #PF: supervisor write access in kernel mode
+[ 0.903860] #PF: error_code(0x0002) - not-present page
+[ 0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0
+[ 0.904502] Oops: Oops: 0002 [#1] SMP NOPTI
+[ 0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE
+[ 0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
+[ 0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))
+[ 0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0
+
+Code starting with the faulting instruction
+===========================================
+ 0: 0f 84 4d 01 00 00 je 0x153
+ 6: 48 89 70 18 mov %rsi,0x18(%rax)
+ a: 8b 4b 10 mov 0x10(%rbx),%ecx
+ d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx
+ 14: 48 8b 78 08 mov 0x8(%rax),%rdi
+ 18: 48 d3 e2 shl %cl,%rdx
+ 1b: 48 21 f2 and %rsi,%rdx
+ 1e: 48 2b 13 sub (%rbx),%rdx
+ 21: 48 8b 30 mov (%rax),%rsi
+ 24: 48 d3 ea shr %cl,%rdx
+ 27: 8b 4b 18 mov 0x18(%rbx),%ecx
+ ...
+[ 0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246
+[ 0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000
+[ 0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+[ 0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000
+[ 0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000
+[ 0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880
+[ 0.909179] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000
+[ 0.909572] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0
+[ 0.910247] PKRU: 55555554
+[ 0.910391] Call Trace:
+[ 0.910527] <TASK>
+[ 0.910638] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)
+[ 0.910826] qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)
+[ 0.911040] __qdisc_destroy (net/sched/sch_generic.c:1076)
+[ 0.911236] tc_new_tfilter (net/sched/cls_api.c:2447)
+[ 0.911447] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)
+[ 0.911663] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)
+[ 0.911894] netlink_rcv_skb (net/netlink/af_netlink.c:2550)
+[ 0.912100] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)
+[ 0.912296] ? __alloc_skb (net/core/skbuff.c:706)
+[ 0.912484] netlink_sendmsg (net/netlink/af_netlink.c:1894)
+[ 0.912682] sock_write_iter (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1) net/socket.c:1195 (discriminator 1))
+[ 0.912880] vfs_write (fs/read_write.c:593 fs/read_write.c:686)
+[ 0.913077] ksys_write (fs/read_write.c:738)
+[ 0.913252] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
+[ 0.913438] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)
+[ 0.913687] RIP: 0033:0x424c34
+[ 0.913844] Code: 89 02 48 c7 c0 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d 2d 44 09 00 00 74 13 b8 01 00 00 00 0f 05 9
+
+Code starting with the faulting instruction
+===========================================
+ 0: 89 02 mov %eax,(%rdx)
+ 2: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
+ 9: eb bd jmp 0xffffffffffffffc8
+ b: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
+ 12: 00 00 00
+ 15: 90 nop
+ 16: f3 0f 1e fa endbr64
+ 1a: 80 3d 2d 44 09 00 00 cmpb $0x0,0x9442d(%rip) # 0x9444e
+ 21: 74 13 je 0x36
+ 23: b8 01 00 00 00 mov $0x1,%eax
+ 28: 0f 05 syscall
+ 2a: 09 .byte 0x9
+[ 0.914807] RSP: 002b:00007ffea1938b78 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
+[ 0.915197] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000424c34
+[ 0.915556] RDX: 000000000000003c RSI: 000000002af378c0 RDI: 0000000000000003
+[ 0.915912] RBP: 00007ffea1938bc0 R08: 00000000004b8820 R09: 0000000000000000
+[ 0.916297] R10: 0000000000000001 R11: 0000000000000202 R12: 00007ffea1938d28
+[ 0.916652] R13: 00007ffea1938d38 R14: 00000000004b3828 R15: 0000000000000001
+[ 0.917039] </TASK>
+[ 0.917158] Modules linked in:
+[ 0.917316] CR2: 0000000000000000
+[ 0.917484] ---[ end trace 0000000000000000 ]---
+[ 0.917717] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))
+[ 0.917978] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0
+
+Code starting with the faulting instruction
+===========================================
+ 0: 0f 84 4d 01 00 00 je 0x153
+ 6: 48 89 70 18 mov %rsi,0x18(%rax)
+ a: 8b 4b 10 mov 0x10(%rbx),%ecx
+ d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx
+ 14: 48 8b 78 08 mov 0x8(%rax),%rdi
+ 18: 48 d3 e2 shl %cl,%rdx
+ 1b: 48 21 f2 and %rsi,%rdx
+ 1e: 48 2b 13 sub (%rbx),%rdx
+ 21: 48 8b 30 mov (%rax),%rsi
+ 24: 48 d3 ea shr %cl,%rdx
+ 27: 8b 4b 18 mov 0x18(%rbx),%ecx
+ ...
+[ 0.918902] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246
+[ 0.919198] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000
+[ 0.919559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+[ 0.919908] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000
+[ 0.920289] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000
+[ 0.920648] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880
+[ 0.921014] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000
+[ 0.921424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 0.921710] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0
+[ 0.922097] PKRU: 55555554
+[ 0.922240] Kernel panic - not syncing: Fatal exception
+[ 0.922590] Kernel Offset: disabled
+
+Fixes: 0545a3037773 ("pkt_sched: QFQ - quick fair queue scheduler")
+Signed-off-by: Xiang Mei <xmei5@asu.edu>
+Link: https://patch.msgid.link/20260106034100.1780779-1-xmei5@asu.edu
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_qfq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index 5b43578493ef1..998030d6ce2dd 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -1484,7 +1484,7 @@ static void qfq_reset_qdisc(struct Qdisc *sch)
+
+ for (i = 0; i < q->clhash.hashsize; i++) {
+ hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
+- if (cl->qdisc->q.qlen > 0)
++ if (cl_is_active(cl))
+ qfq_deactivate_class(q, cl);
+
+ qdisc_reset(cl->qdisc);
+--
+2.51.0
+
--- /dev/null
+From 045631b9754dbd71408283ad40dd87bc8df74dd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 04:35:35 +0800
+Subject: net: sock: fix hardened usercopy panic in sock_recv_errqueue
+
+From: Weiming Shi <bestswngs@gmail.com>
+
+[ Upstream commit 2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20 ]
+
+skbuff_fclone_cache was created without defining a usercopy region,
+[1] unlike skbuff_head_cache which properly whitelists the cb[] field.
+[2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is
+enabled and the kernel attempts to copy sk_buff.cb data to userspace
+via sock_recv_errqueue() -> put_cmsg().
+
+The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone()
+ (from skbuff_fclone_cache) [1]
+2. The skb is cloned via skb_clone() using the pre-allocated fclone
+[3] 3. The cloned skb is queued to sk_error_queue for timestamp
+reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE)
+5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb
+[4] 6. __check_heap_object() fails because skbuff_fclone_cache has no
+ usercopy whitelist [5]
+
+When cloned skbs allocated from skbuff_fclone_cache are used in the
+socket error queue, accessing the sock_exterr_skb structure in skb->cb
+via put_cmsg() triggers a usercopy hardening violation:
+
+[ 5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' (offset 296, size 16)!
+[ 5.382796] kernel BUG at mm/usercopy.c:102!
+[ 5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
+[ 5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7
+[ 5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
+[ 5.384903] RIP: 0010:usercopy_abort+0x6c/0x80
+[ 5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff <0f> 0b 490
+[ 5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246
+[ 5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74
+[ 5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0
+[ 5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74
+[ 5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001
+[ 5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00
+[ 5.384903] FS: 0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000
+[ 5.384903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0
+[ 5.384903] PKRU: 55555554
+[ 5.384903] Call Trace:
+[ 5.384903] <TASK>
+[ 5.384903] __check_heap_object+0x9a/0xd0
+[ 5.384903] __check_object_size+0x46c/0x690
+[ 5.384903] put_cmsg+0x129/0x5e0
+[ 5.384903] sock_recv_errqueue+0x22f/0x380
+[ 5.384903] tls_sw_recvmsg+0x7ed/0x1960
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5.384903] ? schedule+0x6d/0x270
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5.384903] ? mutex_unlock+0x81/0xd0
+[ 5.384903] ? __pfx_mutex_unlock+0x10/0x10
+[ 5.384903] ? __pfx_tls_sw_recvmsg+0x10/0x10
+[ 5.384903] ? _raw_spin_lock_irqsave+0x8f/0xf0
+[ 5.384903] ? _raw_read_unlock_irqrestore+0x20/0x40
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+
+The crash offset 296 corresponds to skb2->cb within skbuff_fclones:
+ - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 -
+ offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 =
+ 272 + 24 (inside sock_exterr_skb.ee)
+
+This patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure.
+
+[1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885
+[2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104
+[3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566
+[4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491
+[5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719
+
+Fixes: 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0")
+Reported-by: Xiang Mei <xmei5@asu.edu>
+Signed-off-by: Weiming Shi <bestswngs@gmail.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20251223203534.1392218-2-bestswngs@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 97cc796a1d334..58f3f0d979540 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3769,7 +3769,7 @@ void sock_enable_timestamp(struct sock *sk, enum sock_flags flag)
+ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+ int level, int type)
+ {
+- struct sock_exterr_skb *serr;
++ struct sock_extended_err ee;
+ struct sk_buff *skb;
+ int copied, err;
+
+@@ -3789,8 +3789,9 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+
+ sock_recv_timestamp(msg, sk, skb);
+
+- serr = SKB_EXT_ERR(skb);
+- put_cmsg(msg, level, type, sizeof(serr->ee), &serr->ee);
++ /* We must use a bounce buffer for CONFIG_HARDENED_USERCOPY=y */
++ ee = SKB_EXT_ERR(skb)->ee;
++ put_cmsg(msg, level, type, sizeof(ee), &ee);
+
+ msg->msg_flags |= MSG_ERRQUEUE;
+ err = copied;
+--
+2.51.0
+
--- /dev/null
+From 6cff300e013c5eafab2a659ffb5232e24d463022 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 10:48:21 +0200
+Subject: net: usb: pegasus: fix memory leak in update_eth_regs_async()
+
+From: Petko Manolov <petkan@nucleusys.com>
+
+[ Upstream commit afa27621a28af317523e0836dad430bec551eb54 ]
+
+When asynchronously writing to the device registers and if usb_submit_urb()
+fail, the code fail to release allocated to this point resources.
+
+Fixes: 323b34963d11 ("drivers: net: usb: pegasus: fix control urb submission")
+Signed-off-by: Petko Manolov <petkan@nucleusys.com>
+Link: https://patch.msgid.link/20260106084821.3746677-1-petko.manolov@konsulko.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/pegasus.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
+index 81ca64debc5b9..c514483134f05 100644
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -168,6 +168,8 @@ static int update_eth_regs_async(pegasus_t *pegasus)
+ netif_device_detach(pegasus->net);
+ netif_err(pegasus, drv, pegasus->net,
+ "%s returned %d\n", __func__, ret);
++ usb_free_urb(async_urb);
++ kfree(req);
+ }
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 8481990e25d3df489f014ca19434272543d7599e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Dec 2025 07:18:53 +0000
+Subject: net: wwan: iosm: Fix memory leak in ipc_mux_deinit()
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit 92e6e0a87f6860a4710f9494f8c704d498ae60f8 ]
+
+Commit 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support")
+allocated memory for pp_qlt in ipc_mux_init() but did not free it in
+ipc_mux_deinit(). This results in a memory leak when the driver is
+unloaded.
+
+Free the allocated memory in ipc_mux_deinit() to fix the leak.
+
+Fixes: 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support")
+Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
+Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Link: https://patch.msgid.link/20251230071853.1062223-1-zilin@seu.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wwan/iosm/iosm_ipc_mux.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wwan/iosm/iosm_ipc_mux.c b/drivers/net/wwan/iosm/iosm_ipc_mux.c
+index fc928b298a984..b846889fcb099 100644
+--- a/drivers/net/wwan/iosm/iosm_ipc_mux.c
++++ b/drivers/net/wwan/iosm/iosm_ipc_mux.c
+@@ -456,6 +456,7 @@ void ipc_mux_deinit(struct iosm_mux *ipc_mux)
+ struct sk_buff_head *free_list;
+ union mux_msg mux_msg;
+ struct sk_buff *skb;
++ int i;
+
+ if (!ipc_mux->initialized)
+ return;
+@@ -479,5 +480,10 @@ void ipc_mux_deinit(struct iosm_mux *ipc_mux)
+ ipc_mux->channel->dl_pipe.is_open = false;
+ }
+
++ if (ipc_mux->protocol != MUX_LITE) {
++ for (i = 0; i < IPC_MEM_MUX_IP_SESSION_ENTRIES; i++)
++ kfree(ipc_mux->ul_adb.pp_qlt[i]);
++ }
++
+ kfree(ipc_mux);
+ }
+--
+2.51.0
+
--- /dev/null
+From 4dc1c32b435f9cef4cae53534cea876e792324f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 09:22:24 +0800
+Subject: netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
+
+From: Di Zhu <zhud@hygon.cn>
+
+[ Upstream commit 02d1e1a3f9239cdb3ecf2c6d365fb959d1bf39df ]
+
+Directly increment the TSO features incurs a side effect: it will also
+directly clear the flags in NETIF_F_ALL_FOR_ALL on the master device,
+which can cause issues such as the inability to enable the nocache copy
+feature on the bonding driver.
+
+The fix is to include NETIF_F_ALL_FOR_ALL in the update mask, thereby
+preventing it from being cleared.
+
+Fixes: b0ce3508b25e ("bonding: allow TSO being set on bonding master")
+Signed-off-by: Di Zhu <zhud@hygon.cn>
+Link: https://patch.msgid.link/20251224012224.56185-1-zhud@hygon.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netdevice.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 35b886385f329..77a99c8ab01c7 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -4986,7 +4986,8 @@ netdev_features_t netdev_increment_features(netdev_features_t all,
+ static inline netdev_features_t netdev_add_tso_features(netdev_features_t features,
+ netdev_features_t mask)
+ {
+- return netdev_increment_features(features, NETIF_F_ALL_TSO, mask);
++ return netdev_increment_features(features, NETIF_F_ALL_TSO |
++ NETIF_F_ALL_FOR_ALL, mask);
+ }
+
+ int __netdev_update_features(struct net_device *dev);
+--
+2.51.0
+
--- /dev/null
+From 34beff7a4e1a9bf95c961107940b423228af1b21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 15:46:40 +0100
+Subject: netfilter: nf_conncount: update last_gc only when GC has been
+ performed
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 7811ba452402d58628e68faedf38745b3d485e3c ]
+
+Currently last_gc is being updated everytime a new connection is
+tracked, that means that it is updated even if a GC wasn't performed.
+With a sufficiently high packet rate, it is possible to always bypass
+the GC, causing the list to grow infinitely.
+
+Update the last_gc value only when a GC has been actually performed.
+
+Fixes: d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conncount.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
+index 3c1b155f7a0ea..828d5c64c68a3 100644
+--- a/net/netfilter/nf_conncount.c
++++ b/net/netfilter/nf_conncount.c
+@@ -229,6 +229,7 @@ static int __nf_conncount_add(struct net *net,
+
+ nf_ct_put(found_ct);
+ }
++ list->last_gc = (u32)jiffies;
+
+ add_new_node:
+ if (WARN_ON_ONCE(list->count > INT_MAX)) {
+@@ -248,7 +249,6 @@ static int __nf_conncount_add(struct net *net,
+ conn->jiffies32 = (u32)jiffies;
+ list_add_tail(&conn->node, &list->head);
+ list->count++;
+- list->last_gc = (u32)jiffies;
+
+ out_put:
+ if (refcounted)
+--
+2.51.0
+
--- /dev/null
+From c87bf8ab17562619af5b98f0b0620853330c1545 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 12:48:26 +0000
+Subject: netfilter: nf_tables: fix memory leak in nf_tables_newrule()
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit d077e8119ddbb4fca67540f1a52453631a47f221 ]
+
+In nf_tables_newrule(), if nft_use_inc() fails, the function jumps to
+the err_release_rule label without freeing the allocated flow, leading
+to a memory leak.
+
+Fix this by adding a new label err_destroy_flow and jumping to it when
+nft_use_inc() fails. This ensures that the flow is properly released
+in this error case.
+
+Fixes: 1689f25924ada ("netfilter: nf_tables: report use refcount overflow")
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index b4741fb337988..6a2b7ce67e7f3 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4196,7 +4196,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
+
+ if (!nft_use_inc(&chain->use)) {
+ err = -EMFILE;
+- goto err_release_rule;
++ goto err_destroy_flow;
+ }
+
+ if (info->nlh->nlmsg_flags & NLM_F_REPLACE) {
+@@ -4246,6 +4246,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
+
+ err_destroy_flow_rule:
+ nft_use_dec_restore(&chain->use);
++err_destroy_flow:
+ if (flow)
+ nft_flow_rule_destroy(flow);
+ err_release_rule:
+--
+2.51.0
+
--- /dev/null
+From 699d0caa518f7bdd3e65a4478e82b942a9a61b09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 12:20:35 +0100
+Subject: netfilter: nft_set_pipapo: fix range overlap detection
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 7711f4bb4b360d9c0ff84db1c0ec91e385625047 ]
+
+set->klen has to be used, not sizeof(). The latter only compares a
+single register but a full check of the entire key is needed.
+
+Example:
+table ip t {
+ map s {
+ typeof iifname . ip saddr : verdict
+ flags interval
+ }
+}
+
+nft add element t s '{ "lo" . 10.0.0.0/24 : drop }' # no error, expected
+nft add element t s '{ "lo" . 10.0.0.0/24 : drop }' # no error, expected
+nft add element t s '{ "lo" . 10.0.0.0/8 : drop }' # bug: no error
+
+The 3rd 'add element' should be rejected via -ENOTEMPTY, not -EEXIST,
+so userspace / nft can report an error to the user.
+
+The latter is only correct for the 2nd case (re-add of existing element).
+
+As-is, userspace is told that the command was successful, but no elements were
+added.
+
+After this patch, 3rd command gives:
+Error: Could not process rule: File exists
+add element t s { "lo" . 127.0.0.0/8 . "lo" : drop }
+ ^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Fixes: 0eb4b5ee33f2 ("netfilter: nft_set_pipapo: Separate partial and complete overlap cases on insertion")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_set_pipapo.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
+index 793790d79d138..642152e9c3227 100644
+--- a/net/netfilter/nft_set_pipapo.c
++++ b/net/netfilter/nft_set_pipapo.c
+@@ -1303,8 +1303,8 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,
+ else
+ dup_end = dup_key;
+
+- if (!memcmp(start, dup_key->data, sizeof(*dup_key->data)) &&
+- !memcmp(end, dup_end->data, sizeof(*dup_end->data))) {
++ if (!memcmp(start, dup_key->data, set->klen) &&
++ !memcmp(end, dup_end->data, set->klen)) {
+ *elem_priv = &dup->priv;
+ return -EEXIST;
+ }
+--
+2.51.0
+
--- /dev/null
+From 4bc9236733d4bc99e8dd859a3d2f2d4aa4ca3c6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 21:21:59 +0100
+Subject: netfilter: nft_synproxy: avoid possible data-race on update operation
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 36a3200575642846a96436d503d46544533bb943 ]
+
+During nft_synproxy eval we are reading nf_synproxy_info struct which
+can be modified on update operation concurrently. As nf_synproxy_info
+struct fits in 32 bits, use READ_ONCE/WRITE_ONCE annotations.
+
+Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_synproxy.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
+index 5d3e518259859..4d3e5a31b4125 100644
+--- a/net/netfilter/nft_synproxy.c
++++ b/net/netfilter/nft_synproxy.c
+@@ -48,7 +48,7 @@ static void nft_synproxy_eval_v4(const struct nft_synproxy *priv,
+ struct tcphdr *_tcph,
+ struct synproxy_options *opts)
+ {
+- struct nf_synproxy_info info = priv->info;
++ struct nf_synproxy_info info = READ_ONCE(priv->info);
+ struct net *net = nft_net(pkt);
+ struct synproxy_net *snet = synproxy_pernet(net);
+ struct sk_buff *skb = pkt->skb;
+@@ -79,7 +79,7 @@ static void nft_synproxy_eval_v6(const struct nft_synproxy *priv,
+ struct tcphdr *_tcph,
+ struct synproxy_options *opts)
+ {
+- struct nf_synproxy_info info = priv->info;
++ struct nf_synproxy_info info = READ_ONCE(priv->info);
+ struct net *net = nft_net(pkt);
+ struct synproxy_net *snet = synproxy_pernet(net);
+ struct sk_buff *skb = pkt->skb;
+@@ -340,7 +340,7 @@ static void nft_synproxy_obj_update(struct nft_object *obj,
+ struct nft_synproxy *newpriv = nft_obj_data(newobj);
+ struct nft_synproxy *priv = nft_obj_data(obj);
+
+- priv->info = newpriv->info;
++ WRITE_ONCE(priv->info, newpriv->info);
+ }
+
+ static struct nft_object_type nft_synproxy_obj_type;
+--
+2.51.0
+
--- /dev/null
+From 9a24d9f689bb762bc4173bf46b85641264da2191 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Nov 2025 19:58:50 -0500
+Subject: riscv: pgtable: Cleanup useless VA_USER_XXX definitions
+
+From: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org>
+
+[ Upstream commit 5e5be092ffadcab0093464ccd9e30f0c5cce16b9 ]
+
+These marcos are not used after commit b5b4287accd7 ("riscv: mm: Use
+hint address in mmap if available"). Cleanup VA_USER_XXX definitions
+in asm/pgtable.h.
+
+Fixes: b5b4287accd7 ("riscv: mm: Use hint address in mmap if available")
+Signed-off-by: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org>
+Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Link: https://patch.msgid.link/20251201005850.702569-1-guoren@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/pgtable.h | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
+index 87c7d94c71f13..aeba8028e9aa8 100644
+--- a/arch/riscv/include/asm/pgtable.h
++++ b/arch/riscv/include/asm/pgtable.h
+@@ -119,10 +119,6 @@
+ #ifdef CONFIG_64BIT
+ #include <asm/pgtable-64.h>
+
+-#define VA_USER_SV39 (UL(1) << (VA_BITS_SV39 - 1))
+-#define VA_USER_SV48 (UL(1) << (VA_BITS_SV48 - 1))
+-#define VA_USER_SV57 (UL(1) << (VA_BITS_SV57 - 1))
+-
+ #define MMAP_VA_BITS_64 ((VA_BITS >= VA_BITS_SV48) ? VA_BITS_SV48 : VA_BITS)
+ #define MMAP_MIN_VA_BITS_64 (VA_BITS_SV39)
+ #define MMAP_VA_BITS (is_compat_task() ? VA_BITS_SV32 : MMAP_VA_BITS_64)
+--
+2.51.0
+
btrfs-qgroup-update-all-parent-qgroups-when-doing-qu.patch
btrfs-tracepoints-use-btrfs_root_id-to-get-the-id-of.patch
btrfs-fix-null-dereference-on-root-when-tracing-inod.patch
+drm-amd-display-respect-user-s-config_frame_warn-mor.patch
+drm-amd-display-apply-e4479aecf658-to-dml.patch
+arm64-dts-ti-k3-am62-lp-sk-nand-rename-pinctrls-to-f.patch
+crypto-qat-fix-duplicate-restarting-msg-during-aer-e.patch
+arm64-dts-add-off-on-delay-us-for-usdhc2-regulator.patch
+arm-dts-imx6q-ba16-fix-rtc-interrupt-level.patch
+arm64-dts-imx8mp-fix-lan8740ai-phy-reference-clock-o.patch
+arm64-dts-imx8qm-ss-dma-correct-the-dma-channels-of-.patch
+arm64-dts-mba8mx-fix-ethernet-phy-irq-support.patch
+netfilter-nft_set_pipapo-fix-range-overlap-detection.patch
+netfilter-nft_synproxy-avoid-possible-data-race-on-u.patch
+gpio-pca953x-add-support-for-level-triggered-interru.patch
+gpio-pca953x-handle-short-interrupt-pulses-on-pcal-d.patch
+netfilter-nf_tables-fix-memory-leak-in-nf_tables_new.patch
+netfilter-nf_conncount-update-last_gc-only-when-gc-h.patch
+net-marvell-prestera-fix-null-dereference-on-devlink.patch
+bridge-fix-c-vlan-preservation-in-802.1ad-vlan_tunne.patch
+net-mscc-ocelot-fix-crash-when-adding-interface-unde.patch
+inet-ping-fix-icmp-out-counting.patch
+net-sock-fix-hardened-usercopy-panic-in-sock_recv_er.patch
+netdev-preserve-netif_f_all_for_all-across-tso-updat.patch
+net-mlx5e-don-t-print-error-message-due-to-invalid-m.patch
+net-wwan-iosm-fix-memory-leak-in-ipc_mux_deinit.patch
+bnxt_en-fix-potential-data-corruption-with-hw-gro-lr.patch
+vsock-make-accept-ed-sockets-use-custom-setsockopt.patch
+btrfs-only-enforce-free-space-tree-if-v1-cache-is-re.patch
+riscv-pgtable-cleanup-useless-va_user_xxx-definition.patch
+net-fix-memory-leak-in-skb_segment_list-for-gro-pack.patch
+idpf-keep-the-netdev-when-a-reset-fails.patch
+idpf-fix-memory-leak-in-idpf_vport_rel.patch
+idpf-cap-maximum-rx-buffer-size.patch
+net-netdevsim-fix-inconsistent-carrier-state-after-l.patch
+hid-quirks-work-around-vid-pid-conflict-for-appledis.patch
+net-sched-sch_qfq-fix-null-deref-when-deactivating-i.patch
+net-usb-pegasus-fix-memory-leak-in-update_eth_regs_a.patch
+net-enetc-fix-build-warning-when-page_size-is-greate.patch
+arp-do-not-assume-dev_hard_header-does-not-change-sk.patch
+erofs-don-t-bother-with-s_stack_depth-increasing-for.patch
+erofs-fix-file-backed-mounts-no-longer-working-on-er.patch
--- /dev/null
+From 907f5445653d145fc723717256e4a11f72d7c1f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Dec 2025 20:43:10 +0100
+Subject: vsock: Make accept()ed sockets use custom setsockopt()
+
+From: Michal Luczaj <mhal@rbox.co>
+
+[ Upstream commit ce5e612dd411de096aa041b9e9325ba1bec5f9f4 ]
+
+SO_ZEROCOPY handling in vsock_connectible_setsockopt() does not get called
+on accept()ed sockets due to a missing flag. Flip it.
+
+Fixes: e0718bd82e27 ("vsock: enable setting SO_ZEROCOPY")
+Signed-off-by: Michal Luczaj <mhal@rbox.co>
+Link: https://patch.msgid.link/20251229-vsock-child-sock-custom-sockopt-v2-1-64778d6c4f88@rbox.co
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/af_vsock.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 621be9be64f67..282d973233245 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -1742,6 +1742,10 @@ static int vsock_accept(struct socket *sock, struct socket *newsock,
+ } else {
+ newsock->state = SS_CONNECTED;
+ sock_graft(connected, newsock);
++
++ set_bit(SOCK_CUSTOM_SOCKOPT,
++ &connected->sk_socket->flags);
++
+ if (vsock_msgzerocopy_allow(vconnected->transport))
+ set_bit(SOCK_SUPPORT_ZC,
+ &connected->sk_socket->flags);
+--
+2.51.0
+
--- /dev/null
+From e0a82f70a545645eb69f2d9d45e008a495340192 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 11:56:05 +0200
+Subject: ARM: dts: imx6q-ba16: fix RTC interrupt level
+
+From: Ian Ray <ian.ray@gehealthcare.com>
+
+[ Upstream commit e6a4eedd49ce27c16a80506c66a04707e0ee0116 ]
+
+RTC interrupt level should be set to "LOW". This was revealed by the
+introduction of commit:
+
+ f181987ef477 ("rtc: m41t80: use IRQ flags obtained from fwnode")
+
+which changed the way IRQ type is obtained.
+
+Fixes: 56c27310c1b4 ("ARM: dts: imx: Add Advantech BA-16 Qseven module")
+Signed-off-by: Ian Ray <ian.ray@gehealthcare.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi b/arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi
+index 53013b12c2ecb..02d66523668d2 100644
+--- a/arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi
++++ b/arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi
+@@ -337,7 +337,7 @@ rtc@32 {
+ pinctrl-0 = <&pinctrl_rtc>;
+ reg = <0x32>;
+ interrupt-parent = <&gpio4>;
+- interrupts = <10 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <10 IRQ_TYPE_LEVEL_LOW>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 8ed5e90f4dd566ce0b27b9291349cc2636989fa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 11:22:40 +0800
+Subject: arm64: dts: add off-on-delay-us for usdhc2 regulator
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+[ Upstream commit ca643894a37a25713029b36cfe7d1bae515cac08 ]
+
+For SD card, according to the spec requirement, for sd card power reset
+operation, it need sd card supply voltage to be lower than 0.5v and keep
+over 1ms, otherwise, next time power back the sd card supply voltage to
+3.3v, sd card can't support SD3.0 mode again.
+
+To match such requirement on imx8qm-mek board, add 4.8ms delay between
+sd power off and power on.
+
+Fixes: 307fd14d4b14 ("arm64: dts: imx: add imx8qm mek support")
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+index d4b13cfd87a92..df99fe88cf4ac 100644
+--- a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
++++ b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+@@ -256,6 +256,7 @@ reg_usdhc2_vmmc: usdhc2-vmmc {
+ regulator-max-microvolt = <3000000>;
+ gpio = <&lsio_gpio4 7 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
++ off-on-delay-us = <4800>;
+ };
+
+ reg_audio: regulator-audio {
+--
+2.51.0
+
--- /dev/null
+From bb3bfd4d5b41404e34a29df83d2e02c8e1507bf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 12:56:51 +0100
+Subject: arm64: dts: freescale: moduline-display: fix compatible
+
+From: Maud Spierings <maudspierings@gocontroll.com>
+
+[ Upstream commit 056c68875122dd342782e5956ed145fe9e059614 ]
+
+The compatibles should include the SoM compatible, this board is based
+on the Ka-Ro TX8P-ML81 SoM, so add it to allow using shared code in the
+bootloader which uses upstream Linux devicetrees as a base.
+
+Also add the hardware revision to the board compatible to handle
+revision specific quirks in the bootloader/userspace.
+
+This is a breaking change, but it is early enough that it can be
+corrected without causing any issues.
+
+Fixes: 03f07be54cdc ("arm64: dts: freescale: Add the GOcontroll Moduline Display baseboard")
+Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/freescale/imx8mp-tx8p-ml81-moduline-display-106.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp-tx8p-ml81-moduline-display-106.dts b/arch/arm64/boot/dts/freescale/imx8mp-tx8p-ml81-moduline-display-106.dts
+index 88ad422c27603..399230144ce39 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp-tx8p-ml81-moduline-display-106.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mp-tx8p-ml81-moduline-display-106.dts
+@@ -9,7 +9,7 @@
+ #include "imx8mp-tx8p-ml81.dtsi"
+
+ / {
+- compatible = "gocontroll,moduline-display", "fsl,imx8mp";
++ compatible = "gocontroll,moduline-display-106", "karo,tx8p-ml81", "fsl,imx8mp";
+ chassis-type = "embedded";
+ hardware = "Moduline Display V1.06";
+ model = "GOcontroll Moduline Display baseboard";
+--
+2.51.0
+
--- /dev/null
+From 293e4d496dde5865930ec04b706d4b691a0a676a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 12:56:52 +0100
+Subject: arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells
+
+From: Maud Spierings <maudspierings@gocontroll.com>
+
+[ Upstream commit cdf4e631eec5ddd49bb625df9fb144d6ecdd6f15 ]
+
+On this SoM eqos is the primary ethernet interface, Ka-Ro fuses the
+address for it in eth_mac1, eth_mac2 seems to be left unfused. In their
+downstream u-boot they fetch it from eth_mac1 [1][2], by setting alias
+of eqos to ethernet0, the driver then fetches the mac address based on
+the alias number.
+
+Set eqos to read from eth_mac1 instead of eth_mac2. Also set fec to
+point at eth_mac2 as it may be fused later even though it is disabled
+by default.
+
+With this changed barebox is now capable of loading the correct address.
+
+Link: https://github.com/karo-electronics/karo-tx-uboot/blob/380543278410bbf04264d80a3bfbe340b8e62439/drivers/net/dwc_eth_qos.c#L1167 [1]
+Link: https://github.com/karo-electronics/karo-tx-uboot/blob/380543278410bbf04264d80a3bfbe340b8e62439/arch/arm/dts/imx8mp-karo.dtsi#L12 [2]
+
+Fixes: bac63d7c5f46 ("arm64: dts: freescale: add Ka-Ro Electronics tx8p-ml81 COM")
+Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp-tx8p-ml81.dtsi | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp-tx8p-ml81.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-tx8p-ml81.dtsi
+index fe8ba16eb40e7..761ee046eb72e 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp-tx8p-ml81.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp-tx8p-ml81.dtsi
+@@ -47,6 +47,7 @@ &eqos {
+ <&clk IMX8MP_SYS_PLL2_100M>,
+ <&clk IMX8MP_SYS_PLL2_50M>;
+ assigned-clock-rates = <266000000>, <100000000>, <50000000>;
++ nvmem-cells = <ð_mac1>;
+ phy-handle = <ðphy0>;
+ phy-mode = "rmii";
+ pinctrl-0 = <&pinctrl_eqos>;
+@@ -75,6 +76,10 @@ ethphy0: ethernet-phy@0 {
+ };
+ };
+
++&fec {
++ nvmem-cells = <ð_mac2>;
++};
++
+ &gpio1 {
+ gpio-line-names = "SODIMM_152",
+ "SODIMM_42",
+--
+2.51.0
+
--- /dev/null
+From 9bad753fdb277fbb6c571dc18e97d931b5209d19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 14:41:51 +0100
+Subject: arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH
+ electronics i.MX8M Plus DHCOM
+
+From: Marek Vasut <marek.vasut@mailbox.org>
+
+[ Upstream commit c63749a7ddc59ac6ec0b05abfa0a21af9f2c1d38 ]
+
+Add missing 'clocks' property to LAN8740Ai PHY node, to allow the PHY driver
+to manage LAN8740Ai CLKIN reference clock supply. This fixes sporadic link
+bouncing caused by interruptions on the PHY reference clock, by letting the
+PHY driver manage the reference clock and assure there are no interruptions.
+
+This follows the matching PHY driver recommendation described in commit
+bedd8d78aba3 ("net: phy: smsc: LAN8710/20: add phy refclk in support")
+
+Fixes: 8d6712695bc8 ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2")
+Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
+Tested-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi
+index 68c2e0156a5c8..f8303b7e2bd22 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi
+@@ -113,6 +113,7 @@ mdio {
+ ethphy0f: ethernet-phy@1 { /* SMSC LAN8740Ai */
+ compatible = "ethernet-phy-id0007.c110",
+ "ethernet-phy-ieee802.3-c22";
++ clocks = <&clk IMX8MP_CLK_ENET_QOS>;
+ interrupt-parent = <&gpio3>;
+ interrupts = <19 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-0 = <&pinctrl_ethphy0>;
+--
+2.51.0
+
--- /dev/null
+From 361013f29c0884ffe6f9da894a93c1b4e7e5bc3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 11:22:39 +0800
+Subject: arm64: dts: imx8qm-mek: correct the light sensor interrupt type to
+ low level
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+[ Upstream commit e0d8678c2f09dca22e6197321f223fa9a0ca2839 ]
+
+light sensor isl29023 share the interrupt with lsm303arg, but these
+two devices use different interrupt type. According to the datasheet
+of these two devides, both support low level trigger type, so correct
+the interrupt type here to avoid the following error log:
+
+ irq: type mismatch, failed to map hwirq-11 for gpio@5d0c0000!
+
+Fixes: 9918092cbb0e ("arm64: dts: imx8qm-mek: add i2c0 and children devices")
+Fixes: 1d8a9f043a77 ("arm64: dts: imx8: use defines for interrupts")
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+index 9c0b6b8d6459d..d4b13cfd87a92 100644
+--- a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
++++ b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+@@ -560,7 +560,7 @@ light-sensor@44 {
+ compatible = "isil,isl29023";
+ reg = <0x44>;
+ interrupt-parent = <&lsio_gpio4>;
+- interrupts = <11 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <11 IRQ_TYPE_LEVEL_LOW>;
+ };
+
+ pressure-sensor@60 {
+--
+2.51.0
+
--- /dev/null
+From 34f2150012504d2802c06dfc565001680f6006ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 09:59:56 +0800
+Subject: arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart
+
+From: Sherry Sun <sherry.sun@nxp.com>
+
+[ Upstream commit a988caeed9d918452aa0a68de2c6e94d86aa43ba ]
+
+The commit 616effc0272b5 ("arm64: dts: imx8: Fix lpuart DMA channel
+order") swap uart rx and tx channel at common imx8-ss-dma.dtsi. But miss
+update imx8qm-ss-dma.dtsi.
+
+The commit 5a8e9b022e569 ("arm64: dts: imx8qm-ss-dma: Pass lpuart
+dma-names") just simple add dma-names as binding doc requirement.
+
+Correct lpuart0 - lpuart3 dma rx and tx channels, and use defines for
+the FSL_EDMA_RX flag.
+
+Fixes: 5a8e9b022e56 ("arm64: dts: imx8qm-ss-dma: Pass lpuart dma-names")
+Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi b/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi
+index d4856b8590e0c..e186c31bfd482 100644
+--- a/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi
+@@ -171,25 +171,25 @@ &flexcan3 {
+
+ &lpuart0 {
+ compatible = "fsl,imx8qm-lpuart", "fsl,imx8qxp-lpuart";
+- dmas = <&edma2 13 0 0>, <&edma2 12 0 1>;
++ dmas = <&edma2 12 0 FSL_EDMA_RX>, <&edma2 13 0 0>;
+ dma-names = "rx","tx";
+ };
+
+ &lpuart1 {
+ compatible = "fsl,imx8qm-lpuart", "fsl,imx8qxp-lpuart";
+- dmas = <&edma2 15 0 0>, <&edma2 14 0 1>;
++ dmas = <&edma2 14 0 FSL_EDMA_RX>, <&edma2 15 0 0>;
+ dma-names = "rx","tx";
+ };
+
+ &lpuart2 {
+ compatible = "fsl,imx8qm-lpuart", "fsl,imx8qxp-lpuart";
+- dmas = <&edma2 17 0 0>, <&edma2 16 0 1>;
++ dmas = <&edma2 16 0 FSL_EDMA_RX>, <&edma2 17 0 0>;
+ dma-names = "rx","tx";
+ };
+
+ &lpuart3 {
+ compatible = "fsl,imx8qm-lpuart", "fsl,imx8qxp-lpuart";
+- dmas = <&edma2 19 0 0>, <&edma2 18 0 1>;
++ dmas = <&edma2 18 0 FSL_EDMA_RX>, <&edma2 19 0 0>;
+ dma-names = "rx","tx";
+ };
+
+--
+2.51.0
+
--- /dev/null
+From bb20f0b84cba55969b449baafd7295865910fc7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 14:15:28 +0100
+Subject: arm64: dts: mba8mx: Fix Ethernet PHY IRQ support
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 89e87d0dc87eb3654c9ae01afc4a18c1c6d1e523 ]
+
+Ethernet PHY interrupt mode is level triggered. Adjust the mode
+accordingly.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Fixes: 70cf622bb16e ("arm64: dts: mba8mx: Add Ethernet PHY IRQ support")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/mba8mx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/mba8mx.dtsi b/arch/arm64/boot/dts/freescale/mba8mx.dtsi
+index 79daba930ad64..3e41da4d6122b 100644
+--- a/arch/arm64/boot/dts/freescale/mba8mx.dtsi
++++ b/arch/arm64/boot/dts/freescale/mba8mx.dtsi
+@@ -185,7 +185,7 @@ ethphy0: ethernet-phy@e {
+ reset-assert-us = <500000>;
+ reset-deassert-us = <500>;
+ interrupt-parent = <&expander2>;
+- interrupts = <6 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <6 IRQ_TYPE_LEVEL_LOW>;
+ };
+ };
+ };
+--
+2.51.0
+
--- /dev/null
+From 914363657beba745a9f2ce7faf58c90abb617f9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 13:27:33 +0100
+Subject: arm64: dts: ti: k3-am62-lp-sk-nand: Rename pinctrls to fix schema
+ warnings
+
+From: Wadim Egorov <w.egorov@phytec.de>
+
+[ Upstream commit cf5e8adebe77917a4cc95e43e461cdbd857591ce ]
+
+Rename pinctrl nodes to comply with naming conventions required by
+pinctrl-single schema.
+
+Fixes: e569152274fec ("arm64: dts: ti: am62-lp-sk: Add overlay for NAND expansion card")
+Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
+Link: https://patch.msgid.link/20251127122733.2523367-3-w.egorov@phytec.de
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62-lp-sk-nand.dtso | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62-lp-sk-nand.dtso b/arch/arm64/boot/dts/ti/k3-am62-lp-sk-nand.dtso
+index 173ac60723b64..b4daa674eaa1e 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62-lp-sk-nand.dtso
++++ b/arch/arm64/boot/dts/ti/k3-am62-lp-sk-nand.dtso
+@@ -14,7 +14,7 @@
+ };
+
+ &main_pmx0 {
+- gpmc0_pins_default: gpmc0-pins-default {
++ gpmc0_pins_default: gpmc0-default-pins {
+ pinctrl-single,pins = <
+ AM62X_IOPAD(0x003c, PIN_INPUT, 0) /* (K19) GPMC0_AD0 */
+ AM62X_IOPAD(0x0040, PIN_INPUT, 0) /* (L19) GPMC0_AD1 */
+--
+2.51.0
+
--- /dev/null
+From 2675d6f43092333993c4bf981ea54408409a002c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 13:27:31 +0100
+Subject: arm64: dts: ti: k3-am642-phyboard-electra-peb-c-010: Fix icssg-prueth
+ schema warning
+
+From: Wadim Egorov <w.egorov@phytec.de>
+
+[ Upstream commit 05bbe52d0be5637dcd3c880348e3688f7ec64eb7 ]
+
+Reduce length of dma-names and dmas properties for icssg1-ethernet
+node to comply with ti,icssg-prueth schema constraints. The previous
+entries exceeded the allowed count and triggered dtschema warnings
+during validation.
+
+Fixes: e53fbf955ea7 ("arm64: dts: ti: k3-am642-phyboard-electra: Add PEB-C-010 Overlay")
+Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
+Link: https://patch.msgid.link/20251127122733.2523367-1-w.egorov@phytec.de
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/ti/k3-am642-phyboard-electra-peb-c-010.dtso | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-peb-c-010.dtso b/arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-peb-c-010.dtso
+index 7fc73cfacadb8..1176a52d560b7 100644
+--- a/arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-peb-c-010.dtso
++++ b/arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-peb-c-010.dtso
+@@ -30,13 +30,10 @@
+ <&main_pktdma 0xc206 15>, /* egress slice 1 */
+ <&main_pktdma 0xc207 15>, /* egress slice 1 */
+ <&main_pktdma 0x4200 15>, /* ingress slice 0 */
+- <&main_pktdma 0x4201 15>, /* ingress slice 1 */
+- <&main_pktdma 0x4202 0>, /* mgmnt rsp slice 0 */
+- <&main_pktdma 0x4203 0>; /* mgmnt rsp slice 1 */
++ <&main_pktdma 0x4201 15>; /* ingress slice 1 */
+ dma-names = "tx0-0", "tx0-1", "tx0-2", "tx0-3",
+ "tx1-0", "tx1-1", "tx1-2", "tx1-3",
+- "rx0", "rx1",
+- "rxmgm0", "rxmgm1";
++ "rx0", "rx1";
+
+ firmware-name = "ti-pruss/am65x-sr2-pru0-prueth-fw.elf",
+ "ti-pruss/am65x-sr2-rtu0-prueth-fw.elf",
+--
+2.51.0
+
--- /dev/null
+From 8fd3b28a9266c2f6bf4ec9019046f0be9e482d96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 13:27:32 +0100
+Subject: arm64: dts: ti: k3-am642-phyboard-electra-x27-gpio1-spi1-uart3: Fix
+ schema warnings
+
+From: Wadim Egorov <w.egorov@phytec.de>
+
+[ Upstream commit d876bb9353d87dee0ae620300106e8def189c785 ]
+
+Rename pinctrl nodes to comply with naming conventions required by
+pinctrl-single schema. Also, replace invalid integer assignment in
+SPI node with a boolean to align with omap-spi schema.
+
+Fixes: 638ab30ce4c6 ("arm64: dts: ti: am64-phyboard-electra: Add DT overlay for X27 connector")
+Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
+Link: https://patch.msgid.link/20251127122733.2523367-2-w.egorov@phytec.de
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../k3-am642-phyboard-electra-x27-gpio1-spi1-uart3.dtso | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-x27-gpio1-spi1-uart3.dtso b/arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-x27-gpio1-spi1-uart3.dtso
+index 996c42ec4253e..bea8efa3e9094 100644
+--- a/arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-x27-gpio1-spi1-uart3.dtso
++++ b/arch/arm64/boot/dts/ti/k3-am642-phyboard-electra-x27-gpio1-spi1-uart3.dtso
+@@ -20,13 +20,13 @@
+ };
+
+ &main_pmx0 {
+- main_gpio1_exp_header_gpio_pins_default: main-gpio1-exp-header-gpio-pins-default {
++ main_gpio1_exp_header_gpio_pins_default: main-gpio1-exp-header-gpio-default-pins {
+ pinctrl-single,pins = <
+ AM64X_IOPAD(0x0220, PIN_INPUT, 7) /* (D14) SPI1_CS1.GPIO1_48 */
+ >;
+ };
+
+- main_spi1_pins_default: main-spi1-pins-default {
++ main_spi1_pins_default: main-spi1-default-pins {
+ pinctrl-single,pins = <
+ AM64X_IOPAD(0x0224, PIN_INPUT, 0) /* (C14) SPI1_CLK */
+ AM64X_IOPAD(0x021C, PIN_OUTPUT, 0) /* (B14) SPI1_CS0 */
+@@ -35,7 +35,7 @@
+ >;
+ };
+
+- main_uart3_pins_default: main-uart3-pins-default {
++ main_uart3_pins_default: main-uart3-default-pins {
+ pinctrl-single,pins = <
+ AM64X_IOPAD(0x0048, PIN_INPUT, 2) /* (U20) GPMC0_AD3.UART3_RXD */
+ AM64X_IOPAD(0x004c, PIN_OUTPUT, 2) /* (U18) GPMC0_AD4.UART3_TXD */
+@@ -52,7 +52,7 @@
+ &main_spi1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&main_spi1_pins_default>;
+- ti,pindir-d0-out-d1-in = <1>;
++ ti,pindir-d0-out-d1-in;
+ status = "okay";
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 2e13ceb4bda22764963326cb69e37035ff72040e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 21:22:50 +0000
+Subject: arp: do not assume dev_hard_header() does not change skb->head
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit c92510f5e3f82ba11c95991824a41e59a9c5ed81 ]
+
+arp_create() is the only dev_hard_header() caller
+making assumption about skb->head being unchanged.
+
+A recent commit broke this assumption.
+
+Initialize @arp pointer after dev_hard_header() call.
+
+Fixes: db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust")
+Reported-by: syzbot+58b44a770a1585795351@syzkaller.appspotmail.com
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260107212250.384552-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/arp.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
+index 833f2cf97178e..3ce1664e8632a 100644
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -564,7 +564,7 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
+
+ skb_reserve(skb, hlen);
+ skb_reset_network_header(skb);
+- arp = skb_put(skb, arp_hdr_len(dev));
++ skb_put(skb, arp_hdr_len(dev));
+ skb->dev = dev;
+ skb->protocol = htons(ETH_P_ARP);
+ if (!src_hw)
+@@ -572,12 +572,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
+ if (!dest_hw)
+ dest_hw = dev->broadcast;
+
+- /*
+- * Fill the device header for the ARP frame
++ /* Fill the device header for the ARP frame.
++ * Note: skb->head can be changed.
+ */
+ if (dev_hard_header(skb, dev, ptype, dest_hw, src_hw, skb->len) < 0)
+ goto out;
+
++ arp = arp_hdr(skb);
+ /*
+ * Fill out the arp protocol part.
+ *
+--
+2.51.0
+
--- /dev/null
+From 079c5b5c1830febc654710a71f282d0607357cf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 13:08:37 -0700
+Subject: block: don't merge bios with different app_tags
+
+From: Caleb Sander Mateos <csander@purestorage.com>
+
+[ Upstream commit 6acd4ac5f8f0ec9b946875553e52907700bcfc77 ]
+
+nvme_set_app_tag() uses the app_tag value from the bio_integrity_payload
+of the struct request's first bio. This assumes all the request's bios
+have the same app_tag. However, it is possible for bios with different
+app_tag values to be merged into a single request.
+Add a check in blk_integrity_merge_{bio,rq}() to prevent the merging of
+bios/requests with different app_tag values if BIP_CHECK_APPTAG is set.
+
+Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
+Fixes: 3d8b5a22d404 ("block: add support to pass user meta buffer")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-integrity.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/block/blk-integrity.c b/block/blk-integrity.c
+index 9b27963680dc3..964eebbee14d0 100644
+--- a/block/blk-integrity.c
++++ b/block/blk-integrity.c
+@@ -140,14 +140,21 @@ EXPORT_SYMBOL_GPL(blk_rq_integrity_map_user);
+ bool blk_integrity_merge_rq(struct request_queue *q, struct request *req,
+ struct request *next)
+ {
++ struct bio_integrity_payload *bip, *bip_next;
++
+ if (blk_integrity_rq(req) == 0 && blk_integrity_rq(next) == 0)
+ return true;
+
+ if (blk_integrity_rq(req) == 0 || blk_integrity_rq(next) == 0)
+ return false;
+
+- if (bio_integrity(req->bio)->bip_flags !=
+- bio_integrity(next->bio)->bip_flags)
++ bip = bio_integrity(req->bio);
++ bip_next = bio_integrity(next->bio);
++ if (bip->bip_flags != bip_next->bip_flags)
++ return false;
++
++ if (bip->bip_flags & BIP_CHECK_APPTAG &&
++ bip->app_tag != bip_next->app_tag)
+ return false;
+
+ if (req->nr_integrity_segments + next->nr_integrity_segments >
+@@ -163,15 +170,21 @@ bool blk_integrity_merge_rq(struct request_queue *q, struct request *req,
+ bool blk_integrity_merge_bio(struct request_queue *q, struct request *req,
+ struct bio *bio)
+ {
++ struct bio_integrity_payload *bip, *bip_bio = bio_integrity(bio);
+ int nr_integrity_segs;
+
+- if (blk_integrity_rq(req) == 0 && bio_integrity(bio) == NULL)
++ if (blk_integrity_rq(req) == 0 && bip_bio == NULL)
+ return true;
+
+- if (blk_integrity_rq(req) == 0 || bio_integrity(bio) == NULL)
++ if (blk_integrity_rq(req) == 0 || bip_bio == NULL)
++ return false;
++
++ bip = bio_integrity(req->bio);
++ if (bip->bip_flags != bip_bio->bip_flags)
+ return false;
+
+- if (bio_integrity(req->bio)->bip_flags != bio_integrity(bio)->bip_flags)
++ if (bip->bip_flags & BIP_CHECK_APPTAG &&
++ bip->app_tag != bip_bio->app_tag)
+ return false;
+
+ nr_integrity_segs = blk_rq_count_integrity_sg(q, bio);
+--
+2.51.0
+
--- /dev/null
+From 5d1b0ceb5aeab8a08eaead6bc8e352d902c1f700 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Dec 2025 00:36:25 -0800
+Subject: bnxt_en: Fix potential data corruption with HW GRO/LRO
+
+From: Srijit Bose <srijit.bose@broadcom.com>
+
+[ Upstream commit ffeafa65b2b26df2f5b5a6118d3174f17bd12ec5 ]
+
+Fix the max number of bits passed to find_first_zero_bit() in
+bnxt_alloc_agg_idx(). We were incorrectly passing the number of
+long words. find_first_zero_bit() may fail to find a zero bit and
+cause a wrong ID to be used. If the wrong ID is already in use, this
+can cause data corruption. Sometimes an error like this can also be
+seen:
+
+bnxt_en 0000:83:00.0 enp131s0np0: TPA end agg_buf 2 != expected agg_bufs 1
+
+Fix it by passing the correct number of bits MAX_TPA_P5. Use
+DECLARE_BITMAP() to more cleanly define the bitmap. Add a sanity
+check to warn if a bit cannot be found and reset the ring [MChan].
+
+Fixes: ec4d8e7cf024 ("bnxt_en: Add TPA ID mapping logic for 57500 chips.")
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Srijit Bose <srijit.bose@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20251231083625.3911652-1-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 15 ++++++++++++---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 +---
+ 2 files changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 0366323ab0676..95c774d98da66 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1482,9 +1482,11 @@ static u16 bnxt_alloc_agg_idx(struct bnxt_rx_ring_info *rxr, u16 agg_id)
+ struct bnxt_tpa_idx_map *map = rxr->rx_tpa_idx_map;
+ u16 idx = agg_id & MAX_TPA_P5_MASK;
+
+- if (test_bit(idx, map->agg_idx_bmap))
+- idx = find_first_zero_bit(map->agg_idx_bmap,
+- BNXT_AGG_IDX_BMAP_SIZE);
++ if (test_bit(idx, map->agg_idx_bmap)) {
++ idx = find_first_zero_bit(map->agg_idx_bmap, MAX_TPA_P5);
++ if (idx >= MAX_TPA_P5)
++ return INVALID_HW_RING_ID;
++ }
+ __set_bit(idx, map->agg_idx_bmap);
+ map->agg_id_tbl[agg_id] = idx;
+ return idx;
+@@ -1548,6 +1550,13 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
+ if (bp->flags & BNXT_FLAG_CHIP_P5_PLUS) {
+ agg_id = TPA_START_AGG_ID_P5(tpa_start);
+ agg_id = bnxt_alloc_agg_idx(rxr, agg_id);
++ if (unlikely(agg_id == INVALID_HW_RING_ID)) {
++ netdev_warn(bp->dev, "Unable to allocate agg ID for ring %d, agg 0x%x\n",
++ rxr->bnapi->index,
++ TPA_START_AGG_ID_P5(tpa_start));
++ bnxt_sched_reset_rxr(bp, rxr);
++ return;
++ }
+ } else {
+ agg_id = TPA_START_AGG_ID(tpa_start);
+ }
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index 3613a172483a1..45bbaec75ded4 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1079,11 +1079,9 @@ struct bnxt_tpa_info {
+ struct rx_agg_cmp *agg_arr;
+ };
+
+-#define BNXT_AGG_IDX_BMAP_SIZE (MAX_TPA_P5 / BITS_PER_LONG)
+-
+ struct bnxt_tpa_idx_map {
+ u16 agg_id_tbl[1024];
+- unsigned long agg_idx_bmap[BNXT_AGG_IDX_BMAP_SIZE];
++ DECLARE_BITMAP(agg_idx_bmap, MAX_TPA_P5);
+ };
+
+ struct bnxt_rx_ring_info {
+--
+2.51.0
+
--- /dev/null
+From 1ef04a8baeed4c5a11ec4444f24f92a30bb2b919 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Dec 2025 03:00:57 +0100
+Subject: bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
+
+From: Alexandre Knecht <knecht.alexandre@gmail.com>
+
+[ Upstream commit 3128df6be147768fe536986fbb85db1d37806a9f ]
+
+When using an 802.1ad bridge with vlan_tunnel, the C-VLAN tag is
+incorrectly stripped from frames during egress processing.
+
+br_handle_egress_vlan_tunnel() uses skb_vlan_pop() to remove the S-VLAN
+from hwaccel before VXLAN encapsulation. However, skb_vlan_pop() also
+moves any "next" VLAN from the payload into hwaccel:
+
+ /* move next vlan tag to hw accel tag */
+ __skb_vlan_pop(skb, &vlan_tci);
+ __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);
+
+For QinQ frames where the C-VLAN sits in the payload, this moves it to
+hwaccel where it gets lost during VXLAN encapsulation.
+
+Fix by calling __vlan_hwaccel_clear_tag() directly, which clears only
+the hwaccel S-VLAN and leaves the payload untouched.
+
+This path is only taken when vlan_tunnel is enabled and tunnel_info
+is configured, so 802.1Q bridges are unaffected.
+
+Tested with 802.1ad bridge + VXLAN vlan_tunnel, verified C-VLAN
+preserved in VXLAN payload via tcpdump.
+
+Fixes: 11538d039ac6 ("bridge: vlan dst_metadata hooks in ingress and egress paths")
+Signed-off-by: Alexandre Knecht <knecht.alexandre@gmail.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20251228020057.2788865-1-knecht.alexandre@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_vlan_tunnel.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/net/bridge/br_vlan_tunnel.c b/net/bridge/br_vlan_tunnel.c
+index a966a6ec82634..257cae9f15698 100644
+--- a/net/bridge/br_vlan_tunnel.c
++++ b/net/bridge/br_vlan_tunnel.c
+@@ -189,7 +189,6 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,
+ IP_TUNNEL_DECLARE_FLAGS(flags) = { };
+ struct metadata_dst *tunnel_dst;
+ __be64 tunnel_id;
+- int err;
+
+ if (!vlan)
+ return 0;
+@@ -199,9 +198,13 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,
+ return 0;
+
+ skb_dst_drop(skb);
+- err = skb_vlan_pop(skb);
+- if (err)
+- return err;
++ /* For 802.1ad (QinQ), skb_vlan_pop() incorrectly moves the C-VLAN
++ * from payload to hwaccel after clearing S-VLAN. We only need to
++ * clear the hwaccel S-VLAN; the C-VLAN must stay in payload for
++ * correct VXLAN encapsulation. This is also correct for 802.1Q
++ * where no C-VLAN exists in payload.
++ */
++ __vlan_hwaccel_clear_tag(skb);
+
+ if (BR_INPUT_SKB_CB(skb)->backup_nhid) {
+ __set_bit(IP_TUNNEL_KEY_BIT, flags);
+--
+2.51.0
+
--- /dev/null
+From bbecd464186f18d94019382623024ea328d82c82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Dec 2025 22:44:34 +0530
+Subject: btrfs: fix NULL pointer dereference in do_abort_log_replay()
+
+From: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+
+[ Upstream commit 530e3d4af566ca44807d79359b90794dea24c4f3 ]
+
+Coverity reported a NULL pointer dereference issue (CID 1666756) in
+do_abort_log_replay(). When btrfs_alloc_path() fails in
+replay_one_buffer(), wc->subvol_path is NULL, but btrfs_abort_log_replay()
+calls do_abort_log_replay() which unconditionally dereferences
+wc->subvol_path when attempting to print debug information. Fix this by
+adding a NULL check before dereferencing wc->subvol_path in
+do_abort_log_replay().
+
+Fixes: 2753e4917624 ("btrfs: dump detailed info and specific messages on log replay failures")
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Suchit Karunakaran <suchitkarunakaran@gmail.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/tree-log.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index de9ea9d52482f..1444857de9fe8 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -189,7 +189,7 @@ static void do_abort_log_replay(struct walk_control *wc, const char *function,
+
+ btrfs_abort_transaction(wc->trans, error);
+
+- if (wc->subvol_path->nodes[0]) {
++ if (wc->subvol_path && wc->subvol_path->nodes[0]) {
+ btrfs_crit(fs_info,
+ "subvolume (root %llu) leaf currently being processed:",
+ btrfs_root_id(wc->root));
+--
+2.51.0
+
--- /dev/null
+From 7569496c394815fe803b146011a6aa9b9b6c4d14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Dec 2025 15:15:28 +1030
+Subject: btrfs: only enforce free space tree if v1 cache is required for bs <
+ ps cases
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 30bcf4e824aa37d305502f52e1527c7b1eabef3d ]
+
+[BUG]
+Since the introduction of btrfs bs < ps support, v1 cache was never on
+the plan due to its hard coded PAGE_SIZE usage, and the future plan to
+properly deprecate it.
+
+However for bs < ps cases, even if 'nospace_cache,clear_cache' mount
+option is specified, it's never respected and free space tree is always
+enabled:
+
+ mkfs.btrfs -f -O ^bgt,fst $dev
+ mount $dev $mnt -o clear_cache,nospace_cache
+ umount $mnt
+ btrfs ins dump-super $dev
+ ...
+ compat_ro_flags 0x3
+ ( FREE_SPACE_TREE |
+ FREE_SPACE_TREE_VALID )
+ ...
+
+This means a different behavior compared to bs >= ps cases.
+
+[CAUSE]
+The forcing usage of v2 space cache is done inside
+btrfs_set_free_space_cache_settings(), however it never checks if we're
+even using space cache but always enabling v2 cache.
+
+[FIX]
+Instead unconditionally enable v2 cache, only forcing v2 cache if the
+old v1 cache is required.
+
+Now v2 space cache can be properly disabled on bs < ps cases:
+
+ mkfs.btrfs -f -O ^bgt,fst $dev
+ mount $dev $mnt -o clear_cache,nospace_cache
+ umount $mnt
+ btrfs ins dump-super $dev
+ ...
+ compat_ro_flags 0x0
+ ...
+
+Fixes: 9f73f1aef98b ("btrfs: force v2 space cache usage for subpage mount")
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/super.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 430e7419349c9..c40944ca7b948 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -736,14 +736,12 @@ bool btrfs_check_options(const struct btrfs_fs_info *info,
+ */
+ void btrfs_set_free_space_cache_settings(struct btrfs_fs_info *fs_info)
+ {
+- if (fs_info->sectorsize < PAGE_SIZE) {
++ if (fs_info->sectorsize < PAGE_SIZE && btrfs_test_opt(fs_info, SPACE_CACHE)) {
++ btrfs_info(fs_info,
++ "forcing free space tree for sector size %u with page size %lu",
++ fs_info->sectorsize, PAGE_SIZE);
+ btrfs_clear_opt(fs_info->mount_opt, SPACE_CACHE);
+- if (!btrfs_test_opt(fs_info, FREE_SPACE_TREE)) {
+- btrfs_info(fs_info,
+- "forcing free space tree for sector size %u with page size %lu",
+- fs_info->sectorsize, PAGE_SIZE);
+- btrfs_set_opt(fs_info->mount_opt, FREE_SPACE_TREE);
+- }
++ btrfs_set_opt(fs_info->mount_opt, FREE_SPACE_TREE);
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From cfd21e6dc6c9b32a21a7b80f16eeea7ff8378a5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 14:51:52 +0000
+Subject: btrfs: release path before initializing extent tree in
+ btrfs_read_locked_inode()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 8731f2c50b0b1d2b58ed5b9671ef2c4bdc2f8347 ]
+
+In btrfs_read_locked_inode() we are calling btrfs_init_file_extent_tree()
+while holding a path with a read locked leaf from a subvolume tree, and
+btrfs_init_file_extent_tree() may do a GFP_KERNEL allocation, which can
+trigger reclaim.
+
+This can create a circular lock dependency which lockdep warns about with
+the following splat:
+
+ [6.1433] ======================================================
+ [6.1574] WARNING: possible circular locking dependency detected
+ [6.1583] 6.18.0+ #4 Tainted: G U
+ [6.1591] ------------------------------------------------------
+ [6.1599] kswapd0/117 is trying to acquire lock:
+ [6.1606] ffff8d9b6333c5b8 (&delayed_node->mutex){+.+.}-{3:3}, at: __btrfs_release_delayed_node.part.0+0x39/0x2f0
+ [6.1625]
+ but task is already holding lock:
+ [6.1633] ffffffffa4ab8ce0 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x195/0xc60
+ [6.1646]
+ which lock already depends on the new lock.
+
+ [6.1657]
+ the existing dependency chain (in reverse order) is:
+ [6.1667]
+ -> #2 (fs_reclaim){+.+.}-{0:0}:
+ [6.1677] fs_reclaim_acquire+0x9d/0xd0
+ [6.1685] __kmalloc_cache_noprof+0x59/0x750
+ [6.1694] btrfs_init_file_extent_tree+0x90/0x100
+ [6.1702] btrfs_read_locked_inode+0xc3/0x6b0
+ [6.1710] btrfs_iget+0xbb/0xf0
+ [6.1716] btrfs_lookup_dentry+0x3c5/0x8e0
+ [6.1724] btrfs_lookup+0x12/0x30
+ [6.1731] lookup_open.isra.0+0x1aa/0x6a0
+ [6.1739] path_openat+0x5f7/0xc60
+ [6.1746] do_filp_open+0xd6/0x180
+ [6.1753] do_sys_openat2+0x8b/0xe0
+ [6.1760] __x64_sys_openat+0x54/0xa0
+ [6.1768] do_syscall_64+0x97/0x3e0
+ [6.1776] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ [6.1784]
+ -> #1 (btrfs-tree-00){++++}-{3:3}:
+ [6.1794] lock_release+0x127/0x2a0
+ [6.1801] up_read+0x1b/0x30
+ [6.1808] btrfs_search_slot+0x8e0/0xff0
+ [6.1817] btrfs_lookup_inode+0x52/0xd0
+ [6.1825] __btrfs_update_delayed_inode+0x73/0x520
+ [6.1833] btrfs_commit_inode_delayed_inode+0x11a/0x120
+ [6.1842] btrfs_log_inode+0x608/0x1aa0
+ [6.1849] btrfs_log_inode_parent+0x249/0xf80
+ [6.1857] btrfs_log_dentry_safe+0x3e/0x60
+ [6.1865] btrfs_sync_file+0x431/0x690
+ [6.1872] do_fsync+0x39/0x80
+ [6.1879] __x64_sys_fsync+0x13/0x20
+ [6.1887] do_syscall_64+0x97/0x3e0
+ [6.1894] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ [6.1903]
+ -> #0 (&delayed_node->mutex){+.+.}-{3:3}:
+ [6.1913] __lock_acquire+0x15e9/0x2820
+ [6.1920] lock_acquire+0xc9/0x2d0
+ [6.1927] __mutex_lock+0xcc/0x10a0
+ [6.1934] __btrfs_release_delayed_node.part.0+0x39/0x2f0
+ [6.1944] btrfs_evict_inode+0x20b/0x4b0
+ [6.1952] evict+0x15a/0x2f0
+ [6.1958] prune_icache_sb+0x91/0xd0
+ [6.1966] super_cache_scan+0x150/0x1d0
+ [6.1974] do_shrink_slab+0x155/0x6f0
+ [6.1981] shrink_slab+0x48e/0x890
+ [6.1988] shrink_one+0x11a/0x1f0
+ [6.1995] shrink_node+0xbfd/0x1320
+ [6.1002] balance_pgdat+0x67f/0xc60
+ [6.1321] kswapd+0x1dc/0x3e0
+ [6.1643] kthread+0xff/0x240
+ [6.1965] ret_from_fork+0x223/0x280
+ [6.1287] ret_from_fork_asm+0x1a/0x30
+ [6.1616]
+ other info that might help us debug this:
+
+ [6.1561] Chain exists of:
+ &delayed_node->mutex --> btrfs-tree-00 --> fs_reclaim
+
+ [6.1503] Possible unsafe locking scenario:
+
+ [6.1110] CPU0 CPU1
+ [6.1411] ---- ----
+ [6.1707] lock(fs_reclaim);
+ [6.1998] lock(btrfs-tree-00);
+ [6.1291] lock(fs_reclaim);
+ [6.1581] lock(&delayed_node->mutex);
+ [6.1874]
+ *** DEADLOCK ***
+
+ [6.1716] 2 locks held by kswapd0/117:
+ [6.1999] #0: ffffffffa4ab8ce0 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x195/0xc60
+ [6.1294] #1: ffff8d998344b0e0 (&type->s_umount_key#40){++++}- {3:3}, at: super_cache_scan+0x37/0x1d0
+ [6.1596]
+ stack backtrace:
+ [6.1183] CPU: 11 UID: 0 PID: 117 Comm: kswapd0 Tainted: G U 6.18.0+ #4 PREEMPT(lazy)
+ [6.1185] Tainted: [U]=USER
+ [6.1186] Hardware name: ASUS System Product Name/PRIME B560M-A AC, BIOS 2001 02/01/2023
+ [6.1187] Call Trace:
+ [6.1187] <TASK>
+ [6.1189] dump_stack_lvl+0x6e/0xa0
+ [6.1192] print_circular_bug.cold+0x17a/0x1c0
+ [6.1194] check_noncircular+0x175/0x190
+ [6.1197] __lock_acquire+0x15e9/0x2820
+ [6.1200] lock_acquire+0xc9/0x2d0
+ [6.1201] ? __btrfs_release_delayed_node.part.0+0x39/0x2f0
+ [6.1204] __mutex_lock+0xcc/0x10a0
+ [6.1206] ? __btrfs_release_delayed_node.part.0+0x39/0x2f0
+ [6.1208] ? __btrfs_release_delayed_node.part.0+0x39/0x2f0
+ [6.1211] ? __btrfs_release_delayed_node.part.0+0x39/0x2f0
+ [6.1213] __btrfs_release_delayed_node.part.0+0x39/0x2f0
+ [6.1215] btrfs_evict_inode+0x20b/0x4b0
+ [6.1217] ? lock_acquire+0xc9/0x2d0
+ [6.1220] evict+0x15a/0x2f0
+ [6.1222] prune_icache_sb+0x91/0xd0
+ [6.1224] super_cache_scan+0x150/0x1d0
+ [6.1226] do_shrink_slab+0x155/0x6f0
+ [6.1228] shrink_slab+0x48e/0x890
+ [6.1229] ? shrink_slab+0x2d2/0x890
+ [6.1231] shrink_one+0x11a/0x1f0
+ [6.1234] shrink_node+0xbfd/0x1320
+ [6.1236] ? shrink_node+0xa2d/0x1320
+ [6.1236] ? shrink_node+0xbd3/0x1320
+ [6.1239] ? balance_pgdat+0x67f/0xc60
+ [6.1239] balance_pgdat+0x67f/0xc60
+ [6.1241] ? finish_task_switch.isra.0+0xc4/0x2a0
+ [6.1246] kswapd+0x1dc/0x3e0
+ [6.1247] ? __pfx_autoremove_wake_function+0x10/0x10
+ [6.1249] ? __pfx_kswapd+0x10/0x10
+ [6.1250] kthread+0xff/0x240
+ [6.1251] ? __pfx_kthread+0x10/0x10
+ [6.1253] ret_from_fork+0x223/0x280
+ [6.1255] ? __pfx_kthread+0x10/0x10
+ [6.1257] ret_from_fork_asm+0x1a/0x30
+ [6.1260] </TASK>
+
+This is because:
+
+1) The fsync task is holding an inode's delayed node mutex (for a
+ directory) while calling __btrfs_update_delayed_inode() and that needs
+ to do a search on the subvolume's btree (therefore read lock some
+ extent buffers);
+
+2) The lookup task, at btrfs_lookup(), triggered reclaim with the
+ GFP_KERNEL allocation done by btrfs_init_file_extent_tree() while
+ holding a read lock on a subvolume leaf;
+
+3) The reclaim triggered kswapd which is doing inode eviction for the
+ directory inode the fsync task is using as an argument to
+ btrfs_commit_inode_delayed_inode() - but in that call chain we are
+ trying to read lock the same leaf that the lookup task is holding
+ while calling btrfs_init_file_extent_tree() and doing the GFP_KERNEL
+ allocation.
+
+Fix this by calling btrfs_init_file_extent_tree() after we don't need the
+path anymore and release it in btrfs_read_locked_inode().
+
+Reported-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Link: https://lore.kernel.org/linux-btrfs/6e55113a22347c3925458a5d840a18401a38b276.camel@linux.intel.com/
+Fixes: 8679d2687c35 ("btrfs: initialize inode::file_extent_tree after i_mode has been set")
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 51401d586a7b6..27a562bad6e87 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -3976,11 +3976,6 @@ static int btrfs_read_locked_inode(struct btrfs_inode *inode, struct btrfs_path
+ btrfs_set_inode_mapping_order(inode);
+
+ cache_index:
+- ret = btrfs_init_file_extent_tree(inode);
+- if (ret)
+- goto out;
+- btrfs_inode_set_file_extent_range(inode, 0,
+- round_up(i_size_read(vfs_inode), fs_info->sectorsize));
+ /*
+ * If we were modified in the current generation and evicted from memory
+ * and then re-read we need to do a full sync since we don't have any
+@@ -4067,6 +4062,20 @@ static int btrfs_read_locked_inode(struct btrfs_inode *inode, struct btrfs_path
+ btrfs_ino(inode), btrfs_root_id(root), ret);
+ }
+
++ /*
++ * We don't need the path anymore, so release it to avoid holding a read
++ * lock on a leaf while calling btrfs_init_file_extent_tree(), which can
++ * allocate memory that triggers reclaim (GFP_KERNEL) and cause a locking
++ * dependency.
++ */
++ btrfs_release_path(path);
++
++ ret = btrfs_init_file_extent_tree(inode);
++ if (ret)
++ goto out;
++ btrfs_inode_set_file_extent_range(inode, 0,
++ round_up(i_size_read(vfs_inode), fs_info->sectorsize));
++
+ if (!maybe_acls)
+ cache_no_acl(vfs_inode);
+
+--
+2.51.0
+
--- /dev/null
+From b121d6de3662b43b087788bd6ebc0a1ea9deca44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 11:16:06 +0530
+Subject: crypto: qat - fix duplicate restarting msg during AER error
+
+From: Harshita Bhilwaria <harshita.bhilwaria@intel.com>
+
+[ Upstream commit 961ac9d97be72267255f1ed841aabf6694b17454 ]
+
+The restarting message from PF to VF is sent twice during AER error
+handling: once from adf_error_detected() and again from
+adf_disable_sriov().
+This causes userspace subservices to shutdown unexpectedly when they
+receive a duplicate restarting message after already being restarted.
+
+Avoid calling adf_pf2vf_notify_restarting() and
+adf_pf2vf_wait_for_restarting_complete() from adf_error_detected() so
+that the restarting msg is sent only once from PF to VF.
+
+Fixes: 9567d3dc760931 ("crypto: qat - improve aer error reset handling")
+Signed-off-by: Harshita Bhilwaria <harshita.bhilwaria@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
+Reviewed-by: Ravikumar PM <ravikumar.pm@intel.com>
+Reviewed-by: Srikanth Thokala <srikanth.thokala@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_aer.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_aer.c b/drivers/crypto/intel/qat/qat_common/adf_aer.c
+index 35679b21ff63b..a098689ab5b75 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_aer.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_aer.c
+@@ -41,8 +41,6 @@ static pci_ers_result_t adf_error_detected(struct pci_dev *pdev,
+ adf_error_notifier(accel_dev);
+ adf_pf2vf_notify_fatal_error(accel_dev);
+ adf_dev_restarting_notify(accel_dev);
+- adf_pf2vf_notify_restarting(accel_dev);
+- adf_pf2vf_wait_for_restarting_complete(accel_dev);
+ pci_clear_master(pdev);
+ adf_dev_down(accel_dev);
+
+--
+2.51.0
+
--- /dev/null
+From d0b6d7857774d3e4fabab5d02841a978af24b4ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Dec 2025 10:47:18 +0800
+Subject: drm/amd/pm: fix wrong pcie parameter on navi1x
+
+From: Yang Wang <kevinyang.wang@amd.com>
+
+[ Upstream commit 4f74c2dd970611d3ec3bb0d58215e73af5cd7214 ]
+
+fix wrong pcie dpm parameter on navi1x
+
+Fixes: 1a18607c07bb ("drm/amd/pm: override pcie dpm parameters only if it is necessary")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4671
+Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
+Co-developed-by: Kenneth Feng <kenneth.feng@amd.com>
+Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 5c5189cf4b0cc0a22bac74a40743ee711cff07f8)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
+index 0028f10ead423..d0fd9537e6236 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
+@@ -2463,8 +2463,8 @@ static int navi10_update_pcie_parameters(struct smu_context *smu,
+ pptable->PcieLaneCount[i] > pcie_width_cap ?
+ pcie_width_cap : pptable->PcieLaneCount[i];
+ smu_pcie_arg = i << 16;
+- smu_pcie_arg |= pcie_gen_cap << 8;
+- smu_pcie_arg |= pcie_width_cap;
++ smu_pcie_arg |= dpm_context->dpm_tables.pcie_table.pcie_gen[i] << 8;
++ smu_pcie_arg |= dpm_context->dpm_tables.pcie_table.pcie_lane[i];
+ ret = smu_cmn_send_smc_msg_with_param(smu,
+ SMU_MSG_OverridePcieParameters,
+ smu_pcie_arg,
+--
+2.51.0
+
--- /dev/null
+From 55fac2a2986b5b85c6083f15991ee98ebfccbfe5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 17:51:11 +0800
+Subject: drm/amd/pm: force send pcie parmater on navi1x
+
+From: Yang Wang <kevinyang.wang@amd.com>
+
+[ Upstream commit dc8a887de1a7d397ab4131f45676e89565417aa8 ]
+
+v1:
+the PMFW didn't initialize the PCIe DPM parameters
+and requires the KMD to actively provide these parameters.
+
+v2:
+clean & remove unused code logic (lijo)
+
+Fixes: 1a18607c07bb ("drm/amd/pm: override pcie dpm parameters only if it is necessary")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4671
+Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit b0dbd5db7cf1f81e4aaedd25cb5e72ce369387b2)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 33 +++++++++----------
+ 1 file changed, 15 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
+index d0fd9537e6236..a2fcf678182b4 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
+@@ -2454,24 +2454,21 @@ static int navi10_update_pcie_parameters(struct smu_context *smu,
+ }
+
+ for (i = 0; i < NUM_LINK_LEVELS; i++) {
+- if (pptable->PcieGenSpeed[i] > pcie_gen_cap ||
+- pptable->PcieLaneCount[i] > pcie_width_cap) {
+- dpm_context->dpm_tables.pcie_table.pcie_gen[i] =
+- pptable->PcieGenSpeed[i] > pcie_gen_cap ?
+- pcie_gen_cap : pptable->PcieGenSpeed[i];
+- dpm_context->dpm_tables.pcie_table.pcie_lane[i] =
+- pptable->PcieLaneCount[i] > pcie_width_cap ?
+- pcie_width_cap : pptable->PcieLaneCount[i];
+- smu_pcie_arg = i << 16;
+- smu_pcie_arg |= dpm_context->dpm_tables.pcie_table.pcie_gen[i] << 8;
+- smu_pcie_arg |= dpm_context->dpm_tables.pcie_table.pcie_lane[i];
+- ret = smu_cmn_send_smc_msg_with_param(smu,
+- SMU_MSG_OverridePcieParameters,
+- smu_pcie_arg,
+- NULL);
+- if (ret)
+- break;
+- }
++ dpm_context->dpm_tables.pcie_table.pcie_gen[i] =
++ pptable->PcieGenSpeed[i] > pcie_gen_cap ?
++ pcie_gen_cap : pptable->PcieGenSpeed[i];
++ dpm_context->dpm_tables.pcie_table.pcie_lane[i] =
++ pptable->PcieLaneCount[i] > pcie_width_cap ?
++ pcie_width_cap : pptable->PcieLaneCount[i];
++ smu_pcie_arg = i << 16;
++ smu_pcie_arg |= dpm_context->dpm_tables.pcie_table.pcie_gen[i] << 8;
++ smu_pcie_arg |= dpm_context->dpm_tables.pcie_table.pcie_lane[i];
++ ret = smu_cmn_send_smc_msg_with_param(smu,
++ SMU_MSG_OverridePcieParameters,
++ smu_pcie_arg,
++ NULL);
++ if (ret)
++ return ret;
+ }
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 26c09d7668577eb6712a940b07f8c057434d0b03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 10:38:31 +0800
+Subject: erofs: don't bother with s_stack_depth increasing for now
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 072a7c7cdbea4f91df854ee2bb216256cd619f2a ]
+
+Previously, commit d53cd891f0e4 ("erofs: limit the level of fs stacking
+for file-backed mounts") bumped `s_stack_depth` by one to avoid kernel
+stack overflow when stacking an unlimited number of EROFS on top of
+each other.
+
+This fix breaks composefs mounts, which need EROFS+ovl^2 sometimes
+(and such setups are already used in production for quite a long time).
+
+One way to fix this regression is to bump FILESYSTEM_MAX_STACK_DEPTH
+from 2 to 3, but proving that this is safe in general is a high bar.
+
+After a long discussion on GitHub issues [1] about possible solutions,
+one conclusion is that there is no need to support nesting file-backed
+EROFS mounts on stacked filesystems, because there is always the option
+to use loopback devices as a fallback.
+
+As a quick fix for the composefs regression for this cycle, instead of
+bumping `s_stack_depth` for file backed EROFS mounts, we disallow
+nesting file-backed EROFS over EROFS and over filesystems with
+`s_stack_depth` > 0.
+
+This works for all known file-backed mount use cases (composefs,
+containerd, and Android APEX for some Android vendors), and the fix is
+self-contained.
+
+Essentially, we are allowing one extra unaccounted fs stacking level of
+EROFS below stacking filesystems, but EROFS can only be used in the read
+path (i.e. overlayfs lower layers), which typically has much lower stack
+usage than the write path.
+
+We can consider increasing FILESYSTEM_MAX_STACK_DEPTH later, after more
+stack usage analysis or using alternative approaches, such as splitting
+the `s_stack_depth` limitation according to different combinations of
+stacking.
+
+Fixes: d53cd891f0e4 ("erofs: limit the level of fs stacking for file-backed mounts")
+Reported-and-tested-by: Dusty Mabe <dusty@dustymabe.com>
+Reported-by: Timothée Ravier <tim@siosm.fr>
+Closes: https://github.com/coreos/fedora-coreos-tracker/issues/2087 [1]
+Reported-by: "Alekséi Naidénov" <an@digitaltide.io>
+Closes: https://lore.kernel.org/r/CAFHtUiYv4+=+JP_-JjARWjo6OwcvBj1wtYN=z0QXwCpec9sXtg@mail.gmail.com
+Acked-by: Amir Goldstein <amir73il@gmail.com>
+Acked-by: Alexander Larsson <alexl@redhat.com>
+Reviewed-and-tested-by: Sheng Yong <shengyong1@xiaomi.com>
+Reviewed-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Cc: Christian Brauner <brauner@kernel.org>
+Cc: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/super.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/fs/erofs/super.c b/fs/erofs/super.c
+index 937a215f626c1..e93264034b5db 100644
+--- a/fs/erofs/super.c
++++ b/fs/erofs/super.c
+@@ -644,14 +644,20 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
+ * fs contexts (including its own) due to self-controlled RO
+ * accesses/contexts and no side-effect changes that need to
+ * context save & restore so it can reuse the current thread
+- * context. However, it still needs to bump `s_stack_depth` to
+- * avoid kernel stack overflow from nested filesystems.
++ * context.
++ * However, we still need to prevent kernel stack overflow due
++ * to filesystem nesting: just ensure that s_stack_depth is 0
++ * to disallow mounting EROFS on stacked filesystems.
++ * Note: s_stack_depth is not incremented here for now, since
++ * EROFS is the only fs supporting file-backed mounts for now.
++ * It MUST change if another fs plans to support them, which
++ * may also require adjusting FILESYSTEM_MAX_STACK_DEPTH.
+ */
+ if (erofs_is_fileio_mode(sbi)) {
+- sb->s_stack_depth =
+- file_inode(sbi->dif0.file)->i_sb->s_stack_depth + 1;
+- if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
+- erofs_err(sb, "maximum fs stacking depth exceeded");
++ inode = file_inode(sbi->dif0.file);
++ if ((inode->i_sb->s_op == &erofs_sops && !sb->s_bdev) ||
++ inode->i_sb->s_stack_depth) {
++ erofs_err(sb, "file-backed mounts cannot be applied to stacked fses");
+ return -ENOTBLK;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 18b080aea14c46511e8413c271f7f527332af43a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jan 2026 19:47:03 +0800
+Subject: erofs: fix file-backed mounts no longer working on EROFS partitions
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 7893cc12251f6f19e7689a4cf3ba803bddbd8437 ]
+
+Sheng Yong reported [1] that Android APEX images didn't work with commit
+072a7c7cdbea ("erofs: don't bother with s_stack_depth increasing for
+now") because "EROFS-formatted APEX file images can be stored within an
+EROFS-formatted Android system partition."
+
+In response, I sent a quick fat-fingered [PATCH v3] to address the
+report. Unfortunately, the updated condition was incorrect:
+
+ if (erofs_is_fileio_mode(sbi)) {
+- sb->s_stack_depth =
+- file_inode(sbi->dif0.file)->i_sb->s_stack_depth + 1;
+- if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
+- erofs_err(sb, "maximum fs stacking depth exceeded");
++ inode = file_inode(sbi->dif0.file);
++ if ((inode->i_sb->s_op == &erofs_sops && !sb->s_bdev) ||
++ inode->i_sb->s_stack_depth) {
+
+The condition `!sb->s_bdev` is always true for all file-backed EROFS
+mounts, making the check effectively a no-op.
+
+The real fix tested and confirmed by Sheng Yong [2] at that time was
+[PATCH v3 RESEND], which correctly ensures the following EROFS^2 setup
+works:
+ EROFS (on a block device) + EROFS (file-backed mount)
+
+But sadly I screwed it up again by upstreaming the outdated [PATCH v3].
+
+This patch applies the same logic as the delta between the upstream
+[PATCH v3] and the real fix [PATCH v3 RESEND].
+
+Reported-by: Sheng Yong <shengyong1@xiaomi.com>
+Closes: https://lore.kernel.org/r/3acec686-4020-4609-aee4-5dae7b9b0093@gmail.com [1]
+Fixes: 072a7c7cdbea ("erofs: don't bother with s_stack_depth increasing for now")
+Link: https://lore.kernel.org/r/243f57b8-246f-47e7-9fb1-27a771e8e9e8@gmail.com [2]
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/super.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/erofs/super.c b/fs/erofs/super.c
+index e93264034b5db..5136cda5972a9 100644
+--- a/fs/erofs/super.c
++++ b/fs/erofs/super.c
+@@ -655,7 +655,8 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
+ */
+ if (erofs_is_fileio_mode(sbi)) {
+ inode = file_inode(sbi->dif0.file);
+- if ((inode->i_sb->s_op == &erofs_sops && !sb->s_bdev) ||
++ if ((inode->i_sb->s_op == &erofs_sops &&
++ !inode->i_sb->s_bdev) ||
+ inode->i_sb->s_stack_depth) {
+ erofs_err(sb, "file-backed mounts cannot be applied to stacked fses");
+ return -ENOTBLK;
+--
+2.51.0
+
--- /dev/null
+From 649c1bc1cb2e239c62ee9230872060419fdd679d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 06:50:26 +0100
+Subject: gpio: it87: balance superio enter/exit calls in error path
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit a05543d6b05ba998fdbb4b383319ae5121bb7407 ]
+
+We always call superio_enter() in it87_gpio_direction_out() but only
+call superio_exit() if the call to it87_gpio_set() succeeds. Move the
+label to balance the calls in error path as well.
+
+Fixes: ef877a159072 ("gpio: it87: use new line value setter callbacks")
+Reported-by: Daniel Gibson <daniel@gibson.sh>
+Closes: https://lore.kernel.org/all/bd0a00e3-9b8c-43e8-8772-e67b91f4c71e@gibson.sh/
+Link: https://lore.kernel.org/r/20251210055026.23146-1-bartosz.golaszewski@oss.qualcomm.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-it87.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpio/gpio-it87.c b/drivers/gpio/gpio-it87.c
+index 5d677bcfccf26..2ad3c239367bc 100644
+--- a/drivers/gpio/gpio-it87.c
++++ b/drivers/gpio/gpio-it87.c
+@@ -12,6 +12,7 @@
+
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
++#include <linux/cleanup.h>
+ #include <linux/init.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+@@ -241,23 +242,17 @@ static int it87_gpio_direction_out(struct gpio_chip *chip,
+ mask = 1 << (gpio_num % 8);
+ group = (gpio_num / 8);
+
+- spin_lock(&it87_gpio->lock);
++ guard(spinlock)(&it87_gpio->lock);
+
+ rc = superio_enter();
+ if (rc)
+- goto exit;
++ return rc;
+
+ /* set the output enable bit */
+ superio_set_mask(mask, group + it87_gpio->output_base);
+
+ rc = it87_gpio_set(chip, gpio_num, val);
+- if (rc)
+- goto exit;
+-
+ superio_exit();
+-
+-exit:
+- spin_unlock(&it87_gpio->lock);
+ return rc;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 67967137a5c1f68ab1e3b0a387a6e1daaf352923 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 16:30:25 +0100
+Subject: gpio: pca953x: handle short interrupt pulses on PCAL devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ernest Van Hoecke <ernest.vanhoecke@toradex.com>
+
+[ Upstream commit 014a17deb41201449f76df2b20c857a9c3294a7c ]
+
+GPIO drivers with latch input support may miss short pulses on input
+pins even when input latching is enabled. The generic interrupt logic in
+the pca953x driver reports interrupts by comparing the current input
+value against the previously sampled one and only signals an event when
+a level change is observed between two reads.
+
+For short pulses, the first edge is captured when the input register is
+read, but if the signal returns to its previous level before the read,
+the second edge is not observed. As a result, successive pulses can
+produce identical input values at read time and no level change is
+detected, causing interrupts to be missed. Below timing diagram shows
+this situation where the top signal is the input pin level and the
+bottom signal indicates the latched value.
+
+─────┐ ┌──*───────────────┐ ┌──*─────────────────┐ ┌──*───
+ │ │ . │ │ . │ │ .
+ │ │ │ │ │ │ │ │ │
+ └──*──┘ │ └──*──┘ │ └──*──┘ │
+Input │ │ │ │ │ │
+ ▼ │ ▼ │ ▼ │
+ IRQ │ IRQ │ IRQ │
+ . . .
+─────┐ .┌──────────────┐ .┌────────────────┐ .┌──
+ │ │ │ │ │ │
+ │ │ │ │ │ │
+ └────────*┘ └────────*┘ └────────*┘
+Latched │ │ │
+ ▼ ▼ ▼
+ READ 0 READ 0 READ 0
+ NO CHANGE NO CHANGE
+
+PCAL variants provide an interrupt status register that records which
+pins triggered an interrupt, but the status and input registers cannot
+be read atomically. The interrupt status is only cleared when the input
+port is read, and the input value must also be read to determine the
+triggering edge. If another interrupt occurs on a different line after
+the status register has been read but before the input register is
+sampled, that event will not be reflected in the earlier status
+snapshot, so relying solely on the interrupt status register is also
+insufficient.
+
+Support for input latching and interrupt status handling was previously
+added by [1], but the interrupt status-based logic was reverted by [2]
+due to these issues. This patch addresses the original problem by
+combining both sources of information. Events indicated by the interrupt
+status register are merged with events detected through the existing
+level-change logic. As a result:
+
+* short pulses, whose second edges are invisible, are detected via the
+ interrupt status register, and
+* interrupts that occur between the status and input reads are still
+ caught by the generic level-change logic.
+
+This significantly improves robustness on devices that signal interrupts
+as short pulses, while avoiding the issues that led to the earlier
+reversion. In practice, even if only the first edge of a pulse is
+observable, the interrupt is reliably detected.
+
+This fixes missed interrupts from an Ilitek touch controller with its
+interrupt line connected to a PCAL6416A, where active-low pulses are
+approximately 200 us long.
+
+[1] commit 44896beae605 ("gpio: pca953x: add PCAL9535 interrupt support for Galileo Gen2")
+[2] commit d6179f6c6204 ("gpio: pca953x: Improve interrupt support")
+
+Fixes: d6179f6c6204 ("gpio: pca953x: Improve interrupt support")
+Signed-off-by: Ernest Van Hoecke <ernest.vanhoecke@toradex.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20251217153050.142057-1-ernestvanhoecke@gmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca953x.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index b46927f550389..b2de916107f42 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -940,14 +940,35 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
+ DECLARE_BITMAP(old_stat, MAX_LINE);
+ DECLARE_BITMAP(cur_stat, MAX_LINE);
+ DECLARE_BITMAP(new_stat, MAX_LINE);
++ DECLARE_BITMAP(int_stat, MAX_LINE);
+ DECLARE_BITMAP(trigger, MAX_LINE);
+ DECLARE_BITMAP(edges, MAX_LINE);
+ int ret;
+
++ if (chip->driver_data & PCA_PCAL) {
++ /* Read INT_STAT before it is cleared by the input-port read. */
++ ret = pca953x_read_regs(chip, PCAL953X_INT_STAT, int_stat);
++ if (ret)
++ return false;
++ }
++
+ ret = pca953x_read_regs(chip, chip->regs->input, cur_stat);
+ if (ret)
+ return false;
+
++ if (chip->driver_data & PCA_PCAL) {
++ /* Detect short pulses via INT_STAT. */
++ bitmap_and(trigger, int_stat, chip->irq_mask, gc->ngpio);
++
++ /* Apply filter for rising/falling edge selection. */
++ bitmap_replace(new_stat, chip->irq_trig_fall, chip->irq_trig_raise,
++ cur_stat, gc->ngpio);
++
++ bitmap_and(int_stat, new_stat, trigger, gc->ngpio);
++ } else {
++ bitmap_zero(int_stat, gc->ngpio);
++ }
++
+ /* Remove output pins from the equation */
+ pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+
+@@ -961,7 +982,8 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
+
+ if (bitmap_empty(chip->irq_trig_level_high, gc->ngpio) &&
+ bitmap_empty(chip->irq_trig_level_low, gc->ngpio)) {
+- if (bitmap_empty(trigger, gc->ngpio))
++ if (bitmap_empty(trigger, gc->ngpio) &&
++ bitmap_empty(int_stat, gc->ngpio))
+ return false;
+ }
+
+@@ -969,6 +991,7 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
+ bitmap_and(old_stat, chip->irq_trig_raise, new_stat, gc->ngpio);
+ bitmap_or(edges, old_stat, cur_stat, gc->ngpio);
+ bitmap_and(pending, edges, trigger, gc->ngpio);
++ bitmap_or(pending, pending, int_stat, gc->ngpio);
+
+ bitmap_and(cur_stat, new_stat, chip->irq_trig_level_high, gc->ngpio);
+ bitmap_and(cur_stat, cur_stat, chip->irq_mask, gc->ngpio);
+--
+2.51.0
+
--- /dev/null
+From 0e5eb275845a25d4aeb551472adabb0e4647e708 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 09:26:40 +0100
+Subject: gpiolib: fix race condition for gdev->srcu
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paweł Narewski <pawel.narewski@nokia.com>
+
+[ Upstream commit a7ac22d53d0990152b108c3f4fe30df45fcb0181 ]
+
+If two drivers were calling gpiochip_add_data_with_key(), one may be
+traversing the srcu-protected list in gpio_name_to_desc(), meanwhile
+other has just added its gdev in gpiodev_add_to_list_unlocked().
+This creates a non-mutexed and non-protected timeframe, when one
+instance is dereferencing and using &gdev->srcu, before the other
+has initialized it, resulting in crash:
+
+[ 4.935481] Unable to handle kernel paging request at virtual address ffff800272bcc000
+[ 4.943396] Mem abort info:
+[ 4.943400] ESR = 0x0000000096000005
+[ 4.943403] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 4.943407] SET = 0, FnV = 0
+[ 4.943410] EA = 0, S1PTW = 0
+[ 4.943413] FSC = 0x05: level 1 translation fault
+[ 4.943416] Data abort info:
+[ 4.943418] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
+[ 4.946220] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+[ 4.955261] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+[ 4.955268] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000038e6c000
+[ 4.961449] [ffff800272bcc000] pgd=0000000000000000
+[ 4.969203] , p4d=1000000039739003
+[ 4.979730] , pud=0000000000000000
+[ 4.980210] phandle (CPU): 0x0000005e, phandle (BE): 0x5e000000 for node "reset"
+[ 4.991736] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
+...
+[ 5.121359] pc : __srcu_read_lock+0x44/0x98
+[ 5.131091] lr : gpio_name_to_desc+0x60/0x1a0
+[ 5.153671] sp : ffff8000833bb430
+[ 5.298440]
+[ 5.298443] Call trace:
+[ 5.298445] __srcu_read_lock+0x44/0x98
+[ 5.309484] gpio_name_to_desc+0x60/0x1a0
+[ 5.320692] gpiochip_add_data_with_key+0x488/0xf00
+ 5.946419] ---[ end trace 0000000000000000 ]---
+
+Move initialization code for gdev fields before it is added to
+gpio_devices, with adjacent initialization code.
+Adjust goto statements to reflect modified order of operations
+
+Fixes: 47d8b4c1d868 ("gpio: add SRCU infrastructure to struct gpio_device")
+Reviewed-by: Jakub Lewalski <jakub.lewalski@nokia.com>
+Signed-off-by: Paweł Narewski <pawel.narewski@nokia.com>
+[Bartosz: fixed a build issue, removed stray newline]
+Link: https://lore.kernel.org/r/20251224082641.10769-1-bartosz.golaszewski@oss.qualcomm.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 40 ++++++++++++++++++++--------------------
+ 1 file changed, 20 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 9a4395a29f68e..9aa6ddf6389cc 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -1091,6 +1091,18 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ gdev->ngpio = gc->ngpio;
+ gdev->can_sleep = gc->can_sleep;
+
++ rwlock_init(&gdev->line_state_lock);
++ RAW_INIT_NOTIFIER_HEAD(&gdev->line_state_notifier);
++ BLOCKING_INIT_NOTIFIER_HEAD(&gdev->device_notifier);
++
++ ret = init_srcu_struct(&gdev->srcu);
++ if (ret)
++ goto err_free_label;
++
++ ret = init_srcu_struct(&gdev->desc_srcu);
++ if (ret)
++ goto err_cleanup_gdev_srcu;
++
+ scoped_guard(mutex, &gpio_devices_lock) {
+ /*
+ * TODO: this allocates a Linux GPIO number base in the global
+@@ -1105,7 +1117,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ if (base < 0) {
+ ret = base;
+ base = 0;
+- goto err_free_label;
++ goto err_cleanup_desc_srcu;
+ }
+
+ /*
+@@ -1125,22 +1137,10 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ ret = gpiodev_add_to_list_unlocked(gdev);
+ if (ret) {
+ gpiochip_err(gc, "GPIO integer space overlap, cannot add chip\n");
+- goto err_free_label;
++ goto err_cleanup_desc_srcu;
+ }
+ }
+
+- rwlock_init(&gdev->line_state_lock);
+- RAW_INIT_NOTIFIER_HEAD(&gdev->line_state_notifier);
+- BLOCKING_INIT_NOTIFIER_HEAD(&gdev->device_notifier);
+-
+- ret = init_srcu_struct(&gdev->srcu);
+- if (ret)
+- goto err_remove_from_list;
+-
+- ret = init_srcu_struct(&gdev->desc_srcu);
+- if (ret)
+- goto err_cleanup_gdev_srcu;
+-
+ #ifdef CONFIG_PINCTRL
+ INIT_LIST_HEAD(&gdev->pin_ranges);
+ #endif
+@@ -1150,11 +1150,11 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+
+ ret = gpiochip_set_names(gc);
+ if (ret)
+- goto err_cleanup_desc_srcu;
++ goto err_remove_from_list;
+
+ ret = gpiochip_init_valid_mask(gc);
+ if (ret)
+- goto err_cleanup_desc_srcu;
++ goto err_remove_from_list;
+
+ for (desc_index = 0; desc_index < gc->ngpio; desc_index++) {
+ struct gpio_desc *desc = &gdev->descs[desc_index];
+@@ -1227,10 +1227,6 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ of_gpiochip_remove(gc);
+ err_free_valid_mask:
+ gpiochip_free_valid_mask(gc);
+-err_cleanup_desc_srcu:
+- cleanup_srcu_struct(&gdev->desc_srcu);
+-err_cleanup_gdev_srcu:
+- cleanup_srcu_struct(&gdev->srcu);
+ err_remove_from_list:
+ scoped_guard(mutex, &gpio_devices_lock)
+ list_del_rcu(&gdev->list);
+@@ -1240,6 +1236,10 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ gpio_device_put(gdev);
+ goto err_print_message;
+ }
++err_cleanup_desc_srcu:
++ cleanup_srcu_struct(&gdev->desc_srcu);
++err_cleanup_gdev_srcu:
++ cleanup_srcu_struct(&gdev->srcu);
+ err_free_label:
+ kfree_const(gdev->label);
+ err_free_descs:
+--
+2.51.0
+
--- /dev/null
+From 6c5513b839ce40c82acac4c063e916ffe9dd810f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 11:54:02 +0200
+Subject: gpiolib: remove unnecessary 'out of memory' messages
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit 0ba6f1ed3808b1f095fbdb490006f0ecd00f52bd ]
+
+We don't need to add additional logs when returning -ENOMEM so remove
+unnecessary error messages.
+
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Stable-dep-of: a7ac22d53d09 ("gpiolib: fix race condition for gdev->srcu")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index cd8800ba5825f..f2ed234b4135e 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2316,10 +2316,8 @@ int gpiochip_add_pingroup_range(struct gpio_chip *gc,
+ int ret;
+
+ pin_range = kzalloc(sizeof(*pin_range), GFP_KERNEL);
+- if (!pin_range) {
+- chip_err(gc, "failed to allocate pin ranges\n");
++ if (!pin_range)
+ return -ENOMEM;
+- }
+
+ /* Use local offset as range ID */
+ pin_range->range.id = gpio_offset;
+@@ -2379,10 +2377,8 @@ int gpiochip_add_pin_range_with_pins(struct gpio_chip *gc,
+ int ret;
+
+ pin_range = kzalloc(sizeof(*pin_range), GFP_KERNEL);
+- if (!pin_range) {
+- chip_err(gc, "failed to allocate pin ranges\n");
++ if (!pin_range)
+ return -ENOMEM;
+- }
+
+ /* Use local offset as range ID */
+ pin_range->range.id = gpio_offset;
+--
+2.51.0
+
--- /dev/null
+From c0fbf279d84e0aba28ef8690d8e216ff0951a655 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 11:54:03 +0200
+Subject: gpiolib: rename GPIO chip printk macros
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit d4f335b410ddbe3e99f48f8b5ea78a25041274f1 ]
+
+The chip_$level() macros take struct gpio_chip as argument so make it
+follow the convention of using the 'gpiochip_' prefix.
+
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Stable-dep-of: a7ac22d53d09 ("gpiolib: fix race condition for gdev->srcu")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-cdev.c | 2 +-
+ drivers/gpio/gpiolib-sysfs.c | 2 +-
+ drivers/gpio/gpiolib.c | 80 ++++++++++++++++++------------------
+ drivers/gpio/gpiolib.h | 8 ++--
+ 4 files changed, 45 insertions(+), 47 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
+index d8d93059ac04c..d925e75d1dce1 100644
+--- a/drivers/gpio/gpiolib-cdev.c
++++ b/drivers/gpio/gpiolib-cdev.c
+@@ -2828,7 +2828,7 @@ int gpiolib_cdev_register(struct gpio_device *gdev, dev_t devt)
+ if (!gc)
+ return -ENODEV;
+
+- chip_dbg(gc, "added GPIO chardev (%d:%d)\n", MAJOR(devt), gdev->id);
++ gpiochip_dbg(gc, "added GPIO chardev (%d:%d)\n", MAJOR(devt), gdev->id);
+
+ return 0;
+ }
+diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
+index 9a849245b3588..7d5fc1ea2aa54 100644
+--- a/drivers/gpio/gpiolib-sysfs.c
++++ b/drivers/gpio/gpiolib-sysfs.c
+@@ -1091,7 +1091,7 @@ static int gpiofind_sysfs_register(struct gpio_chip *gc, const void *data)
+
+ ret = gpiochip_sysfs_register(gdev);
+ if (ret)
+- chip_err(gc, "failed to register the sysfs entry: %d\n", ret);
++ gpiochip_err(gc, "failed to register the sysfs entry: %d\n", ret);
+
+ return 0;
+ }
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index f2ed234b4135e..9a4395a29f68e 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -921,8 +921,8 @@ static void gpiochip_machine_hog(struct gpio_chip *gc, struct gpiod_hog *hog)
+
+ desc = gpiochip_get_desc(gc, hog->chip_hwnum);
+ if (IS_ERR(desc)) {
+- chip_err(gc, "%s: unable to get GPIO desc: %ld\n", __func__,
+- PTR_ERR(desc));
++ gpiochip_err(gc, "%s: unable to get GPIO desc: %ld\n",
++ __func__, PTR_ERR(desc));
+ return;
+ }
+
+@@ -1124,7 +1124,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+
+ ret = gpiodev_add_to_list_unlocked(gdev);
+ if (ret) {
+- chip_err(gc, "GPIO integer space overlap, cannot add chip\n");
++ gpiochip_err(gc, "GPIO integer space overlap, cannot add chip\n");
+ goto err_free_label;
+ }
+ }
+@@ -1528,8 +1528,7 @@ static void gpiochip_set_hierarchical_irqchip(struct gpio_chip *gc,
+ &parent_hwirq,
+ &parent_type);
+ if (ret) {
+- chip_err(gc, "skip set-up on hwirq %d\n",
+- i);
++ gpiochip_err(gc, "skip set-up on hwirq %d\n", i);
+ continue;
+ }
+
+@@ -1542,15 +1541,14 @@ static void gpiochip_set_hierarchical_irqchip(struct gpio_chip *gc,
+ ret = irq_domain_alloc_irqs(gc->irq.domain, 1,
+ NUMA_NO_NODE, &fwspec);
+ if (ret < 0) {
+- chip_err(gc,
+- "can not allocate irq for GPIO line %d parent hwirq %d in hierarchy domain: %d\n",
+- i, parent_hwirq,
+- ret);
++ gpiochip_err(gc,
++ "can not allocate irq for GPIO line %d parent hwirq %d in hierarchy domain: %d\n",
++ i, parent_hwirq, ret);
+ }
+ }
+ }
+
+- chip_err(gc, "%s unknown fwnode type proceed anyway\n", __func__);
++ gpiochip_err(gc, "%s unknown fwnode type proceed anyway\n", __func__);
+
+ return;
+ }
+@@ -1602,15 +1600,15 @@ static int gpiochip_hierarchy_irq_domain_alloc(struct irq_domain *d,
+ if (ret)
+ return ret;
+
+- chip_dbg(gc, "allocate IRQ %d, hwirq %lu\n", irq, hwirq);
++ gpiochip_dbg(gc, "allocate IRQ %d, hwirq %lu\n", irq, hwirq);
+
+ ret = girq->child_to_parent_hwirq(gc, hwirq, type,
+ &parent_hwirq, &parent_type);
+ if (ret) {
+- chip_err(gc, "can't look up hwirq %lu\n", hwirq);
++ gpiochip_err(gc, "can't look up hwirq %lu\n", hwirq);
+ return ret;
+ }
+- chip_dbg(gc, "found parent hwirq %u\n", parent_hwirq);
++ gpiochip_dbg(gc, "found parent hwirq %u\n", parent_hwirq);
+
+ /*
+ * We set handle_bad_irq because the .set_type() should
+@@ -1631,8 +1629,8 @@ static int gpiochip_hierarchy_irq_domain_alloc(struct irq_domain *d,
+ if (ret)
+ return ret;
+
+- chip_dbg(gc, "alloc_irqs_parent for %d parent hwirq %d\n",
+- irq, parent_hwirq);
++ gpiochip_dbg(gc, "alloc_irqs_parent for %d parent hwirq %d\n",
++ irq, parent_hwirq);
+ irq_set_lockdep_class(irq, gc->irq.lock_key, gc->irq.request_key);
+ ret = irq_domain_alloc_irqs_parent(d, irq, 1, &gpio_parent_fwspec);
+ /*
+@@ -1642,9 +1640,9 @@ static int gpiochip_hierarchy_irq_domain_alloc(struct irq_domain *d,
+ if (irq_domain_is_msi(d->parent) && (ret == -EEXIST))
+ ret = 0;
+ if (ret)
+- chip_err(gc,
+- "failed to allocate parent hwirq %d for hwirq %lu\n",
+- parent_hwirq, hwirq);
++ gpiochip_err(gc,
++ "failed to allocate parent hwirq %d for hwirq %lu\n",
++ parent_hwirq, hwirq);
+
+ return ret;
+ }
+@@ -1720,7 +1718,7 @@ static struct irq_domain *gpiochip_hierarchy_create_domain(struct gpio_chip *gc)
+
+ if (!gc->irq.child_to_parent_hwirq ||
+ !gc->irq.fwnode) {
+- chip_err(gc, "missing irqdomain vital data\n");
++ gpiochip_err(gc, "missing irqdomain vital data\n");
+ return ERR_PTR(-EINVAL);
+ }
+
+@@ -1993,7 +1991,7 @@ static void gpiochip_set_irq_hooks(struct gpio_chip *gc)
+ if (irqchip->flags & IRQCHIP_IMMUTABLE)
+ return;
+
+- chip_warn(gc, "not an immutable chip, please consider fixing it!\n");
++ gpiochip_warn(gc, "not an immutable chip, please consider fixing it!\n");
+
+ if (!irqchip->irq_request_resources &&
+ !irqchip->irq_release_resources) {
+@@ -2009,8 +2007,8 @@ static void gpiochip_set_irq_hooks(struct gpio_chip *gc)
+ * ...and if so, give a gentle warning that this is bad
+ * practice.
+ */
+- chip_info(gc,
+- "detected irqchip that is shared with multiple gpiochips: please fix the driver.\n");
++ gpiochip_info(gc,
++ "detected irqchip that is shared with multiple gpiochips: please fix the driver.\n");
+ return;
+ }
+
+@@ -2039,7 +2037,8 @@ static int gpiochip_irqchip_add_allocated_domain(struct gpio_chip *gc,
+ return -EINVAL;
+
+ if (gc->to_irq)
+- chip_warn(gc, "to_irq is redefined in %s and you shouldn't rely on it\n", __func__);
++ gpiochip_warn(gc, "to_irq is redefined in %s and you shouldn't rely on it\n",
++ __func__);
+
+ gc->to_irq = gpiochip_to_irq;
+ gc->irq.domain = domain;
+@@ -2080,7 +2079,7 @@ static int gpiochip_add_irqchip(struct gpio_chip *gc,
+ return 0;
+
+ if (gc->irq.parent_handler && gc->can_sleep) {
+- chip_err(gc, "you cannot have chained interrupts on a chip that may sleep\n");
++ gpiochip_err(gc, "you cannot have chained interrupts on a chip that may sleep\n");
+ return -EINVAL;
+ }
+
+@@ -2336,7 +2335,7 @@ int gpiochip_add_pingroup_range(struct gpio_chip *gc,
+
+ pinctrl_add_gpio_range(pctldev, &pin_range->range);
+
+- chip_dbg(gc, "created GPIO range %d->%d ==> %s PINGRP %s\n",
++ gpiochip_dbg(gc, "created GPIO range %d->%d ==> %s PINGRP %s\n",
+ gpio_offset, gpio_offset + pin_range->range.npins - 1,
+ pinctrl_dev_get_devname(pctldev), pin_group);
+
+@@ -2392,19 +2391,18 @@ int gpiochip_add_pin_range_with_pins(struct gpio_chip *gc,
+ &pin_range->range);
+ if (IS_ERR(pin_range->pctldev)) {
+ ret = PTR_ERR(pin_range->pctldev);
+- chip_err(gc, "could not create pin range\n");
++ gpiochip_err(gc, "could not create pin range\n");
+ kfree(pin_range);
+ return ret;
+ }
+ if (pin_range->range.pins)
+- chip_dbg(gc, "created GPIO range %d->%d ==> %s %d sparse PIN range { %d, ... }",
+- gpio_offset, gpio_offset + npins - 1,
+- pinctl_name, npins, pins[0]);
++ gpiochip_dbg(gc, "created GPIO range %d->%d ==> %s %d sparse PIN range { %d, ... }",
++ gpio_offset, gpio_offset + npins - 1,
++ pinctl_name, npins, pins[0]);
+ else
+- chip_dbg(gc, "created GPIO range %d->%d ==> %s PIN %d->%d\n",
+- gpio_offset, gpio_offset + npins - 1,
+- pinctl_name,
+- pin_offset, pin_offset + npins - 1);
++ gpiochip_dbg(gc, "created GPIO range %d->%d ==> %s PIN %d->%d\n",
++ gpio_offset, gpio_offset + npins - 1, pinctl_name,
++ pin_offset, pin_offset + npins - 1);
+
+ list_add_tail(&pin_range->node, &gdev->pin_ranges);
+
+@@ -2614,7 +2612,7 @@ struct gpio_desc *gpiochip_request_own_desc(struct gpio_chip *gc,
+ int ret;
+
+ if (IS_ERR(desc)) {
+- chip_err(gc, "failed to get GPIO %s descriptor\n", name);
++ gpiochip_err(gc, "failed to get GPIO %s descriptor\n", name);
+ return desc;
+ }
+
+@@ -2625,7 +2623,7 @@ struct gpio_desc *gpiochip_request_own_desc(struct gpio_chip *gc,
+ ret = gpiod_configure_flags(desc, label, lflags, dflags);
+ if (ret) {
+ gpiod_free_commit(desc);
+- chip_err(gc, "setup of own GPIO %s failed\n", name);
++ gpiochip_err(gc, "setup of own GPIO %s failed\n", name);
+ return ERR_PTR(ret);
+ }
+
+@@ -4052,8 +4050,8 @@ int gpiochip_lock_as_irq(struct gpio_chip *gc, unsigned int offset)
+ int dir = gpiod_get_direction(desc);
+
+ if (dir < 0) {
+- chip_err(gc, "%s: cannot get GPIO direction\n",
+- __func__);
++ gpiochip_err(gc, "%s: cannot get GPIO direction\n",
++ __func__);
+ return dir;
+ }
+ }
+@@ -4061,9 +4059,9 @@ int gpiochip_lock_as_irq(struct gpio_chip *gc, unsigned int offset)
+ /* To be valid for IRQ the line needs to be input or open drain */
+ if (test_bit(GPIOD_FLAG_IS_OUT, &desc->flags) &&
+ !test_bit(GPIOD_FLAG_OPEN_DRAIN, &desc->flags)) {
+- chip_err(gc,
+- "%s: tried to flag a GPIO set as output for IRQ\n",
+- __func__);
++ gpiochip_err(gc,
++ "%s: tried to flag a GPIO set as output for IRQ\n",
++ __func__);
+ return -EIO;
+ }
+
+@@ -4140,7 +4138,7 @@ int gpiochip_reqres_irq(struct gpio_chip *gc, unsigned int offset)
+
+ ret = gpiochip_lock_as_irq(gc, offset);
+ if (ret) {
+- chip_err(gc, "unable to lock HW IRQ %u for IRQ\n", offset);
++ gpiochip_err(gc, "unable to lock HW IRQ %u for IRQ\n", offset);
+ module_put(gc->gpiodev->owner);
+ return ret;
+ }
+diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h
+index 2a003a7311e7a..6ee29d0222393 100644
+--- a/drivers/gpio/gpiolib.h
++++ b/drivers/gpio/gpiolib.h
+@@ -309,13 +309,13 @@ do { \
+
+ /* With chip prefix */
+
+-#define chip_err(gc, fmt, ...) \
++#define gpiochip_err(gc, fmt, ...) \
+ dev_err(&gc->gpiodev->dev, "(%s): " fmt, gc->label, ##__VA_ARGS__)
+-#define chip_warn(gc, fmt, ...) \
++#define gpiochip_warn(gc, fmt, ...) \
+ dev_warn(&gc->gpiodev->dev, "(%s): " fmt, gc->label, ##__VA_ARGS__)
+-#define chip_info(gc, fmt, ...) \
++#define gpiochip_info(gc, fmt, ...) \
+ dev_info(&gc->gpiodev->dev, "(%s): " fmt, gc->label, ##__VA_ARGS__)
+-#define chip_dbg(gc, fmt, ...) \
++#define gpiochip_dbg(gc, fmt, ...) \
+ dev_dbg(&gc->gpiodev->dev, "(%s): " fmt, gc->label, ##__VA_ARGS__)
+
+ #endif /* GPIOLIB_H */
+--
+2.51.0
+
--- /dev/null
+From b5898cabed4089d0f4da413d8285b8e476b26ceb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Nov 2025 09:40:09 +0900
+Subject: gpu: nova-core: select RUST_FW_LOADER_ABSTRACTIONS
+
+From: Alexandre Courbot <acourbot@nvidia.com>
+
+[ Upstream commit 3d3352e73a55a4ccf110f8b3419bbe2fbfd8a030 ]
+
+RUST_FW_LOADER_ABSTRACTIONS was depended on by NOVA_CORE, but NOVA_CORE
+is selected by DRM_NOVA. This creates a situation where, if DRM_NOVA is
+selected, NOVA_CORE gets enabled but not RUST_FW_LOADER_ABSTRACTIONS,
+which results in a build error.
+
+Since the firmware loader is an implementation detail of the driver, it
+should be enabled along with it, so change the "depends on" to a
+"select".
+
+Fixes: 54e6baf123fd ("gpu: nova-core: add initial driver stub")
+Closes: https://lore.kernel.org/oe-kbuild-all/202512061721.rxKGnt5q-lkp@intel.com/
+Tested-by: Alyssa Ross <hi@alyssa.is>
+Acked-by: Danilo Krummrich <dakr@kernel.org>
+Link: https://patch.msgid.link/20251106-b4-select-rust-fw-v3-2-771172257755@nvidia.com
+Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/nova-core/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/nova-core/Kconfig b/drivers/gpu/nova-core/Kconfig
+index 20d3e6d0d796e..527920f9c4d39 100644
+--- a/drivers/gpu/nova-core/Kconfig
++++ b/drivers/gpu/nova-core/Kconfig
+@@ -3,7 +3,7 @@ config NOVA_CORE
+ depends on 64BIT
+ depends on PCI
+ depends on RUST
+- depends on RUST_FW_LOADER_ABSTRACTIONS
++ select RUST_FW_LOADER_ABSTRACTIONS
+ select AUXILIARY_BUS
+ default n
+ help
+--
+2.51.0
+
--- /dev/null
+From 85b30574cf3989138a4e736b82825df28c6dffe2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 17:56:35 +0100
+Subject: HID: Intel-thc-hid: Intel-thc: fix dma_unmap_sg() nents value
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit 0e13150c1a13a3a3d6184c24bfd080d5999945d1 ]
+
+The `dma_unmap_sg()` functions should be called with the same nents as the
+`dma_map_sg()`, not the value the map function returned.
+
+Save the number of entries in struct thc_dma_configuration.
+
+Fixes: a688404b2e20 ("HID: intel-thc-hid: intel-thc: Add THC DMA interfaces")
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Reviewed-by: Even Xu <even.xu@intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/intel-thc-hid/intel-thc/intel-thc-dma.c | 4 +++-
+ drivers/hid/intel-thc-hid/intel-thc/intel-thc-dma.h | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dma.c b/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dma.c
+index 82b8854843e05..a0c368aa7979c 100644
+--- a/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dma.c
++++ b/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dma.c
+@@ -232,6 +232,7 @@ static int setup_dma_buffers(struct thc_device *dev,
+ return 0;
+
+ memset(config->sgls, 0, sizeof(config->sgls));
++ memset(config->sgls_nent_pages, 0, sizeof(config->sgls_nent_pages));
+ memset(config->sgls_nent, 0, sizeof(config->sgls_nent));
+
+ cpu_addr = dma_alloc_coherent(dev->dev, prd_tbls_size,
+@@ -254,6 +255,7 @@ static int setup_dma_buffers(struct thc_device *dev,
+ }
+ count = dma_map_sg(dev->dev, config->sgls[i], nent, dir);
+
++ config->sgls_nent_pages[i] = nent;
+ config->sgls_nent[i] = count;
+ }
+
+@@ -299,7 +301,7 @@ static void release_dma_buffers(struct thc_device *dev,
+ continue;
+
+ dma_unmap_sg(dev->dev, config->sgls[i],
+- config->sgls_nent[i],
++ config->sgls_nent_pages[i],
+ config->dir);
+
+ sgl_free(config->sgls[i]);
+diff --git a/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dma.h b/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dma.h
+index 78917400492ca..541d33995baf3 100644
+--- a/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dma.h
++++ b/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dma.h
+@@ -91,6 +91,7 @@ struct thc_prd_table {
+ * @dir: Direction of DMA for this config
+ * @prd_tbls: PRD tables for current DMA
+ * @sgls: Array of pointers to scatter-gather lists
++ * @sgls_nent_pages: Number of pages per scatter-gather list
+ * @sgls_nent: Actual number of entries per scatter-gather list
+ * @prd_tbl_num: Actual number of PRD tables
+ * @max_packet_size: Size of the buffer needed for 1 DMA message (1 PRD table)
+@@ -107,6 +108,7 @@ struct thc_dma_configuration {
+
+ struct thc_prd_table *prd_tbls;
+ struct scatterlist *sgls[PRD_TABLES_NUM];
++ u8 sgls_nent_pages[PRD_TABLES_NUM];
+ u8 sgls_nent[PRD_TABLES_NUM];
+ u8 prd_tbl_num;
+
+--
+2.51.0
+
--- /dev/null
+From cc5c6a20719cc2942731d3b6706578207142a788 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Dec 2025 09:14:38 +0800
+Subject: HID: Intel-thc-hid: Intel-thc: Fix wrong register reading
+
+From: Even Xu <even.xu@intel.com>
+
+[ Upstream commit f39006965dd37e7be823dba6ca484adccc7a4dff ]
+
+Correct the read register for the setting of max input size and
+interrupt delay.
+
+Fixes: 22da60f0304b ("HID: Intel-thc-hid: Intel-thc: Introduce interrupt delay control")
+Fixes: 45e92a093099 ("HID: Intel-thc-hid: Intel-thc: Introduce max input size control")
+Signed-off-by: Even Xu <even.xu@intel.com>
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c b/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c
+index 636a683065015..7e220a4c5ded7 100644
+--- a/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c
++++ b/drivers/hid/intel-thc-hid/intel-thc/intel-thc-dev.c
+@@ -1593,7 +1593,7 @@ int thc_i2c_set_rx_max_size(struct thc_device *dev, u32 max_rx_size)
+ if (!max_rx_size)
+ return -EOPNOTSUPP;
+
+- ret = regmap_read(dev->thc_regmap, THC_M_PRT_SW_SEQ_STS_OFFSET, &val);
++ ret = regmap_read(dev->thc_regmap, THC_M_PRT_SPI_ICRRD_OPCODE_OFFSET, &val);
+ if (ret)
+ return ret;
+
+@@ -1662,7 +1662,7 @@ int thc_i2c_set_rx_int_delay(struct thc_device *dev, u32 delay_us)
+ if (!delay_us)
+ return -EOPNOTSUPP;
+
+- ret = regmap_read(dev->thc_regmap, THC_M_PRT_SW_SEQ_STS_OFFSET, &val);
++ ret = regmap_read(dev->thc_regmap, THC_M_PRT_SPI_ICRRD_OPCODE_OFFSET, &val);
+ if (ret)
+ return ret;
+
+--
+2.51.0
+
--- /dev/null
+From 5207c3fbf4ca0ad7935f9687e20e3379045a8918 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 13:46:41 +0100
+Subject: HID: quirks: work around VID/PID conflict for appledisplay
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit c7fabe4ad9219866c203164a214c474c95b36bf2 ]
+
+For years I wondered why the Apple Cinema Display driver would not
+just work for me. Turns out the hidraw driver instantly takes it
+over. Fix by adding appledisplay VID/PIDs to hid_have_special_driver.
+
+Fixes: 069e8a65cd79 ("Driver for Apple Cinema Display")
+Signed-off-by: René Rebe <rene@exactco.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-quirks.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index c89a015686c07..6a8a7ca3d8047 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -232,6 +232,15 @@ static const struct hid_device_id hid_quirks[] = {
+ * used as a driver. See hid_scan_report().
+ */
+ static const struct hid_device_id hid_have_special_driver[] = {
++#if IS_ENABLED(CONFIG_APPLEDISPLAY)
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9218) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9219) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x921c) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x921d) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9222) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9226) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9236) },
++#endif
+ #if IS_ENABLED(CONFIG_HID_A4TECH)
+ { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
+--
+2.51.0
+
--- /dev/null
+From 0e351f44e8e72dd8a8a44162720999610260beca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 13:20:36 -0800
+Subject: idpf: cap maximum Rx buffer size
+
+From: Joshua Hay <joshua.a.hay@intel.com>
+
+[ Upstream commit 086efe0a1ecc36cffe46640ce12649a4cd3ff171 ]
+
+The HW only supports a maximum Rx buffer size of 16K-128. On systems
+using large pages, the libeth logic can configure the buffer size to be
+larger than this. The upper bound is PAGE_SIZE while the lower bound is
+MTU rounded up to the nearest power of 2. For example, ARM systems with
+a 64K page size and an mtu of 9000 will set the Rx buffer size to 16K,
+which will cause the config Rx queues message to fail.
+
+Initialize the bufq/fill queue buf_len field to the maximum supported
+size. This will trigger the libeth logic to cap the maximum Rx buffer
+size by reducing the upper bound.
+
+Fixes: 74d1412ac8f37 ("idpf: use libeth Rx buffer management for payload buffer")
+Signed-off-by: Joshua Hay <joshua.a.hay@intel.com>
+Acked-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: David Decotigny <ddecotig@google.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_txrx.c | 8 +++++---
+ drivers/net/ethernet/intel/idpf/idpf_txrx.h | 1 +
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+index 3698979b4c9ee..f66948f5de78b 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+@@ -695,9 +695,10 @@ static int idpf_rx_buf_alloc_singleq(struct idpf_rx_queue *rxq)
+ static int idpf_rx_bufs_init_singleq(struct idpf_rx_queue *rxq)
+ {
+ struct libeth_fq fq = {
+- .count = rxq->desc_count,
+- .type = LIBETH_FQE_MTU,
+- .nid = idpf_q_vector_to_mem(rxq->q_vector),
++ .count = rxq->desc_count,
++ .type = LIBETH_FQE_MTU,
++ .buf_len = IDPF_RX_MAX_BUF_SZ,
++ .nid = idpf_q_vector_to_mem(rxq->q_vector),
+ };
+ int ret;
+
+@@ -754,6 +755,7 @@ static int idpf_rx_bufs_init(struct idpf_buf_queue *bufq,
+ .truesize = bufq->truesize,
+ .count = bufq->desc_count,
+ .type = type,
++ .buf_len = IDPF_RX_MAX_BUF_SZ,
+ .hsplit = idpf_queue_has(HSPLIT_EN, bufq),
+ .xdp = idpf_xdp_enabled(bufq->q_vector->vport),
+ .nid = idpf_q_vector_to_mem(bufq->q_vector),
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.h b/drivers/net/ethernet/intel/idpf/idpf_txrx.h
+index 0472698ca1927..423cc9486dce7 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.h
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.h
+@@ -101,6 +101,7 @@ do { \
+ idx = 0; \
+ } while (0)
+
++#define IDPF_RX_MAX_BUF_SZ (16384 - 128)
+ #define IDPF_RX_BUF_STRIDE 32
+ #define IDPF_RX_BUF_POST_STRIDE 16
+ #define IDPF_LOW_WATERMARK 64
+--
+2.51.0
+
--- /dev/null
+From bc5821ad381722367b5864879910758417bd8f4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Nov 2025 14:36:24 -0800
+Subject: idpf: convert vport state to bitmap
+
+From: Emil Tantilov <emil.s.tantilov@intel.com>
+
+[ Upstream commit 8dd72ebc73f37b216410db17340f15e6fb2cdb7b ]
+
+Convert vport state to a bitmap and remove the DOWN state which is
+redundant in the existing logic. There are no functional changes aside
+from the use of bitwise operations when setting and checking the states.
+Removed the double underscore to be consistent with the naming of other
+bitmaps in the header and renamed current_state to vport_is_up to match
+the meaning of the new variable.
+
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Chittim Madhu <madhu.chittim@intel.com>
+Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://patch.msgid.link/20251125223632.1857532-6-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 2e281e1155fc ("idpf: detach and close netdevs while handling a reset")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf.h | 12 ++++------
+ .../net/ethernet/intel/idpf/idpf_ethtool.c | 12 +++++-----
+ drivers/net/ethernet/intel/idpf/idpf_lib.c | 24 +++++++++----------
+ .../ethernet/intel/idpf/idpf_singleq_txrx.c | 2 +-
+ drivers/net/ethernet/intel/idpf/idpf_txrx.c | 2 +-
+ .../net/ethernet/intel/idpf/idpf_virtchnl.c | 4 ++--
+ drivers/net/ethernet/intel/idpf/xdp.c | 2 +-
+ 7 files changed, 28 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf.h b/drivers/net/ethernet/intel/idpf/idpf.h
+index ca4da0c899794..64142f8163fed 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf.h
++++ b/drivers/net/ethernet/intel/idpf/idpf.h
+@@ -131,14 +131,12 @@ enum idpf_cap_field {
+
+ /**
+ * enum idpf_vport_state - Current vport state
+- * @__IDPF_VPORT_DOWN: Vport is down
+- * @__IDPF_VPORT_UP: Vport is up
+- * @__IDPF_VPORT_STATE_LAST: Must be last, number of states
++ * @IDPF_VPORT_UP: Vport is up
++ * @IDPF_VPORT_STATE_NBITS: Must be last, number of states
+ */
+ enum idpf_vport_state {
+- __IDPF_VPORT_DOWN,
+- __IDPF_VPORT_UP,
+- __IDPF_VPORT_STATE_LAST,
++ IDPF_VPORT_UP,
++ IDPF_VPORT_STATE_NBITS
+ };
+
+ /**
+@@ -162,7 +160,7 @@ struct idpf_netdev_priv {
+ u16 vport_idx;
+ u16 max_tx_hdr_size;
+ u16 tx_max_bufs;
+- enum idpf_vport_state state;
++ DECLARE_BITMAP(state, IDPF_VPORT_STATE_NBITS);
+ struct rtnl_link_stats64 netstats;
+ spinlock_t stats_lock;
+ };
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_ethtool.c b/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
+index a5a1eec9ade8b..eed166bc46f38 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
+@@ -386,7 +386,7 @@ static int idpf_get_rxfh(struct net_device *netdev,
+ }
+
+ rss_data = &adapter->vport_config[np->vport_idx]->user_config.rss_data;
+- if (np->state != __IDPF_VPORT_UP)
++ if (!test_bit(IDPF_VPORT_UP, np->state))
+ goto unlock_mutex;
+
+ rxfh->hfunc = ETH_RSS_HASH_TOP;
+@@ -436,7 +436,7 @@ static int idpf_set_rxfh(struct net_device *netdev,
+ }
+
+ rss_data = &adapter->vport_config[vport->idx]->user_config.rss_data;
+- if (np->state != __IDPF_VPORT_UP)
++ if (!test_bit(IDPF_VPORT_UP, np->state))
+ goto unlock_mutex;
+
+ if (rxfh->hfunc != ETH_RSS_HASH_NO_CHANGE &&
+@@ -1167,7 +1167,7 @@ static void idpf_get_ethtool_stats(struct net_device *netdev,
+ idpf_vport_ctrl_lock(netdev);
+ vport = idpf_netdev_to_vport(netdev);
+
+- if (np->state != __IDPF_VPORT_UP) {
++ if (!test_bit(IDPF_VPORT_UP, np->state)) {
+ idpf_vport_ctrl_unlock(netdev);
+
+ return;
+@@ -1319,7 +1319,7 @@ static int idpf_get_q_coalesce(struct net_device *netdev,
+ idpf_vport_ctrl_lock(netdev);
+ vport = idpf_netdev_to_vport(netdev);
+
+- if (np->state != __IDPF_VPORT_UP)
++ if (!test_bit(IDPF_VPORT_UP, np->state))
+ goto unlock_mutex;
+
+ if (q_num >= vport->num_rxq && q_num >= vport->num_txq) {
+@@ -1507,7 +1507,7 @@ static int idpf_set_coalesce(struct net_device *netdev,
+ idpf_vport_ctrl_lock(netdev);
+ vport = idpf_netdev_to_vport(netdev);
+
+- if (np->state != __IDPF_VPORT_UP)
++ if (!test_bit(IDPF_VPORT_UP, np->state))
+ goto unlock_mutex;
+
+ for (i = 0; i < vport->num_txq; i++) {
+@@ -1710,7 +1710,7 @@ static void idpf_get_ts_stats(struct net_device *netdev,
+ ts_stats->err = u64_stats_read(&vport->tstamp_stats.discarded);
+ } while (u64_stats_fetch_retry(&vport->tstamp_stats.stats_sync, start));
+
+- if (np->state != __IDPF_VPORT_UP)
++ if (!test_bit(IDPF_VPORT_UP, np->state))
+ goto exit;
+
+ for (u16 i = 0; i < vport->num_txq_grp; i++) {
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index 452f3107378cb..313803c088478 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -519,7 +519,7 @@ static int idpf_del_mac_filter(struct idpf_vport *vport,
+ }
+ spin_unlock_bh(&vport_config->mac_filter_list_lock);
+
+- if (np->state == __IDPF_VPORT_UP) {
++ if (test_bit(IDPF_VPORT_UP, np->state)) {
+ int err;
+
+ err = idpf_add_del_mac_filters(vport, np, false, async);
+@@ -590,7 +590,7 @@ static int idpf_add_mac_filter(struct idpf_vport *vport,
+ if (err)
+ return err;
+
+- if (np->state == __IDPF_VPORT_UP)
++ if (test_bit(IDPF_VPORT_UP, np->state))
+ err = idpf_add_del_mac_filters(vport, np, true, async);
+
+ return err;
+@@ -894,7 +894,7 @@ static void idpf_vport_stop(struct idpf_vport *vport, bool rtnl)
+ {
+ struct idpf_netdev_priv *np = netdev_priv(vport->netdev);
+
+- if (np->state <= __IDPF_VPORT_DOWN)
++ if (!test_bit(IDPF_VPORT_UP, np->state))
+ return;
+
+ if (rtnl)
+@@ -921,7 +921,7 @@ static void idpf_vport_stop(struct idpf_vport *vport, bool rtnl)
+ idpf_xdp_rxq_info_deinit_all(vport);
+ idpf_vport_queues_rel(vport);
+ idpf_vport_intr_rel(vport);
+- np->state = __IDPF_VPORT_DOWN;
++ clear_bit(IDPF_VPORT_UP, np->state);
+
+ if (rtnl)
+ rtnl_unlock();
+@@ -1345,7 +1345,7 @@ static int idpf_up_complete(struct idpf_vport *vport)
+ netif_tx_start_all_queues(vport->netdev);
+ }
+
+- np->state = __IDPF_VPORT_UP;
++ set_bit(IDPF_VPORT_UP, np->state);
+
+ return 0;
+ }
+@@ -1391,7 +1391,7 @@ static int idpf_vport_open(struct idpf_vport *vport, bool rtnl)
+ struct idpf_vport_config *vport_config;
+ int err;
+
+- if (np->state != __IDPF_VPORT_DOWN)
++ if (test_bit(IDPF_VPORT_UP, np->state))
+ return -EBUSY;
+
+ if (rtnl)
+@@ -1602,7 +1602,7 @@ void idpf_init_task(struct work_struct *work)
+
+ /* Once state is put into DOWN, driver is ready for dev_open */
+ np = netdev_priv(vport->netdev);
+- np->state = __IDPF_VPORT_DOWN;
++ clear_bit(IDPF_VPORT_UP, np->state);
+ if (test_and_clear_bit(IDPF_VPORT_UP_REQUESTED, vport_config->flags))
+ idpf_vport_open(vport, true);
+
+@@ -1796,7 +1796,7 @@ static void idpf_set_vport_state(struct idpf_adapter *adapter)
+ continue;
+
+ np = netdev_priv(adapter->netdevs[i]);
+- if (np->state == __IDPF_VPORT_UP)
++ if (test_bit(IDPF_VPORT_UP, np->state))
+ set_bit(IDPF_VPORT_UP_REQUESTED,
+ adapter->vport_config[i]->flags);
+ }
+@@ -1934,7 +1934,7 @@ int idpf_initiate_soft_reset(struct idpf_vport *vport,
+ enum idpf_vport_reset_cause reset_cause)
+ {
+ struct idpf_netdev_priv *np = netdev_priv(vport->netdev);
+- enum idpf_vport_state current_state = np->state;
++ bool vport_is_up = test_bit(IDPF_VPORT_UP, np->state);
+ struct idpf_adapter *adapter = vport->adapter;
+ struct idpf_vport *new_vport;
+ int err;
+@@ -1985,7 +1985,7 @@ int idpf_initiate_soft_reset(struct idpf_vport *vport,
+ goto free_vport;
+ }
+
+- if (current_state <= __IDPF_VPORT_DOWN) {
++ if (!vport_is_up) {
+ idpf_send_delete_queues_msg(vport);
+ } else {
+ set_bit(IDPF_VPORT_DEL_QUEUES, vport->flags);
+@@ -2018,7 +2018,7 @@ int idpf_initiate_soft_reset(struct idpf_vport *vport,
+ if (err)
+ goto err_open;
+
+- if (current_state == __IDPF_VPORT_UP)
++ if (vport_is_up)
+ err = idpf_vport_open(vport, false);
+
+ goto free_vport;
+@@ -2028,7 +2028,7 @@ int idpf_initiate_soft_reset(struct idpf_vport *vport,
+ vport->num_rxq, vport->num_bufq);
+
+ err_open:
+- if (current_state == __IDPF_VPORT_UP)
++ if (vport_is_up)
+ idpf_vport_open(vport, false);
+
+ free_vport:
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c
+index 61e6130661404..e3ddf18dcbf51 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c
+@@ -570,7 +570,7 @@ static bool idpf_tx_singleq_clean(struct idpf_tx_queue *tx_q, int napi_budget,
+ np = netdev_priv(tx_q->netdev);
+ nq = netdev_get_tx_queue(tx_q->netdev, tx_q->idx);
+
+- dont_wake = np->state != __IDPF_VPORT_UP ||
++ dont_wake = !test_bit(IDPF_VPORT_UP, np->state) ||
+ !netif_carrier_ok(tx_q->netdev);
+ __netif_txq_completed_wake(nq, ss.packets, ss.bytes,
+ IDPF_DESC_UNUSED(tx_q), IDPF_TX_WAKE_THRESH,
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+index 828f7c444d309..1993a3b0da59b 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+@@ -2275,7 +2275,7 @@ static bool idpf_tx_clean_complq(struct idpf_compl_queue *complq, int budget,
+ /* Update BQL */
+ nq = netdev_get_tx_queue(tx_q->netdev, tx_q->idx);
+
+- dont_wake = !complq_ok || np->state != __IDPF_VPORT_UP ||
++ dont_wake = !complq_ok || !test_bit(IDPF_VPORT_UP, np->state) ||
+ !netif_carrier_ok(tx_q->netdev);
+ /* Check if the TXQ needs to and can be restarted */
+ __netif_txq_completed_wake(nq, tx_q->cleaned_pkts, tx_q->cleaned_bytes,
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+index fc03d55bc9b90..5bbe7d9294c14 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+@@ -68,7 +68,7 @@ static void idpf_handle_event_link(struct idpf_adapter *adapter,
+
+ vport->link_up = v2e->link_status;
+
+- if (np->state != __IDPF_VPORT_UP)
++ if (!test_bit(IDPF_VPORT_UP, np->state))
+ return;
+
+ if (vport->link_up) {
+@@ -2760,7 +2760,7 @@ int idpf_send_get_stats_msg(struct idpf_vport *vport)
+
+
+ /* Don't send get_stats message if the link is down */
+- if (np->state <= __IDPF_VPORT_DOWN)
++ if (!test_bit(IDPF_VPORT_UP, np->state))
+ return 0;
+
+ stats_msg.vport_id = cpu_to_le32(vport->vport_id);
+diff --git a/drivers/net/ethernet/intel/idpf/xdp.c b/drivers/net/ethernet/intel/idpf/xdp.c
+index 21ce25b0567f6..958d16f874248 100644
+--- a/drivers/net/ethernet/intel/idpf/xdp.c
++++ b/drivers/net/ethernet/intel/idpf/xdp.c
+@@ -418,7 +418,7 @@ static int idpf_xdp_setup_prog(struct idpf_vport *vport,
+ if (test_bit(IDPF_REMOVE_IN_PROG, vport->adapter->flags) ||
+ !test_bit(IDPF_VPORT_REG_NETDEV, cfg->flags) ||
+ !!vport->xdp_prog == !!prog) {
+- if (np->state == __IDPF_VPORT_UP)
++ if (test_bit(IDPF_VPORT_UP, np->state))
+ idpf_xdp_copy_prog_to_rqs(vport, prog);
+
+ old = xchg(&vport->xdp_prog, prog);
+--
+2.51.0
+
--- /dev/null
+From dcdfe306c5acf645bba24e4016b7f5c32a1ca96c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:15 -0800
+Subject: idpf: detach and close netdevs while handling a reset
+
+From: Emil Tantilov <emil.s.tantilov@intel.com>
+
+[ Upstream commit 2e281e1155fc476c571c0bd2ffbfe28ab829a5c3 ]
+
+Protect the reset path from callbacks by setting the netdevs to detached
+state and close any netdevs in UP state until the reset handling has
+completed. During a reset, the driver will de-allocate resources for the
+vport, and there is no guarantee that those will recover, which is why the
+existing vport_ctrl_lock does not provide sufficient protection.
+
+idpf_detach_and_close() is called right before reset handling. If the
+reset handling succeeds, the netdevs state is recovered via call to
+idpf_attach_and_open(). If the reset handling fails the netdevs remain
+down. The detach/down calls are protected with RTNL lock to avoid racing
+with callbacks. On the recovery side the attach can be done without
+holding the RTNL lock as there are no callbacks expected at that point,
+due to detach/close always being done first in that flow.
+
+The previous logic restoring the netdevs state based on the
+IDPF_VPORT_UP_REQUESTED flag in the init task is not needed anymore, hence
+the removal of idpf_set_vport_state(). The IDPF_VPORT_UP_REQUESTED is
+still being used to restore the state of the netdevs following the reset,
+but has no use outside of the reset handling flow.
+
+idpf_init_hard_reset() is converted to void, since it was used as such and
+there is no error handling being done based on its return value.
+
+Before this change, invoking hard and soft resets simultaneously will
+cause the driver to lose the vport state:
+ip -br a
+<inf> UP
+echo 1 > /sys/class/net/ens801f0/device/reset& \
+ethtool -L ens801f0 combined 8
+ip -br a
+<inf> DOWN
+ip link set <inf> up
+ip -br a
+<inf> DOWN
+
+Also in case of a failure in the reset path, the netdev is left
+exposed to external callbacks, while vport resources are not
+initialized, leading to a crash on subsequent ifup/down:
+[408471.398966] idpf 0000:83:00.0: HW reset detected
+[408471.411744] idpf 0000:83:00.0: Device HW Reset initiated
+[408472.277901] idpf 0000:83:00.0: The driver was unable to contact the device's firmware. Check that the FW is running. Driver state= 0x2
+[408508.125551] BUG: kernel NULL pointer dereference, address: 0000000000000078
+[408508.126112] #PF: supervisor read access in kernel mode
+[408508.126687] #PF: error_code(0x0000) - not-present page
+[408508.127256] PGD 2aae2f067 P4D 0
+[408508.127824] Oops: Oops: 0000 [#1] SMP NOPTI
+...
+[408508.130871] RIP: 0010:idpf_stop+0x39/0x70 [idpf]
+...
+[408508.139193] Call Trace:
+[408508.139637] <TASK>
+[408508.140077] __dev_close_many+0xbb/0x260
+[408508.140533] __dev_change_flags+0x1cf/0x280
+[408508.140987] netif_change_flags+0x26/0x70
+[408508.141434] dev_change_flags+0x3d/0xb0
+[408508.141878] devinet_ioctl+0x460/0x890
+[408508.142321] inet_ioctl+0x18e/0x1d0
+[408508.142762] ? _copy_to_user+0x22/0x70
+[408508.143207] sock_do_ioctl+0x3d/0xe0
+[408508.143652] sock_ioctl+0x10e/0x330
+[408508.144091] ? find_held_lock+0x2b/0x80
+[408508.144537] __x64_sys_ioctl+0x96/0xe0
+[408508.144979] do_syscall_64+0x79/0x3d0
+[408508.145415] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[408508.145860] RIP: 0033:0x7f3e0bb4caff
+
+Fixes: 0fe45467a104 ("idpf: add create vport and netdev configuration")
+Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_lib.c | 121 ++++++++++++---------
+ 1 file changed, 72 insertions(+), 49 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index 313803c088478..a964e0f5891eb 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -729,6 +729,65 @@ static int idpf_init_mac_addr(struct idpf_vport *vport,
+ return 0;
+ }
+
++static void idpf_detach_and_close(struct idpf_adapter *adapter)
++{
++ int max_vports = adapter->max_vports;
++
++ for (int i = 0; i < max_vports; i++) {
++ struct net_device *netdev = adapter->netdevs[i];
++
++ /* If the interface is in detached state, that means the
++ * previous reset was not handled successfully for this
++ * vport.
++ */
++ if (!netif_device_present(netdev))
++ continue;
++
++ /* Hold RTNL to protect racing with callbacks */
++ rtnl_lock();
++ netif_device_detach(netdev);
++ if (netif_running(netdev)) {
++ set_bit(IDPF_VPORT_UP_REQUESTED,
++ adapter->vport_config[i]->flags);
++ dev_close(netdev);
++ }
++ rtnl_unlock();
++ }
++}
++
++static void idpf_attach_and_open(struct idpf_adapter *adapter)
++{
++ int max_vports = adapter->max_vports;
++
++ for (int i = 0; i < max_vports; i++) {
++ struct idpf_vport *vport = adapter->vports[i];
++ struct idpf_vport_config *vport_config;
++ struct net_device *netdev;
++
++ /* In case of a critical error in the init task, the vport
++ * will be freed. Only continue to restore the netdevs
++ * if the vport is allocated.
++ */
++ if (!vport)
++ continue;
++
++ /* No need for RTNL on attach as this function is called
++ * following detach and dev_close(). We do take RTNL for
++ * dev_open() below as it can race with external callbacks
++ * following the call to netif_device_attach().
++ */
++ netdev = adapter->netdevs[i];
++ netif_device_attach(netdev);
++ vport_config = adapter->vport_config[vport->idx];
++ if (test_and_clear_bit(IDPF_VPORT_UP_REQUESTED,
++ vport_config->flags)) {
++ rtnl_lock();
++ dev_open(netdev, NULL);
++ rtnl_unlock();
++ }
++ }
++}
++
+ /**
+ * idpf_cfg_netdev - Allocate, configure and register a netdev
+ * @vport: main vport structure
+@@ -1041,10 +1100,11 @@ static void idpf_vport_dealloc(struct idpf_vport *vport)
+ idpf_idc_deinit_vport_aux_device(vport->vdev_info);
+
+ idpf_deinit_mac_addr(vport);
+- idpf_vport_stop(vport, true);
+
+- if (!test_bit(IDPF_HR_RESET_IN_PROG, adapter->flags))
++ if (!test_bit(IDPF_HR_RESET_IN_PROG, adapter->flags)) {
++ idpf_vport_stop(vport, true);
+ idpf_decfg_netdev(vport);
++ }
+ if (test_bit(IDPF_REMOVE_IN_PROG, adapter->flags))
+ idpf_del_all_mac_filters(vport);
+
+@@ -1544,7 +1604,6 @@ void idpf_init_task(struct work_struct *work)
+ struct idpf_vport_config *vport_config;
+ struct idpf_vport_max_q max_q;
+ struct idpf_adapter *adapter;
+- struct idpf_netdev_priv *np;
+ struct idpf_vport *vport;
+ u16 num_default_vports;
+ struct pci_dev *pdev;
+@@ -1600,12 +1659,6 @@ void idpf_init_task(struct work_struct *work)
+ if (idpf_cfg_netdev(vport))
+ goto unwind_vports;
+
+- /* Once state is put into DOWN, driver is ready for dev_open */
+- np = netdev_priv(vport->netdev);
+- clear_bit(IDPF_VPORT_UP, np->state);
+- if (test_and_clear_bit(IDPF_VPORT_UP_REQUESTED, vport_config->flags))
+- idpf_vport_open(vport, true);
+-
+ /* Spawn and return 'idpf_init_task' work queue until all the
+ * default vports are created
+ */
+@@ -1781,27 +1834,6 @@ static int idpf_check_reset_complete(struct idpf_hw *hw,
+ return -EBUSY;
+ }
+
+-/**
+- * idpf_set_vport_state - Set the vport state to be after the reset
+- * @adapter: Driver specific private structure
+- */
+-static void idpf_set_vport_state(struct idpf_adapter *adapter)
+-{
+- u16 i;
+-
+- for (i = 0; i < adapter->max_vports; i++) {
+- struct idpf_netdev_priv *np;
+-
+- if (!adapter->netdevs[i])
+- continue;
+-
+- np = netdev_priv(adapter->netdevs[i]);
+- if (test_bit(IDPF_VPORT_UP, np->state))
+- set_bit(IDPF_VPORT_UP_REQUESTED,
+- adapter->vport_config[i]->flags);
+- }
+-}
+-
+ /**
+ * idpf_init_hard_reset - Initiate a hardware reset
+ * @adapter: Driver specific private structure
+@@ -1810,28 +1842,17 @@ static void idpf_set_vport_state(struct idpf_adapter *adapter)
+ * reallocate. Also reinitialize the mailbox. Return 0 on success,
+ * negative on failure.
+ */
+-static int idpf_init_hard_reset(struct idpf_adapter *adapter)
++static void idpf_init_hard_reset(struct idpf_adapter *adapter)
+ {
+ struct idpf_reg_ops *reg_ops = &adapter->dev_ops.reg_ops;
+ struct device *dev = &adapter->pdev->dev;
+- struct net_device *netdev;
+ int err;
+- u16 i;
+
++ idpf_detach_and_close(adapter);
+ mutex_lock(&adapter->vport_ctrl_lock);
+
+ dev_info(dev, "Device HW Reset initiated\n");
+
+- /* Avoid TX hangs on reset */
+- for (i = 0; i < adapter->max_vports; i++) {
+- netdev = adapter->netdevs[i];
+- if (!netdev)
+- continue;
+-
+- netif_carrier_off(netdev);
+- netif_tx_disable(netdev);
+- }
+-
+ /* Prepare for reset */
+ if (test_and_clear_bit(IDPF_HR_DRV_LOAD, adapter->flags)) {
+ reg_ops->trigger_reset(adapter, IDPF_HR_DRV_LOAD);
+@@ -1840,7 +1861,6 @@ static int idpf_init_hard_reset(struct idpf_adapter *adapter)
+
+ idpf_idc_issue_reset_event(adapter->cdev_info);
+
+- idpf_set_vport_state(adapter);
+ idpf_vc_core_deinit(adapter);
+ if (!is_reset)
+ reg_ops->trigger_reset(adapter, IDPF_HR_FUNC_RESET);
+@@ -1887,11 +1907,14 @@ static int idpf_init_hard_reset(struct idpf_adapter *adapter)
+ unlock_mutex:
+ mutex_unlock(&adapter->vport_ctrl_lock);
+
+- /* Wait until all vports are created to init RDMA CORE AUX */
+- if (!err)
+- err = idpf_idc_init(adapter);
+-
+- return err;
++ /* Attempt to restore netdevs and initialize RDMA CORE AUX device,
++ * provided vc_core_init succeeded. It is still possible that
++ * vports are not allocated at this point if the init task failed.
++ */
++ if (!err) {
++ idpf_attach_and_open(adapter);
++ idpf_idc_init(adapter);
++ }
+ }
+
+ /**
+--
+2.51.0
+
--- /dev/null
+From e5a184d2b3c84b6a404e02e7a9b192fccc135db5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 08:03:49 +0100
+Subject: idpf: fix aux device unplugging when rdma is not supported by vport
+
+From: Larysa Zaremba <larysa.zaremba@intel.com>
+
+[ Upstream commit 4648fb2f2e7210c53b85220ee07d42d1e4bae3f9 ]
+
+If vport flags do not contain VIRTCHNL2_VPORT_ENABLE_RDMA, driver does not
+allocate vdev_info for this vport. This leads to kernel NULL pointer
+dereference in idpf_idc_vport_dev_down(), which references vdev_info for
+every vport regardless.
+
+Check, if vdev_info was ever allocated before unplugging aux device.
+
+Fixes: be91128c579c ("idpf: implement RDMA vport auxiliary dev create, init, and destroy")
+Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
+Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Krishneil Singh <krishneil.k.singh@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_idc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_idc.c b/drivers/net/ethernet/intel/idpf/idpf_idc.c
+index 7e20a07e98e53..6dad0593f7f22 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_idc.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_idc.c
+@@ -322,7 +322,7 @@ static void idpf_idc_vport_dev_down(struct idpf_adapter *adapter)
+ for (i = 0; i < adapter->num_alloc_vports; i++) {
+ struct idpf_vport *vport = adapter->vports[i];
+
+- if (!vport)
++ if (!vport || !vport->vdev_info)
+ continue;
+
+ idpf_unplug_aux_dev(vport->vdev_info->adev);
+--
+2.51.0
+
--- /dev/null
+From 9febd6969e968eb13e78781856e46360c787acef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 17:12:46 -0600
+Subject: idpf: Fix error handling in idpf_vport_open()
+
+From: Sreedevi Joshi <sreedevi.joshi@intel.com>
+
+[ Upstream commit 87b8ee64685bc096a087af833d4594b2332bfdb1 ]
+
+Fix error handling to properly cleanup interrupts when
+idpf_vport_queue_ids_init() or idpf_rx_bufs_init_all() fail. Jump to
+'intr_deinit' instead of 'queues_rel' to ensure interrupts are cleaned up
+before releasing other resources.
+
+Fixes: d4d558718266 ("idpf: initialize interrupts and enable vport")
+Signed-off-by: Sreedevi Joshi <sreedevi.joshi@intel.com>
+Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_lib.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index 003bab3ce5ae6..131a8121839bd 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -1524,14 +1524,14 @@ static int idpf_vport_open(struct idpf_vport *vport, bool rtnl)
+ if (err) {
+ dev_err(&adapter->pdev->dev, "Failed to initialize queue registers for vport %u: %d\n",
+ vport->vport_id, err);
+- goto queues_rel;
++ goto intr_deinit;
+ }
+
+ err = idpf_rx_bufs_init_all(vport);
+ if (err) {
+ dev_err(&adapter->pdev->dev, "Failed to initialize RX buffers for vport %u: %d\n",
+ vport->vport_id, err);
+- goto queues_rel;
++ goto intr_deinit;
+ }
+
+ idpf_rx_init_buf_tail(vport);
+--
+2.51.0
+
--- /dev/null
+From c46f5d470a5d104b5032cc28f5b5addc58df236b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:18 -0800
+Subject: idpf: fix error handling in the init_task on load
+
+From: Emil Tantilov <emil.s.tantilov@intel.com>
+
+[ Upstream commit 4d792219fe6f891b5b557a607ac8a0a14eda6e38 ]
+
+If the init_task fails during a driver load, we end up without vports and
+netdevs, effectively failing the entire process. In that state a
+subsequent reset will result in a crash as the service task attempts to
+access uninitialized resources. Following trace is from an error in the
+init_task where the CREATE_VPORT (op 501) is rejected by the FW:
+
+[40922.763136] idpf 0000:83:00.0: Device HW Reset initiated
+[40924.449797] idpf 0000:83:00.0: Transaction failed (op 501)
+[40958.148190] idpf 0000:83:00.0: HW reset detected
+[40958.161202] BUG: kernel NULL pointer dereference, address: 00000000000000a8
+...
+[40958.168094] Workqueue: idpf-0000:83:00.0-vc_event idpf_vc_event_task [idpf]
+[40958.168865] RIP: 0010:idpf_vc_event_task+0x9b/0x350 [idpf]
+...
+[40958.177932] Call Trace:
+[40958.178491] <TASK>
+[40958.179040] process_one_work+0x226/0x6d0
+[40958.179609] worker_thread+0x19e/0x340
+[40958.180158] ? __pfx_worker_thread+0x10/0x10
+[40958.180702] kthread+0x10f/0x250
+[40958.181238] ? __pfx_kthread+0x10/0x10
+[40958.181774] ret_from_fork+0x251/0x2b0
+[40958.182307] ? __pfx_kthread+0x10/0x10
+[40958.182834] ret_from_fork_asm+0x1a/0x30
+[40958.183370] </TASK>
+
+Fix the error handling in the init_task to make sure the service and
+mailbox tasks are disabled if the error happens during load. These are
+started in idpf_vc_core_init(), which spawns the init_task and has no way
+of knowing if it failed. If the error happens on reset, following
+successful driver load, the tasks can still run, as that will allow the
+netdevs to attempt recovery through another reset. Stop the PTP callbacks
+either way as those will be restarted by the call to idpf_vc_core_init()
+during a successful reset.
+
+Fixes: 0fe45467a104 ("idpf: add create vport and netdev configuration")
+Reported-by: Vivek Kumar <iamvivekkumar@google.com>
+Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_lib.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index 04af10cfaa8cb..e2ee8b137421f 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -1690,10 +1690,9 @@ void idpf_init_task(struct work_struct *work)
+ set_bit(IDPF_VPORT_REG_NETDEV, vport_config->flags);
+ }
+
+- /* As all the required vports are created, clear the reset flag
+- * unconditionally here in case we were in reset and the link was down.
+- */
++ /* Clear the reset and load bits as all vports are created */
+ clear_bit(IDPF_HR_RESET_IN_PROG, adapter->flags);
++ clear_bit(IDPF_HR_DRV_LOAD, adapter->flags);
+ /* Start the statistics task now */
+ queue_delayed_work(adapter->stats_wq, &adapter->stats_task,
+ msecs_to_jiffies(10 * (pdev->devfn & 0x07)));
+@@ -1707,6 +1706,15 @@ void idpf_init_task(struct work_struct *work)
+ idpf_vport_dealloc(adapter->vports[index]);
+ }
+ }
++ /* Cleanup after vc_core_init, which has no way of knowing the
++ * init task failed on driver load.
++ */
++ if (test_and_clear_bit(IDPF_HR_DRV_LOAD, adapter->flags)) {
++ cancel_delayed_work_sync(&adapter->serv_task);
++ cancel_delayed_work_sync(&adapter->mbx_task);
++ }
++ idpf_ptp_release(adapter);
++
+ clear_bit(IDPF_HR_RESET_IN_PROG, adapter->flags);
+ }
+
+@@ -1856,7 +1864,7 @@ static void idpf_init_hard_reset(struct idpf_adapter *adapter)
+ dev_info(dev, "Device HW Reset initiated\n");
+
+ /* Prepare for reset */
+- if (test_and_clear_bit(IDPF_HR_DRV_LOAD, adapter->flags)) {
++ if (test_bit(IDPF_HR_DRV_LOAD, adapter->flags)) {
+ reg_ops->trigger_reset(adapter, IDPF_HR_DRV_LOAD);
+ } else if (test_and_clear_bit(IDPF_HR_FUNC_RESET, adapter->flags)) {
+ bool is_reset = idpf_is_reset_detected(adapter);
+--
+2.51.0
+
--- /dev/null
+From dcc07f75ba22c82dac0a1c6fe152573bf9f87b9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 16:23:52 -0500
+Subject: idpf: fix issue with ethtool -n command display
+
+From: Erik Gabriel Carrillo <erik.g.carrillo@intel.com>
+
+[ Upstream commit 36aae2ea6bd76b8246caa50e34a4f4824f0a3be8 ]
+
+When ethtool -n is executed on an interface to display the flow steering
+rules, "rxclass: Unknown flow type" error is generated.
+
+The flow steering list maintained in the driver currently stores only the
+location and q_index but other fields of the ethtool_rx_flow_spec are not
+stored. This may be enough for the virtchnl command to delete the entry.
+However, when the ethtool -n command is used to query the flow steering
+rules, the ethtool_rx_flow_spec returned is not complete causing the
+error below.
+
+Resolve this by storing the flow spec (fsp) when rules are added and
+returning the complete flow spec when rules are queried.
+
+Also, change the return value from EINVAL to ENOENT when flow steering
+entry is not found during query by location or when deleting an entry.
+
+Add logic to detect and reject duplicate filter entries at the same
+location and change logic to perform upfront validation of all error
+conditions before adding flow rules through virtchnl. This avoids the
+need for additional virtchnl delete messages when subsequent operations
+fail, which was missing in the original upstream code.
+
+Example:
+Before the fix:
+ethtool -n eth1
+2 RX rings available
+Total 2 rules
+
+rxclass: Unknown flow type
+rxclass: Unknown flow type
+
+After the fix:
+ethtool -n eth1
+2 RX rings available
+Total 2 rules
+
+Filter: 0
+ Rule Type: TCP over IPv4
+ Src IP addr: 10.0.0.1 mask: 0.0.0.0
+ Dest IP addr: 0.0.0.0 mask: 255.255.255.255
+ TOS: 0x0 mask: 0xff
+ Src port: 0 mask: 0xffff
+ Dest port: 0 mask: 0xffff
+ Action: Direct to queue 0
+
+Filter: 1
+ Rule Type: UDP over IPv4
+ Src IP addr: 10.0.0.1 mask: 0.0.0.0
+ Dest IP addr: 0.0.0.0 mask: 255.255.255.255
+ TOS: 0x0 mask: 0xff
+ Src port: 0 mask: 0xffff
+ Dest port: 0 mask: 0xffff
+ Action: Direct to queue 0
+
+Fixes: ada3e24b84a0 ("idpf: add flow steering support")
+Signed-off-by: Erik Gabriel Carrillo <erik.g.carrillo@intel.com>
+Co-developed-by: Sreedevi Joshi <sreedevi.joshi@intel.com>
+Signed-off-by: Sreedevi Joshi <sreedevi.joshi@intel.com>
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Mina Almasry <almasrymina@google.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf.h | 3 +-
+ .../net/ethernet/intel/idpf/idpf_ethtool.c | 59 ++++++++++++-------
+ 2 files changed, 40 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf.h b/drivers/net/ethernet/intel/idpf/idpf.h
+index af8deb5fa80f0..df64d252b5642 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf.h
++++ b/drivers/net/ethernet/intel/idpf/idpf.h
+@@ -284,8 +284,7 @@ struct idpf_port_stats {
+
+ struct idpf_fsteer_fltr {
+ struct list_head list;
+- u32 loc;
+- u32 q_index;
++ struct ethtool_rx_flow_spec fs;
+ };
+
+ /**
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_ethtool.c b/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
+index 8477e7ba28706..8e9a93125b4aa 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
+@@ -38,11 +38,15 @@ static int idpf_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd,
+ cmd->data = idpf_fsteer_max_rules(vport);
+ break;
+ case ETHTOOL_GRXCLSRULE:
+- err = -EINVAL;
++ err = -ENOENT;
+ spin_lock_bh(&vport_config->flow_steer_list_lock);
+ list_for_each_entry(f, &user_config->flow_steer_list, list)
+- if (f->loc == cmd->fs.location) {
+- cmd->fs.ring_cookie = f->q_index;
++ if (f->fs.location == cmd->fs.location) {
++ /* Avoid infoleak from padding: zero first,
++ * then assign fields
++ */
++ memset(&cmd->fs, 0, sizeof(cmd->fs));
++ cmd->fs = f->fs;
+ err = 0;
+ break;
+ }
+@@ -56,7 +60,7 @@ static int idpf_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd,
+ err = -EMSGSIZE;
+ break;
+ }
+- rule_locs[cnt] = f->loc;
++ rule_locs[cnt] = f->fs.location;
+ cnt++;
+ }
+ if (!err)
+@@ -158,7 +162,7 @@ static int idpf_add_flow_steer(struct net_device *netdev,
+ struct idpf_vport *vport;
+ u32 flow_type, q_index;
+ u16 num_rxq;
+- int err;
++ int err = 0;
+
+ vport = idpf_netdev_to_vport(netdev);
+ vport_config = vport->adapter->vport_config[np->vport_idx];
+@@ -184,6 +188,29 @@ static int idpf_add_flow_steer(struct net_device *netdev,
+ if (!rule)
+ return -ENOMEM;
+
++ fltr = kzalloc(sizeof(*fltr), GFP_KERNEL);
++ if (!fltr) {
++ err = -ENOMEM;
++ goto out_free_rule;
++ }
++
++ /* detect duplicate entry and reject before adding rules */
++ spin_lock_bh(&vport_config->flow_steer_list_lock);
++ list_for_each_entry(f, &user_config->flow_steer_list, list) {
++ if (f->fs.location == fsp->location) {
++ err = -EEXIST;
++ break;
++ }
++
++ if (f->fs.location > fsp->location)
++ break;
++ parent = f;
++ }
++ spin_unlock_bh(&vport_config->flow_steer_list_lock);
++
++ if (err)
++ goto out;
++
+ rule->vport_id = cpu_to_le32(vport->vport_id);
+ rule->count = cpu_to_le32(1);
+ info = &rule->rule_info[0];
+@@ -222,28 +249,20 @@ static int idpf_add_flow_steer(struct net_device *netdev,
+ goto out;
+ }
+
+- fltr = kzalloc(sizeof(*fltr), GFP_KERNEL);
+- if (!fltr) {
+- err = -ENOMEM;
+- goto out;
+- }
++ /* Save a copy of the user's flow spec so ethtool can later retrieve it */
++ fltr->fs = *fsp;
+
+- fltr->loc = fsp->location;
+- fltr->q_index = q_index;
+ spin_lock_bh(&vport_config->flow_steer_list_lock);
+- list_for_each_entry(f, &user_config->flow_steer_list, list) {
+- if (f->loc >= fltr->loc)
+- break;
+- parent = f;
+- }
+-
+ parent ? list_add(&fltr->list, &parent->list) :
+ list_add(&fltr->list, &user_config->flow_steer_list);
+
+ user_config->num_fsteer_fltrs++;
+ spin_unlock_bh(&vport_config->flow_steer_list_lock);
++ goto out_free_rule;
+
+ out:
++ kfree(fltr);
++out_free_rule:
+ kfree(rule);
+ return err;
+ }
+@@ -297,14 +316,14 @@ static int idpf_del_flow_steer(struct net_device *netdev,
+ spin_lock_bh(&vport_config->flow_steer_list_lock);
+ list_for_each_entry_safe(f, iter,
+ &user_config->flow_steer_list, list) {
+- if (f->loc == fsp->location) {
++ if (f->fs.location == fsp->location) {
+ list_del(&f->list);
+ kfree(f);
+ user_config->num_fsteer_fltrs--;
+ goto out_unlock;
+ }
+ }
+- err = -EINVAL;
++ err = -ENOENT;
+
+ out_unlock:
+ spin_unlock_bh(&vport_config->flow_steer_list_lock);
+--
+2.51.0
+
--- /dev/null
+From a399f1e201af2823b557936b509a83cdf14fce29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:17 -0800
+Subject: idpf: fix memory leak in idpf_vc_core_deinit()
+
+From: Emil Tantilov <emil.s.tantilov@intel.com>
+
+[ Upstream commit e111cbc4adf9f9974eed040aeece7e17460f6bff ]
+
+Make sure to free hw->lan_regs. Reported by kmemleak during reset:
+
+unreferenced object 0xff1b913d02a936c0 (size 96):
+ comm "kworker/u258:14", pid 2174, jiffies 4294958305
+ hex dump (first 32 bytes):
+ 00 00 00 c0 a8 ba 2d ff 00 00 00 00 00 00 00 00 ......-.........
+ 00 00 40 08 00 00 00 00 00 00 25 b3 a8 ba 2d ff ..@.......%...-.
+ backtrace (crc 36063c4f):
+ __kmalloc_noprof+0x48f/0x890
+ idpf_vc_core_init+0x6ce/0x9b0 [idpf]
+ idpf_vc_event_task+0x1fb/0x350 [idpf]
+ process_one_work+0x226/0x6d0
+ worker_thread+0x19e/0x340
+ kthread+0x10f/0x250
+ ret_from_fork+0x251/0x2b0
+ ret_from_fork_asm+0x1a/0x30
+
+Fixes: 6aa53e861c1a ("idpf: implement get LAN MMIO memory regions")
+Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Joshua Hay <joshua.a.hay@intel.com>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+index 5bbe7d9294c14..01bbd12a642a0 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+@@ -3570,6 +3570,7 @@ int idpf_vc_core_init(struct idpf_adapter *adapter)
+ */
+ void idpf_vc_core_deinit(struct idpf_adapter *adapter)
+ {
++ struct idpf_hw *hw = &adapter->hw;
+ bool remove_in_prog;
+
+ if (!test_bit(IDPF_VC_CORE_INIT, adapter->flags))
+@@ -3593,6 +3594,9 @@ void idpf_vc_core_deinit(struct idpf_adapter *adapter)
+
+ idpf_vport_params_buf_rel(adapter);
+
++ kfree(hw->lan_regs);
++ hw->lan_regs = NULL;
++
+ kfree(adapter->vports);
+ adapter->vports = NULL;
+
+--
+2.51.0
+
--- /dev/null
+From 7082071cb84975afb16c5b8596cc04b82419c4e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:16 -0800
+Subject: idpf: fix memory leak in idpf_vport_rel()
+
+From: Emil Tantilov <emil.s.tantilov@intel.com>
+
+[ Upstream commit f6242b354605faff263ca45882b148200915a3f6 ]
+
+Free vport->rx_ptype_lkup in idpf_vport_rel() to avoid leaking memory
+during a reset. Reported by kmemleak:
+
+unreferenced object 0xff450acac838a000 (size 4096):
+ comm "kworker/u258:5", pid 7732, jiffies 4296830044
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 10 00 00 00 10 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 ................
+ backtrace (crc 3da81902):
+ __kmalloc_cache_noprof+0x469/0x7a0
+ idpf_send_get_rx_ptype_msg+0x90/0x570 [idpf]
+ idpf_init_task+0x1ec/0x8d0 [idpf]
+ process_one_work+0x226/0x6d0
+ worker_thread+0x19e/0x340
+ kthread+0x10f/0x250
+ ret_from_fork+0x251/0x2b0
+ ret_from_fork_asm+0x1a/0x30
+
+Fixes: 0fe45467a104 ("idpf: add create vport and netdev configuration")
+Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index a964e0f5891eb..04af10cfaa8cb 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -1082,6 +1082,8 @@ static void idpf_vport_rel(struct idpf_vport *vport)
+ kfree(adapter->vport_config[idx]->req_qs_chunks);
+ adapter->vport_config[idx]->req_qs_chunks = NULL;
+ }
++ kfree(vport->rx_ptype_lkup);
++ vport->rx_ptype_lkup = NULL;
+ kfree(vport);
+ adapter->num_alloc_vports--;
+ }
+--
+2.51.0
+
--- /dev/null
+From de0870497fc20162be47318287aaf87b5cf9b9cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 16:23:51 -0500
+Subject: idpf: fix memory leak of flow steer list on rmmod
+
+From: Sreedevi Joshi <sreedevi.joshi@intel.com>
+
+[ Upstream commit f9841bd28b600526ca4f6713b0ca49bf7bb98452 ]
+
+The flow steering list maintains entries that are added and removed as
+ethtool creates and deletes flow steering rules. Module removal with active
+entries causes memory leak as the list is not properly cleaned up.
+
+Prevent this by iterating through the remaining entries in the list and
+freeing the associated memory during module removal. Add a spinlock
+(flow_steer_list_lock) to protect the list access from multiple threads.
+
+Fixes: ada3e24b84a0 ("idpf: add flow steering support")
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Sreedevi Joshi <sreedevi.joshi@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Mina Almasry <almasrymina@google.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf.h | 2 ++
+ .../net/ethernet/intel/idpf/idpf_ethtool.c | 15 ++++++++--
+ drivers/net/ethernet/intel/idpf/idpf_lib.c | 28 ++++++++++++++++++-
+ 3 files changed, 42 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf.h b/drivers/net/ethernet/intel/idpf/idpf.h
+index 64142f8163fed..af8deb5fa80f0 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf.h
++++ b/drivers/net/ethernet/intel/idpf/idpf.h
+@@ -558,6 +558,7 @@ struct idpf_vector_lifo {
+ * @max_q: Maximum possible queues
+ * @req_qs_chunks: Queue chunk data for requested queues
+ * @mac_filter_list_lock: Lock to protect mac filters
++ * @flow_steer_list_lock: Lock to protect fsteer filters
+ * @flags: See enum idpf_vport_config_flags
+ */
+ struct idpf_vport_config {
+@@ -565,6 +566,7 @@ struct idpf_vport_config {
+ struct idpf_vport_max_q max_q;
+ struct virtchnl2_add_queues *req_qs_chunks;
+ spinlock_t mac_filter_list_lock;
++ spinlock_t flow_steer_list_lock;
+ DECLARE_BITMAP(flags, IDPF_VPORT_CONFIG_FLAGS_NBITS);
+ };
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_ethtool.c b/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
+index eed166bc46f38..8477e7ba28706 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
+@@ -18,6 +18,7 @@ static int idpf_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd,
+ {
+ struct idpf_netdev_priv *np = netdev_priv(netdev);
+ struct idpf_vport_user_config_data *user_config;
++ struct idpf_vport_config *vport_config;
+ struct idpf_fsteer_fltr *f;
+ struct idpf_vport *vport;
+ unsigned int cnt = 0;
+@@ -25,7 +26,8 @@ static int idpf_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd,
+
+ idpf_vport_ctrl_lock(netdev);
+ vport = idpf_netdev_to_vport(netdev);
+- user_config = &np->adapter->vport_config[np->vport_idx]->user_config;
++ vport_config = np->adapter->vport_config[np->vport_idx];
++ user_config = &vport_config->user_config;
+
+ switch (cmd->cmd) {
+ case ETHTOOL_GRXRINGS:
+@@ -37,15 +39,18 @@ static int idpf_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd,
+ break;
+ case ETHTOOL_GRXCLSRULE:
+ err = -EINVAL;
++ spin_lock_bh(&vport_config->flow_steer_list_lock);
+ list_for_each_entry(f, &user_config->flow_steer_list, list)
+ if (f->loc == cmd->fs.location) {
+ cmd->fs.ring_cookie = f->q_index;
+ err = 0;
+ break;
+ }
++ spin_unlock_bh(&vport_config->flow_steer_list_lock);
+ break;
+ case ETHTOOL_GRXCLSRLALL:
+ cmd->data = idpf_fsteer_max_rules(vport);
++ spin_lock_bh(&vport_config->flow_steer_list_lock);
+ list_for_each_entry(f, &user_config->flow_steer_list, list) {
+ if (cnt == cmd->rule_cnt) {
+ err = -EMSGSIZE;
+@@ -56,6 +61,7 @@ static int idpf_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd,
+ }
+ if (!err)
+ cmd->rule_cnt = user_config->num_fsteer_fltrs;
++ spin_unlock_bh(&vport_config->flow_steer_list_lock);
+ break;
+ default:
+ break;
+@@ -224,6 +230,7 @@ static int idpf_add_flow_steer(struct net_device *netdev,
+
+ fltr->loc = fsp->location;
+ fltr->q_index = q_index;
++ spin_lock_bh(&vport_config->flow_steer_list_lock);
+ list_for_each_entry(f, &user_config->flow_steer_list, list) {
+ if (f->loc >= fltr->loc)
+ break;
+@@ -234,6 +241,7 @@ static int idpf_add_flow_steer(struct net_device *netdev,
+ list_add(&fltr->list, &user_config->flow_steer_list);
+
+ user_config->num_fsteer_fltrs++;
++ spin_unlock_bh(&vport_config->flow_steer_list_lock);
+
+ out:
+ kfree(rule);
+@@ -286,17 +294,20 @@ static int idpf_del_flow_steer(struct net_device *netdev,
+ goto out;
+ }
+
++ spin_lock_bh(&vport_config->flow_steer_list_lock);
+ list_for_each_entry_safe(f, iter,
+ &user_config->flow_steer_list, list) {
+ if (f->loc == fsp->location) {
+ list_del(&f->list);
+ kfree(f);
+ user_config->num_fsteer_fltrs--;
+- goto out;
++ goto out_unlock;
+ }
+ }
+ err = -EINVAL;
+
++out_unlock:
++ spin_unlock_bh(&vport_config->flow_steer_list_lock);
+ out:
+ kfree(rule);
+ return err;
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index e2ee8b137421f..d56366e676cf7 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -442,6 +442,29 @@ int idpf_intr_req(struct idpf_adapter *adapter)
+ return err;
+ }
+
++/**
++ * idpf_del_all_flow_steer_filters - Delete all flow steer filters in list
++ * @vport: main vport struct
++ *
++ * Takes flow_steer_list_lock spinlock. Deletes all filters
++ */
++static void idpf_del_all_flow_steer_filters(struct idpf_vport *vport)
++{
++ struct idpf_vport_config *vport_config;
++ struct idpf_fsteer_fltr *f, *ftmp;
++
++ vport_config = vport->adapter->vport_config[vport->idx];
++
++ spin_lock_bh(&vport_config->flow_steer_list_lock);
++ list_for_each_entry_safe(f, ftmp, &vport_config->user_config.flow_steer_list,
++ list) {
++ list_del(&f->list);
++ kfree(f);
++ }
++ vport_config->user_config.num_fsteer_fltrs = 0;
++ spin_unlock_bh(&vport_config->flow_steer_list_lock);
++}
++
+ /**
+ * idpf_find_mac_filter - Search filter list for specific mac filter
+ * @vconfig: Vport config structure
+@@ -1107,8 +1130,10 @@ static void idpf_vport_dealloc(struct idpf_vport *vport)
+ idpf_vport_stop(vport, true);
+ idpf_decfg_netdev(vport);
+ }
+- if (test_bit(IDPF_REMOVE_IN_PROG, adapter->flags))
++ if (test_bit(IDPF_REMOVE_IN_PROG, adapter->flags)) {
+ idpf_del_all_mac_filters(vport);
++ idpf_del_all_flow_steer_filters(vport);
++ }
+
+ if (adapter->netdevs[i]) {
+ struct idpf_netdev_priv *np = netdev_priv(adapter->netdevs[i]);
+@@ -1648,6 +1673,7 @@ void idpf_init_task(struct work_struct *work)
+ vport_config = adapter->vport_config[index];
+
+ spin_lock_init(&vport_config->mac_filter_list_lock);
++ spin_lock_init(&vport_config->flow_steer_list_lock);
+
+ INIT_LIST_HEAD(&vport_config->user_config.mac_filter_list);
+ INIT_LIST_HEAD(&vport_config->user_config.flow_steer_list);
+--
+2.51.0
+
--- /dev/null
+From ac03729cd114a3889a1e773c4930c410c5d605a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 12:47:49 -0600
+Subject: idpf: Fix RSS LUT configuration on down interfaces
+
+From: Sreedevi Joshi <sreedevi.joshi@intel.com>
+
+[ Upstream commit 445b49d13787da2fe8d51891ee196e5077feef44 ]
+
+RSS LUT provisioning and queries on a down interface currently return
+silently without effect. Users should be able to configure RSS settings
+even when the interface is down.
+
+Fix by maintaining RSS configuration changes in the driver's soft copy and
+deferring HW programming until the interface comes up.
+
+Fixes: 02cbfba1add5 ("idpf: add ethtool callbacks")
+Signed-off-by: Sreedevi Joshi <sreedevi.joshi@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Reviewed-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_ethtool.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_ethtool.c b/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
+index 8e9a93125b4aa..3e191cf528b69 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
+@@ -395,7 +395,10 @@ static u32 idpf_get_rxfh_indir_size(struct net_device *netdev)
+ * @netdev: network interface device structure
+ * @rxfh: pointer to param struct (indir, key, hfunc)
+ *
+- * Reads the indirection table directly from the hardware. Always returns 0.
++ * RSS LUT and Key information are read from driver's cached
++ * copy. When rxhash is off, rss lut will be displayed as zeros.
++ *
++ * Return: 0 on success, -errno otherwise.
+ */
+ static int idpf_get_rxfh(struct net_device *netdev,
+ struct ethtool_rxfh_param *rxfh)
+@@ -403,10 +406,13 @@ static int idpf_get_rxfh(struct net_device *netdev,
+ struct idpf_netdev_priv *np = netdev_priv(netdev);
+ struct idpf_rss_data *rss_data;
+ struct idpf_adapter *adapter;
++ struct idpf_vport *vport;
++ bool rxhash_ena;
+ int err = 0;
+ u16 i;
+
+ idpf_vport_ctrl_lock(netdev);
++ vport = idpf_netdev_to_vport(netdev);
+
+ adapter = np->adapter;
+
+@@ -416,9 +422,8 @@ static int idpf_get_rxfh(struct net_device *netdev,
+ }
+
+ rss_data = &adapter->vport_config[np->vport_idx]->user_config.rss_data;
+- if (!test_bit(IDPF_VPORT_UP, np->state))
+- goto unlock_mutex;
+
++ rxhash_ena = idpf_is_feature_ena(vport, NETIF_F_RXHASH);
+ rxfh->hfunc = ETH_RSS_HASH_TOP;
+
+ if (rxfh->key)
+@@ -426,7 +431,7 @@ static int idpf_get_rxfh(struct net_device *netdev,
+
+ if (rxfh->indir) {
+ for (i = 0; i < rss_data->rss_lut_size; i++)
+- rxfh->indir[i] = rss_data->rss_lut[i];
++ rxfh->indir[i] = rxhash_ena ? rss_data->rss_lut[i] : 0;
+ }
+
+ unlock_mutex:
+@@ -466,8 +471,6 @@ static int idpf_set_rxfh(struct net_device *netdev,
+ }
+
+ rss_data = &adapter->vport_config[vport->idx]->user_config.rss_data;
+- if (!test_bit(IDPF_VPORT_UP, np->state))
+- goto unlock_mutex;
+
+ if (rxfh->hfunc != ETH_RSS_HASH_NO_CHANGE &&
+ rxfh->hfunc != ETH_RSS_HASH_TOP) {
+@@ -483,7 +486,8 @@ static int idpf_set_rxfh(struct net_device *netdev,
+ rss_data->rss_lut[lut] = rxfh->indir[lut];
+ }
+
+- err = idpf_config_rss(vport);
++ if (test_bit(IDPF_VPORT_UP, np->state))
++ err = idpf_config_rss(vport);
+
+ unlock_mutex:
+ idpf_vport_ctrl_unlock(netdev);
+--
+2.51.0
+
--- /dev/null
+From 7f174e16516d16f7c18fbe258fe098a33f106a01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 12:47:48 -0600
+Subject: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations
+
+From: Sreedevi Joshi <sreedevi.joshi@intel.com>
+
+[ Upstream commit 83f38f210b85676f40ba8586b5a8edae19b56995 ]
+
+The RSS LUT is not initialized until the interface comes up, causing
+the following NULL pointer crash when ethtool operations like rxhash on/off
+are performed before the interface is brought up for the first time.
+
+Move RSS LUT initialization from ndo_open to vport creation to ensure LUT
+is always available. This enables RSS configuration via ethtool before
+bringing the interface up. Simplify LUT management by maintaining all
+changes in the driver's soft copy and programming zeros to the indirection
+table when rxhash is disabled. Defer HW programming until the interface
+comes up if it is down during rxhash and LUT configuration changes.
+
+Steps to reproduce:
+** Load idpf driver; interfaces will be created
+ modprobe idpf
+** Before bringing the interfaces up, turn rxhash off
+ ethtool -K eth2 rxhash off
+
+[89408.371875] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[89408.371908] #PF: supervisor read access in kernel mode
+[89408.371924] #PF: error_code(0x0000) - not-present page
+[89408.371940] PGD 0 P4D 0
+[89408.371953] Oops: Oops: 0000 [#1] SMP NOPTI
+<snip>
+[89408.372052] RIP: 0010:memcpy_orig+0x16/0x130
+[89408.372310] Call Trace:
+[89408.372317] <TASK>
+[89408.372326] ? idpf_set_features+0xfc/0x180 [idpf]
+[89408.372363] __netdev_update_features+0x295/0xde0
+[89408.372384] ethnl_set_features+0x15e/0x460
+[89408.372406] genl_family_rcv_msg_doit+0x11f/0x180
+[89408.372429] genl_rcv_msg+0x1ad/0x2b0
+[89408.372446] ? __pfx_ethnl_set_features+0x10/0x10
+[89408.372465] ? __pfx_genl_rcv_msg+0x10/0x10
+[89408.372482] netlink_rcv_skb+0x58/0x100
+[89408.372502] genl_rcv+0x2c/0x50
+[89408.372516] netlink_unicast+0x289/0x3e0
+[89408.372533] netlink_sendmsg+0x215/0x440
+[89408.372551] __sys_sendto+0x234/0x240
+[89408.372571] __x64_sys_sendto+0x28/0x30
+[89408.372585] x64_sys_call+0x1909/0x1da0
+[89408.372604] do_syscall_64+0x7a/0xfa0
+[89408.373140] ? clear_bhb_loop+0x60/0xb0
+[89408.373647] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[89408.378887] </TASK>
+<snip>
+
+Fixes: a251eee62133 ("idpf: add SRIOV support and other ndo_ops")
+Signed-off-by: Sreedevi Joshi <sreedevi.joshi@intel.com>
+Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Reviewed-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf.h | 2 -
+ drivers/net/ethernet/intel/idpf/idpf_lib.c | 94 +++++++++----------
+ drivers/net/ethernet/intel/idpf/idpf_txrx.c | 36 +++----
+ drivers/net/ethernet/intel/idpf/idpf_txrx.h | 4 +-
+ .../net/ethernet/intel/idpf/idpf_virtchnl.c | 9 +-
+ 5 files changed, 66 insertions(+), 79 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf.h b/drivers/net/ethernet/intel/idpf/idpf.h
+index df64d252b5642..c74c47bc0b9b9 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf.h
++++ b/drivers/net/ethernet/intel/idpf/idpf.h
+@@ -423,14 +423,12 @@ enum idpf_user_flags {
+ * @rss_key: RSS hash key
+ * @rss_lut_size: Size of RSS lookup table
+ * @rss_lut: RSS lookup table
+- * @cached_lut: Used to restore previously init RSS lut
+ */
+ struct idpf_rss_data {
+ u16 rss_key_size;
+ u8 *rss_key;
+ u16 rss_lut_size;
+ u32 *rss_lut;
+- u32 *cached_lut;
+ };
+
+ /**
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index d56366e676cf7..51716e5a84ef3 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -1073,7 +1073,7 @@ static void idpf_vport_rel(struct idpf_vport *vport)
+ u16 idx = vport->idx;
+
+ vport_config = adapter->vport_config[vport->idx];
+- idpf_deinit_rss(vport);
++ idpf_deinit_rss_lut(vport);
+ rss_data = &vport_config->user_config.rss_data;
+ kfree(rss_data->rss_key);
+ rss_data->rss_key = NULL;
+@@ -1226,6 +1226,7 @@ static struct idpf_vport *idpf_vport_alloc(struct idpf_adapter *adapter,
+ u16 idx = adapter->next_vport;
+ struct idpf_vport *vport;
+ u16 num_max_q;
++ int err;
+
+ if (idx == IDPF_NO_FREE_SLOT)
+ return NULL;
+@@ -1276,10 +1277,11 @@ static struct idpf_vport *idpf_vport_alloc(struct idpf_adapter *adapter,
+
+ idpf_vport_init(vport, max_q);
+
+- /* This alloc is done separate from the LUT because it's not strictly
+- * dependent on how many queues we have. If we change number of queues
+- * and soft reset we'll need a new LUT but the key can remain the same
+- * for as long as the vport exists.
++ /* LUT and key are both initialized here. Key is not strictly dependent
++ * on how many queues we have. If we change number of queues and soft
++ * reset is initiated, LUT will be freed and a new LUT will be allocated
++ * as per the updated number of queues during vport bringup. However,
++ * the key remains the same for as long as the vport exists.
+ */
+ rss_data = &adapter->vport_config[idx]->user_config.rss_data;
+ rss_data->rss_key = kzalloc(rss_data->rss_key_size, GFP_KERNEL);
+@@ -1289,6 +1291,11 @@ static struct idpf_vport *idpf_vport_alloc(struct idpf_adapter *adapter,
+ /* Initialize default rss key */
+ netdev_rss_key_fill((void *)rss_data->rss_key, rss_data->rss_key_size);
+
++ /* Initialize default rss LUT */
++ err = idpf_init_rss_lut(vport);
++ if (err)
++ goto free_rss_key;
++
+ /* fill vport slot in the adapter struct */
+ adapter->vports[idx] = vport;
+ adapter->vport_ids[idx] = idpf_get_vport_id(vport);
+@@ -1299,6 +1306,8 @@ static struct idpf_vport *idpf_vport_alloc(struct idpf_adapter *adapter,
+
+ return vport;
+
++free_rss_key:
++ kfree(rss_data->rss_key);
+ free_vector_idxs:
+ kfree(vport->q_vector_idxs);
+ free_vport:
+@@ -1476,6 +1485,7 @@ static int idpf_vport_open(struct idpf_vport *vport, bool rtnl)
+ struct idpf_netdev_priv *np = netdev_priv(vport->netdev);
+ struct idpf_adapter *adapter = vport->adapter;
+ struct idpf_vport_config *vport_config;
++ struct idpf_rss_data *rss_data;
+ int err;
+
+ if (test_bit(IDPF_VPORT_UP, np->state))
+@@ -1570,12 +1580,21 @@ static int idpf_vport_open(struct idpf_vport *vport, bool rtnl)
+ idpf_restore_features(vport);
+
+ vport_config = adapter->vport_config[vport->idx];
+- if (vport_config->user_config.rss_data.rss_lut)
+- err = idpf_config_rss(vport);
+- else
+- err = idpf_init_rss(vport);
++ rss_data = &vport_config->user_config.rss_data;
++
++ if (!rss_data->rss_lut) {
++ err = idpf_init_rss_lut(vport);
++ if (err) {
++ dev_err(&adapter->pdev->dev,
++ "Failed to initialize RSS LUT for vport %u: %d\n",
++ vport->vport_id, err);
++ goto disable_vport;
++ }
++ }
++
++ err = idpf_config_rss(vport);
+ if (err) {
+- dev_err(&adapter->pdev->dev, "Failed to initialize RSS for vport %u: %d\n",
++ dev_err(&adapter->pdev->dev, "Failed to configure RSS for vport %u: %d\n",
+ vport->vport_id, err);
+ goto disable_vport;
+ }
+@@ -1584,7 +1603,7 @@ static int idpf_vport_open(struct idpf_vport *vport, bool rtnl)
+ if (err) {
+ dev_err(&adapter->pdev->dev, "Failed to complete interface up for vport %u: %d\n",
+ vport->vport_id, err);
+- goto deinit_rss;
++ goto disable_vport;
+ }
+
+ if (rtnl)
+@@ -1592,8 +1611,6 @@ static int idpf_vport_open(struct idpf_vport *vport, bool rtnl)
+
+ return 0;
+
+-deinit_rss:
+- idpf_deinit_rss(vport);
+ disable_vport:
+ idpf_send_disable_vport_msg(vport);
+ disable_queues:
+@@ -2051,7 +2068,7 @@ int idpf_initiate_soft_reset(struct idpf_vport *vport,
+ idpf_vport_stop(vport, false);
+ }
+
+- idpf_deinit_rss(vport);
++ idpf_deinit_rss_lut(vport);
+ /* We're passing in vport here because we need its wait_queue
+ * to send a message and it should be getting all the vport
+ * config data out of the adapter but we need to be careful not
+@@ -2219,40 +2236,6 @@ static void idpf_set_rx_mode(struct net_device *netdev)
+ dev_err(dev, "Failed to set promiscuous mode: %d\n", err);
+ }
+
+-/**
+- * idpf_vport_manage_rss_lut - disable/enable RSS
+- * @vport: the vport being changed
+- *
+- * In the event of disable request for RSS, this function will zero out RSS
+- * LUT, while in the event of enable request for RSS, it will reconfigure RSS
+- * LUT with the default LUT configuration.
+- */
+-static int idpf_vport_manage_rss_lut(struct idpf_vport *vport)
+-{
+- bool ena = idpf_is_feature_ena(vport, NETIF_F_RXHASH);
+- struct idpf_rss_data *rss_data;
+- u16 idx = vport->idx;
+- int lut_size;
+-
+- rss_data = &vport->adapter->vport_config[idx]->user_config.rss_data;
+- lut_size = rss_data->rss_lut_size * sizeof(u32);
+-
+- if (ena) {
+- /* This will contain the default or user configured LUT */
+- memcpy(rss_data->rss_lut, rss_data->cached_lut, lut_size);
+- } else {
+- /* Save a copy of the current LUT to be restored later if
+- * requested.
+- */
+- memcpy(rss_data->cached_lut, rss_data->rss_lut, lut_size);
+-
+- /* Zero out the current LUT to disable */
+- memset(rss_data->rss_lut, 0, lut_size);
+- }
+-
+- return idpf_config_rss(vport);
+-}
+-
+ /**
+ * idpf_set_features - set the netdev feature flags
+ * @netdev: ptr to the netdev being adjusted
+@@ -2278,10 +2261,19 @@ static int idpf_set_features(struct net_device *netdev,
+ }
+
+ if (changed & NETIF_F_RXHASH) {
++ struct idpf_netdev_priv *np = netdev_priv(netdev);
++
+ netdev->features ^= NETIF_F_RXHASH;
+- err = idpf_vport_manage_rss_lut(vport);
+- if (err)
+- goto unlock_mutex;
++
++ /* If the interface is not up when changing the rxhash, update
++ * to the HW is skipped. The updated LUT will be committed to
++ * the HW when the interface is brought up.
++ */
++ if (test_bit(IDPF_VPORT_UP, np->state)) {
++ err = idpf_config_rss(vport);
++ if (err)
++ goto unlock_mutex;
++ }
+ }
+
+ if (changed & NETIF_F_GRO_HW) {
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+index 1993a3b0da59b..39553689ffdbf 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+@@ -4650,57 +4650,47 @@ static void idpf_fill_dflt_rss_lut(struct idpf_vport *vport)
+
+ rss_data = &adapter->vport_config[vport->idx]->user_config.rss_data;
+
+- for (i = 0; i < rss_data->rss_lut_size; i++) {
++ for (i = 0; i < rss_data->rss_lut_size; i++)
+ rss_data->rss_lut[i] = i % num_active_rxq;
+- rss_data->cached_lut[i] = rss_data->rss_lut[i];
+- }
+ }
+
+ /**
+- * idpf_init_rss - Allocate and initialize RSS resources
++ * idpf_init_rss_lut - Allocate and initialize RSS LUT
+ * @vport: virtual port
+ *
+- * Return 0 on success, negative on failure
++ * Return: 0 on success, negative on failure
+ */
+-int idpf_init_rss(struct idpf_vport *vport)
++int idpf_init_rss_lut(struct idpf_vport *vport)
+ {
+ struct idpf_adapter *adapter = vport->adapter;
+ struct idpf_rss_data *rss_data;
+- u32 lut_size;
+
+ rss_data = &adapter->vport_config[vport->idx]->user_config.rss_data;
++ if (!rss_data->rss_lut) {
++ u32 lut_size;
+
+- lut_size = rss_data->rss_lut_size * sizeof(u32);
+- rss_data->rss_lut = kzalloc(lut_size, GFP_KERNEL);
+- if (!rss_data->rss_lut)
+- return -ENOMEM;
+-
+- rss_data->cached_lut = kzalloc(lut_size, GFP_KERNEL);
+- if (!rss_data->cached_lut) {
+- kfree(rss_data->rss_lut);
+- rss_data->rss_lut = NULL;
+-
+- return -ENOMEM;
++ lut_size = rss_data->rss_lut_size * sizeof(u32);
++ rss_data->rss_lut = kzalloc(lut_size, GFP_KERNEL);
++ if (!rss_data->rss_lut)
++ return -ENOMEM;
+ }
+
+ /* Fill the default RSS lut values */
+ idpf_fill_dflt_rss_lut(vport);
+
+- return idpf_config_rss(vport);
++ return 0;
+ }
+
+ /**
+- * idpf_deinit_rss - Release RSS resources
++ * idpf_deinit_rss_lut - Release RSS LUT
+ * @vport: virtual port
+ */
+-void idpf_deinit_rss(struct idpf_vport *vport)
++void idpf_deinit_rss_lut(struct idpf_vport *vport)
+ {
+ struct idpf_adapter *adapter = vport->adapter;
+ struct idpf_rss_data *rss_data;
+
+ rss_data = &adapter->vport_config[vport->idx]->user_config.rss_data;
+- kfree(rss_data->cached_lut);
+- rss_data->cached_lut = NULL;
+ kfree(rss_data->rss_lut);
+ rss_data->rss_lut = NULL;
+ }
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.h b/drivers/net/ethernet/intel/idpf/idpf_txrx.h
+index 75b977094741f..7d20593bd8778 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.h
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.h
+@@ -1086,8 +1086,8 @@ void idpf_vport_intr_deinit(struct idpf_vport *vport);
+ int idpf_vport_intr_init(struct idpf_vport *vport);
+ void idpf_vport_intr_ena(struct idpf_vport *vport);
+ int idpf_config_rss(struct idpf_vport *vport);
+-int idpf_init_rss(struct idpf_vport *vport);
+-void idpf_deinit_rss(struct idpf_vport *vport);
++int idpf_init_rss_lut(struct idpf_vport *vport);
++void idpf_deinit_rss_lut(struct idpf_vport *vport);
+ int idpf_rx_bufs_init_all(struct idpf_vport *vport);
+
+ struct idpf_q_vector *idpf_find_rxq_vec(const struct idpf_vport *vport,
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+index 01bbd12a642a0..cb702eac86c80 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+@@ -2804,6 +2804,10 @@ int idpf_send_get_stats_msg(struct idpf_vport *vport)
+ * @vport: virtual port data structure
+ * @get: flag to set or get rss look up table
+ *
++ * When rxhash is disabled, RSS LUT will be configured with zeros. If rxhash
++ * is enabled, the LUT values stored in driver's soft copy will be used to setup
++ * the HW.
++ *
+ * Returns 0 on success, negative on failure.
+ */
+ int idpf_send_get_set_rss_lut_msg(struct idpf_vport *vport, bool get)
+@@ -2814,10 +2818,12 @@ int idpf_send_get_set_rss_lut_msg(struct idpf_vport *vport, bool get)
+ struct idpf_rss_data *rss_data;
+ int buf_size, lut_buf_size;
+ ssize_t reply_sz;
++ bool rxhash_ena;
+ int i;
+
+ rss_data =
+ &vport->adapter->vport_config[vport->idx]->user_config.rss_data;
++ rxhash_ena = idpf_is_feature_ena(vport, NETIF_F_RXHASH);
+ buf_size = struct_size(rl, lut, rss_data->rss_lut_size);
+ rl = kzalloc(buf_size, GFP_KERNEL);
+ if (!rl)
+@@ -2839,7 +2845,8 @@ int idpf_send_get_set_rss_lut_msg(struct idpf_vport *vport, bool get)
+ } else {
+ rl->lut_entries = cpu_to_le16(rss_data->rss_lut_size);
+ for (i = 0; i < rss_data->rss_lut_size; i++)
+- rl->lut[i] = cpu_to_le32(rss_data->rss_lut[i]);
++ rl->lut[i] = rxhash_ena ?
++ cpu_to_le32(rss_data->rss_lut[i]) : 0;
+
+ xn_params.vc_op = VIRTCHNL2_OP_SET_RSS_LUT;
+ }
+--
+2.51.0
+
--- /dev/null
+From 65a8437a57b3b0d0caafd2e8a9a45320db6e5e12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 12:47:50 -0600
+Subject: idpf: Fix RSS LUT NULL ptr issue after soft reset
+
+From: Sreedevi Joshi <sreedevi.joshi@intel.com>
+
+[ Upstream commit ebecca5b093895da801b3eba1a55b4ec4027d196 ]
+
+During soft reset, the RSS LUT is freed and not restored unless the
+interface is up. If an ethtool command that accesses the rss lut is
+attempted immediately after reset, it will result in NULL ptr
+dereference. Also, there is no need to reset the rss lut if the soft reset
+does not involve queue count change.
+
+After soft reset, set the RSS LUT to default values based on the updated
+queue count only if the reset was a result of a queue count change and
+the LUT was not configured by the user. In all other cases, don't touch
+the LUT.
+
+Steps to reproduce:
+
+** Bring the interface down (if up)
+ifconfig eth1 down
+
+** update the queue count (eg., 27->20)
+ethtool -L eth1 combined 20
+
+** display the RSS LUT
+ethtool -x eth1
+
+[82375.558338] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[82375.558373] #PF: supervisor read access in kernel mode
+[82375.558391] #PF: error_code(0x0000) - not-present page
+[82375.558408] PGD 0 P4D 0
+[82375.558421] Oops: Oops: 0000 [#1] SMP NOPTI
+<snip>
+[82375.558516] RIP: 0010:idpf_get_rxfh+0x108/0x150 [idpf]
+[82375.558786] Call Trace:
+[82375.558793] <TASK>
+[82375.558804] rss_prepare.isra.0+0x187/0x2a0
+[82375.558827] rss_prepare_data+0x3a/0x50
+[82375.558845] ethnl_default_doit+0x13d/0x3e0
+[82375.558863] genl_family_rcv_msg_doit+0x11f/0x180
+[82375.558886] genl_rcv_msg+0x1ad/0x2b0
+[82375.558902] ? __pfx_ethnl_default_doit+0x10/0x10
+[82375.558920] ? __pfx_genl_rcv_msg+0x10/0x10
+[82375.558937] netlink_rcv_skb+0x58/0x100
+[82375.558957] genl_rcv+0x2c/0x50
+[82375.558971] netlink_unicast+0x289/0x3e0
+[82375.558988] netlink_sendmsg+0x215/0x440
+[82375.559005] __sys_sendto+0x234/0x240
+[82375.559555] __x64_sys_sendto+0x28/0x30
+[82375.560068] x64_sys_call+0x1909/0x1da0
+[82375.560576] do_syscall_64+0x7a/0xfa0
+[82375.561076] ? clear_bhb_loop+0x60/0xb0
+[82375.561567] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+<snip>
+
+Fixes: 02cbfba1add5 ("idpf: add ethtool callbacks")
+Signed-off-by: Sreedevi Joshi <sreedevi.joshi@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Reviewed-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_lib.c | 20 ++++----------------
+ drivers/net/ethernet/intel/idpf/idpf_txrx.c | 2 +-
+ drivers/net/ethernet/intel/idpf/idpf_txrx.h | 1 +
+ 3 files changed, 6 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index 51716e5a84ef3..003bab3ce5ae6 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -1484,8 +1484,6 @@ static int idpf_vport_open(struct idpf_vport *vport, bool rtnl)
+ {
+ struct idpf_netdev_priv *np = netdev_priv(vport->netdev);
+ struct idpf_adapter *adapter = vport->adapter;
+- struct idpf_vport_config *vport_config;
+- struct idpf_rss_data *rss_data;
+ int err;
+
+ if (test_bit(IDPF_VPORT_UP, np->state))
+@@ -1579,19 +1577,6 @@ static int idpf_vport_open(struct idpf_vport *vport, bool rtnl)
+
+ idpf_restore_features(vport);
+
+- vport_config = adapter->vport_config[vport->idx];
+- rss_data = &vport_config->user_config.rss_data;
+-
+- if (!rss_data->rss_lut) {
+- err = idpf_init_rss_lut(vport);
+- if (err) {
+- dev_err(&adapter->pdev->dev,
+- "Failed to initialize RSS LUT for vport %u: %d\n",
+- vport->vport_id, err);
+- goto disable_vport;
+- }
+- }
+-
+ err = idpf_config_rss(vport);
+ if (err) {
+ dev_err(&adapter->pdev->dev, "Failed to configure RSS for vport %u: %d\n",
+@@ -2068,7 +2053,6 @@ int idpf_initiate_soft_reset(struct idpf_vport *vport,
+ idpf_vport_stop(vport, false);
+ }
+
+- idpf_deinit_rss_lut(vport);
+ /* We're passing in vport here because we need its wait_queue
+ * to send a message and it should be getting all the vport
+ * config data out of the adapter but we need to be careful not
+@@ -2094,6 +2078,10 @@ int idpf_initiate_soft_reset(struct idpf_vport *vport,
+ if (err)
+ goto err_open;
+
++ if (reset_cause == IDPF_SR_Q_CHANGE &&
++ !netif_is_rxfh_configured(vport->netdev))
++ idpf_fill_dflt_rss_lut(vport);
++
+ if (vport_is_up)
+ err = idpf_vport_open(vport, false);
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+index 39553689ffdbf..3698979b4c9ee 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+@@ -4641,7 +4641,7 @@ int idpf_config_rss(struct idpf_vport *vport)
+ * idpf_fill_dflt_rss_lut - Fill the indirection table with the default values
+ * @vport: virtual port structure
+ */
+-static void idpf_fill_dflt_rss_lut(struct idpf_vport *vport)
++void idpf_fill_dflt_rss_lut(struct idpf_vport *vport)
+ {
+ struct idpf_adapter *adapter = vport->adapter;
+ u16 num_active_rxq = vport->num_rxq;
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.h b/drivers/net/ethernet/intel/idpf/idpf_txrx.h
+index 7d20593bd8778..0472698ca1927 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.h
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.h
+@@ -1085,6 +1085,7 @@ void idpf_vport_intr_update_itr_ena_irq(struct idpf_q_vector *q_vector);
+ void idpf_vport_intr_deinit(struct idpf_vport *vport);
+ int idpf_vport_intr_init(struct idpf_vport *vport);
+ void idpf_vport_intr_ena(struct idpf_vport *vport);
++void idpf_fill_dflt_rss_lut(struct idpf_vport *vport);
+ int idpf_config_rss(struct idpf_vport *vport);
+ int idpf_init_rss_lut(struct idpf_vport *vport);
+ void idpf_deinit_rss_lut(struct idpf_vport *vport);
+--
+2.51.0
+
--- /dev/null
+From a59ff67e3dddb9410ae9687ee66e55c7602151c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 16:12:14 -0800
+Subject: idpf: keep the netdev when a reset fails
+
+From: Emil Tantilov <emil.s.tantilov@intel.com>
+
+[ Upstream commit 083029bd8b445595222a3cd14076b880781c1765 ]
+
+During a successful reset the driver would re-allocate vport resources
+while keeping the netdevs intact. However, in case of an error in the
+init task, the netdev of the failing vport will be unregistered,
+effectively removing the network interface:
+
+[ 121.211076] idpf 0000:83:00.0: enabling device (0100 -> 0102)
+[ 121.221976] idpf 0000:83:00.0: Device HW Reset initiated
+[ 124.161229] idpf 0000:83:00.0 ens801f0: renamed from eth0
+[ 124.163364] idpf 0000:83:00.0 ens801f0d1: renamed from eth1
+[ 125.934656] idpf 0000:83:00.0 ens801f0d2: renamed from eth2
+[ 128.218429] idpf 0000:83:00.0 ens801f0d3: renamed from eth3
+
+ip -br a
+ens801f0 UP
+ens801f0d1 UP
+ens801f0d2 UP
+ens801f0d3 UP
+echo 1 > /sys/class/net/ens801f0/device/reset
+
+[ 145.885537] idpf 0000:83:00.0: resetting
+[ 145.990280] idpf 0000:83:00.0: reset done
+[ 146.284766] idpf 0000:83:00.0: HW reset detected
+[ 146.296610] idpf 0000:83:00.0: Device HW Reset initiated
+[ 211.556719] idpf 0000:83:00.0: Transaction timed-out (op:526 cookie:7700 vc_op:526 salt:77 timeout:60000ms)
+[ 272.996705] idpf 0000:83:00.0: Transaction timed-out (op:502 cookie:7800 vc_op:502 salt:78 timeout:60000ms)
+
+ip -br a
+ens801f0d1 DOWN
+ens801f0d2 DOWN
+ens801f0d3 DOWN
+
+Re-shuffle the logic in the error path of the init task to make sure the
+netdevs remain intact. This will allow the driver to attempt recovery via
+subsequent resets, provided the FW is still functional.
+
+The main change is to make sure that idpf_decfg_netdev() is not called
+should the init task fail during a reset. The error handling is
+consolidated under unwind_vports, as the removed labels had the same
+cleanup logic split depending on the point of failure.
+
+Fixes: ce1b75d0635c ("idpf: add ptypes and MAC filter support")
+Signed-off-by: Emil Tantilov <emil.s.tantilov@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Samuel Salin <Samuel.salin@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_lib.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index aaafe40f5eaf7..452f3107378cb 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -1579,6 +1579,10 @@ void idpf_init_task(struct work_struct *work)
+ goto unwind_vports;
+ }
+
++ err = idpf_send_get_rx_ptype_msg(vport);
++ if (err)
++ goto unwind_vports;
++
+ index = vport->idx;
+ vport_config = adapter->vport_config[index];
+
+@@ -1590,15 +1594,11 @@ void idpf_init_task(struct work_struct *work)
+ err = idpf_check_supported_desc_ids(vport);
+ if (err) {
+ dev_err(&pdev->dev, "failed to get required descriptor ids\n");
+- goto cfg_netdev_err;
++ goto unwind_vports;
+ }
+
+ if (idpf_cfg_netdev(vport))
+- goto cfg_netdev_err;
+-
+- err = idpf_send_get_rx_ptype_msg(vport);
+- if (err)
+- goto handle_err;
++ goto unwind_vports;
+
+ /* Once state is put into DOWN, driver is ready for dev_open */
+ np = netdev_priv(vport->netdev);
+@@ -1645,11 +1645,6 @@ void idpf_init_task(struct work_struct *work)
+
+ return;
+
+-handle_err:
+- idpf_decfg_netdev(vport);
+-cfg_netdev_err:
+- idpf_vport_rel(vport);
+- adapter->vports[index] = NULL;
+ unwind_vports:
+ if (default_vport) {
+ for (index = 0; index < adapter->max_vports; index++) {
+--
+2.51.0
+
--- /dev/null
+From df84dda3eb0b11e424d4eb5d018cac4fb206daf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 15:00:07 +0100
+Subject: inet: frags: drop fraglist conntrack references
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 2ef02ac38d3c17f34a00c4b267d961a8d4b45d1a ]
+
+Jakub added a warning in nf_conntrack_cleanup_net_list() to make debugging
+leaked skbs/conntrack references more obvious.
+
+syzbot reports this as triggering, and I can also reproduce this via
+ip_defrag.sh selftest:
+
+ conntrack cleanup blocked for 60s
+ WARNING: net/netfilter/nf_conntrack_core.c:2512
+ [..]
+
+conntrack clenups gets stuck because there are skbs with still hold nf_conn
+references via their frag_list.
+
+ net.core.skb_defer_max=0 makes the hang disappear.
+
+Eric Dumazet points out that skb_release_head_state() doesn't follow the
+fraglist.
+
+ip_defrag.sh can only reproduce this problem since
+commit 6471658dc66c ("udp: use skb_attempt_defer_free()"), but AFAICS this
+problem could happen with TCP as well if pmtu discovery is off.
+
+The relevant problem path for udp is:
+1. netns emits fragmented packets
+2. nf_defrag_v6_hook reassembles them (in output hook)
+3. reassembled skb is tracked (skb owns nf_conn reference)
+4. ip6_output refragments
+5. refragmented packets also own nf_conn reference (ip6_fragment
+ calls ip6_copy_metadata())
+6. on input path, nf_defrag_v6_hook skips defragmentation: the
+ fragments already have skb->nf_conn attached
+7. skbs are reassembled via ipv6_frag_rcv()
+8. skb_consume_udp -> skb_attempt_defer_free() -> skb ends up
+ in pcpu freelist, but still has nf_conn reference.
+
+Possible solutions:
+ 1 let defrag engine drop nf_conn entry, OR
+ 2 export kick_defer_list_purge() and call it from the conntrack
+ netns exit callback, OR
+ 3 add skb_has_frag_list() check to skb_attempt_defer_free()
+
+2 & 3 also solve ip_defrag.sh hang but share same drawback:
+
+Such reassembled skbs, queued to socket, can prevent conntrack module
+removal until userspace has consumed the packet. While both tcp and udp
+stack do call nf_reset_ct() before placing skb on socket queue, that
+function doesn't iterate frag_list skbs.
+
+Therefore drop nf_conn entries when they are placed in defrag queue.
+Keep the nf_conn entry of the first (offset 0) skb so that reassembled
+skb retains nf_conn entry for sake of TX path.
+
+Note that fixes tag is incorrect; it points to the commit introducing the
+'ip_defrag.sh reproducible problem': no need to backport this patch to
+every stable kernel.
+
+Reported-by: syzbot+4393c47753b7808dac7d@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/693b0fa7.050a0220.4004e.040d.GAE@google.com/
+Fixes: 6471658dc66c ("udp: use skb_attempt_defer_free()")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260102140030.32367-1-fw@strlen.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/inet_fragment.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
+index 001ee5c4d962e..4e6d7467ed444 100644
+--- a/net/ipv4/inet_fragment.c
++++ b/net/ipv4/inet_fragment.c
+@@ -488,6 +488,8 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,
+ }
+
+ FRAG_CB(skb)->ip_defrag_offset = offset;
++ if (offset)
++ nf_reset_ct(skb);
+
+ return IPFRAG_OK;
+ }
+--
+2.51.0
+
--- /dev/null
+From fea544b94db57fc1e290b5d53daee46a35b4f50f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 14:31:45 +0800
+Subject: inet: ping: Fix icmp out counting
+
+From: yuan.gao <yuan.gao@ucloud.cn>
+
+[ Upstream commit 4c0856c225b39b1def6c9a6bc56faca79550da13 ]
+
+When the ping program uses an IPPROTO_ICMP socket to send ICMP_ECHO
+messages, ICMP_MIB_OUTMSGS is counted twice.
+
+ ping_v4_sendmsg
+ ping_v4_push_pending_frames
+ ip_push_pending_frames
+ ip_finish_skb
+ __ip_make_skb
+ icmp_out_count(net, icmp_type); // first count
+ icmp_out_count(sock_net(sk), user_icmph.type); // second count
+
+However, when the ping program uses an IPPROTO_RAW socket,
+ICMP_MIB_OUTMSGS is counted correctly only once.
+
+Therefore, the first count should be removed.
+
+Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
+Signed-off-by: yuan.gao <yuan.gao@ucloud.cn>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Tested-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20251224063145.3615282-1-yuan.gao@ucloud.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ping.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 5321c5801c64d..a5227d23bb0b5 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -828,10 +828,8 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ out_free:
+ if (free)
+ kfree(ipc.opt);
+- if (!err) {
+- icmp_out_count(sock_net(sk), user_icmph.type);
++ if (!err)
+ return len;
+- }
+ return err;
+
+ do_confirm:
+--
+2.51.0
+
--- /dev/null
+From eba901a5b709df97926010f89bcd6ba4e02468c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Dec 2025 11:22:50 +0100
+Subject: irqchip/gic-v5: Fix gicv5_its_map_event() ITTE read endianness
+
+From: Lorenzo Pieralisi <lpieralisi@kernel.org>
+
+[ Upstream commit 1690eeb0cb2bb77096cb6c826b6849ef05013e34 ]
+
+Kbuild bot (through sparse) reported that the ITTE read to carry out
+a valid check in gicv5_its_map_event() lacks proper endianness handling.
+
+Add the missing endianess conversion.
+
+Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Link: https://patch.msgid.link/20251222102250.435460-1-lpieralisi@kernel.org
+Closes: https://lore.kernel.org/oe-kbuild-all/202512131849.30ZRTBeR-lkp@intel.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v5-its.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
+index 554485f0be1fb..8e22134b9f486 100644
+--- a/drivers/irqchip/irq-gic-v5-its.c
++++ b/drivers/irqchip/irq-gic-v5-its.c
+@@ -849,7 +849,7 @@ static int gicv5_its_map_event(struct gicv5_its_dev *its_dev, u16 event_id, u32
+
+ itte = gicv5_its_device_get_itte_ref(its_dev, event_id);
+
+- if (FIELD_GET(GICV5_ITTL2E_VALID, *itte))
++ if (FIELD_GET(GICV5_ITTL2E_VALID, le64_to_cpu(*itte)))
+ return -EEXIST;
+
+ itt_entry = FIELD_PREP(GICV5_ITTL2E_LPI_ID, lpi) |
+--
+2.51.0
+
--- /dev/null
+From 3f10e07e56cf99569e9d2c7dca3aa64c694aa296 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 12:29:38 +0100
+Subject: net: airoha: Fix npu rx DMA definitions
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit a7fc8c641cab855824c45e5e8877e40fd528b5df ]
+
+Fix typos in npu rx DMA descriptor definitions.
+
+Fixes: b3ef7bdec66fb ("net: airoha: Add airoha_offload.h header")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20260102-airoha-npu-dma-rx-def-fixes-v1-1-205fc6bf7d94@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/soc/airoha/airoha_offload.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/soc/airoha/airoha_offload.h b/include/linux/soc/airoha/airoha_offload.h
+index 6f66eb339b3fc..1a33f846afafa 100644
+--- a/include/linux/soc/airoha/airoha_offload.h
++++ b/include/linux/soc/airoha/airoha_offload.h
+@@ -70,12 +70,12 @@ static inline void airoha_ppe_dev_check_skb(struct airoha_ppe_dev *dev,
+ #define NPU_RX1_DESC_NUM 512
+
+ /* CTRL */
+-#define NPU_RX_DMA_DESC_LAST_MASK BIT(29)
+-#define NPU_RX_DMA_DESC_LEN_MASK GENMASK(28, 15)
+-#define NPU_RX_DMA_DESC_CUR_LEN_MASK GENMASK(14, 1)
++#define NPU_RX_DMA_DESC_LAST_MASK BIT(27)
++#define NPU_RX_DMA_DESC_LEN_MASK GENMASK(26, 14)
++#define NPU_RX_DMA_DESC_CUR_LEN_MASK GENMASK(13, 1)
+ #define NPU_RX_DMA_DESC_DONE_MASK BIT(0)
+ /* INFO */
+-#define NPU_RX_DMA_PKT_COUNT_MASK GENMASK(31, 28)
++#define NPU_RX_DMA_PKT_COUNT_MASK GENMASK(31, 29)
+ #define NPU_RX_DMA_PKT_ID_MASK GENMASK(28, 26)
+ #define NPU_RX_DMA_SRC_PORT_MASK GENMASK(25, 21)
+ #define NPU_RX_DMA_CRSN_MASK GENMASK(20, 16)
+--
+2.51.0
+
--- /dev/null
+From 1049a9e89c8aaab31c4bb4abfa8b7868d1563229 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 09:43:31 +0100
+Subject: net: airoha: Fix schedule while atomic in airoha_ppe_deinit()
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 6abcf751bc084804a9e5b3051442e8a2ce67f48a ]
+
+airoha_ppe_deinit() runs airoha_npu_ppe_deinit() in atomic context.
+airoha_npu_ppe_deinit routine allocates ppe_data buffer with GFP_KERNEL
+flag. Rely on rcu_replace_pointer in airoha_ppe_deinit routine in order
+to fix schedule while atomic issue in airoha_npu_ppe_deinit() since we
+do not need atomic context there.
+
+Fixes: 00a7678310fe3 ("net: airoha: Introduce flowtable offload support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20260105-airoha-fw-ethtool-v2-1-3b32b158cc31@kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/airoha/airoha_ppe.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/airoha/airoha_ppe.c b/drivers/net/ethernet/airoha/airoha_ppe.c
+index c0e17035db18e..190d98970014f 100644
+--- a/drivers/net/ethernet/airoha/airoha_ppe.c
++++ b/drivers/net/ethernet/airoha/airoha_ppe.c
+@@ -1466,13 +1466,16 @@ void airoha_ppe_deinit(struct airoha_eth *eth)
+ {
+ struct airoha_npu *npu;
+
+- rcu_read_lock();
+- npu = rcu_dereference(eth->npu);
++ mutex_lock(&flow_offload_mutex);
++
++ npu = rcu_replace_pointer(eth->npu, NULL,
++ lockdep_is_held(&flow_offload_mutex));
+ if (npu) {
+ npu->ops.ppe_deinit(npu);
+ airoha_npu_put(npu);
+ }
+- rcu_read_unlock();
++
++ mutex_unlock(&flow_offload_mutex);
+
+ rhashtable_destroy(ð->ppe->l2_flows);
+ rhashtable_destroy(ð->flow_table);
+--
+2.51.0
+
--- /dev/null
+From 0217741a4eb3caef1172e6071e82425b59fdbea9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Dec 2025 22:58:08 +0800
+Subject: net/ena: fix missing lock when update devlink params
+
+From: Frank Liang <xiliang@redhat.com>
+
+[ Upstream commit 8da901ffe497a53fa4ecc3ceed0e6d771586f88e ]
+
+Fix assert lock warning while calling devl_param_driverinit_value_set()
+in ena.
+
+WARNING: net/devlink/core.c:261 at devl_assert_locked+0x62/0x90, CPU#0: kworker/0:0/9
+CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.19.0-rc2+ #1 PREEMPT(lazy)
+Hardware name: Amazon EC2 m8i-flex.4xlarge/, BIOS 1.0 10/16/2017
+Workqueue: events work_for_cpu_fn
+RIP: 0010:devl_assert_locked+0x62/0x90
+
+Call Trace:
+ <TASK>
+ devl_param_driverinit_value_set+0x15/0x1c0
+ ena_devlink_alloc+0x18c/0x220 [ena]
+ ? __pfx_ena_devlink_alloc+0x10/0x10 [ena]
+ ? trace_hardirqs_on+0x18/0x140
+ ? lockdep_hardirqs_on+0x8c/0x130
+ ? __raw_spin_unlock_irqrestore+0x5d/0x80
+ ? __raw_spin_unlock_irqrestore+0x46/0x80
+ ? devm_ioremap_wc+0x9a/0xd0
+ ena_probe+0x4d2/0x1b20 [ena]
+ ? __lock_acquire+0x56a/0xbd0
+ ? __pfx_ena_probe+0x10/0x10 [ena]
+ ? local_clock+0x15/0x30
+ ? __lock_release.isra.0+0x1c9/0x340
+ ? mark_held_locks+0x40/0x70
+ ? lockdep_hardirqs_on_prepare.part.0+0x92/0x170
+ ? trace_hardirqs_on+0x18/0x140
+ ? lockdep_hardirqs_on+0x8c/0x130
+ ? __raw_spin_unlock_irqrestore+0x5d/0x80
+ ? __raw_spin_unlock_irqrestore+0x46/0x80
+ ? __pfx_ena_probe+0x10/0x10 [ena]
+ ......
+ </TASK>
+
+Fixes: 816b52624cf6 ("net: ena: Control PHC enable through devlink")
+Signed-off-by: Frank Liang <xiliang@redhat.com>
+Reviewed-by: David Arinzon <darinzon@amazon.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Link: https://patch.msgid.link/20251231145808.6103-1-xiliang@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_devlink.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_devlink.c b/drivers/net/ethernet/amazon/ena/ena_devlink.c
+index ac81c24016dd4..4772185e669d2 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_devlink.c
++++ b/drivers/net/ethernet/amazon/ena/ena_devlink.c
+@@ -53,10 +53,12 @@ void ena_devlink_disable_phc_param(struct devlink *devlink)
+ {
+ union devlink_param_value value;
+
++ devl_lock(devlink);
+ value.vbool = false;
+ devl_param_driverinit_value_set(devlink,
+ DEVLINK_PARAM_GENERIC_ID_ENABLE_PHC,
+ value);
++ devl_unlock(devlink);
+ }
+
+ static void ena_devlink_port_register(struct devlink *devlink)
+@@ -145,10 +147,12 @@ static int ena_devlink_configure_params(struct devlink *devlink)
+ return rc;
+ }
+
++ devl_lock(devlink);
+ value.vbool = ena_phc_is_enabled(adapter);
+ devl_param_driverinit_value_set(devlink,
+ DEVLINK_PARAM_GENERIC_ID_ENABLE_PHC,
+ value);
++ devl_unlock(devlink);
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 0b5296ac0df0f1aa809a149b16a62bed63000a6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 17:12:04 +0800
+Subject: net: enetc: fix build warning when PAGE_SIZE is greater than 128K
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit 4b5bdabb5449b652122e43f507f73789041d4abe ]
+
+The max buffer size of ENETC RX BD is 0xFFFF bytes, so if the PAGE_SIZE
+is greater than 128K, ENETC_RXB_DMA_SIZE and ENETC_RXB_DMA_SIZE_XDP will
+be greater than 0xFFFF, thus causing a build warning.
+
+This will not cause any practical issues because ENETC is currently only
+used on the ARM64 platform, and the max PAGE_SIZE is 64K. So this patch
+is only for fixing the build warning that occurs when compiling ENETC
+drivers for other platforms.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202601050637.kHEKKOG7-lkp@intel.com/
+Fixes: e59bc32df2e9 ("net: enetc: correct the value of ENETC_RXB_TRUESIZE")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260107091204.1980222-1-wei.fang@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h
+index f279fa597991e..60c7205ea9ff5 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc.h
++++ b/drivers/net/ethernet/freescale/enetc/enetc.h
+@@ -79,9 +79,9 @@ struct enetc_lso_t {
+ #define ENETC_RXB_TRUESIZE (PAGE_SIZE >> 1)
+ #define ENETC_RXB_PAD NET_SKB_PAD /* add extra space if needed */
+ #define ENETC_RXB_DMA_SIZE \
+- (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD)
++ min(SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD, 0xffff)
+ #define ENETC_RXB_DMA_SIZE_XDP \
+- (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - XDP_PACKET_HEADROOM)
++ min(SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - XDP_PACKET_HEADROOM, 0xffff)
+
+ struct enetc_rx_swbd {
+ dma_addr_t dma;
+--
+2.51.0
+
--- /dev/null
+From abeda43c3c174a4af1e799990dfbaeff013d703f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jan 2026 23:31:01 +0200
+Subject: net: fix memory leak in skb_segment_list for GRO packets
+
+From: Mohammad Heib <mheib@redhat.com>
+
+[ Upstream commit 238e03d0466239410b72294b79494e43d4fabe77 ]
+
+When skb_segment_list() is called during packet forwarding, it handles
+packets that were aggregated by the GRO engine.
+
+Historically, the segmentation logic in skb_segment_list assumes that
+individual segments are split from a parent SKB and may need to carry
+their own socket memory accounting. Accordingly, the code transfers
+truesize from the parent to the newly created segments.
+
+Prior to commit ed4cccef64c1 ("gro: fix ownership transfer"), this
+truesize subtraction in skb_segment_list() was valid because fragments
+still carry a reference to the original socket.
+
+However, commit ed4cccef64c1 ("gro: fix ownership transfer") changed
+this behavior by ensuring that fraglist entries are explicitly
+orphaned (skb->sk = NULL) to prevent illegal orphaning later in the
+stack. This change meant that the entire socket memory charge remained
+with the head SKB, but the corresponding accounting logic in
+skb_segment_list() was never updated.
+
+As a result, the current code unconditionally adds each fragment's
+truesize to delta_truesize and subtracts it from the parent SKB. Since
+the fragments are no longer charged to the socket, this subtraction
+results in an effective under-count of memory when the head is freed.
+This causes sk_wmem_alloc to remain non-zero, preventing socket
+destruction and leading to a persistent memory leak.
+
+The leak can be observed via KMEMLEAK when tearing down the networking
+environment:
+
+unreferenced object 0xffff8881e6eb9100 (size 2048):
+ comm "ping", pid 6720, jiffies 4295492526
+ backtrace:
+ kmem_cache_alloc_noprof+0x5c6/0x800
+ sk_prot_alloc+0x5b/0x220
+ sk_alloc+0x35/0xa00
+ inet6_create.part.0+0x303/0x10d0
+ __sock_create+0x248/0x640
+ __sys_socket+0x11b/0x1d0
+
+Since skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST
+packets constructed by GRO, the truesize adjustment is removed.
+
+The call to skb_release_head_state() must be preserved. As documented in
+commit cf673ed0e057 ("net: fix fraglist segmentation reference count
+leak"), it is still required to correctly drop references to SKB
+extensions that may be overwritten during __copy_skb_header().
+
+Fixes: ed4cccef64c1 ("gro: fix ownership transfer")
+Signed-off-by: Mohammad Heib <mheib@redhat.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Link: https://patch.msgid.link/20260104213101.352887-1-mheib@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skbuff.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 6be01454f262a..9a763d120925a 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4597,12 +4597,14 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
+ {
+ struct sk_buff *list_skb = skb_shinfo(skb)->frag_list;
+ unsigned int tnl_hlen = skb_tnl_header_len(skb);
+- unsigned int delta_truesize = 0;
+ unsigned int delta_len = 0;
+ struct sk_buff *tail = NULL;
+ struct sk_buff *nskb, *tmp;
+ int len_diff, err;
+
++ /* Only skb_gro_receive_list generated skbs arrive here */
++ DEBUG_NET_WARN_ON_ONCE(!(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST));
++
+ skb_push(skb, -skb_network_offset(skb) + offset);
+
+ /* Ensure the head is writeable before touching the shared info */
+@@ -4616,8 +4618,9 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
+ nskb = list_skb;
+ list_skb = list_skb->next;
+
++ DEBUG_NET_WARN_ON_ONCE(nskb->sk);
++
+ err = 0;
+- delta_truesize += nskb->truesize;
+ if (skb_shared(nskb)) {
+ tmp = skb_clone(nskb, GFP_ATOMIC);
+ if (tmp) {
+@@ -4660,7 +4663,6 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
+ goto err_linearize;
+ }
+
+- skb->truesize = skb->truesize - delta_truesize;
+ skb->data_len = skb->data_len - delta_len;
+ skb->len = skb->len - delta_len;
+
+--
+2.51.0
+
--- /dev/null
+From d43d06fe161d0fc45807cd0d8029601ebe2451b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Dec 2025 21:21:18 -0800
+Subject: net: marvell: prestera: fix NULL dereference on devlink_alloc()
+ failure
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit a428e0da1248c353557970848994f35fd3f005e2 ]
+
+devlink_alloc() may return NULL on allocation failure, but
+prestera_devlink_alloc() unconditionally calls devlink_priv() on
+the returned pointer.
+
+This leads to a NULL pointer dereference if devlink allocation fails.
+Add a check for a NULL devlink pointer and return NULL early to avoid
+the crash.
+
+Fixes: 34dd1710f5a3 ("net: marvell: prestera: Add basic devlink support")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Acked-by: Elad Nachman <enachman@marvell.com>
+Link: https://patch.msgid.link/20251230052124.897012-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/prestera/prestera_devlink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/prestera/prestera_devlink.c b/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
+index 2a4c9df4eb797..e63d95c1842f3 100644
+--- a/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
++++ b/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
+@@ -387,6 +387,8 @@ struct prestera_switch *prestera_devlink_alloc(struct prestera_device *dev)
+
+ dl = devlink_alloc(&prestera_dl_ops, sizeof(struct prestera_switch),
+ dev->dev);
++ if (!dl)
++ return NULL;
+
+ return devlink_priv(dl);
+ }
+--
+2.51.0
+
--- /dev/null
+From 2cedb4c99fb3a237a16da800aa22fe7356ecf91c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Dec 2025 15:27:13 +0200
+Subject: net/mlx5: Lag, multipath, give priority for routes with smaller
+ network prefix
+
+From: Patrisious Haddad <phaddad@nvidia.com>
+
+[ Upstream commit 31057979cdadfee9f934746fd84046b43506ba61 ]
+
+Today multipath offload is controlled by a single route and the route
+controlling is selected if it meets one of the following criteria:
+ 1. No controlling route is set.
+ 2. New route destination is the same as old one.
+ 3. New route metric is lower than old route metric.
+
+This can cause unwanted behaviour in case a new route is added
+with a smaller network prefix which should get the priority.
+
+Fix this by adding a new criteria to give priority to new route with
+a smaller network prefix.
+
+Fixes: ad11c4f1d8fd ("net/mlx5e: Lag, Only handle events from highest priority multipath entry")
+Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Link: https://patch.msgid.link/20251225132717.358820-2-mbloch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/lag/mp.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/mp.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/mp.c
+index aee17fcf3b36c..cdc99fe5c9568 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/mp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/mp.c
+@@ -173,10 +173,15 @@ static void mlx5_lag_fib_route_event(struct mlx5_lag *ldev, unsigned long event,
+ }
+
+ /* Handle multipath entry with lower priority value */
+- if (mp->fib.mfi && mp->fib.mfi != fi &&
++ if (mp->fib.mfi &&
+ (mp->fib.dst != fen_info->dst || mp->fib.dst_len != fen_info->dst_len) &&
+- fi->fib_priority >= mp->fib.priority)
++ mp->fib.dst_len <= fen_info->dst_len &&
++ !(mp->fib.dst_len == fen_info->dst_len &&
++ fi->fib_priority < mp->fib.priority)) {
++ mlx5_core_dbg(ldev->pf[idx].dev,
++ "Multipath entry with lower priority was rejected\n");
+ return;
++ }
+
+ nh_dev0 = mlx5_lag_get_next_fib_dev(ldev, fi, NULL);
+ nh_dev1 = mlx5_lag_get_next_fib_dev(ldev, fi, nh_dev0);
+--
+2.51.0
+
--- /dev/null
+From 061e0b06d9303638c01861ece07f073f931e371e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Dec 2025 15:27:17 +0200
+Subject: net/mlx5e: Dealloc forgotten PSP RX modify header
+
+From: Cosmin Ratiu <cratiu@nvidia.com>
+
+[ Upstream commit 0462a15d2d1fafd3d48cf3c7c67393e42d03908c ]
+
+The commit which added RX steering rules for PSP forgot to free a modify
+header HW object on the cleanup path, which lead to health errors when
+reloading the driver and uninitializing the device:
+
+mlx5_core 0000:08:00.0: poll_health:803:(pid 3021): Fatal error 3 detected
+
+Fix that by saving the modify header pointer in the PSP steering struct
+and deallocating it after freeing the rule which references it.
+
+Fixes: 9536fbe10c9d ("net/mlx5e: Add PSP steering in local NIC RX")
+Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
+Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Link: https://patch.msgid.link/20251225132717.358820-6-mbloch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/en_accel/psp.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c
+index 8565cfe8d7dce..943d6fc6e7a04 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c
+@@ -41,6 +41,7 @@ struct mlx5e_accel_fs_psp_prot {
+ struct mlx5_flow_table *ft;
+ struct mlx5_flow_group *miss_group;
+ struct mlx5_flow_handle *miss_rule;
++ struct mlx5_modify_hdr *rx_modify_hdr;
+ struct mlx5_flow_destination default_dest;
+ struct mlx5e_psp_rx_err rx_err;
+ u32 refcnt;
+@@ -217,13 +218,19 @@ static int accel_psp_fs_rx_err_create_ft(struct mlx5e_psp_fs *fs,
+ return err;
+ }
+
+-static void accel_psp_fs_rx_fs_destroy(struct mlx5e_accel_fs_psp_prot *fs_prot)
++static void accel_psp_fs_rx_fs_destroy(struct mlx5e_psp_fs *fs,
++ struct mlx5e_accel_fs_psp_prot *fs_prot)
+ {
+ if (fs_prot->def_rule) {
+ mlx5_del_flow_rules(fs_prot->def_rule);
+ fs_prot->def_rule = NULL;
+ }
+
++ if (fs_prot->rx_modify_hdr) {
++ mlx5_modify_header_dealloc(fs->mdev, fs_prot->rx_modify_hdr);
++ fs_prot->rx_modify_hdr = NULL;
++ }
++
+ if (fs_prot->miss_rule) {
+ mlx5_del_flow_rules(fs_prot->miss_rule);
+ fs_prot->miss_rule = NULL;
+@@ -327,6 +334,7 @@ static int accel_psp_fs_rx_create_ft(struct mlx5e_psp_fs *fs,
+ modify_hdr = NULL;
+ goto out_err;
+ }
++ fs_prot->rx_modify_hdr = modify_hdr;
+
+ flow_act.action = MLX5_FLOW_CONTEXT_ACTION_FWD_DEST |
+ MLX5_FLOW_CONTEXT_ACTION_CRYPTO_DECRYPT |
+@@ -347,7 +355,7 @@ static int accel_psp_fs_rx_create_ft(struct mlx5e_psp_fs *fs,
+ goto out;
+
+ out_err:
+- accel_psp_fs_rx_fs_destroy(fs_prot);
++ accel_psp_fs_rx_fs_destroy(fs, fs_prot);
+ out:
+ kvfree(flow_group_in);
+ kvfree(spec);
+@@ -364,7 +372,7 @@ static int accel_psp_fs_rx_destroy(struct mlx5e_psp_fs *fs, enum accel_fs_psp_ty
+ /* The netdev unreg already happened, so all offloaded rule are already removed */
+ fs_prot = &accel_psp->fs_prot[type];
+
+- accel_psp_fs_rx_fs_destroy(fs_prot);
++ accel_psp_fs_rx_fs_destroy(fs, fs_prot);
+
+ accel_psp_fs_rx_err_destroy_ft(fs, &fs_prot->rx_err);
+
+--
+2.51.0
+
--- /dev/null
+From db805d3128473ffbb72a57d2105b4f6f2f95c3df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Dec 2025 15:27:14 +0200
+Subject: net/mlx5e: Don't gate FEC histograms on ppcnt_statistical_group
+
+From: Alexei Lazar <alazar@nvidia.com>
+
+[ Upstream commit 6c75dc9de40ff91ec2b621b78f6cd9031762067c ]
+
+Currently, the ppcnt_statistical_group capability check
+incorrectly gates access to FEC histogram statistics.
+This capability applies only to statistical and physical
+counter groups, not for histogram data.
+
+Restrict the ppcnt_statistical_group check to the
+Physical_Layer_Counters and Physical_Layer_Statistical_Counters
+groups.
+Histogram statistics access remains gated by the pphcr
+capability.
+
+The issue is harmless as of today, as it happens that
+ppcnt_statistical_group is set on all existing devices that
+have pphcr set.
+
+Fixes: 6b81b8a0b197 ("net/mlx5e: Don't query FEC statistics when FEC is disabled")
+Signed-off-by: Alexei Lazar <alazar@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Link: https://patch.msgid.link/20251225132717.358820-3-mbloch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+index a2802cfc9b989..a8af84fc97638 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+@@ -1608,12 +1608,13 @@ void mlx5e_stats_fec_get(struct mlx5e_priv *priv,
+ {
+ int mode = fec_active_mode(priv->mdev);
+
+- if (mode == MLX5E_FEC_NOFEC ||
+- !MLX5_CAP_PCAM_FEATURE(priv->mdev, ppcnt_statistical_group))
++ if (mode == MLX5E_FEC_NOFEC)
+ return;
+
+- fec_set_corrected_bits_total(priv, fec_stats);
+- fec_set_block_stats(priv, mode, fec_stats);
++ if (MLX5_CAP_PCAM_FEATURE(priv->mdev, ppcnt_statistical_group)) {
++ fec_set_corrected_bits_total(priv, fec_stats);
++ fec_set_block_stats(priv, mode, fec_stats);
++ }
+
+ if (MLX5_CAP_PCAM_REG(priv->mdev, pphcr))
+ fec_set_histograms_stats(priv, mode, hist);
+--
+2.51.0
+
--- /dev/null
+From 352dad73a3e2d48e3ab30ebf4fd4806866358397 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Dec 2025 15:27:16 +0200
+Subject: net/mlx5e: Don't print error message due to invalid module
+
+From: Gal Pressman <gal@nvidia.com>
+
+[ Upstream commit 144297e2a24e3e54aee1180ec21120ea38822b97 ]
+
+Dumping module EEPROM on newer modules is supported through the netlink
+interface only.
+
+Querying with old userspace ethtool (or other tools, such as 'lshw')
+which still uses the ioctl interface results in an error message that
+could flood dmesg (in addition to the expected error return value).
+The original message was added under the assumption that the driver
+should be able to handle all module types, but now that such flows are
+easily triggered from userspace, it doesn't serve its purpose.
+
+Change the log level of the print in mlx5_query_module_eeprom() to
+debug.
+
+Fixes: bb64143eee8c ("net/mlx5e: Add ethtool support for dump module EEPROM")
+Signed-off-by: Gal Pressman <gal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Link: https://patch.msgid.link/20251225132717.358820-5-mbloch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/port.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+index aa9f2b0a77d36..876e648c91ba8 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+@@ -430,7 +430,8 @@ int mlx5_query_module_eeprom(struct mlx5_core_dev *dev,
+ mlx5_qsfp_eeprom_params_set(&query.i2c_address, &query.page, &offset);
+ break;
+ default:
+- mlx5_core_err(dev, "Module ID not recognized: 0x%x\n", module_id);
++ mlx5_core_dbg(dev, "Module ID not recognized: 0x%x\n",
++ module_id);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From becc50932ab9947b506a7d5f55897f6df555d5eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Dec 2025 20:36:17 +0000
+Subject: net: mscc: ocelot: Fix crash when adding interface under a lag
+
+From: Jerry Wu <w.7erry@foxmail.com>
+
+[ Upstream commit 34f3ff52cb9fa7dbf04f5c734fcc4cb6ed5d1a95 ]
+
+Commit 15faa1f67ab4 ("lan966x: Fix crash when adding interface under a lag")
+fixed a similar issue in the lan966x driver caused by a NULL pointer dereference.
+The ocelot_set_aggr_pgids() function in the ocelot driver has similar logic
+and is susceptible to the same crash.
+
+This issue specifically affects the ocelot_vsc7514.c frontend, which leaves
+unused ports as NULL pointers. The felix_vsc9959.c frontend is unaffected as
+it uses the DSA framework which registers all ports.
+
+Fix this by checking if the port pointer is valid before accessing it.
+
+Fixes: 528d3f190c98 ("net: mscc: ocelot: drop the use of the "lags" array")
+Signed-off-by: Jerry Wu <w.7erry@foxmail.com>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/tencent_75EF812B305E26B0869C673DD1160866C90A@qq.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index 08bee56aea35f..c345d9b17c892 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -2307,14 +2307,16 @@ static void ocelot_set_aggr_pgids(struct ocelot *ocelot)
+
+ /* Now, set PGIDs for each active LAG */
+ for (lag = 0; lag < ocelot->num_phys_ports; lag++) {
+- struct net_device *bond = ocelot->ports[lag]->bond;
++ struct ocelot_port *ocelot_port = ocelot->ports[lag];
+ int num_active_ports = 0;
++ struct net_device *bond;
+ unsigned long bond_mask;
+ u8 aggr_idx[16];
+
+- if (!bond || (visited & BIT(lag)))
++ if (!ocelot_port || !ocelot_port->bond || (visited & BIT(lag)))
+ continue;
+
++ bond = ocelot_port->bond;
+ bond_mask = ocelot_get_bond_mask(ocelot, bond);
+
+ for_each_set_bit(port, &bond_mask, ocelot->num_phys_ports) {
+--
+2.51.0
+
--- /dev/null
+From 2c198731a405d469b4f0e27bc541216fb0a23259 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 00:17:32 +0900
+Subject: net: netdevsim: fix inconsistent carrier state after link/unlink
+
+From: Yohei Kojima <yk@y-koj.net>
+
+[ Upstream commit d83dddffe1904e4a576d11a541878850a8e64cd2 ]
+
+This patch fixes the edge case behavior on ifup/ifdown and
+linking/unlinking two netdevsim interfaces:
+
+1. unlink two interfaces netdevsim1 and netdevsim2
+2. ifdown netdevsim1
+3. ifup netdevsim1
+4. link two interfaces netdevsim1 and netdevsim2
+5. (Now two interfaces are linked in terms of netdevsim peer, but
+ carrier state of the two interfaces remains DOWN.)
+
+This inconsistent behavior is caused by the current implementation,
+which only cares about the "link, then ifup" order, not "ifup, then
+link" order. This patch fixes the inconsistency by calling
+netif_carrier_on() when two netdevsim interfaces are linked.
+
+This patch fixes buggy behavior on NetworkManager-based systems which
+causes the netdevsim test to fail with the following error:
+
+ # timeout set to 600
+ # selftests: drivers/net/netdevsim: peer.sh
+ # 2025/12/25 00:54:03 socat[9115] W address is opened in read-write mode but only supports read-only
+ # 2025/12/25 00:56:17 socat[9115] W connect(7, AF=2 192.168.1.1:1234, 16): Connection timed out
+ # 2025/12/25 00:56:17 socat[9115] E TCP:192.168.1.1:1234: Connection timed out
+ # expected 3 bytes, got 0
+ # 2025/12/25 00:56:17 socat[9109] W exiting on signal 15
+ not ok 13 selftests: drivers/net/netdevsim: peer.sh # exit=1
+
+This patch also solves timeout on TCP Fast Open (TFO) test in
+NetworkManager-based systems because it also depends on netdevsim's
+carrier consistency.
+
+Fixes: 1a8fed52f7be ("netdevsim: set the carrier when the device goes up")
+Signed-off-by: Yohei Kojima <yk@y-koj.net>
+Reviewed-by: Breno Leitao <leitao@debian.org>
+Link: https://patch.msgid.link/602c9e1ba5bb2ee1997bb38b1d866c9c3b807ae9.1767624906.git.yk@y-koj.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/netdevsim/bus.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/netdevsim/bus.c b/drivers/net/netdevsim/bus.c
+index 70e8c38ddad6b..d16b95304aa7e 100644
+--- a/drivers/net/netdevsim/bus.c
++++ b/drivers/net/netdevsim/bus.c
+@@ -332,6 +332,11 @@ static ssize_t link_device_store(const struct bus_type *bus, const char *buf, si
+ rcu_assign_pointer(nsim_a->peer, nsim_b);
+ rcu_assign_pointer(nsim_b->peer, nsim_a);
+
++ if (netif_running(dev_a) && netif_running(dev_b)) {
++ netif_carrier_on(dev_a);
++ netif_carrier_on(dev_b);
++ }
++
+ out_err:
+ put_net(ns_b);
+ put_net(ns_a);
+@@ -381,6 +386,9 @@ static ssize_t unlink_device_store(const struct bus_type *bus, const char *buf,
+ if (!peer)
+ goto out_put_netns;
+
++ netif_carrier_off(dev);
++ netif_carrier_off(peer->netdev);
++
+ err = 0;
+ RCU_INIT_POINTER(nsim->peer, NULL);
+ RCU_INIT_POINTER(peer->peer, NULL);
+--
+2.51.0
+
--- /dev/null
+From 9f433e570b007dcfa742ca584e100bd38c2bc674 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 13:09:39 +0100
+Subject: net: phy: mxl-86110: Add power management and soft reset support
+
+From: Stefano Radaelli <stefano.r@variscite.com>
+
+[ Upstream commit 62f7edd59964eb588e96fce1ad35a2327ea54424 ]
+
+Implement soft_reset, suspend, and resume callbacks using
+genphy_soft_reset(), genphy_suspend(), and genphy_resume()
+to fix PHY initialization and power management issues.
+
+The soft_reset callback is needed to properly recover the PHY after an
+ifconfig down/up cycle. Without it, the PHY can remain in power-down
+state, causing MDIO register access failures during config_init().
+The soft reset ensures the PHY is operational before configuration.
+
+The suspend/resume callbacks enable proper power management during
+system suspend/resume cycles.
+
+Fixes: b2908a989c59 ("net: phy: add driver for MaxLinear MxL86110 PHY")
+Signed-off-by: Stefano Radaelli <stefano.r@variscite.com>
+Link: https://patch.msgid.link/20251223120940.407195-1-stefano.r@variscite.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mxl-86110.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/phy/mxl-86110.c b/drivers/net/phy/mxl-86110.c
+index e5d137a37a1d4..42a5fe3f115f4 100644
+--- a/drivers/net/phy/mxl-86110.c
++++ b/drivers/net/phy/mxl-86110.c
+@@ -938,6 +938,9 @@ static struct phy_driver mxl_phy_drvs[] = {
+ PHY_ID_MATCH_EXACT(PHY_ID_MXL86110),
+ .name = "MXL86110 Gigabit Ethernet",
+ .config_init = mxl86110_config_init,
++ .suspend = genphy_suspend,
++ .resume = genphy_resume,
++ .soft_reset = genphy_soft_reset,
+ .get_wol = mxl86110_get_wol,
+ .set_wol = mxl86110_set_wol,
+ .led_brightness_set = mxl86110_led_brightness_set,
+--
+2.51.0
+
--- /dev/null
+From 3161594057fa6ec3ff2c804e08125db2762973df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 00:59:05 +0000
+Subject: net/sched: act_api: avoid dereferencing ERR_PTR in
+ tcf_idrinfo_destroy
+
+From: Shivani Gupta <shivani07g@gmail.com>
+
+[ Upstream commit adb25a46dc0a43173f5ea5f5f58fc8ba28970c7c ]
+
+syzbot reported a crash in tc_act_in_hw() during netns teardown where
+tcf_idrinfo_destroy() passed an ERR_PTR(-EBUSY) value as a tc_action
+pointer, leading to an invalid dereference.
+
+Guard against ERR_PTR entries when iterating the action IDR so teardown
+does not call tc_act_in_hw() on an error pointer.
+
+Fixes: 84a7d6797e6a ("net/sched: acp_api: no longer acquire RTNL in tc_action_net_exit()")
+Link: https://syzkaller.appspot.com/bug?extid=8f1c492ffa4644ff3826
+Reported-by: syzbot+8f1c492ffa4644ff3826@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=8f1c492ffa4644ff3826
+Signed-off-by: Shivani Gupta <shivani07g@gmail.com>
+Link: https://patch.msgid.link/20260105005905.243423-1-shivani07g@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_api.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/sched/act_api.c b/net/sched/act_api.c
+index ff6be5cfe2b05..e1ab0faeb8113 100644
+--- a/net/sched/act_api.c
++++ b/net/sched/act_api.c
+@@ -940,6 +940,8 @@ void tcf_idrinfo_destroy(const struct tc_action_ops *ops,
+ int ret;
+
+ idr_for_each_entry_ul(idr, p, tmp, id) {
++ if (IS_ERR(p))
++ continue;
+ if (tc_act_in_hw(p) && !mutex_taken) {
+ rtnl_lock();
+ mutex_taken = true;
+--
+2.51.0
+
--- /dev/null
+From 9be1ef85487ebf3e64f10a5025f2cf7f67039c1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 20:41:00 -0700
+Subject: net/sched: sch_qfq: Fix NULL deref when deactivating inactive
+ aggregate in qfq_reset
+
+From: Xiang Mei <xmei5@asu.edu>
+
+[ Upstream commit c1d73b1480235731e35c81df70b08f4714a7d095 ]
+
+`qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class
+itself is active.
+
+Two qfq_class objects may point to the same leaf_qdisc. This happens
+when:
+
+1. one QFQ qdisc is attached to the dev as the root qdisc, and
+
+2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()
+/ qdisc_put()) and is pending to be destroyed, as in function
+tc_new_tfilter.
+
+When packets are enqueued through the root QFQ qdisc, the shared
+leaf_qdisc->q.qlen increases. At the same time, the second QFQ
+qdisc triggers qdisc_put and qdisc_destroy: the qdisc enters
+qfq_reset() with its own q->q.qlen == 0, but its class's leaf
+qdisc->q.qlen > 0. Therefore, the qfq_reset would wrongly deactivate
+an inactive aggregate and trigger a null-deref in qfq_deactivate_agg:
+
+[ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[ 0.903571] #PF: supervisor write access in kernel mode
+[ 0.903860] #PF: error_code(0x0002) - not-present page
+[ 0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0
+[ 0.904502] Oops: Oops: 0002 [#1] SMP NOPTI
+[ 0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE
+[ 0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
+[ 0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))
+[ 0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0
+
+Code starting with the faulting instruction
+===========================================
+ 0: 0f 84 4d 01 00 00 je 0x153
+ 6: 48 89 70 18 mov %rsi,0x18(%rax)
+ a: 8b 4b 10 mov 0x10(%rbx),%ecx
+ d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx
+ 14: 48 8b 78 08 mov 0x8(%rax),%rdi
+ 18: 48 d3 e2 shl %cl,%rdx
+ 1b: 48 21 f2 and %rsi,%rdx
+ 1e: 48 2b 13 sub (%rbx),%rdx
+ 21: 48 8b 30 mov (%rax),%rsi
+ 24: 48 d3 ea shr %cl,%rdx
+ 27: 8b 4b 18 mov 0x18(%rbx),%ecx
+ ...
+[ 0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246
+[ 0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000
+[ 0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+[ 0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000
+[ 0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000
+[ 0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880
+[ 0.909179] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000
+[ 0.909572] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0
+[ 0.910247] PKRU: 55555554
+[ 0.910391] Call Trace:
+[ 0.910527] <TASK>
+[ 0.910638] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)
+[ 0.910826] qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)
+[ 0.911040] __qdisc_destroy (net/sched/sch_generic.c:1076)
+[ 0.911236] tc_new_tfilter (net/sched/cls_api.c:2447)
+[ 0.911447] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)
+[ 0.911663] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)
+[ 0.911894] netlink_rcv_skb (net/netlink/af_netlink.c:2550)
+[ 0.912100] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)
+[ 0.912296] ? __alloc_skb (net/core/skbuff.c:706)
+[ 0.912484] netlink_sendmsg (net/netlink/af_netlink.c:1894)
+[ 0.912682] sock_write_iter (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1) net/socket.c:1195 (discriminator 1))
+[ 0.912880] vfs_write (fs/read_write.c:593 fs/read_write.c:686)
+[ 0.913077] ksys_write (fs/read_write.c:738)
+[ 0.913252] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
+[ 0.913438] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)
+[ 0.913687] RIP: 0033:0x424c34
+[ 0.913844] Code: 89 02 48 c7 c0 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d 2d 44 09 00 00 74 13 b8 01 00 00 00 0f 05 9
+
+Code starting with the faulting instruction
+===========================================
+ 0: 89 02 mov %eax,(%rdx)
+ 2: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
+ 9: eb bd jmp 0xffffffffffffffc8
+ b: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
+ 12: 00 00 00
+ 15: 90 nop
+ 16: f3 0f 1e fa endbr64
+ 1a: 80 3d 2d 44 09 00 00 cmpb $0x0,0x9442d(%rip) # 0x9444e
+ 21: 74 13 je 0x36
+ 23: b8 01 00 00 00 mov $0x1,%eax
+ 28: 0f 05 syscall
+ 2a: 09 .byte 0x9
+[ 0.914807] RSP: 002b:00007ffea1938b78 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
+[ 0.915197] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000424c34
+[ 0.915556] RDX: 000000000000003c RSI: 000000002af378c0 RDI: 0000000000000003
+[ 0.915912] RBP: 00007ffea1938bc0 R08: 00000000004b8820 R09: 0000000000000000
+[ 0.916297] R10: 0000000000000001 R11: 0000000000000202 R12: 00007ffea1938d28
+[ 0.916652] R13: 00007ffea1938d38 R14: 00000000004b3828 R15: 0000000000000001
+[ 0.917039] </TASK>
+[ 0.917158] Modules linked in:
+[ 0.917316] CR2: 0000000000000000
+[ 0.917484] ---[ end trace 0000000000000000 ]---
+[ 0.917717] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))
+[ 0.917978] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0
+
+Code starting with the faulting instruction
+===========================================
+ 0: 0f 84 4d 01 00 00 je 0x153
+ 6: 48 89 70 18 mov %rsi,0x18(%rax)
+ a: 8b 4b 10 mov 0x10(%rbx),%ecx
+ d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx
+ 14: 48 8b 78 08 mov 0x8(%rax),%rdi
+ 18: 48 d3 e2 shl %cl,%rdx
+ 1b: 48 21 f2 and %rsi,%rdx
+ 1e: 48 2b 13 sub (%rbx),%rdx
+ 21: 48 8b 30 mov (%rax),%rsi
+ 24: 48 d3 ea shr %cl,%rdx
+ 27: 8b 4b 18 mov 0x18(%rbx),%ecx
+ ...
+[ 0.918902] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246
+[ 0.919198] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000
+[ 0.919559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+[ 0.919908] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000
+[ 0.920289] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000
+[ 0.920648] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880
+[ 0.921014] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000
+[ 0.921424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 0.921710] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0
+[ 0.922097] PKRU: 55555554
+[ 0.922240] Kernel panic - not syncing: Fatal exception
+[ 0.922590] Kernel Offset: disabled
+
+Fixes: 0545a3037773 ("pkt_sched: QFQ - quick fair queue scheduler")
+Signed-off-by: Xiang Mei <xmei5@asu.edu>
+Link: https://patch.msgid.link/20260106034100.1780779-1-xmei5@asu.edu
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_qfq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index 2255355e51d35..a91a5bac8f737 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -1481,7 +1481,7 @@ static void qfq_reset_qdisc(struct Qdisc *sch)
+
+ for (i = 0; i < q->clhash.hashsize; i++) {
+ hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
+- if (cl->qdisc->q.qlen > 0)
++ if (cl_is_active(cl))
+ qfq_deactivate_class(q, cl);
+
+ qdisc_reset(cl->qdisc);
+--
+2.51.0
+
--- /dev/null
+From e38383e18648565cf933a6b02a14b3c8f7f525a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 16:18:39 +0100
+Subject: net: sfp: return the number of written bytes for smbus single byte
+ access
+
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+
+[ Upstream commit 13ff3e724207f579d3c814ee05516fefcb4f32e8 ]
+
+We expect the SFP write accessors to return the number of written bytes.
+We fail to do so for single-byte smbus accesses, which may cause errors
+when setting a module's high-power state and for some cotsworks modules.
+
+Let's return the amount of written bytes, as expected.
+
+Fixes: 7662abf4db94 ("net: phy: sfp: Add support for SMBus module access")
+Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20260105151840.144552-1-maxime.chevallier@bootlin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/sfp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 0401fa6b24d25..6b4dd906b804f 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -763,7 +763,7 @@ static int sfp_smbus_byte_write(struct sfp *sfp, bool a2, u8 dev_addr,
+ dev_addr++;
+ }
+
+- return 0;
++ return data - (u8 *)buf;
+ }
+
+ static int sfp_i2c_configure(struct sfp *sfp, struct i2c_adapter *i2c)
+--
+2.51.0
+
--- /dev/null
+From 33e41f658c05d39a75cf7cfb6c36e0020715d6cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 04:35:35 +0800
+Subject: net: sock: fix hardened usercopy panic in sock_recv_errqueue
+
+From: Weiming Shi <bestswngs@gmail.com>
+
+[ Upstream commit 2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20 ]
+
+skbuff_fclone_cache was created without defining a usercopy region,
+[1] unlike skbuff_head_cache which properly whitelists the cb[] field.
+[2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is
+enabled and the kernel attempts to copy sk_buff.cb data to userspace
+via sock_recv_errqueue() -> put_cmsg().
+
+The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone()
+ (from skbuff_fclone_cache) [1]
+2. The skb is cloned via skb_clone() using the pre-allocated fclone
+[3] 3. The cloned skb is queued to sk_error_queue for timestamp
+reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE)
+5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb
+[4] 6. __check_heap_object() fails because skbuff_fclone_cache has no
+ usercopy whitelist [5]
+
+When cloned skbs allocated from skbuff_fclone_cache are used in the
+socket error queue, accessing the sock_exterr_skb structure in skb->cb
+via put_cmsg() triggers a usercopy hardening violation:
+
+[ 5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' (offset 296, size 16)!
+[ 5.382796] kernel BUG at mm/usercopy.c:102!
+[ 5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
+[ 5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7
+[ 5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
+[ 5.384903] RIP: 0010:usercopy_abort+0x6c/0x80
+[ 5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff <0f> 0b 490
+[ 5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246
+[ 5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74
+[ 5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0
+[ 5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74
+[ 5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001
+[ 5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00
+[ 5.384903] FS: 0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000
+[ 5.384903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0
+[ 5.384903] PKRU: 55555554
+[ 5.384903] Call Trace:
+[ 5.384903] <TASK>
+[ 5.384903] __check_heap_object+0x9a/0xd0
+[ 5.384903] __check_object_size+0x46c/0x690
+[ 5.384903] put_cmsg+0x129/0x5e0
+[ 5.384903] sock_recv_errqueue+0x22f/0x380
+[ 5.384903] tls_sw_recvmsg+0x7ed/0x1960
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5.384903] ? schedule+0x6d/0x270
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5.384903] ? mutex_unlock+0x81/0xd0
+[ 5.384903] ? __pfx_mutex_unlock+0x10/0x10
+[ 5.384903] ? __pfx_tls_sw_recvmsg+0x10/0x10
+[ 5.384903] ? _raw_spin_lock_irqsave+0x8f/0xf0
+[ 5.384903] ? _raw_read_unlock_irqrestore+0x20/0x40
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+
+The crash offset 296 corresponds to skb2->cb within skbuff_fclones:
+ - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 -
+ offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 =
+ 272 + 24 (inside sock_exterr_skb.ee)
+
+This patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure.
+
+[1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885
+[2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104
+[3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566
+[4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491
+[5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719
+
+Fixes: 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0")
+Reported-by: Xiang Mei <xmei5@asu.edu>
+Signed-off-by: Weiming Shi <bestswngs@gmail.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20251223203534.1392218-2-bestswngs@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index dc03d4b5909a2..5a38837a58384 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3836,7 +3836,7 @@ void sock_enable_timestamp(struct sock *sk, enum sock_flags flag)
+ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+ int level, int type)
+ {
+- struct sock_exterr_skb *serr;
++ struct sock_extended_err ee;
+ struct sk_buff *skb;
+ int copied, err;
+
+@@ -3856,8 +3856,9 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+
+ sock_recv_timestamp(msg, sk, skb);
+
+- serr = SKB_EXT_ERR(skb);
+- put_cmsg(msg, level, type, sizeof(serr->ee), &serr->ee);
++ /* We must use a bounce buffer for CONFIG_HARDENED_USERCOPY=y */
++ ee = SKB_EXT_ERR(skb)->ee;
++ put_cmsg(msg, level, type, sizeof(ee), &ee);
+
+ msg->msg_flags |= MSG_ERRQUEUE;
+ err = copied;
+--
+2.51.0
+
--- /dev/null
+From 9315635e14bef5fbe8bd1fa608273a6e600de992 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 10:48:21 +0200
+Subject: net: usb: pegasus: fix memory leak in update_eth_regs_async()
+
+From: Petko Manolov <petkan@nucleusys.com>
+
+[ Upstream commit afa27621a28af317523e0836dad430bec551eb54 ]
+
+When asynchronously writing to the device registers and if usb_submit_urb()
+fail, the code fail to release allocated to this point resources.
+
+Fixes: 323b34963d11 ("drivers: net: usb: pegasus: fix control urb submission")
+Signed-off-by: Petko Manolov <petkan@nucleusys.com>
+Link: https://patch.msgid.link/20260106084821.3746677-1-petko.manolov@konsulko.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/pegasus.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
+index 81ca64debc5b9..c514483134f05 100644
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -168,6 +168,8 @@ static int update_eth_regs_async(pegasus_t *pegasus)
+ netif_device_detach(pegasus->net);
+ netif_err(pegasus, drv, pegasus->net,
+ "%s returned %d\n", __func__, ret);
++ usb_free_urb(async_urb);
++ kfree(req);
+ }
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 872ae6307f8fa6832bbf466af4185088df1276d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Dec 2025 07:18:53 +0000
+Subject: net: wwan: iosm: Fix memory leak in ipc_mux_deinit()
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit 92e6e0a87f6860a4710f9494f8c704d498ae60f8 ]
+
+Commit 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support")
+allocated memory for pp_qlt in ipc_mux_init() but did not free it in
+ipc_mux_deinit(). This results in a memory leak when the driver is
+unloaded.
+
+Free the allocated memory in ipc_mux_deinit() to fix the leak.
+
+Fixes: 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support")
+Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
+Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Link: https://patch.msgid.link/20251230071853.1062223-1-zilin@seu.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wwan/iosm/iosm_ipc_mux.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wwan/iosm/iosm_ipc_mux.c b/drivers/net/wwan/iosm/iosm_ipc_mux.c
+index fc928b298a984..b846889fcb099 100644
+--- a/drivers/net/wwan/iosm/iosm_ipc_mux.c
++++ b/drivers/net/wwan/iosm/iosm_ipc_mux.c
+@@ -456,6 +456,7 @@ void ipc_mux_deinit(struct iosm_mux *ipc_mux)
+ struct sk_buff_head *free_list;
+ union mux_msg mux_msg;
+ struct sk_buff *skb;
++ int i;
+
+ if (!ipc_mux->initialized)
+ return;
+@@ -479,5 +480,10 @@ void ipc_mux_deinit(struct iosm_mux *ipc_mux)
+ ipc_mux->channel->dl_pipe.is_open = false;
+ }
+
++ if (ipc_mux->protocol != MUX_LITE) {
++ for (i = 0; i < IPC_MEM_MUX_IP_SESSION_ENTRIES; i++)
++ kfree(ipc_mux->ul_adb.pp_qlt[i]);
++ }
++
+ kfree(ipc_mux);
+ }
+--
+2.51.0
+
--- /dev/null
+From 6cf7042e70f5d0a24c17fd44afe49e492faa6e39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 09:22:24 +0800
+Subject: netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
+
+From: Di Zhu <zhud@hygon.cn>
+
+[ Upstream commit 02d1e1a3f9239cdb3ecf2c6d365fb959d1bf39df ]
+
+Directly increment the TSO features incurs a side effect: it will also
+directly clear the flags in NETIF_F_ALL_FOR_ALL on the master device,
+which can cause issues such as the inability to enable the nocache copy
+feature on the bonding driver.
+
+The fix is to include NETIF_F_ALL_FOR_ALL in the update mask, thereby
+preventing it from being cleared.
+
+Fixes: b0ce3508b25e ("bonding: allow TSO being set on bonding master")
+Signed-off-by: Di Zhu <zhud@hygon.cn>
+Link: https://patch.msgid.link/20251224012224.56185-1-zhud@hygon.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netdevice.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 77c46a2823eca..c6c04cd0a6816 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -5299,7 +5299,8 @@ netdev_features_t netdev_increment_features(netdev_features_t all,
+ static inline netdev_features_t netdev_add_tso_features(netdev_features_t features,
+ netdev_features_t mask)
+ {
+- return netdev_increment_features(features, NETIF_F_ALL_TSO, mask);
++ return netdev_increment_features(features, NETIF_F_ALL_TSO |
++ NETIF_F_ALL_FOR_ALL, mask);
+ }
+
+ int __netdev_update_features(struct net_device *dev);
+--
+2.51.0
+
--- /dev/null
+From 4fe8e22facd5ca51818904d0a328a657c65d0866 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 15:46:40 +0100
+Subject: netfilter: nf_conncount: update last_gc only when GC has been
+ performed
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 7811ba452402d58628e68faedf38745b3d485e3c ]
+
+Currently last_gc is being updated everytime a new connection is
+tracked, that means that it is updated even if a GC wasn't performed.
+With a sufficiently high packet rate, it is possible to always bypass
+the GC, causing the list to grow infinitely.
+
+Update the last_gc value only when a GC has been actually performed.
+
+Fixes: d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conncount.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
+index 3c1b155f7a0ea..828d5c64c68a3 100644
+--- a/net/netfilter/nf_conncount.c
++++ b/net/netfilter/nf_conncount.c
+@@ -229,6 +229,7 @@ static int __nf_conncount_add(struct net *net,
+
+ nf_ct_put(found_ct);
+ }
++ list->last_gc = (u32)jiffies;
+
+ add_new_node:
+ if (WARN_ON_ONCE(list->count > INT_MAX)) {
+@@ -248,7 +249,6 @@ static int __nf_conncount_add(struct net *net,
+ conn->jiffies32 = (u32)jiffies;
+ list_add_tail(&conn->node, &list->head);
+ list->count++;
+- list->last_gc = (u32)jiffies;
+
+ out_put:
+ if (refcounted)
+--
+2.51.0
+
--- /dev/null
+From 052b23c13f730a9535855e82aae66dd71858f378 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 12:48:26 +0000
+Subject: netfilter: nf_tables: fix memory leak in nf_tables_newrule()
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit d077e8119ddbb4fca67540f1a52453631a47f221 ]
+
+In nf_tables_newrule(), if nft_use_inc() fails, the function jumps to
+the err_release_rule label without freeing the allocated flow, leading
+to a memory leak.
+
+Fix this by adding a new label err_destroy_flow and jumping to it when
+nft_use_inc() fails. This ensures that the flow is properly released
+in this error case.
+
+Fixes: 1689f25924ada ("netfilter: nf_tables: report use refcount overflow")
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 1a204f6371ad1..a3669acd68a32 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4378,7 +4378,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
+
+ if (!nft_use_inc(&chain->use)) {
+ err = -EMFILE;
+- goto err_release_rule;
++ goto err_destroy_flow;
+ }
+
+ if (info->nlh->nlmsg_flags & NLM_F_REPLACE) {
+@@ -4428,6 +4428,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
+
+ err_destroy_flow_rule:
+ nft_use_dec_restore(&chain->use);
++err_destroy_flow:
+ if (flow)
+ nft_flow_rule_destroy(flow);
+ err_release_rule:
+--
+2.51.0
+
--- /dev/null
+From 5d3f20e25bc4b95c90107e979126a0689abc7179 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 12:20:35 +0100
+Subject: netfilter: nft_set_pipapo: fix range overlap detection
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 7711f4bb4b360d9c0ff84db1c0ec91e385625047 ]
+
+set->klen has to be used, not sizeof(). The latter only compares a
+single register but a full check of the entire key is needed.
+
+Example:
+table ip t {
+ map s {
+ typeof iifname . ip saddr : verdict
+ flags interval
+ }
+}
+
+nft add element t s '{ "lo" . 10.0.0.0/24 : drop }' # no error, expected
+nft add element t s '{ "lo" . 10.0.0.0/24 : drop }' # no error, expected
+nft add element t s '{ "lo" . 10.0.0.0/8 : drop }' # bug: no error
+
+The 3rd 'add element' should be rejected via -ENOTEMPTY, not -EEXIST,
+so userspace / nft can report an error to the user.
+
+The latter is only correct for the 2nd case (re-add of existing element).
+
+As-is, userspace is told that the command was successful, but no elements were
+added.
+
+After this patch, 3rd command gives:
+Error: Could not process rule: File exists
+add element t s { "lo" . 127.0.0.0/8 . "lo" : drop }
+ ^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Fixes: 0eb4b5ee33f2 ("netfilter: nft_set_pipapo: Separate partial and complete overlap cases on insertion")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_set_pipapo.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
+index 112fe46788b6f..6d77a5f0088ad 100644
+--- a/net/netfilter/nft_set_pipapo.c
++++ b/net/netfilter/nft_set_pipapo.c
+@@ -1317,8 +1317,8 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,
+ else
+ dup_end = dup_key;
+
+- if (!memcmp(start, dup_key->data, sizeof(*dup_key->data)) &&
+- !memcmp(end, dup_end->data, sizeof(*dup_end->data))) {
++ if (!memcmp(start, dup_key->data, set->klen) &&
++ !memcmp(end, dup_end->data, set->klen)) {
+ *elem_priv = &dup->priv;
+ return -EEXIST;
+ }
+--
+2.51.0
+
--- /dev/null
+From 3b8f1179a0714cede677bc3c9875ffe55b2059ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 21:21:59 +0100
+Subject: netfilter: nft_synproxy: avoid possible data-race on update operation
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 36a3200575642846a96436d503d46544533bb943 ]
+
+During nft_synproxy eval we are reading nf_synproxy_info struct which
+can be modified on update operation concurrently. As nf_synproxy_info
+struct fits in 32 bits, use READ_ONCE/WRITE_ONCE annotations.
+
+Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_synproxy.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
+index 5d3e518259859..4d3e5a31b4125 100644
+--- a/net/netfilter/nft_synproxy.c
++++ b/net/netfilter/nft_synproxy.c
+@@ -48,7 +48,7 @@ static void nft_synproxy_eval_v4(const struct nft_synproxy *priv,
+ struct tcphdr *_tcph,
+ struct synproxy_options *opts)
+ {
+- struct nf_synproxy_info info = priv->info;
++ struct nf_synproxy_info info = READ_ONCE(priv->info);
+ struct net *net = nft_net(pkt);
+ struct synproxy_net *snet = synproxy_pernet(net);
+ struct sk_buff *skb = pkt->skb;
+@@ -79,7 +79,7 @@ static void nft_synproxy_eval_v6(const struct nft_synproxy *priv,
+ struct tcphdr *_tcph,
+ struct synproxy_options *opts)
+ {
+- struct nf_synproxy_info info = priv->info;
++ struct nf_synproxy_info info = READ_ONCE(priv->info);
+ struct net *net = nft_net(pkt);
+ struct synproxy_net *snet = synproxy_pernet(net);
+ struct sk_buff *skb = pkt->skb;
+@@ -340,7 +340,7 @@ static void nft_synproxy_obj_update(struct nft_object *obj,
+ struct nft_synproxy *newpriv = nft_obj_data(newobj);
+ struct nft_synproxy *priv = nft_obj_data(obj);
+
+- priv->info = newpriv->info;
++ WRITE_ONCE(priv->info, newpriv->info);
+ }
+
+ static struct nft_object_type nft_synproxy_obj_type;
+--
+2.51.0
+
--- /dev/null
+From 08f97bc7f4105fb660f7a6b8ec9580350f86e6a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 12:31:40 +0000
+Subject: netfs: Fix early read unlock of page with EOF in middle
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 570ad253a3455a520f03c2136af8714bc780186d ]
+
+The read result collection for buffered reads seems to run ahead of the
+completion of subrequests under some circumstances, as can be seen in the
+following log snippet:
+
+ 9p_client_res: client 18446612686390831168 response P9_TREAD tag 0 err 0
+ ...
+ netfs_sreq: R=00001b55[1] DOWN TERM f=192 s=0 5fb2/5fb2 s=5 e=0
+ ...
+ netfs_collect_folio: R=00001b55 ix=00004 r=4000-5000 t=4000/5fb2
+ netfs_folio: i=157f3 ix=00004-00004 read-done
+ netfs_folio: i=157f3 ix=00004-00004 read-unlock
+ netfs_collect_folio: R=00001b55 ix=00005 r=5000-5fb2 t=5000/5fb2
+ netfs_folio: i=157f3 ix=00005-00005 read-done
+ netfs_folio: i=157f3 ix=00005-00005 read-unlock
+ ...
+ netfs_collect_stream: R=00001b55[0:] cto=5fb2 frn=ffffffff
+ netfs_collect_state: R=00001b55 col=5fb2 cln=6000 n=c
+ netfs_collect_stream: R=00001b55[0:] cto=5fb2 frn=ffffffff
+ netfs_collect_state: R=00001b55 col=5fb2 cln=6000 n=8
+ ...
+ netfs_sreq: R=00001b55[2] ZERO SUBMT f=000 s=5fb2 0/4e s=0 e=0
+ netfs_sreq: R=00001b55[2] ZERO TERM f=102 s=5fb2 4e/4e s=5 e=0
+
+The 'cto=5fb2' indicates the collected file pos we've collected results to
+so far - but we still have 0x4e more bytes to go - so we shouldn't have
+collected folio ix=00005 yet. The 'ZERO' subreq that clears the tail
+happens after we unlock the folio, allowing the application to see the
+uncleared tail through mmap.
+
+The problem is that netfs_read_unlock_folios() will unlock a folio in which
+the amount of read results collected hits EOF position - but the ZERO
+subreq lies beyond that and so happens after.
+
+Fix this by changing the end check to always be the end of the folio and
+never the end of the file.
+
+In the future, I should look at clearing to the end of the folio here rather
+than adding a ZERO subreq to do this. On the other hand, the ZERO subreq can
+run in parallel with an async READ subreq. Further, the ZERO subreq may still
+be necessary to, say, handle extents in a ceph file that don't have any
+backing store and are thus implicitly all zeros.
+
+This can be reproduced by creating a file, the size of which doesn't align
+to a page boundary, e.g. 24998 (0x5fb2) bytes and then doing something
+like:
+
+ xfs_io -c "mmap -r 0 0x6000" -c "madvise -d 0 0x6000" \
+ -c "mread -v 0 0x6000" /xfstest.test/x
+
+The last 0x4e bytes should all be 00, but if the tail hasn't been cleared
+yet, you may see rubbish there. This can be reproduced with kafs by
+modifying the kernel to disable the call to netfs_read_subreq_progress()
+and to stop afs_issue_read() from doing the async call for NETFS_READAHEAD.
+Reproduction can be made easier by inserting an mdelay(100) in
+netfs_issue_read() for the ZERO-subreq case.
+
+AFS and CIFS are normally unlikely to show this as they dispatch READ ops
+asynchronously, which allows the ZERO-subreq to finish first. 9P's READ op is
+completely synchronous, so the ZERO-subreq will always happen after. It isn't
+seen all the time, though, because the collection may be done in a worker
+thread.
+
+Reported-by: Christian Schoenebeck <linux_oss@crudebyte.com>
+Link: https://lore.kernel.org/r/8622834.T7Z3S40VBb@weasel/
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://patch.msgid.link/938162.1766233900@warthog.procyon.org.uk
+Fixes: e2d46f2ec332 ("netfs: Change the read result collector to only use one work item")
+Tested-by: Christian Schoenebeck <linux_oss@crudebyte.com>
+Acked-by: Dominique Martinet <asmadeus@codewreck.org>
+Suggested-by: Dominique Martinet <asmadeus@codewreck.org>
+cc: Dominique Martinet <asmadeus@codewreck.org>
+cc: Christian Schoenebeck <linux_oss@crudebyte.com>
+cc: v9fs@lists.linux.dev
+cc: netfs@lists.linux.dev
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/netfs/read_collect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/netfs/read_collect.c b/fs/netfs/read_collect.c
+index a95e7aadafd07..7a0ffa675fb17 100644
+--- a/fs/netfs/read_collect.c
++++ b/fs/netfs/read_collect.c
+@@ -137,7 +137,7 @@ static void netfs_read_unlock_folios(struct netfs_io_request *rreq,
+ rreq->front_folio_order = order;
+ fsize = PAGE_SIZE << order;
+ fpos = folio_pos(folio);
+- fend = umin(fpos + fsize, rreq->i_size);
++ fend = fpos + fsize;
+
+ trace_netfs_collect_folio(rreq, folio, fend, collected_to);
+
+--
+2.51.0
+
--- /dev/null
+From 3625bb833d38bde1145dd4acc37a643fd170f1d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 22:46:38 -0600
+Subject: PCI/VGA: Don't assume the only VGA device on a system is `boot_vga`
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit fd390ff144513eb0310c350b1cf5fa8d6ddd0c53 ]
+
+Some systems ship with multiple display class devices but not all
+of them are VGA devices. If the "only" VGA device on the system is not
+used for displaying the image on the screen marking it as `boot_vga`
+because nothing was found is totally wrong.
+
+This behavior actually leads to mistakes of the wrong device being
+advertised to userspace and then userspace can make incorrect decisions.
+
+As there is an accurate `boot_display` sysfs file stop lying about
+`boot_vga` by assuming if nothing is found it's the right device.
+
+Reported-by: Aaron Erhardt <aer@tuxedocomputers.com>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220712
+Tested-by: Aaron Erhardt <aer@tuxedocomputers.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: ad90860bd10ee ("fbcon: Use screen info to find primary device")
+Tested-by: Luke D. Jones <luke@ljones.dev>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patch.msgid.link/20260106044638.52906-1-superm1@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/vgaarb.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/drivers/pci/vgaarb.c b/drivers/pci/vgaarb.c
+index 436fa7f4c3873..baa242b140993 100644
+--- a/drivers/pci/vgaarb.c
++++ b/drivers/pci/vgaarb.c
+@@ -652,13 +652,6 @@ static bool vga_is_boot_device(struct vga_device *vgadev)
+ return true;
+ }
+
+- /*
+- * Vgadev has neither IO nor MEM enabled. If we haven't found any
+- * other VGA devices, it is the best candidate so far.
+- */
+- if (!boot_vga)
+- return true;
+-
+ return false;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 6aa5d3195bfc83fac2aad710eb45c793c3c7b6de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Dec 2025 14:14:41 +0100
+Subject: perf: Ensure swevent hrtimer is properly destroyed
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit ff5860f5088e9076ebcccf05a6ca709d5935cfa9 ]
+
+With the change to hrtimer_try_to_cancel() in
+perf_swevent_cancel_hrtimer() it appears possible for the hrtimer to
+still be active by the time the event gets freed.
+
+Make sure the event does a full hrtimer_cancel() on the free path by
+installing a perf_event::destroy handler.
+
+Fixes: eb3182ef0405 ("perf/core: Fix system hang caused by cpu-clock usage")
+Reported-by: CyberUnicorns <a101e_iotvul@163.com>
+Tested-by: CyberUnicorns <a101e_iotvul@163.com>
+Debugged-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 413b88a4e00fb..d95f9dce018f4 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -11835,6 +11835,11 @@ static void perf_swevent_cancel_hrtimer(struct perf_event *event)
+ }
+ }
+
++static void perf_swevent_destroy_hrtimer(struct perf_event *event)
++{
++ hrtimer_cancel(&event->hw.hrtimer);
++}
++
+ static void perf_swevent_init_hrtimer(struct perf_event *event)
+ {
+ struct hw_perf_event *hwc = &event->hw;
+@@ -11843,6 +11848,7 @@ static void perf_swevent_init_hrtimer(struct perf_event *event)
+ return;
+
+ hrtimer_setup(&hwc->hrtimer, perf_swevent_hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD);
++ event->destroy = perf_swevent_destroy_hrtimer;
+
+ /*
+ * Since hrtimers have a fixed rate, we can do a static freq->period
+--
+2.51.0
+
--- /dev/null
+From 626fe4931bc7f951bba2a97e27d228de7270bc37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 12:32:42 +0100
+Subject: pinctrl: mediatek: mt8189: restore previous register base name array
+ order
+
+From: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
+
+[ Upstream commit fa917d3d570279dc3d699cbd947d0da0fde2e402 ]
+
+In mt8189-pinctrl driver, a previous commit changed the register base
+name array (mt8189_pinctrl_register_base_names) entry name and order to
+align it with the same name and order as the "mediatek,mt8189-pinctrl"
+devicetree bindings. The new order (by ascending register address) now
+causes an issue with MT8189 pinctrl configuration.
+
+MT8189 SoC has multiple base addresses for the pin configuration
+registers. Several constant data structures, declaring each pin
+configuration, are using PIN_FIELD_BASE() macro which i_base parameter
+indicates for a given pin the lookup index in the base register address
+array of the driver internal data for the configuration register
+read/write accesses. But in practice, this parameter is given a
+hardcoded numerical value that corresponds to the expected base
+register entry index in mt8189_pinctrl_register_base_names array.
+Since this array reordering, the i_base index matching is no more
+correct.
+
+So, in order to avoid modifying over a thousand of PIN_FIELD_BASE()
+calls, restore previous mt8189_pinctrl_register_base_names entry order.
+
+Fixes: 518919276c41 ("pinctrl: mediatek: mt8189: align register base names to dt-bindings ones")
+Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
+Signed-off-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-mt8189.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-mt8189.c b/drivers/pinctrl/mediatek/pinctrl-mt8189.c
+index f6a3e584588b0..cd4cdff309a12 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-mt8189.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt8189.c
+@@ -1642,7 +1642,7 @@ static const struct mtk_pin_reg_calc mt8189_reg_cals[PINCTRL_PIN_REG_MAX] = {
+ };
+
+ static const char * const mt8189_pinctrl_register_base_names[] = {
+- "base", "lm", "rb0", "rb1", "bm0", "bm1", "bm2", "lt0", "lt1", "rt",
++ "base", "bm0", "bm1", "bm2", "lm", "lt0", "lt1", "rb0", "rb1", "rt",
+ };
+
+ static const struct mtk_eint_hw mt8189_eint_hw = {
+--
+2.51.0
+
--- /dev/null
+From a6b8ccc4894a67c65ef37717e2b1868e66032615 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jan 2026 11:39:52 +0200
+Subject: Revert "dsa: mv88e6xxx: make serdes SGMII/Fiber tx amplitude
+ configurable"
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 7801edc9badd972cb62cf11c0427e70b6dca239d ]
+
+This reverts commit 926eae604403acfa27ba5b072af458e87e634a50, which
+never could have produced the intended effect:
+https://lore.kernel.org/netdev/AM0PR06MB10396BBF8B568D77556FC46F8F7DEA@AM0PR06MB10396.eurprd06.prod.outlook.com/
+
+The reason why it is broken beyond repair in this form is that the
+mv88e6xxx driver outsources its "tx-p2p-microvolt" property to the OF
+node of an external Ethernet PHY. This:
+(a) does not work if there is no external PHY (chip-to-chip connection,
+ or SFP module)
+(b) pollutes the OF property namespace / bindings of said external PHY
+ ("tx-p2p-microvolt" could have meaning for the Ethernet PHY's SerDes
+ interface as well)
+
+We can revisit the idea of making SerDes amplitude configurable once we
+have proper bindings for the mv88e6xxx SerDes. Until then, remove the
+code that leaves us with unnecessary baggage.
+
+Fixes: 926eae604403 ("dsa: mv88e6xxx: make serdes SGMII/Fiber tx amplitude configurable")
+Cc: Holger Brunck <holger.brunck@hitachienergy.com>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20260104093952.486606-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 23 ---------------
+ drivers/net/dsa/mv88e6xxx/chip.h | 4 ---
+ drivers/net/dsa/mv88e6xxx/serdes.c | 46 ------------------------------
+ drivers/net/dsa/mv88e6xxx/serdes.h | 5 ----
+ 4 files changed, 78 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index b4d48997bf467..09002c853b78e 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -3364,13 +3364,10 @@ static int mv88e6xxx_setup_upstream_port(struct mv88e6xxx_chip *chip, int port)
+
+ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+ {
+- struct device_node *phy_handle = NULL;
+ struct fwnode_handle *ports_fwnode;
+ struct fwnode_handle *port_fwnode;
+ struct dsa_switch *ds = chip->ds;
+ struct mv88e6xxx_port *p;
+- struct dsa_port *dp;
+- int tx_amp;
+ int err;
+ u16 reg;
+ u32 val;
+@@ -3582,23 +3579,6 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
+ return err;
+ }
+
+- if (chip->info->ops->serdes_set_tx_amplitude) {
+- dp = dsa_to_port(ds, port);
+- if (dp)
+- phy_handle = of_parse_phandle(dp->dn, "phy-handle", 0);
+-
+- if (phy_handle && !of_property_read_u32(phy_handle,
+- "tx-p2p-microvolt",
+- &tx_amp))
+- err = chip->info->ops->serdes_set_tx_amplitude(chip,
+- port, tx_amp);
+- if (phy_handle) {
+- of_node_put(phy_handle);
+- if (err)
+- return err;
+- }
+- }
+-
+ /* Port based VLAN map: give each port the same default address
+ * database, and allow bidirectional communication between the
+ * CPU and DSA port(s), and the other ports.
+@@ -4768,7 +4748,6 @@ static const struct mv88e6xxx_ops mv88e6176_ops = {
+ .serdes_irq_mapping = mv88e6352_serdes_irq_mapping,
+ .serdes_get_regs_len = mv88e6352_serdes_get_regs_len,
+ .serdes_get_regs = mv88e6352_serdes_get_regs,
+- .serdes_set_tx_amplitude = mv88e6352_serdes_set_tx_amplitude,
+ .gpio_ops = &mv88e6352_gpio_ops,
+ .phylink_get_caps = mv88e6352_phylink_get_caps,
+ .pcs_ops = &mv88e6352_pcs_ops,
+@@ -5044,7 +5023,6 @@ static const struct mv88e6xxx_ops mv88e6240_ops = {
+ .serdes_irq_mapping = mv88e6352_serdes_irq_mapping,
+ .serdes_get_regs_len = mv88e6352_serdes_get_regs_len,
+ .serdes_get_regs = mv88e6352_serdes_get_regs,
+- .serdes_set_tx_amplitude = mv88e6352_serdes_set_tx_amplitude,
+ .gpio_ops = &mv88e6352_gpio_ops,
+ .avb_ops = &mv88e6352_avb_ops,
+ .ptp_ops = &mv88e6352_ptp_ops,
+@@ -5481,7 +5459,6 @@ static const struct mv88e6xxx_ops mv88e6352_ops = {
+ .serdes_get_stats = mv88e6352_serdes_get_stats,
+ .serdes_get_regs_len = mv88e6352_serdes_get_regs_len,
+ .serdes_get_regs = mv88e6352_serdes_get_regs,
+- .serdes_set_tx_amplitude = mv88e6352_serdes_set_tx_amplitude,
+ .phylink_get_caps = mv88e6352_phylink_get_caps,
+ .pcs_ops = &mv88e6352_pcs_ops,
+ };
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h
+index 2f211e55cb47b..e073446ee7d02 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.h
++++ b/drivers/net/dsa/mv88e6xxx/chip.h
+@@ -642,10 +642,6 @@ struct mv88e6xxx_ops {
+ void (*serdes_get_regs)(struct mv88e6xxx_chip *chip, int port,
+ void *_p);
+
+- /* SERDES SGMII/Fiber Output Amplitude */
+- int (*serdes_set_tx_amplitude)(struct mv88e6xxx_chip *chip, int port,
+- int val);
+-
+ /* Address Translation Unit operations */
+ int (*atu_get_hash)(struct mv88e6xxx_chip *chip, u8 *hash);
+ int (*atu_set_hash)(struct mv88e6xxx_chip *chip, u8 hash);
+diff --git a/drivers/net/dsa/mv88e6xxx/serdes.c b/drivers/net/dsa/mv88e6xxx/serdes.c
+index b3330211edbca..a936ee80ce006 100644
+--- a/drivers/net/dsa/mv88e6xxx/serdes.c
++++ b/drivers/net/dsa/mv88e6xxx/serdes.c
+@@ -25,14 +25,6 @@ static int mv88e6352_serdes_read(struct mv88e6xxx_chip *chip, int reg,
+ reg, val);
+ }
+
+-static int mv88e6352_serdes_write(struct mv88e6xxx_chip *chip, int reg,
+- u16 val)
+-{
+- return mv88e6xxx_phy_page_write(chip, MV88E6352_ADDR_SERDES,
+- MV88E6352_SERDES_PAGE_FIBER,
+- reg, val);
+-}
+-
+ static int mv88e6390_serdes_read(struct mv88e6xxx_chip *chip,
+ int lane, int device, int reg, u16 *val)
+ {
+@@ -506,41 +498,3 @@ void mv88e6390_serdes_get_regs(struct mv88e6xxx_chip *chip, int port, void *_p)
+ p[i] = reg;
+ }
+ }
+-
+-static const int mv88e6352_serdes_p2p_to_reg[] = {
+- /* Index of value in microvolts corresponds to the register value */
+- 14000, 112000, 210000, 308000, 406000, 504000, 602000, 700000,
+-};
+-
+-int mv88e6352_serdes_set_tx_amplitude(struct mv88e6xxx_chip *chip, int port,
+- int val)
+-{
+- bool found = false;
+- u16 ctrl, reg;
+- int err;
+- int i;
+-
+- err = mv88e6352_g2_scratch_port_has_serdes(chip, port);
+- if (err <= 0)
+- return err;
+-
+- for (i = 0; i < ARRAY_SIZE(mv88e6352_serdes_p2p_to_reg); ++i) {
+- if (mv88e6352_serdes_p2p_to_reg[i] == val) {
+- reg = i;
+- found = true;
+- break;
+- }
+- }
+-
+- if (!found)
+- return -EINVAL;
+-
+- err = mv88e6352_serdes_read(chip, MV88E6352_SERDES_SPEC_CTRL2, &ctrl);
+- if (err)
+- return err;
+-
+- ctrl &= ~MV88E6352_SERDES_OUT_AMP_MASK;
+- ctrl |= reg;
+-
+- return mv88e6352_serdes_write(chip, MV88E6352_SERDES_SPEC_CTRL2, ctrl);
+-}
+diff --git a/drivers/net/dsa/mv88e6xxx/serdes.h b/drivers/net/dsa/mv88e6xxx/serdes.h
+index ad887d8601bcb..17a3e85fabaa3 100644
+--- a/drivers/net/dsa/mv88e6xxx/serdes.h
++++ b/drivers/net/dsa/mv88e6xxx/serdes.h
+@@ -29,8 +29,6 @@ struct phylink_link_state;
+ #define MV88E6352_SERDES_INT_FIBRE_ENERGY BIT(4)
+ #define MV88E6352_SERDES_INT_STATUS 0x13
+
+-#define MV88E6352_SERDES_SPEC_CTRL2 0x1a
+-#define MV88E6352_SERDES_OUT_AMP_MASK 0x0007
+
+ #define MV88E6341_PORT5_LANE 0x15
+
+@@ -140,9 +138,6 @@ void mv88e6352_serdes_get_regs(struct mv88e6xxx_chip *chip, int port, void *_p);
+ int mv88e6390_serdes_get_regs_len(struct mv88e6xxx_chip *chip, int port);
+ void mv88e6390_serdes_get_regs(struct mv88e6xxx_chip *chip, int port, void *_p);
+
+-int mv88e6352_serdes_set_tx_amplitude(struct mv88e6xxx_chip *chip, int port,
+- int val);
+-
+ /* Return the (first) SERDES lane address a port is using, -errno otherwise. */
+ static inline int mv88e6xxx_serdes_get_lane(struct mv88e6xxx_chip *chip,
+ int port)
+--
+2.51.0
+
--- /dev/null
+From bc9dd368ce9f2da835ace34a199a5ee3e42255da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Dec 2025 10:44:27 +0800
+Subject: riscv: cpufeature: Fix Zk bundled extension missing Zknh
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guodong Xu <guodong@riscstar.com>
+
+[ Upstream commit 8632180daf735074a746ce2b3808a8f2c079310e ]
+
+The Zk extension is a bundle consisting of Zkn, Zkr, and Zkt. The Zkn
+extension itself is a bundle consisting of Zbkb, Zbkc, Zbkx, Zknd, Zkne,
+and Zknh.
+
+The current implementation of riscv_zk_bundled_exts manually listed
+the dependencies but missed RISCV_ISA_EXT_ZKNH.
+
+Fix this by introducing a RISCV_ISA_EXT_ZKN macro that lists the Zkn
+components and using it in both riscv_zk_bundled_exts and
+riscv_zkn_bundled_exts.
+
+This adds the missing Zknh extension to Zk and reduces code duplication.
+
+Fixes: 0d8295ed975b ("riscv: add ISA extension parsing for scalar crypto")
+Link: https://patch.msgid.link/20231114141256.126749-4-cleger@rivosinc.com/
+Signed-off-by: Guodong Xu <guodong@riscstar.com>
+Reviewed-by: Clément Léger <cleger@rivosinc.com>
+Link: https://patch.msgid.link/20251223-zk-missing-zknh-v1-1-b627c990ee1a@riscstar.com
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/cpufeature.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/arch/riscv/kernel/cpufeature.c b/arch/riscv/kernel/cpufeature.c
+index 72ca768f4e919..2367e9755524a 100644
+--- a/arch/riscv/kernel/cpufeature.c
++++ b/arch/riscv/kernel/cpufeature.c
+@@ -279,23 +279,22 @@ static const unsigned int riscv_a_exts[] = {
+ RISCV_ISA_EXT_ZALRSC,
+ };
+
++#define RISCV_ISA_EXT_ZKN \
++ RISCV_ISA_EXT_ZBKB, \
++ RISCV_ISA_EXT_ZBKC, \
++ RISCV_ISA_EXT_ZBKX, \
++ RISCV_ISA_EXT_ZKND, \
++ RISCV_ISA_EXT_ZKNE, \
++ RISCV_ISA_EXT_ZKNH
++
+ static const unsigned int riscv_zk_bundled_exts[] = {
+- RISCV_ISA_EXT_ZBKB,
+- RISCV_ISA_EXT_ZBKC,
+- RISCV_ISA_EXT_ZBKX,
+- RISCV_ISA_EXT_ZKND,
+- RISCV_ISA_EXT_ZKNE,
++ RISCV_ISA_EXT_ZKN,
+ RISCV_ISA_EXT_ZKR,
+- RISCV_ISA_EXT_ZKT,
++ RISCV_ISA_EXT_ZKT
+ };
+
+ static const unsigned int riscv_zkn_bundled_exts[] = {
+- RISCV_ISA_EXT_ZBKB,
+- RISCV_ISA_EXT_ZBKC,
+- RISCV_ISA_EXT_ZBKX,
+- RISCV_ISA_EXT_ZKND,
+- RISCV_ISA_EXT_ZKNE,
+- RISCV_ISA_EXT_ZKNH,
++ RISCV_ISA_EXT_ZKN
+ };
+
+ static const unsigned int riscv_zks_bundled_exts[] = {
+--
+2.51.0
+
--- /dev/null
+From e087ca13929254be2e88be6f91e1607bb32e31a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Nov 2025 19:58:50 -0500
+Subject: riscv: pgtable: Cleanup useless VA_USER_XXX definitions
+
+From: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org>
+
+[ Upstream commit 5e5be092ffadcab0093464ccd9e30f0c5cce16b9 ]
+
+These marcos are not used after commit b5b4287accd7 ("riscv: mm: Use
+hint address in mmap if available"). Cleanup VA_USER_XXX definitions
+in asm/pgtable.h.
+
+Fixes: b5b4287accd7 ("riscv: mm: Use hint address in mmap if available")
+Signed-off-by: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org>
+Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Link: https://patch.msgid.link/20251201005850.702569-1-guoren@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/pgtable.h | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
+index 5a08eb5fe99fc..30d1ea93dde34 100644
+--- a/arch/riscv/include/asm/pgtable.h
++++ b/arch/riscv/include/asm/pgtable.h
+@@ -124,10 +124,6 @@
+ #ifdef CONFIG_64BIT
+ #include <asm/pgtable-64.h>
+
+-#define VA_USER_SV39 (UL(1) << (VA_BITS_SV39 - 1))
+-#define VA_USER_SV48 (UL(1) << (VA_BITS_SV48 - 1))
+-#define VA_USER_SV57 (UL(1) << (VA_BITS_SV57 - 1))
+-
+ #define MMAP_VA_BITS_64 ((VA_BITS >= VA_BITS_SV48) ? VA_BITS_SV48 : VA_BITS)
+ #define MMAP_MIN_VA_BITS_64 (VA_BITS_SV39)
+ #define MMAP_VA_BITS (is_compat_task() ? VA_BITS_SV32 : MMAP_VA_BITS_64)
+--
+2.51.0
+
--- /dev/null
+From 6e30f188454a2ca8f16a0cabd1ad291036d00e02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 18:33:19 +0200
+Subject: selftests: drv-net: Bring back tool() to driver __init__s
+
+From: Gal Pressman <gal@nvidia.com>
+
+[ Upstream commit 353cfc0ef3f34ef7fe313ae38dac37f2454a7cf5 ]
+
+The pp_alloc_fail.py test (which doesn't run in NIPA CI?) uses tool, add
+back the import.
+
+Resolves:
+ ImportError: cannot import name 'tool' from 'lib.py'
+
+Fixes: 68a052239fc4 ("selftests: drv-net: update remaining Python init files")
+Reviewed-by: Nimrod Oren <noren@nvidia.com>
+Signed-off-by: Gal Pressman <gal@nvidia.com>
+Link: https://patch.msgid.link/20260105163319.47619-1-gal@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/drivers/net/hw/lib/py/__init__.py | 4 ++--
+ tools/testing/selftests/net/lib/py/__init__.py | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/drivers/net/hw/lib/py/__init__.py b/tools/testing/selftests/drivers/net/hw/lib/py/__init__.py
+index fb010a48a5a19..a86f5c311fdcb 100644
+--- a/tools/testing/selftests/drivers/net/hw/lib/py/__init__.py
++++ b/tools/testing/selftests/drivers/net/hw/lib/py/__init__.py
+@@ -22,7 +22,7 @@ try:
+ NlError, RtnlFamily, DevlinkFamily, PSPFamily
+ from net.lib.py import CmdExitFailure
+ from net.lib.py import bkg, cmd, bpftool, bpftrace, defer, ethtool, \
+- fd_read_timeout, ip, rand_port, wait_port_listen, wait_file
++ fd_read_timeout, ip, rand_port, wait_port_listen, wait_file, tool
+ from net.lib.py import KsftSkipEx, KsftFailEx, KsftXfailEx
+ from net.lib.py import ksft_disruptive, ksft_exit, ksft_pr, ksft_run, \
+ ksft_setup
+@@ -37,7 +37,7 @@ try:
+ "CmdExitFailure",
+ "bkg", "cmd", "bpftool", "bpftrace", "defer", "ethtool",
+ "fd_read_timeout", "ip", "rand_port",
+- "wait_port_listen", "wait_file",
++ "wait_port_listen", "wait_file", "tool",
+ "KsftSkipEx", "KsftFailEx", "KsftXfailEx",
+ "ksft_disruptive", "ksft_exit", "ksft_pr", "ksft_run",
+ "ksft_setup",
+diff --git a/tools/testing/selftests/net/lib/py/__init__.py b/tools/testing/selftests/net/lib/py/__init__.py
+index 97b7cf2b20eb9..8f2da17d53510 100644
+--- a/tools/testing/selftests/net/lib/py/__init__.py
++++ b/tools/testing/selftests/net/lib/py/__init__.py
+@@ -12,7 +12,7 @@ from .ksft import KsftFailEx, KsftSkipEx, KsftXfailEx, ksft_pr, ksft_eq, \
+ from .netns import NetNS, NetNSEnter
+ from .nsim import NetdevSim, NetdevSimDev
+ from .utils import CmdExitFailure, fd_read_timeout, cmd, bkg, defer, \
+- bpftool, ip, ethtool, bpftrace, rand_port, wait_port_listen, wait_file
++ bpftool, ip, ethtool, bpftrace, rand_port, wait_port_listen, wait_file, tool
+ from .ynl import NlError, YnlFamily, EthtoolFamily, NetdevFamily, RtnlFamily, RtnlAddrFamily
+ from .ynl import NetshaperFamily, DevlinkFamily, PSPFamily
+
+@@ -25,7 +25,7 @@ __all__ = ["KSRC",
+ "NetNS", "NetNSEnter",
+ "CmdExitFailure", "fd_read_timeout", "cmd", "bkg", "defer",
+ "bpftool", "ip", "ethtool", "bpftrace", "rand_port",
+- "wait_port_listen", "wait_file",
++ "wait_port_listen", "wait_file", "tool",
+ "NetdevSim", "NetdevSimDev",
+ "NetshaperFamily", "DevlinkFamily", "PSPFamily", "NlError",
+ "YnlFamily", "EthtoolFamily", "NetdevFamily", "RtnlFamily",
+--
+2.51.0
+
btrfs-fix-null-dereference-on-root-when-tracing-inod.patch
btrfs-fix-use-after-free-warning-in-btrfs_get_or_cre.patch
of-unittest-fix-memory-leak-in-unittest_data_add.patch
+arm64-dts-ti-k3-am642-phyboard-electra-peb-c-010-fix.patch
+arm64-dts-ti-k3-am642-phyboard-electra-x27-gpio1-spi.patch
+arm64-dts-ti-k3-am62-lp-sk-nand-rename-pinctrls-to-f.patch
+gpu-nova-core-select-rust_fw_loader_abstractions.patch
+gpio-it87-balance-superio-enter-exit-calls-in-error-.patch
+hid-intel-thc-hid-intel-thc-fix-dma_unmap_sg-nents-v.patch
+hid-intel-thc-hid-intel-thc-fix-wrong-register-readi.patch
+netfs-fix-early-read-unlock-of-page-with-eof-in-midd.patch
+pinctrl-mediatek-mt8189-restore-previous-register-ba.patch
+crypto-qat-fix-duplicate-restarting-msg-during-aer-e.patch
+arm64-dts-imx8qm-mek-correct-the-light-sensor-interr.patch
+arm64-dts-add-off-on-delay-us-for-usdhc2-regulator.patch
+arm-dts-imx6q-ba16-fix-rtc-interrupt-level.patch
+arm64-dts-freescale-moduline-display-fix-compatible.patch
+arm64-dts-freescale-tx8p-ml81-fix-eqos-nvmem-cells.patch
+arm64-dts-imx8mp-fix-lan8740ai-phy-reference-clock-o.patch
+arm64-dts-imx8qm-ss-dma-correct-the-dma-channels-of-.patch
+arm64-dts-mba8mx-fix-ethernet-phy-irq-support.patch
+netfilter-nft_set_pipapo-fix-range-overlap-detection.patch
+netfilter-nft_synproxy-avoid-possible-data-race-on-u.patch
+gpiolib-remove-unnecessary-out-of-memory-messages.patch
+gpiolib-rename-gpio-chip-printk-macros.patch
+gpiolib-fix-race-condition-for-gdev-srcu.patch
+gpio-pca953x-handle-short-interrupt-pulses-on-pcal-d.patch
+netfilter-nf_tables-fix-memory-leak-in-nf_tables_new.patch
+netfilter-nf_conncount-update-last_gc-only-when-gc-h.patch
+net-marvell-prestera-fix-null-dereference-on-devlink.patch
+bridge-fix-c-vlan-preservation-in-802.1ad-vlan_tunne.patch
+net-mscc-ocelot-fix-crash-when-adding-interface-unde.patch
+inet-ping-fix-icmp-out-counting.patch
+net-phy-mxl-86110-add-power-management-and-soft-rese.patch
+net-sock-fix-hardened-usercopy-panic-in-sock_recv_er.patch
+netdev-preserve-netif_f_all_for_all-across-tso-updat.patch
+net-mlx5-lag-multipath-give-priority-for-routes-with.patch
+net-mlx5e-don-t-gate-fec-histograms-on-ppcnt_statist.patch
+net-mlx5e-don-t-print-error-message-due-to-invalid-m.patch
+net-mlx5e-dealloc-forgotten-psp-rx-modify-header.patch
+net-ena-fix-missing-lock-when-update-devlink-params.patch
+net-wwan-iosm-fix-memory-leak-in-ipc_mux_deinit.patch
+bnxt_en-fix-potential-data-corruption-with-hw-gro-lr.patch
+virtio_net-fix-device-mismatch-in-devm_kzalloc-devm_.patch
+inet-frags-drop-fraglist-conntrack-references.patch
+perf-ensure-swevent-hrtimer-is-properly-destroyed.patch
+drm-amd-pm-fix-wrong-pcie-parameter-on-navi1x.patch
+drm-amd-pm-force-send-pcie-parmater-on-navi1x.patch
+vsock-make-accept-ed-sockets-use-custom-setsockopt.patch
+btrfs-release-path-before-initializing-extent-tree-i.patch
+btrfs-only-enforce-free-space-tree-if-v1-cache-is-re.patch
+btrfs-fix-null-pointer-dereference-in-do_abort_log_r.patch
+net-airoha-fix-npu-rx-dma-definitions.patch
+riscv-cpufeature-fix-zk-bundled-extension-missing-zk.patch
+riscv-pgtable-cleanup-useless-va_user_xxx-definition.patch
+net-fix-memory-leak-in-skb_segment_list-for-gro-pack.patch
+pci-vga-don-t-assume-the-only-vga-device-on-a-system.patch
+idpf-keep-the-netdev-when-a-reset-fails.patch
+idpf-convert-vport-state-to-bitmap.patch
+idpf-detach-and-close-netdevs-while-handling-a-reset.patch
+idpf-fix-memory-leak-in-idpf_vport_rel.patch
+idpf-fix-memory-leak-in-idpf_vc_core_deinit.patch
+idpf-fix-error-handling-in-the-init_task-on-load.patch
+idpf-fix-memory-leak-of-flow-steer-list-on-rmmod.patch
+idpf-fix-issue-with-ethtool-n-command-display.patch
+idpf-fix-rss-lut-null-pointer-crash-on-early-ethtool.patch
+idpf-fix-rss-lut-configuration-on-down-interfaces.patch
+idpf-fix-rss-lut-null-ptr-issue-after-soft-reset.patch
+idpf-fix-error-handling-in-idpf_vport_open.patch
+idpf-cap-maximum-rx-buffer-size.patch
+idpf-fix-aux-device-unplugging-when-rdma-is-not-supp.patch
+revert-dsa-mv88e6xxx-make-serdes-sgmii-fiber-tx-ampl.patch
+udp-call-skb_orphan-before-skb_attempt_defer_free.patch
+net-sfp-return-the-number-of-written-bytes-for-smbus.patch
+net-sched-act_api-avoid-dereferencing-err_ptr-in-tcf.patch
+selftests-drv-net-bring-back-tool-to-driver-__init__.patch
+net-netdevsim-fix-inconsistent-carrier-state-after-l.patch
+block-don-t-merge-bios-with-different-app_tags.patch
+trace-ftrace_dump_on_oops-is-not-exported-make-it-st.patch
+sparc-pci-correct-64-bit-non-pref-pref-bar-resources.patch
+hid-quirks-work-around-vid-pid-conflict-for-appledis.patch
+net-airoha-fix-schedule-while-atomic-in-airoha_ppe_d.patch
+wifi-mac80211_hwsim-fix-typo-in-frequency-notificati.patch
+net-sched-sch_qfq-fix-null-deref-when-deactivating-i.patch
+net-usb-pegasus-fix-memory-leak-in-update_eth_regs_a.patch
+net-enetc-fix-build-warning-when-page_size-is-greate.patch
+arp-do-not-assume-dev_hard_header-does-not-change-sk.patch
+ublk-fix-use-after-free-in-ublk_partition_scan_work.patch
+irqchip-gic-v5-fix-gicv5_its_map_event-itte-read-end.patch
+erofs-don-t-bother-with-s_stack_depth-increasing-for.patch
+erofs-fix-file-backed-mounts-no-longer-working-on-er.patch
--- /dev/null
+From 34f18fb1e4672f919b506978e88bcb074e6ec2fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Nov 2025 19:04:11 +0200
+Subject: sparc/PCI: Correct 64-bit non-pref -> pref BAR resources
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit bdb32359eab94013e80cf7e3d40a3fd4972da93a ]
+
+SPARC T5-2 dts describes some PCI BARs as 64-bit resources without the
+pref(etchable) bit (0x83... vs 0xc3... in assigned-addresses) for address
+ranges above the 4G threshold. Such resources cannot be placed into a
+non-prefetchable PCI bridge window that is capable only of 32-bit
+addressing. As such, it looks like the platform is improperly described by
+the dts.
+
+The kernel detects this problem (see the IORESOURCE_PREFETCH check in
+pci_find_parent_resource()) and fails to assign these BAR resources to the
+resource tree due to lack of a compatible bridge window.
+
+Prior to 754babaaf333 ("sparc/PCI: Remove pcibios_enable_device() as they
+do nothing extra") SPARC arch code did not test whether device resources
+were successfully in the resource tree when enabling a device, effectively
+hiding the problem. After removing the arch-specific enable code,
+pci_enable_resources() refuses to enable the device when it finds not all
+mem resources are assigned, and therefore mpt3sas can't be enabled:
+
+ pci 0001:04:00.0: reg 0x14: [mem 0x801110000000-0x80111000ffff 64bit]
+ pci 0001:04:00.0: reg 0x1c: [mem 0x801110040000-0x80111007ffff 64bit]
+ pci 0001:04:00.0: BAR 1 [mem 0x801110000000-0x80111000ffff 64bit]: can't claim; no compatible bridge window
+ pci 0001:04:00.0: BAR 3 [mem 0x801110040000-0x80111007ffff 64bit]: can't claim; no compatible bridge window
+ mpt3sas 0001:04:00.0: BAR 1 [mem size 0x00010000 64bit]: not assigned; can't enable device
+
+For clarity, this filtered log only shows failures for one mpt3sas device
+but other devices fail similarly. In the reported case, the end result with
+all the failures is an unbootable system.
+
+Things appeared to "work" before 754babaaf333 ("sparc/PCI: Remove
+pcibios_enable_device() as they do nothing extra") because the resource
+tree is agnostic to whether PCI BAR resources are properly in the tree or
+not. So as long as there was a parent resource (e.g. a root bus resource)
+that contains the address range, the resource tree code just places
+resource request underneath it without any consideration to the
+intermediate BAR resource. While it worked, it's incorrect setup still.
+
+Add an OF fixup to set the IORESOURCE_PREFETCH flag for a 64-bit PCI
+resource that has the end address above 4G requiring placement into the
+prefetchable window. Also log the issue.
+
+Fixes: 754babaaf333 ("sparc/PCI: Remove pcibios_enable_device() as they do nothing extra")
+Reported-by: Nathaniel Roach <nroach44@gmail.com>
+Closes: https://github.com/sparclinux/issues/issues/22
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Nathaniel Roach <nroach44@gmail.com>
+Link: https://patch.msgid.link/20251124170411.3709-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/pci.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/arch/sparc/kernel/pci.c b/arch/sparc/kernel/pci.c
+index a9448088e762e..b290107170e94 100644
+--- a/arch/sparc/kernel/pci.c
++++ b/arch/sparc/kernel/pci.c
+@@ -181,6 +181,28 @@ static int __init ofpci_debug(char *str)
+
+ __setup("ofpci_debug=", ofpci_debug);
+
++static void of_fixup_pci_pref(struct pci_dev *dev, int index,
++ struct resource *res)
++{
++ struct pci_bus_region region;
++
++ if (!(res->flags & IORESOURCE_MEM_64))
++ return;
++
++ if (!resource_size(res))
++ return;
++
++ pcibios_resource_to_bus(dev->bus, ®ion, res);
++ if (region.end <= ~((u32)0))
++ return;
++
++ if (!(res->flags & IORESOURCE_PREFETCH)) {
++ res->flags |= IORESOURCE_PREFETCH;
++ pci_info(dev, "reg 0x%x: fixup: pref added to 64-bit resource\n",
++ index);
++ }
++}
++
+ static unsigned long pci_parse_of_flags(u32 addr0)
+ {
+ unsigned long flags = 0;
+@@ -244,6 +266,7 @@ static void pci_parse_of_addrs(struct platform_device *op,
+ res->end = op_res->end;
+ res->flags = flags;
+ res->name = pci_name(dev);
++ of_fixup_pci_pref(dev, i, res);
+
+ pci_info(dev, "reg 0x%x: %pR\n", i, res);
+ }
+--
+2.51.0
+
--- /dev/null
+From 5f8eb937800bfe7517af8f7bc0eca1dafbbad30e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 23:10:54 +0000
+Subject: trace: ftrace_dump_on_oops[] is not exported, make it static
+
+From: Ben Dooks <ben.dooks@codethink.co.uk>
+
+[ Upstream commit 1e2ed4bfd50ace3c4272cfab7e9aa90956fb7ae0 ]
+
+The ftrace_dump_on_oops string is not used outside of trace.c so
+make it static to avoid the export warning from sparse:
+
+kernel/trace/trace.c:141:6: warning: symbol 'ftrace_dump_on_oops' was not declared. Should it be static?
+
+Fixes: dd293df6395a2 ("tracing: Move trace sysctls into trace.c")
+Link: https://patch.msgid.link/20260106231054.84270-1-ben.dooks@codethink.co.uk
+Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index ddff2af3cd3f7..142e3b737f0bc 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -141,7 +141,7 @@ cpumask_var_t __read_mostly tracing_buffer_mask;
+ * by commas.
+ */
+ /* Set to string format zero to disable by default */
+-char ftrace_dump_on_oops[MAX_TRACER_SIZE] = "0";
++static char ftrace_dump_on_oops[MAX_TRACER_SIZE] = "0";
+
+ /* When set, tracing will stop when a WARN*() is hit */
+ static int __disable_trace_on_warning;
+--
+2.51.0
+
--- /dev/null
+From 18007e5f9d53152918a477b9a611d03b29edd5b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jan 2026 20:14:54 +0800
+Subject: ublk: fix use-after-free in ublk_partition_scan_work
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit f0d385f6689f37a2828c686fb279121df006b4cb ]
+
+A race condition exists between the async partition scan work and device
+teardown that can lead to a use-after-free of ub->ub_disk:
+
+1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk()
+2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does:
+ - del_gendisk(ub->ub_disk)
+ - ublk_detach_disk() sets ub->ub_disk = NULL
+ - put_disk() which may free the disk
+3. The worker ublk_partition_scan_work() then dereferences ub->ub_disk
+ leading to UAF
+
+Fix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold
+a reference to the disk during the partition scan. The spinlock in
+ublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker
+either gets a valid reference or sees NULL and exits early.
+
+Also change flush_work() to cancel_work_sync() to avoid running the
+partition scan work unnecessarily when the disk is already detached.
+
+Fixes: 7fc4da6a304b ("ublk: scan partition in async way")
+Reported-by: Ruikai Peng <ruikai@pwno.io>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/ublk_drv.c | 37 ++++++++++++++++++++++---------------
+ 1 file changed, 22 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
+index babb58d2dcaf7..e09c1b5999b75 100644
+--- a/drivers/block/ublk_drv.c
++++ b/drivers/block/ublk_drv.c
+@@ -255,20 +255,6 @@ static inline struct request *__ublk_check_and_get_req(struct ublk_device *ub,
+ u16 q_id, u16 tag, struct ublk_io *io, size_t offset);
+ static inline unsigned int ublk_req_build_flags(struct request *req);
+
+-static void ublk_partition_scan_work(struct work_struct *work)
+-{
+- struct ublk_device *ub =
+- container_of(work, struct ublk_device, partition_scan_work);
+-
+- if (WARN_ON_ONCE(!test_and_clear_bit(GD_SUPPRESS_PART_SCAN,
+- &ub->ub_disk->state)))
+- return;
+-
+- mutex_lock(&ub->ub_disk->open_mutex);
+- bdev_disk_changed(ub->ub_disk, false);
+- mutex_unlock(&ub->ub_disk->open_mutex);
+-}
+-
+ static inline struct ublksrv_io_desc *
+ ublk_get_iod(const struct ublk_queue *ubq, unsigned tag)
+ {
+@@ -1663,6 +1649,27 @@ static void ublk_put_disk(struct gendisk *disk)
+ put_device(disk_to_dev(disk));
+ }
+
++static void ublk_partition_scan_work(struct work_struct *work)
++{
++ struct ublk_device *ub =
++ container_of(work, struct ublk_device, partition_scan_work);
++ /* Hold disk reference to prevent UAF during concurrent teardown */
++ struct gendisk *disk = ublk_get_disk(ub);
++
++ if (!disk)
++ return;
++
++ if (WARN_ON_ONCE(!test_and_clear_bit(GD_SUPPRESS_PART_SCAN,
++ &disk->state)))
++ goto out;
++
++ mutex_lock(&disk->open_mutex);
++ bdev_disk_changed(disk, false);
++ mutex_unlock(&disk->open_mutex);
++out:
++ ublk_put_disk(disk);
++}
++
+ /*
+ * Use this function to ensure that ->canceling is consistently set for
+ * the device and all queues. Do not set these flags directly.
+@@ -2107,7 +2114,7 @@ static void ublk_stop_dev(struct ublk_device *ub)
+ mutex_lock(&ub->mutex);
+ ublk_stop_dev_unlocked(ub);
+ mutex_unlock(&ub->mutex);
+- flush_work(&ub->partition_scan_work);
++ cancel_work_sync(&ub->partition_scan_work);
+ ublk_cancel_dev(ub);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 7f0db1978eca699e2ca2cdd3166e7d695ea71fd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 09:36:30 +0000
+Subject: udp: call skb_orphan() before skb_attempt_defer_free()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit e5c8eda39a9fc1547d1398d707aa06c1d080abdd ]
+
+Standard UDP receive path does not use skb->destructor.
+
+But skmsg layer does use it, since it calls skb_set_owner_sk_safe()
+from udp_read_skb().
+
+This then triggers this warning in skb_attempt_defer_free():
+
+ DEBUG_NET_WARN_ON_ONCE(skb->destructor);
+
+We must call skb_orphan() to fix this issue.
+
+Fixes: 6471658dc66c ("udp: use skb_attempt_defer_free()")
+Reported-by: syzbot+3e68572cf2286ce5ebe9@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/695b83bd.050a0220.1c9965.002b.GAE@google.com/T/#u
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260105093630.1976085-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 30dfbf73729da..860bd61ff047f 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1851,6 +1851,7 @@ void skb_consume_udp(struct sock *sk, struct sk_buff *skb, int len)
+ sk_peek_offset_bwd(sk, len);
+
+ if (!skb_shared(skb)) {
++ skb_orphan(skb);
+ skb_attempt_defer_free(skb);
+ return;
+ }
+--
+2.51.0
+
--- /dev/null
+From 514b8d3a28c339e0031542c18f44c90355908b60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jan 2026 15:49:00 +0530
+Subject: virtio_net: fix device mismatch in devm_kzalloc/devm_kfree
+
+From: Kommula Shiva Shankar <kshankar@marvell.com>
+
+[ Upstream commit acb4bc6e1ba34ae1a34a9334a1ce8474c909466e ]
+
+Initial rss_hdr allocation uses virtio_device->device,
+but virtnet_set_queues() frees using net_device->device.
+This device mismatch causing below devres warning
+
+[ 3788.514041] ------------[ cut here ]------------
+[ 3788.514044] WARNING: drivers/base/devres.c:1095 at devm_kfree+0x84/0x98, CPU#16: vdpa/1463
+[ 3788.514054] Modules linked in: octep_vdpa virtio_net virtio_vdpa [last unloaded: virtio_vdpa]
+[ 3788.514064] CPU: 16 UID: 0 PID: 1463 Comm: vdpa Tainted: G W 6.18.0 #10 PREEMPT
+[ 3788.514067] Tainted: [W]=WARN
+[ 3788.514069] Hardware name: Marvell CN106XX board (DT)
+[ 3788.514071] pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
+[ 3788.514074] pc : devm_kfree+0x84/0x98
+[ 3788.514076] lr : devm_kfree+0x54/0x98
+[ 3788.514079] sp : ffff800084e2f220
+[ 3788.514080] x29: ffff800084e2f220 x28: ffff0003b2366000 x27: 000000000000003f
+[ 3788.514085] x26: 000000000000003f x25: ffff000106f17c10 x24: 0000000000000080
+[ 3788.514089] x23: ffff00045bb8ab08 x22: ffff00045bb8a000 x21: 0000000000000018
+[ 3788.514093] x20: ffff0004355c3080 x19: ffff00045bb8aa00 x18: 0000000000080000
+[ 3788.514098] x17: 0000000000000040 x16: 000000000000001f x15: 000000000007ffff
+[ 3788.514102] x14: 0000000000000488 x13: 0000000000000005 x12: 00000000000fffff
+[ 3788.514106] x11: ffffffffffffffff x10: 0000000000000005 x9 : ffff800080c8c05c
+[ 3788.514110] x8 : ffff800084e2eeb8 x7 : 0000000000000000 x6 : 000000000000003f
+[ 3788.514115] x5 : ffff8000831bafe0 x4 : ffff800080c8b010 x3 : ffff0004355c3080
+[ 3788.514119] x2 : ffff0004355c3080 x1 : 0000000000000000 x0 : 0000000000000000
+[ 3788.514123] Call trace:
+[ 3788.514125] devm_kfree+0x84/0x98 (P)
+[ 3788.514129] virtnet_set_queues+0x134/0x2e8 [virtio_net]
+[ 3788.514135] virtnet_probe+0x9c0/0xe00 [virtio_net]
+[ 3788.514139] virtio_dev_probe+0x1e0/0x338
+[ 3788.514144] really_probe+0xc8/0x3a0
+[ 3788.514149] __driver_probe_device+0x84/0x170
+[ 3788.514152] driver_probe_device+0x44/0x120
+[ 3788.514155] __device_attach_driver+0xc4/0x168
+[ 3788.514158] bus_for_each_drv+0x8c/0xf0
+[ 3788.514161] __device_attach+0xa4/0x1c0
+[ 3788.514164] device_initial_probe+0x1c/0x30
+[ 3788.514168] bus_probe_device+0xb4/0xc0
+[ 3788.514170] device_add+0x614/0x828
+[ 3788.514173] register_virtio_device+0x214/0x258
+[ 3788.514175] virtio_vdpa_probe+0xa0/0x110 [virtio_vdpa]
+[ 3788.514179] vdpa_dev_probe+0xa8/0xd8
+[ 3788.514183] really_probe+0xc8/0x3a0
+[ 3788.514186] __driver_probe_device+0x84/0x170
+[ 3788.514189] driver_probe_device+0x44/0x120
+[ 3788.514192] __device_attach_driver+0xc4/0x168
+[ 3788.514195] bus_for_each_drv+0x8c/0xf0
+[ 3788.514197] __device_attach+0xa4/0x1c0
+[ 3788.514200] device_initial_probe+0x1c/0x30
+[ 3788.514203] bus_probe_device+0xb4/0xc0
+[ 3788.514206] device_add+0x614/0x828
+[ 3788.514209] _vdpa_register_device+0x58/0x88
+[ 3788.514211] octep_vdpa_dev_add+0x104/0x228 [octep_vdpa]
+[ 3788.514215] vdpa_nl_cmd_dev_add_set_doit+0x2d0/0x3c0
+[ 3788.514218] genl_family_rcv_msg_doit+0xe4/0x158
+[ 3788.514222] genl_rcv_msg+0x218/0x298
+[ 3788.514225] netlink_rcv_skb+0x64/0x138
+[ 3788.514229] genl_rcv+0x40/0x60
+[ 3788.514233] netlink_unicast+0x32c/0x3b0
+[ 3788.514237] netlink_sendmsg+0x170/0x3b8
+[ 3788.514241] __sys_sendto+0x12c/0x1c0
+[ 3788.514246] __arm64_sys_sendto+0x30/0x48
+[ 3788.514249] invoke_syscall.constprop.0+0x58/0xf8
+[ 3788.514255] do_el0_svc+0x48/0xd0
+[ 3788.514259] el0_svc+0x48/0x210
+[ 3788.514264] el0t_64_sync_handler+0xa0/0xe8
+[ 3788.514268] el0t_64_sync+0x198/0x1a0
+[ 3788.514271] ---[ end trace 0000000000000000 ]---
+
+Fix by using virtio_device->device consistently for
+allocation and deallocation
+
+Fixes: 4944be2f5ad8c ("virtio_net: Allocate rss_hdr with devres")
+Signed-off-by: Kommula Shiva Shankar <kshankar@marvell.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Link: https://patch.msgid.link/20260102101900.692770-1-kshankar@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 8e04adb57f52a..4e1a5291099a5 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -3783,7 +3783,7 @@ static int virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs)
+ if (vi->has_rss && !netif_is_rxfh_configured(dev)) {
+ old_rss_hdr = vi->rss_hdr;
+ old_rss_trailer = vi->rss_trailer;
+- vi->rss_hdr = devm_kzalloc(&dev->dev, virtnet_rss_hdr_size(vi), GFP_KERNEL);
++ vi->rss_hdr = devm_kzalloc(&vi->vdev->dev, virtnet_rss_hdr_size(vi), GFP_KERNEL);
+ if (!vi->rss_hdr) {
+ vi->rss_hdr = old_rss_hdr;
+ return -ENOMEM;
+@@ -3794,7 +3794,7 @@ static int virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs)
+
+ if (!virtnet_commit_rss_command(vi)) {
+ /* restore ctrl_rss if commit_rss_command failed */
+- devm_kfree(&dev->dev, vi->rss_hdr);
++ devm_kfree(&vi->vdev->dev, vi->rss_hdr);
+ vi->rss_hdr = old_rss_hdr;
+ vi->rss_trailer = old_rss_trailer;
+
+@@ -3802,7 +3802,7 @@ static int virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs)
+ queue_pairs);
+ return -EINVAL;
+ }
+- devm_kfree(&dev->dev, old_rss_hdr);
++ devm_kfree(&vi->vdev->dev, old_rss_hdr);
+ goto succ;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 869718eb18bca75d5aa9ba3e0808b01c6d950b36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Dec 2025 20:43:10 +0100
+Subject: vsock: Make accept()ed sockets use custom setsockopt()
+
+From: Michal Luczaj <mhal@rbox.co>
+
+[ Upstream commit ce5e612dd411de096aa041b9e9325ba1bec5f9f4 ]
+
+SO_ZEROCOPY handling in vsock_connectible_setsockopt() does not get called
+on accept()ed sockets due to a missing flag. Flip it.
+
+Fixes: e0718bd82e27 ("vsock: enable setting SO_ZEROCOPY")
+Signed-off-by: Michal Luczaj <mhal@rbox.co>
+Link: https://patch.msgid.link/20251229-vsock-child-sock-custom-sockopt-v2-1-64778d6c4f88@rbox.co
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/af_vsock.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index a9ca9c3b87b31..cbd649bf01459 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -1787,6 +1787,10 @@ static int vsock_accept(struct socket *sock, struct socket *newsock,
+ } else {
+ newsock->state = SS_CONNECTED;
+ sock_graft(connected, newsock);
++
++ set_bit(SOCK_CUSTOM_SOCKOPT,
++ &connected->sk_socket->flags);
++
+ if (vsock_msgzerocopy_allow(vconnected->transport))
+ set_bit(SOCK_SUPPORT_ZC,
+ &connected->sk_socket->flags);
+--
+2.51.0
+
--- /dev/null
+From 3d727cac8c8a3a39347162220b6d152aba255fae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 14:36:51 +0100
+Subject: wifi: mac80211_hwsim: fix typo in frequency notification
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit 333418872bfecf4843f1ded7a4151685dfcf07d5 ]
+
+The NAN notification is for 5745 MHz which corresponds to channel 149
+and not 5475 which is not actually a valid channel. This could result in
+a NULL pointer dereference in cfg80211_next_nan_dw_notif.
+
+Fixes: a37a6f54439b ("wifi: mac80211_hwsim: Add simulation support for NAN device")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Reviewed-by: Ilan Peer <ilan.peer@intel.com>
+Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20260107143652.7dab2035836f.Iacbaf7bb94ed5c14a0928a625827e4137d8bfede@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/virtual/mac80211_hwsim.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
+index 5903d82e1ab1e..2f263d89d2d69 100644
+--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
++++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
+@@ -4040,7 +4040,7 @@ mac80211_hwsim_nan_dw_start(struct hrtimer *timer)
+ ieee80211_vif_to_wdev(data->nan_device_vif);
+
+ if (data->nan_curr_dw_band == NL80211_BAND_5GHZ)
+- ch = ieee80211_get_channel(hw->wiphy, 5475);
++ ch = ieee80211_get_channel(hw->wiphy, 5745);
+ else
+ ch = ieee80211_get_channel(hw->wiphy, 2437);
+
+--
+2.51.0
+
--- /dev/null
+From 6d5cf4d2d7dbbede637f1d956e957e285a2f8e16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 11:56:05 +0200
+Subject: ARM: dts: imx6q-ba16: fix RTC interrupt level
+
+From: Ian Ray <ian.ray@gehealthcare.com>
+
+[ Upstream commit e6a4eedd49ce27c16a80506c66a04707e0ee0116 ]
+
+RTC interrupt level should be set to "LOW". This was revealed by the
+introduction of commit:
+
+ f181987ef477 ("rtc: m41t80: use IRQ flags obtained from fwnode")
+
+which changed the way IRQ type is obtained.
+
+Fixes: 56c27310c1b4 ("ARM: dts: imx: Add Advantech BA-16 Qseven module")
+Signed-off-by: Ian Ray <ian.ray@gehealthcare.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi b/arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi
+index f266f1b7e0cfc..0c033e69ecc04 100644
+--- a/arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi
++++ b/arch/arm/boot/dts/nxp/imx/imx6q-ba16.dtsi
+@@ -335,7 +335,7 @@ rtc@32 {
+ pinctrl-0 = <&pinctrl_rtc>;
+ reg = <0x32>;
+ interrupt-parent = <&gpio4>;
+- interrupts = <10 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <10 IRQ_TYPE_LEVEL_LOW>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 5db5bea494a28a6ec197262cf3df8be3e4d03e21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 11:22:40 +0800
+Subject: arm64: dts: add off-on-delay-us for usdhc2 regulator
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+[ Upstream commit ca643894a37a25713029b36cfe7d1bae515cac08 ]
+
+For SD card, according to the spec requirement, for sd card power reset
+operation, it need sd card supply voltage to be lower than 0.5v and keep
+over 1ms, otherwise, next time power back the sd card supply voltage to
+3.3v, sd card can't support SD3.0 mode again.
+
+To match such requirement on imx8qm-mek board, add 4.8ms delay between
+sd power off and power on.
+
+Fixes: 307fd14d4b14 ("arm64: dts: imx: add imx8qm mek support")
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+index a9ab87699f3d5..d22cec32b7cee 100644
+--- a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
++++ b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+@@ -38,6 +38,7 @@ reg_usdhc2_vmmc: usdhc2-vmmc {
+ regulator-max-microvolt = <3000000>;
+ gpio = <&lsio_gpio4 7 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
++ off-on-delay-us = <4800>;
+ };
+ };
+
+--
+2.51.0
+
--- /dev/null
+From a4ee756ef8d515c046cd5d11ed033afc6260c901 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 14:41:51 +0100
+Subject: arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH
+ electronics i.MX8M Plus DHCOM
+
+From: Marek Vasut <marek.vasut@mailbox.org>
+
+[ Upstream commit c63749a7ddc59ac6ec0b05abfa0a21af9f2c1d38 ]
+
+Add missing 'clocks' property to LAN8740Ai PHY node, to allow the PHY driver
+to manage LAN8740Ai CLKIN reference clock supply. This fixes sporadic link
+bouncing caused by interruptions on the PHY reference clock, by letting the
+PHY driver manage the reference clock and assure there are no interruptions.
+
+This follows the matching PHY driver recommendation described in commit
+bedd8d78aba3 ("net: phy: smsc: LAN8710/20: add phy refclk in support")
+
+Fixes: 8d6712695bc8 ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2")
+Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
+Tested-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi
+index 2e93d922c8611..2ff47f6ec7979 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp-dhcom-som.dtsi
+@@ -105,6 +105,7 @@ mdio {
+ ethphy0f: ethernet-phy@0 { /* SMSC LAN8740Ai */
+ compatible = "ethernet-phy-id0007.c110",
+ "ethernet-phy-ieee802.3-c22";
++ clocks = <&clk IMX8MP_CLK_ENET_QOS>;
+ interrupt-parent = <&gpio3>;
+ interrupts = <19 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-0 = <&pinctrl_ethphy0>;
+--
+2.51.0
+
--- /dev/null
+From a810f24b7f42afa115fd37a9a59ca118d8dd0dde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 21:22:50 +0000
+Subject: arp: do not assume dev_hard_header() does not change skb->head
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit c92510f5e3f82ba11c95991824a41e59a9c5ed81 ]
+
+arp_create() is the only dev_hard_header() caller
+making assumption about skb->head being unchanged.
+
+A recent commit broke this assumption.
+
+Initialize @arp pointer after dev_hard_header() call.
+
+Fixes: db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust")
+Reported-by: syzbot+58b44a770a1585795351@syzkaller.appspotmail.com
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20260107212250.384552-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/arp.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
+index 784dc8b37be5a..4ea5987e06b61 100644
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -563,7 +563,7 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
+
+ skb_reserve(skb, hlen);
+ skb_reset_network_header(skb);
+- arp = skb_put(skb, arp_hdr_len(dev));
++ skb_put(skb, arp_hdr_len(dev));
+ skb->dev = dev;
+ skb->protocol = htons(ETH_P_ARP);
+ if (!src_hw)
+@@ -571,12 +571,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
+ if (!dest_hw)
+ dest_hw = dev->broadcast;
+
+- /*
+- * Fill the device header for the ARP frame
++ /* Fill the device header for the ARP frame.
++ * Note: skb->head can be changed.
+ */
+ if (dev_hard_header(skb, dev, ptype, dest_hw, src_hw, skb->len) < 0)
+ goto out;
+
++ arp = arp_hdr(skb);
+ /*
+ * Fill out the arp protocol part.
+ *
+--
+2.51.0
+
--- /dev/null
+From 12eee252a2389db4012d4e5d1426f868d1108fbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Dec 2025 00:36:25 -0800
+Subject: bnxt_en: Fix potential data corruption with HW GRO/LRO
+
+From: Srijit Bose <srijit.bose@broadcom.com>
+
+[ Upstream commit ffeafa65b2b26df2f5b5a6118d3174f17bd12ec5 ]
+
+Fix the max number of bits passed to find_first_zero_bit() in
+bnxt_alloc_agg_idx(). We were incorrectly passing the number of
+long words. find_first_zero_bit() may fail to find a zero bit and
+cause a wrong ID to be used. If the wrong ID is already in use, this
+can cause data corruption. Sometimes an error like this can also be
+seen:
+
+bnxt_en 0000:83:00.0 enp131s0np0: TPA end agg_buf 2 != expected agg_bufs 1
+
+Fix it by passing the correct number of bits MAX_TPA_P5. Use
+DECLARE_BITMAP() to more cleanly define the bitmap. Add a sanity
+check to warn if a bit cannot be found and reset the ring [MChan].
+
+Fixes: ec4d8e7cf024 ("bnxt_en: Add TPA ID mapping logic for 57500 chips.")
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Srijit Bose <srijit.bose@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20251231083625.3911652-1-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 15 ++++++++++++---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 +---
+ 2 files changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 8e4e8291d8c66..e337b6c7ee6f9 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1268,9 +1268,11 @@ static u16 bnxt_alloc_agg_idx(struct bnxt_rx_ring_info *rxr, u16 agg_id)
+ struct bnxt_tpa_idx_map *map = rxr->rx_tpa_idx_map;
+ u16 idx = agg_id & MAX_TPA_P5_MASK;
+
+- if (test_bit(idx, map->agg_idx_bmap))
+- idx = find_first_zero_bit(map->agg_idx_bmap,
+- BNXT_AGG_IDX_BMAP_SIZE);
++ if (test_bit(idx, map->agg_idx_bmap)) {
++ idx = find_first_zero_bit(map->agg_idx_bmap, MAX_TPA_P5);
++ if (idx >= MAX_TPA_P5)
++ return INVALID_HW_RING_ID;
++ }
+ __set_bit(idx, map->agg_idx_bmap);
+ map->agg_id_tbl[agg_id] = idx;
+ return idx;
+@@ -1303,6 +1305,13 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
+ if (bp->flags & BNXT_FLAG_CHIP_P5) {
+ agg_id = TPA_START_AGG_ID_P5(tpa_start);
+ agg_id = bnxt_alloc_agg_idx(rxr, agg_id);
++ if (unlikely(agg_id == INVALID_HW_RING_ID)) {
++ netdev_warn(bp->dev, "Unable to allocate agg ID for ring %d, agg 0x%x\n",
++ rxr->bnapi->index,
++ TPA_START_AGG_ID_P5(tpa_start));
++ bnxt_sched_reset_rxr(bp, rxr);
++ return;
++ }
+ } else {
+ agg_id = TPA_START_AGG_ID(tpa_start);
+ }
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index 0116f67593e3a..d96c9aabf97a7 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -898,11 +898,9 @@ struct bnxt_tpa_info {
+ struct rx_agg_cmp *agg_arr;
+ };
+
+-#define BNXT_AGG_IDX_BMAP_SIZE (MAX_TPA_P5 / BITS_PER_LONG)
+-
+ struct bnxt_tpa_idx_map {
+ u16 agg_id_tbl[1024];
+- unsigned long agg_idx_bmap[BNXT_AGG_IDX_BMAP_SIZE];
++ DECLARE_BITMAP(agg_idx_bmap, MAX_TPA_P5);
+ };
+
+ struct bnxt_rx_ring_info {
+--
+2.51.0
+
--- /dev/null
+From 8dd712605b7895dfbe618a1777bdbf6fa060836f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Dec 2025 03:00:57 +0100
+Subject: bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
+
+From: Alexandre Knecht <knecht.alexandre@gmail.com>
+
+[ Upstream commit 3128df6be147768fe536986fbb85db1d37806a9f ]
+
+When using an 802.1ad bridge with vlan_tunnel, the C-VLAN tag is
+incorrectly stripped from frames during egress processing.
+
+br_handle_egress_vlan_tunnel() uses skb_vlan_pop() to remove the S-VLAN
+from hwaccel before VXLAN encapsulation. However, skb_vlan_pop() also
+moves any "next" VLAN from the payload into hwaccel:
+
+ /* move next vlan tag to hw accel tag */
+ __skb_vlan_pop(skb, &vlan_tci);
+ __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);
+
+For QinQ frames where the C-VLAN sits in the payload, this moves it to
+hwaccel where it gets lost during VXLAN encapsulation.
+
+Fix by calling __vlan_hwaccel_clear_tag() directly, which clears only
+the hwaccel S-VLAN and leaves the payload untouched.
+
+This path is only taken when vlan_tunnel is enabled and tunnel_info
+is configured, so 802.1Q bridges are unaffected.
+
+Tested with 802.1ad bridge + VXLAN vlan_tunnel, verified C-VLAN
+preserved in VXLAN payload via tcpdump.
+
+Fixes: 11538d039ac6 ("bridge: vlan dst_metadata hooks in ingress and egress paths")
+Signed-off-by: Alexandre Knecht <knecht.alexandre@gmail.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20251228020057.2788865-1-knecht.alexandre@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_vlan_tunnel.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/net/bridge/br_vlan_tunnel.c b/net/bridge/br_vlan_tunnel.c
+index 81833ca7a2c77..b41494ce59438 100644
+--- a/net/bridge/br_vlan_tunnel.c
++++ b/net/bridge/br_vlan_tunnel.c
+@@ -187,7 +187,6 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,
+ {
+ struct metadata_dst *tunnel_dst;
+ __be64 tunnel_id;
+- int err;
+
+ if (!vlan)
+ return 0;
+@@ -197,9 +196,13 @@ int br_handle_egress_vlan_tunnel(struct sk_buff *skb,
+ return 0;
+
+ skb_dst_drop(skb);
+- err = skb_vlan_pop(skb);
+- if (err)
+- return err;
++ /* For 802.1ad (QinQ), skb_vlan_pop() incorrectly moves the C-VLAN
++ * from payload to hwaccel after clearing S-VLAN. We only need to
++ * clear the hwaccel S-VLAN; the C-VLAN must stay in payload for
++ * correct VXLAN encapsulation. This is also correct for 802.1Q
++ * where no C-VLAN exists in payload.
++ */
++ __vlan_hwaccel_clear_tag(skb);
+
+ if (BR_INPUT_SKB_CB(skb)->backup_nhid) {
+ tunnel_dst = __ip_tun_set_dst(0, 0, 0, 0, 0, TUNNEL_KEY,
+--
+2.51.0
+
--- /dev/null
+From 60dca6715320754489c49225806d0ec42056418a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 23:37:30 +0800
+Subject: gpio: pca953x: Add support for level-triggered interrupts
+
+From: Potin Lai <potin.lai.pt@gmail.com>
+
+[ Upstream commit 417b0f8d08f878615de9481c6e8827fbc8b57ed2 ]
+
+Adds support for level-triggered interrupts in the PCA953x GPIO
+expander driver. Previously, the driver only supported edge-triggered
+interrupts, which could lead to missed events in scenarios where an
+interrupt condition persists until it is explicitly cleared.
+
+By enabling level-triggered interrupts, the driver can now detect and
+respond to sustained interrupt conditions more reliably.
+
+Signed-off-by: Potin Lai <potin.lai.pt@gmail.com>
+Link: https://lore.kernel.org/r/20250409-gpio-pca953x-level-triggered-irq-v3-1-7f184d814934@gmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Stable-dep-of: 014a17deb412 ("gpio: pca953x: handle short interrupt pulses on PCAL devices")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca953x.c | 32 +++++++++++++++++++++++++++-----
+ 1 file changed, 27 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index de965e6353c5b..6b9bfdebadb5a 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -207,6 +207,8 @@ struct pca953x_chip {
+ DECLARE_BITMAP(irq_stat, MAX_LINE);
+ DECLARE_BITMAP(irq_trig_raise, MAX_LINE);
+ DECLARE_BITMAP(irq_trig_fall, MAX_LINE);
++ DECLARE_BITMAP(irq_trig_level_high, MAX_LINE);
++ DECLARE_BITMAP(irq_trig_level_low, MAX_LINE);
+ #endif
+ atomic_t wakeup_path;
+
+@@ -767,6 +769,8 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d)
+ pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+
+ bitmap_or(irq_mask, chip->irq_trig_fall, chip->irq_trig_raise, gc->ngpio);
++ bitmap_or(irq_mask, irq_mask, chip->irq_trig_level_high, gc->ngpio);
++ bitmap_or(irq_mask, irq_mask, chip->irq_trig_level_low, gc->ngpio);
+ bitmap_complement(reg_direction, reg_direction, gc->ngpio);
+ bitmap_and(irq_mask, irq_mask, reg_direction, gc->ngpio);
+
+@@ -784,13 +788,15 @@ static int pca953x_irq_set_type(struct irq_data *d, unsigned int type)
+ struct device *dev = &chip->client->dev;
+ irq_hw_number_t hwirq = irqd_to_hwirq(d);
+
+- if (!(type & IRQ_TYPE_EDGE_BOTH)) {
++ if (!(type & IRQ_TYPE_SENSE_MASK)) {
+ dev_err(dev, "irq %d: unsupported type %d\n", d->irq, type);
+ return -EINVAL;
+ }
+
+ assign_bit(hwirq, chip->irq_trig_fall, type & IRQ_TYPE_EDGE_FALLING);
+ assign_bit(hwirq, chip->irq_trig_raise, type & IRQ_TYPE_EDGE_RISING);
++ assign_bit(hwirq, chip->irq_trig_level_low, type & IRQ_TYPE_LEVEL_LOW);
++ assign_bit(hwirq, chip->irq_trig_level_high, type & IRQ_TYPE_LEVEL_HIGH);
+
+ return 0;
+ }
+@@ -803,6 +809,8 @@ static void pca953x_irq_shutdown(struct irq_data *d)
+
+ clear_bit(hwirq, chip->irq_trig_raise);
+ clear_bit(hwirq, chip->irq_trig_fall);
++ clear_bit(hwirq, chip->irq_trig_level_low);
++ clear_bit(hwirq, chip->irq_trig_level_high);
+ }
+
+ static void pca953x_irq_print_chip(struct irq_data *data, struct seq_file *p)
+@@ -833,6 +841,7 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
+ DECLARE_BITMAP(cur_stat, MAX_LINE);
+ DECLARE_BITMAP(new_stat, MAX_LINE);
+ DECLARE_BITMAP(trigger, MAX_LINE);
++ DECLARE_BITMAP(edges, MAX_LINE);
+ int ret;
+
+ ret = pca953x_read_regs(chip, chip->regs->input, cur_stat);
+@@ -850,13 +859,26 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
+
+ bitmap_copy(chip->irq_stat, new_stat, gc->ngpio);
+
+- if (bitmap_empty(trigger, gc->ngpio))
+- return false;
++ if (bitmap_empty(chip->irq_trig_level_high, gc->ngpio) &&
++ bitmap_empty(chip->irq_trig_level_low, gc->ngpio)) {
++ if (bitmap_empty(trigger, gc->ngpio))
++ return false;
++ }
+
+ bitmap_and(cur_stat, chip->irq_trig_fall, old_stat, gc->ngpio);
+ bitmap_and(old_stat, chip->irq_trig_raise, new_stat, gc->ngpio);
+- bitmap_or(new_stat, old_stat, cur_stat, gc->ngpio);
+- bitmap_and(pending, new_stat, trigger, gc->ngpio);
++ bitmap_or(edges, old_stat, cur_stat, gc->ngpio);
++ bitmap_and(pending, edges, trigger, gc->ngpio);
++
++ bitmap_and(cur_stat, new_stat, chip->irq_trig_level_high, gc->ngpio);
++ bitmap_and(cur_stat, cur_stat, chip->irq_mask, gc->ngpio);
++ bitmap_or(pending, pending, cur_stat, gc->ngpio);
++
++ bitmap_complement(cur_stat, new_stat, gc->ngpio);
++ bitmap_and(cur_stat, cur_stat, reg_direction, gc->ngpio);
++ bitmap_and(old_stat, cur_stat, chip->irq_trig_level_low, gc->ngpio);
++ bitmap_and(old_stat, old_stat, chip->irq_mask, gc->ngpio);
++ bitmap_or(pending, pending, old_stat, gc->ngpio);
+
+ return !bitmap_empty(pending, gc->ngpio);
+ }
+--
+2.51.0
+
--- /dev/null
+From dbac0105e2ebc49dad10c08b94da8910c58126e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 16:30:25 +0100
+Subject: gpio: pca953x: handle short interrupt pulses on PCAL devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ernest Van Hoecke <ernest.vanhoecke@toradex.com>
+
+[ Upstream commit 014a17deb41201449f76df2b20c857a9c3294a7c ]
+
+GPIO drivers with latch input support may miss short pulses on input
+pins even when input latching is enabled. The generic interrupt logic in
+the pca953x driver reports interrupts by comparing the current input
+value against the previously sampled one and only signals an event when
+a level change is observed between two reads.
+
+For short pulses, the first edge is captured when the input register is
+read, but if the signal returns to its previous level before the read,
+the second edge is not observed. As a result, successive pulses can
+produce identical input values at read time and no level change is
+detected, causing interrupts to be missed. Below timing diagram shows
+this situation where the top signal is the input pin level and the
+bottom signal indicates the latched value.
+
+─────┐ ┌──*───────────────┐ ┌──*─────────────────┐ ┌──*───
+ │ │ . │ │ . │ │ .
+ │ │ │ │ │ │ │ │ │
+ └──*──┘ │ └──*──┘ │ └──*──┘ │
+Input │ │ │ │ │ │
+ ▼ │ ▼ │ ▼ │
+ IRQ │ IRQ │ IRQ │
+ . . .
+─────┐ .┌──────────────┐ .┌────────────────┐ .┌──
+ │ │ │ │ │ │
+ │ │ │ │ │ │
+ └────────*┘ └────────*┘ └────────*┘
+Latched │ │ │
+ ▼ ▼ ▼
+ READ 0 READ 0 READ 0
+ NO CHANGE NO CHANGE
+
+PCAL variants provide an interrupt status register that records which
+pins triggered an interrupt, but the status and input registers cannot
+be read atomically. The interrupt status is only cleared when the input
+port is read, and the input value must also be read to determine the
+triggering edge. If another interrupt occurs on a different line after
+the status register has been read but before the input register is
+sampled, that event will not be reflected in the earlier status
+snapshot, so relying solely on the interrupt status register is also
+insufficient.
+
+Support for input latching and interrupt status handling was previously
+added by [1], but the interrupt status-based logic was reverted by [2]
+due to these issues. This patch addresses the original problem by
+combining both sources of information. Events indicated by the interrupt
+status register are merged with events detected through the existing
+level-change logic. As a result:
+
+* short pulses, whose second edges are invisible, are detected via the
+ interrupt status register, and
+* interrupts that occur between the status and input reads are still
+ caught by the generic level-change logic.
+
+This significantly improves robustness on devices that signal interrupts
+as short pulses, while avoiding the issues that led to the earlier
+reversion. In practice, even if only the first edge of a pulse is
+observable, the interrupt is reliably detected.
+
+This fixes missed interrupts from an Ilitek touch controller with its
+interrupt line connected to a PCAL6416A, where active-low pulses are
+approximately 200 us long.
+
+[1] commit 44896beae605 ("gpio: pca953x: add PCAL9535 interrupt support for Galileo Gen2")
+[2] commit d6179f6c6204 ("gpio: pca953x: Improve interrupt support")
+
+Fixes: d6179f6c6204 ("gpio: pca953x: Improve interrupt support")
+Signed-off-by: Ernest Van Hoecke <ernest.vanhoecke@toradex.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20251217153050.142057-1-ernestvanhoecke@gmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca953x.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index 6b9bfdebadb5a..120d6695a4b55 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -840,14 +840,35 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
+ DECLARE_BITMAP(old_stat, MAX_LINE);
+ DECLARE_BITMAP(cur_stat, MAX_LINE);
+ DECLARE_BITMAP(new_stat, MAX_LINE);
++ DECLARE_BITMAP(int_stat, MAX_LINE);
+ DECLARE_BITMAP(trigger, MAX_LINE);
+ DECLARE_BITMAP(edges, MAX_LINE);
+ int ret;
+
++ if (chip->driver_data & PCA_PCAL) {
++ /* Read INT_STAT before it is cleared by the input-port read. */
++ ret = pca953x_read_regs(chip, PCAL953X_INT_STAT, int_stat);
++ if (ret)
++ return false;
++ }
++
+ ret = pca953x_read_regs(chip, chip->regs->input, cur_stat);
+ if (ret)
+ return false;
+
++ if (chip->driver_data & PCA_PCAL) {
++ /* Detect short pulses via INT_STAT. */
++ bitmap_and(trigger, int_stat, chip->irq_mask, gc->ngpio);
++
++ /* Apply filter for rising/falling edge selection. */
++ bitmap_replace(new_stat, chip->irq_trig_fall, chip->irq_trig_raise,
++ cur_stat, gc->ngpio);
++
++ bitmap_and(int_stat, new_stat, trigger, gc->ngpio);
++ } else {
++ bitmap_zero(int_stat, gc->ngpio);
++ }
++
+ /* Remove output pins from the equation */
+ pca953x_read_regs(chip, chip->regs->direction, reg_direction);
+
+@@ -861,7 +882,8 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
+
+ if (bitmap_empty(chip->irq_trig_level_high, gc->ngpio) &&
+ bitmap_empty(chip->irq_trig_level_low, gc->ngpio)) {
+- if (bitmap_empty(trigger, gc->ngpio))
++ if (bitmap_empty(trigger, gc->ngpio) &&
++ bitmap_empty(int_stat, gc->ngpio))
+ return false;
+ }
+
+@@ -869,6 +891,7 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
+ bitmap_and(old_stat, chip->irq_trig_raise, new_stat, gc->ngpio);
+ bitmap_or(edges, old_stat, cur_stat, gc->ngpio);
+ bitmap_and(pending, edges, trigger, gc->ngpio);
++ bitmap_or(pending, pending, int_stat, gc->ngpio);
+
+ bitmap_and(cur_stat, new_stat, chip->irq_trig_level_high, gc->ngpio);
+ bitmap_and(cur_stat, cur_stat, chip->irq_mask, gc->ngpio);
+--
+2.51.0
+
--- /dev/null
+From 78cf9d68a3ad33ab45254d9c49cc902ea086585b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Sep 2023 16:40:34 +0300
+Subject: gpio: pca953x: Utilise dev_err_probe() where it makes sense
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit c47f7ff0fe61738a40b1b4fef3cd8317ec314079 ]
+
+At least in pca953x_irq_setup() we may use dev_err_probe().
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Stable-dep-of: 014a17deb412 ("gpio: pca953x: handle short interrupt pulses on PCAL devices")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca953x.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index faadbe66b23e7..3a0b999521e44 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -895,6 +895,7 @@ static irqreturn_t pca953x_irq_handler(int irq, void *devid)
+ static int pca953x_irq_setup(struct pca953x_chip *chip, int irq_base)
+ {
+ struct i2c_client *client = chip->client;
++ struct device *dev = &client->dev;
+ DECLARE_BITMAP(reg_direction, MAX_LINE);
+ DECLARE_BITMAP(irq_stat, MAX_LINE);
+ struct gpio_irq_chip *girq;
+@@ -943,11 +944,8 @@ static int pca953x_irq_setup(struct pca953x_chip *chip, int irq_base)
+ NULL, pca953x_irq_handler,
+ IRQF_ONESHOT | IRQF_SHARED,
+ dev_name(&client->dev), chip);
+- if (ret) {
+- dev_err(&client->dev, "failed to request irq %d\n",
+- client->irq);
+- return ret;
+- }
++ if (ret)
++ return dev_err_probe(dev, client->irq, "failed to request irq\n");
+
+ return 0;
+ }
+--
+2.51.0
+
--- /dev/null
+From 013624a867604fb362c04b3de028bfd1a6cc2bd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Sep 2023 16:40:37 +0300
+Subject: gpio: pca953x: Utilise temporary variable for struct device
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 6811886ac91eb414b1b74920e05e6590c3f2a688 ]
+
+We have a temporary variable to keep pointer to struct device.
+Utilise it where it makes sense.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Stable-dep-of: 014a17deb412 ("gpio: pca953x: handle short interrupt pulses on PCAL devices")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca953x.c | 30 ++++++++++++++----------------
+ 1 file changed, 14 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index 3a0b999521e44..de965e6353c5b 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -781,11 +781,11 @@ static int pca953x_irq_set_type(struct irq_data *d, unsigned int type)
+ {
+ struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+ struct pca953x_chip *chip = gpiochip_get_data(gc);
++ struct device *dev = &chip->client->dev;
+ irq_hw_number_t hwirq = irqd_to_hwirq(d);
+
+ if (!(type & IRQ_TYPE_EDGE_BOTH)) {
+- dev_err(&chip->client->dev, "irq %d: unsupported type %d\n",
+- d->irq, type);
++ dev_err(dev, "irq %d: unsupported type %d\n", d->irq, type);
+ return -EINVAL;
+ }
+
+@@ -902,7 +902,7 @@ static int pca953x_irq_setup(struct pca953x_chip *chip, int irq_base)
+ int ret;
+
+ if (dmi_first_match(pca953x_dmi_acpi_irq_info)) {
+- ret = pca953x_acpi_get_irq(&client->dev);
++ ret = pca953x_acpi_get_irq(dev);
+ if (ret > 0)
+ client->irq = ret;
+ }
+@@ -940,10 +940,9 @@ static int pca953x_irq_setup(struct pca953x_chip *chip, int irq_base)
+ girq->threaded = true;
+ girq->first = irq_base; /* FIXME: get rid of this */
+
+- ret = devm_request_threaded_irq(&client->dev, client->irq,
+- NULL, pca953x_irq_handler,
+- IRQF_ONESHOT | IRQF_SHARED,
+- dev_name(&client->dev), chip);
++ ret = devm_request_threaded_irq(dev, client->irq, NULL, pca953x_irq_handler,
++ IRQF_ONESHOT | IRQF_SHARED, dev_name(dev),
++ chip);
+ if (ret)
+ return dev_err_probe(dev, client->irq, "failed to request irq\n");
+
+@@ -951,13 +950,13 @@ static int pca953x_irq_setup(struct pca953x_chip *chip, int irq_base)
+ }
+
+ #else /* CONFIG_GPIO_PCA953X_IRQ */
+-static int pca953x_irq_setup(struct pca953x_chip *chip,
+- int irq_base)
++static int pca953x_irq_setup(struct pca953x_chip *chip, int irq_base)
+ {
+ struct i2c_client *client = chip->client;
++ struct device *dev = &client->dev;
+
+ if (client->irq && irq_base != -1 && (chip->driver_data & PCA_INT))
+- dev_warn(&client->dev, "interrupt support not compiled in\n");
++ dev_warn(dev, "interrupt support not compiled in\n");
+
+ return 0;
+ }
+@@ -1048,11 +1047,11 @@ static int pca953x_probe(struct i2c_client *client)
+ int ret;
+ const struct regmap_config *regmap_config;
+
+- chip = devm_kzalloc(&client->dev, sizeof(*chip), GFP_KERNEL);
++ chip = devm_kzalloc(dev, sizeof(*chip), GFP_KERNEL);
+ if (chip == NULL)
+ return -ENOMEM;
+
+- pdata = dev_get_platdata(&client->dev);
++ pdata = dev_get_platdata(dev);
+ if (pdata) {
+ irq_base = pdata->irq_base;
+ chip->gpio_start = pdata->gpio_base;
+@@ -1069,8 +1068,7 @@ static int pca953x_probe(struct i2c_client *client)
+ * using "reset" GPIO. Otherwise any of those platform
+ * must use _DSD method with corresponding property.
+ */
+- reset_gpio = devm_gpiod_get_optional(&client->dev, "reset",
+- GPIOD_OUT_LOW);
++ reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
+ if (IS_ERR(reset_gpio))
+ return dev_err_probe(dev, PTR_ERR(reset_gpio),
+ "Failed to get reset gpio\n");
+@@ -1090,10 +1088,10 @@ static int pca953x_probe(struct i2c_client *client)
+ pca953x_setup_gpio(chip, chip->driver_data & PCA_GPIO_MASK);
+
+ if (NBANK(chip) > 2 || PCA_CHIP_TYPE(chip->driver_data) == PCA957X_TYPE) {
+- dev_info(&client->dev, "using AI\n");
++ dev_info(dev, "using AI\n");
+ regmap_config = &pca953x_ai_i2c_regmap;
+ } else {
+- dev_info(&client->dev, "using no AI\n");
++ dev_info(dev, "using no AI\n");
+ regmap_config = &pca953x_i2c_regmap;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ca72f42ff4402842f839f41c8c5616447908423d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 13:46:41 +0100
+Subject: HID: quirks: work around VID/PID conflict for appledisplay
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactco.de>
+
+[ Upstream commit c7fabe4ad9219866c203164a214c474c95b36bf2 ]
+
+For years I wondered why the Apple Cinema Display driver would not
+just work for me. Turns out the hidraw driver instantly takes it
+over. Fix by adding appledisplay VID/PIDs to hid_have_special_driver.
+
+Fixes: 069e8a65cd79 ("Driver for Apple Cinema Display")
+Signed-off-by: René Rebe <rene@exactco.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-quirks.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 2da21415e676c..192b8f63baaab 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -232,6 +232,15 @@ static const struct hid_device_id hid_quirks[] = {
+ * used as a driver. See hid_scan_report().
+ */
+ static const struct hid_device_id hid_have_special_driver[] = {
++#if IS_ENABLED(CONFIG_APPLEDISPLAY)
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9218) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9219) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x921c) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x921d) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9222) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9226) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, 0x9236) },
++#endif
+ #if IS_ENABLED(CONFIG_HID_A4TECH)
+ { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) },
+--
+2.51.0
+
--- /dev/null
+From c3ad4d9dc882bf29c6a9963695f9f229528bce2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 14:31:45 +0800
+Subject: inet: ping: Fix icmp out counting
+
+From: yuan.gao <yuan.gao@ucloud.cn>
+
+[ Upstream commit 4c0856c225b39b1def6c9a6bc56faca79550da13 ]
+
+When the ping program uses an IPPROTO_ICMP socket to send ICMP_ECHO
+messages, ICMP_MIB_OUTMSGS is counted twice.
+
+ ping_v4_sendmsg
+ ping_v4_push_pending_frames
+ ip_push_pending_frames
+ ip_finish_skb
+ __ip_make_skb
+ icmp_out_count(net, icmp_type); // first count
+ icmp_out_count(sock_net(sk), user_icmph.type); // second count
+
+However, when the ping program uses an IPPROTO_RAW socket,
+ICMP_MIB_OUTMSGS is counted correctly only once.
+
+Therefore, the first count should be removed.
+
+Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
+Signed-off-by: yuan.gao <yuan.gao@ucloud.cn>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Tested-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20251224063145.3615282-1-yuan.gao@ucloud.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ping.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 5c848136bc266..47f2e7dd554ad 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -839,10 +839,8 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ out_free:
+ if (free)
+ kfree(ipc.opt);
+- if (!err) {
+- icmp_out_count(sock_net(sk), user_icmph.type);
++ if (!err)
+ return len;
+- }
+ return err;
+
+ do_confirm:
+--
+2.51.0
+
--- /dev/null
+From 2c9c0719f0bfe1ae0ea081389de1de62ab0e6e58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jan 2026 17:12:04 +0800
+Subject: net: enetc: fix build warning when PAGE_SIZE is greater than 128K
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit 4b5bdabb5449b652122e43f507f73789041d4abe ]
+
+The max buffer size of ENETC RX BD is 0xFFFF bytes, so if the PAGE_SIZE
+is greater than 128K, ENETC_RXB_DMA_SIZE and ENETC_RXB_DMA_SIZE_XDP will
+be greater than 0xFFFF, thus causing a build warning.
+
+This will not cause any practical issues because ENETC is currently only
+used on the ARM64 platform, and the max PAGE_SIZE is 64K. So this patch
+is only for fixing the build warning that occurs when compiling ENETC
+drivers for other platforms.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202601050637.kHEKKOG7-lkp@intel.com/
+Fixes: e59bc32df2e9 ("net: enetc: correct the value of ENETC_RXB_TRUESIZE")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20260107091204.1980222-1-wei.fang@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h
+index dcf3e4b4e3f55..14b2f471fc68f 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc.h
++++ b/drivers/net/ethernet/freescale/enetc/enetc.h
+@@ -44,9 +44,9 @@ struct enetc_tx_swbd {
+ #define ENETC_RXB_TRUESIZE (PAGE_SIZE >> 1)
+ #define ENETC_RXB_PAD NET_SKB_PAD /* add extra space if needed */
+ #define ENETC_RXB_DMA_SIZE \
+- (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD)
++ min(SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - ENETC_RXB_PAD, 0xffff)
+ #define ENETC_RXB_DMA_SIZE_XDP \
+- (SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - XDP_PACKET_HEADROOM)
++ min(SKB_WITH_OVERHEAD(ENETC_RXB_TRUESIZE) - XDP_PACKET_HEADROOM, 0xffff)
+
+ struct enetc_rx_swbd {
+ dma_addr_t dma;
+--
+2.51.0
+
--- /dev/null
+From 2226784ccea63aef2e63464fdab473c255fd869c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jan 2026 23:31:01 +0200
+Subject: net: fix memory leak in skb_segment_list for GRO packets
+
+From: Mohammad Heib <mheib@redhat.com>
+
+[ Upstream commit 238e03d0466239410b72294b79494e43d4fabe77 ]
+
+When skb_segment_list() is called during packet forwarding, it handles
+packets that were aggregated by the GRO engine.
+
+Historically, the segmentation logic in skb_segment_list assumes that
+individual segments are split from a parent SKB and may need to carry
+their own socket memory accounting. Accordingly, the code transfers
+truesize from the parent to the newly created segments.
+
+Prior to commit ed4cccef64c1 ("gro: fix ownership transfer"), this
+truesize subtraction in skb_segment_list() was valid because fragments
+still carry a reference to the original socket.
+
+However, commit ed4cccef64c1 ("gro: fix ownership transfer") changed
+this behavior by ensuring that fraglist entries are explicitly
+orphaned (skb->sk = NULL) to prevent illegal orphaning later in the
+stack. This change meant that the entire socket memory charge remained
+with the head SKB, but the corresponding accounting logic in
+skb_segment_list() was never updated.
+
+As a result, the current code unconditionally adds each fragment's
+truesize to delta_truesize and subtracts it from the parent SKB. Since
+the fragments are no longer charged to the socket, this subtraction
+results in an effective under-count of memory when the head is freed.
+This causes sk_wmem_alloc to remain non-zero, preventing socket
+destruction and leading to a persistent memory leak.
+
+The leak can be observed via KMEMLEAK when tearing down the networking
+environment:
+
+unreferenced object 0xffff8881e6eb9100 (size 2048):
+ comm "ping", pid 6720, jiffies 4295492526
+ backtrace:
+ kmem_cache_alloc_noprof+0x5c6/0x800
+ sk_prot_alloc+0x5b/0x220
+ sk_alloc+0x35/0xa00
+ inet6_create.part.0+0x303/0x10d0
+ __sock_create+0x248/0x640
+ __sys_socket+0x11b/0x1d0
+
+Since skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST
+packets constructed by GRO, the truesize adjustment is removed.
+
+The call to skb_release_head_state() must be preserved. As documented in
+commit cf673ed0e057 ("net: fix fraglist segmentation reference count
+leak"), it is still required to correctly drop references to SKB
+extensions that may be overwritten during __copy_skb_header().
+
+Fixes: ed4cccef64c1 ("gro: fix ownership transfer")
+Signed-off-by: Mohammad Heib <mheib@redhat.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Link: https://patch.msgid.link/20260104213101.352887-1-mheib@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skbuff.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 073e2c5274079..4c28954f915fa 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4344,12 +4344,14 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
+ {
+ struct sk_buff *list_skb = skb_shinfo(skb)->frag_list;
+ unsigned int tnl_hlen = skb_tnl_header_len(skb);
+- unsigned int delta_truesize = 0;
+ unsigned int delta_len = 0;
+ struct sk_buff *tail = NULL;
+ struct sk_buff *nskb, *tmp;
+ int len_diff, err;
+
++ /* Only skb_gro_receive_list generated skbs arrive here */
++ DEBUG_NET_WARN_ON_ONCE(!(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST));
++
+ skb_push(skb, -skb_network_offset(skb) + offset);
+
+ /* Ensure the head is writeable before touching the shared info */
+@@ -4363,8 +4365,9 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
+ nskb = list_skb;
+ list_skb = list_skb->next;
+
++ DEBUG_NET_WARN_ON_ONCE(nskb->sk);
++
+ err = 0;
+- delta_truesize += nskb->truesize;
+ if (skb_shared(nskb)) {
+ tmp = skb_clone(nskb, GFP_ATOMIC);
+ if (tmp) {
+@@ -4407,7 +4410,6 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
+ goto err_linearize;
+ }
+
+- skb->truesize = skb->truesize - delta_truesize;
+ skb->data_len = skb->data_len - delta_len;
+ skb->len = skb->len - delta_len;
+
+--
+2.51.0
+
--- /dev/null
+From c6201f3e7bc282e891bbde0548016f25ca43083f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Dec 2025 21:21:18 -0800
+Subject: net: marvell: prestera: fix NULL dereference on devlink_alloc()
+ failure
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit a428e0da1248c353557970848994f35fd3f005e2 ]
+
+devlink_alloc() may return NULL on allocation failure, but
+prestera_devlink_alloc() unconditionally calls devlink_priv() on
+the returned pointer.
+
+This leads to a NULL pointer dereference if devlink allocation fails.
+Add a check for a NULL devlink pointer and return NULL early to avoid
+the crash.
+
+Fixes: 34dd1710f5a3 ("net: marvell: prestera: Add basic devlink support")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Acked-by: Elad Nachman <enachman@marvell.com>
+Link: https://patch.msgid.link/20251230052124.897012-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/prestera/prestera_devlink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/prestera/prestera_devlink.c b/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
+index 2a4c9df4eb797..e63d95c1842f3 100644
+--- a/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
++++ b/drivers/net/ethernet/marvell/prestera/prestera_devlink.c
+@@ -387,6 +387,8 @@ struct prestera_switch *prestera_devlink_alloc(struct prestera_device *dev)
+
+ dl = devlink_alloc(&prestera_dl_ops, sizeof(struct prestera_switch),
+ dev->dev);
++ if (!dl)
++ return NULL;
+
+ return devlink_priv(dl);
+ }
+--
+2.51.0
+
--- /dev/null
+From 1e98ae0ed8948198baffca17d9b5eaf2a1321128 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Dec 2025 15:27:16 +0200
+Subject: net/mlx5e: Don't print error message due to invalid module
+
+From: Gal Pressman <gal@nvidia.com>
+
+[ Upstream commit 144297e2a24e3e54aee1180ec21120ea38822b97 ]
+
+Dumping module EEPROM on newer modules is supported through the netlink
+interface only.
+
+Querying with old userspace ethtool (or other tools, such as 'lshw')
+which still uses the ioctl interface results in an error message that
+could flood dmesg (in addition to the expected error return value).
+The original message was added under the assumption that the driver
+should be able to handle all module types, but now that such flows are
+easily triggered from userspace, it doesn't serve its purpose.
+
+Change the log level of the print in mlx5_query_module_eeprom() to
+debug.
+
+Fixes: bb64143eee8c ("net/mlx5e: Add ethtool support for dump module EEPROM")
+Signed-off-by: Gal Pressman <gal@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Link: https://patch.msgid.link/20251225132717.358820-5-mbloch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/port.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+index 749f0fc2c189a..a5622b44385eb 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c
+@@ -432,7 +432,8 @@ int mlx5_query_module_eeprom(struct mlx5_core_dev *dev,
+ mlx5_qsfp_eeprom_params_set(&query.i2c_address, &query.page, &offset);
+ break;
+ default:
+- mlx5_core_err(dev, "Module ID not recognized: 0x%x\n", module_id);
++ mlx5_core_dbg(dev, "Module ID not recognized: 0x%x\n",
++ module_id);
+ return -EINVAL;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b192432f6e8e0d8cf11bec6ad2fea522e385d2b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Dec 2025 20:36:17 +0000
+Subject: net: mscc: ocelot: Fix crash when adding interface under a lag
+
+From: Jerry Wu <w.7erry@foxmail.com>
+
+[ Upstream commit 34f3ff52cb9fa7dbf04f5c734fcc4cb6ed5d1a95 ]
+
+Commit 15faa1f67ab4 ("lan966x: Fix crash when adding interface under a lag")
+fixed a similar issue in the lan966x driver caused by a NULL pointer dereference.
+The ocelot_set_aggr_pgids() function in the ocelot driver has similar logic
+and is susceptible to the same crash.
+
+This issue specifically affects the ocelot_vsc7514.c frontend, which leaves
+unused ports as NULL pointers. The felix_vsc9959.c frontend is unaffected as
+it uses the DSA framework which registers all ports.
+
+Fix this by checking if the port pointer is valid before accessing it.
+
+Fixes: 528d3f190c98 ("net: mscc: ocelot: drop the use of the "lags" array")
+Signed-off-by: Jerry Wu <w.7erry@foxmail.com>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/tencent_75EF812B305E26B0869C673DD1160866C90A@qq.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index 252d8e6f18c3c..a77d42d611dab 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -2307,14 +2307,16 @@ static void ocelot_set_aggr_pgids(struct ocelot *ocelot)
+
+ /* Now, set PGIDs for each active LAG */
+ for (lag = 0; lag < ocelot->num_phys_ports; lag++) {
+- struct net_device *bond = ocelot->ports[lag]->bond;
++ struct ocelot_port *ocelot_port = ocelot->ports[lag];
+ int num_active_ports = 0;
++ struct net_device *bond;
+ unsigned long bond_mask;
+ u8 aggr_idx[16];
+
+- if (!bond || (visited & BIT(lag)))
++ if (!ocelot_port || !ocelot_port->bond || (visited & BIT(lag)))
+ continue;
+
++ bond = ocelot_port->bond;
+ bond_mask = ocelot_get_bond_mask(ocelot, bond);
+
+ for_each_set_bit(port, &bond_mask, ocelot->num_phys_ports) {
+--
+2.51.0
+
--- /dev/null
+From 66fb4a416b86b3394924757d4cb9b142f39fe1f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jan 2026 20:41:00 -0700
+Subject: net/sched: sch_qfq: Fix NULL deref when deactivating inactive
+ aggregate in qfq_reset
+
+From: Xiang Mei <xmei5@asu.edu>
+
+[ Upstream commit c1d73b1480235731e35c81df70b08f4714a7d095 ]
+
+`qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class
+itself is active.
+
+Two qfq_class objects may point to the same leaf_qdisc. This happens
+when:
+
+1. one QFQ qdisc is attached to the dev as the root qdisc, and
+
+2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()
+/ qdisc_put()) and is pending to be destroyed, as in function
+tc_new_tfilter.
+
+When packets are enqueued through the root QFQ qdisc, the shared
+leaf_qdisc->q.qlen increases. At the same time, the second QFQ
+qdisc triggers qdisc_put and qdisc_destroy: the qdisc enters
+qfq_reset() with its own q->q.qlen == 0, but its class's leaf
+qdisc->q.qlen > 0. Therefore, the qfq_reset would wrongly deactivate
+an inactive aggregate and trigger a null-deref in qfq_deactivate_agg:
+
+[ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[ 0.903571] #PF: supervisor write access in kernel mode
+[ 0.903860] #PF: error_code(0x0002) - not-present page
+[ 0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0
+[ 0.904502] Oops: Oops: 0002 [#1] SMP NOPTI
+[ 0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE
+[ 0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
+[ 0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))
+[ 0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0
+
+Code starting with the faulting instruction
+===========================================
+ 0: 0f 84 4d 01 00 00 je 0x153
+ 6: 48 89 70 18 mov %rsi,0x18(%rax)
+ a: 8b 4b 10 mov 0x10(%rbx),%ecx
+ d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx
+ 14: 48 8b 78 08 mov 0x8(%rax),%rdi
+ 18: 48 d3 e2 shl %cl,%rdx
+ 1b: 48 21 f2 and %rsi,%rdx
+ 1e: 48 2b 13 sub (%rbx),%rdx
+ 21: 48 8b 30 mov (%rax),%rsi
+ 24: 48 d3 ea shr %cl,%rdx
+ 27: 8b 4b 18 mov 0x18(%rbx),%ecx
+ ...
+[ 0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246
+[ 0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000
+[ 0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+[ 0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000
+[ 0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000
+[ 0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880
+[ 0.909179] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000
+[ 0.909572] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0
+[ 0.910247] PKRU: 55555554
+[ 0.910391] Call Trace:
+[ 0.910527] <TASK>
+[ 0.910638] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)
+[ 0.910826] qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)
+[ 0.911040] __qdisc_destroy (net/sched/sch_generic.c:1076)
+[ 0.911236] tc_new_tfilter (net/sched/cls_api.c:2447)
+[ 0.911447] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)
+[ 0.911663] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)
+[ 0.911894] netlink_rcv_skb (net/netlink/af_netlink.c:2550)
+[ 0.912100] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)
+[ 0.912296] ? __alloc_skb (net/core/skbuff.c:706)
+[ 0.912484] netlink_sendmsg (net/netlink/af_netlink.c:1894)
+[ 0.912682] sock_write_iter (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1) net/socket.c:1195 (discriminator 1))
+[ 0.912880] vfs_write (fs/read_write.c:593 fs/read_write.c:686)
+[ 0.913077] ksys_write (fs/read_write.c:738)
+[ 0.913252] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
+[ 0.913438] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)
+[ 0.913687] RIP: 0033:0x424c34
+[ 0.913844] Code: 89 02 48 c7 c0 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d 2d 44 09 00 00 74 13 b8 01 00 00 00 0f 05 9
+
+Code starting with the faulting instruction
+===========================================
+ 0: 89 02 mov %eax,(%rdx)
+ 2: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
+ 9: eb bd jmp 0xffffffffffffffc8
+ b: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
+ 12: 00 00 00
+ 15: 90 nop
+ 16: f3 0f 1e fa endbr64
+ 1a: 80 3d 2d 44 09 00 00 cmpb $0x0,0x9442d(%rip) # 0x9444e
+ 21: 74 13 je 0x36
+ 23: b8 01 00 00 00 mov $0x1,%eax
+ 28: 0f 05 syscall
+ 2a: 09 .byte 0x9
+[ 0.914807] RSP: 002b:00007ffea1938b78 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
+[ 0.915197] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000424c34
+[ 0.915556] RDX: 000000000000003c RSI: 000000002af378c0 RDI: 0000000000000003
+[ 0.915912] RBP: 00007ffea1938bc0 R08: 00000000004b8820 R09: 0000000000000000
+[ 0.916297] R10: 0000000000000001 R11: 0000000000000202 R12: 00007ffea1938d28
+[ 0.916652] R13: 00007ffea1938d38 R14: 00000000004b3828 R15: 0000000000000001
+[ 0.917039] </TASK>
+[ 0.917158] Modules linked in:
+[ 0.917316] CR2: 0000000000000000
+[ 0.917484] ---[ end trace 0000000000000000 ]---
+[ 0.917717] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))
+[ 0.917978] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0
+
+Code starting with the faulting instruction
+===========================================
+ 0: 0f 84 4d 01 00 00 je 0x153
+ 6: 48 89 70 18 mov %rsi,0x18(%rax)
+ a: 8b 4b 10 mov 0x10(%rbx),%ecx
+ d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx
+ 14: 48 8b 78 08 mov 0x8(%rax),%rdi
+ 18: 48 d3 e2 shl %cl,%rdx
+ 1b: 48 21 f2 and %rsi,%rdx
+ 1e: 48 2b 13 sub (%rbx),%rdx
+ 21: 48 8b 30 mov (%rax),%rsi
+ 24: 48 d3 ea shr %cl,%rdx
+ 27: 8b 4b 18 mov 0x18(%rbx),%ecx
+ ...
+[ 0.918902] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246
+[ 0.919198] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000
+[ 0.919559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+[ 0.919908] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000
+[ 0.920289] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000
+[ 0.920648] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880
+[ 0.921014] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000
+[ 0.921424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 0.921710] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0
+[ 0.922097] PKRU: 55555554
+[ 0.922240] Kernel panic - not syncing: Fatal exception
+[ 0.922590] Kernel Offset: disabled
+
+Fixes: 0545a3037773 ("pkt_sched: QFQ - quick fair queue scheduler")
+Signed-off-by: Xiang Mei <xmei5@asu.edu>
+Link: https://patch.msgid.link/20260106034100.1780779-1-xmei5@asu.edu
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_qfq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
+index 69fdbbbb3b634..29847c28ffaca 100644
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -1484,7 +1484,7 @@ static void qfq_reset_qdisc(struct Qdisc *sch)
+
+ for (i = 0; i < q->clhash.hashsize; i++) {
+ hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
+- if (cl->qdisc->q.qlen > 0)
++ if (cl_is_active(cl))
+ qfq_deactivate_class(q, cl);
+
+ qdisc_reset(cl->qdisc);
+--
+2.51.0
+
--- /dev/null
+From c064996cff94744effda3c3720be10e308673751 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 04:35:35 +0800
+Subject: net: sock: fix hardened usercopy panic in sock_recv_errqueue
+
+From: Weiming Shi <bestswngs@gmail.com>
+
+[ Upstream commit 2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20 ]
+
+skbuff_fclone_cache was created without defining a usercopy region,
+[1] unlike skbuff_head_cache which properly whitelists the cb[] field.
+[2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is
+enabled and the kernel attempts to copy sk_buff.cb data to userspace
+via sock_recv_errqueue() -> put_cmsg().
+
+The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone()
+ (from skbuff_fclone_cache) [1]
+2. The skb is cloned via skb_clone() using the pre-allocated fclone
+[3] 3. The cloned skb is queued to sk_error_queue for timestamp
+reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE)
+5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb
+[4] 6. __check_heap_object() fails because skbuff_fclone_cache has no
+ usercopy whitelist [5]
+
+When cloned skbs allocated from skbuff_fclone_cache are used in the
+socket error queue, accessing the sock_exterr_skb structure in skb->cb
+via put_cmsg() triggers a usercopy hardening violation:
+
+[ 5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' (offset 296, size 16)!
+[ 5.382796] kernel BUG at mm/usercopy.c:102!
+[ 5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
+[ 5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7
+[ 5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
+[ 5.384903] RIP: 0010:usercopy_abort+0x6c/0x80
+[ 5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff <0f> 0b 490
+[ 5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246
+[ 5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74
+[ 5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0
+[ 5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74
+[ 5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001
+[ 5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00
+[ 5.384903] FS: 0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000
+[ 5.384903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0
+[ 5.384903] PKRU: 55555554
+[ 5.384903] Call Trace:
+[ 5.384903] <TASK>
+[ 5.384903] __check_heap_object+0x9a/0xd0
+[ 5.384903] __check_object_size+0x46c/0x690
+[ 5.384903] put_cmsg+0x129/0x5e0
+[ 5.384903] sock_recv_errqueue+0x22f/0x380
+[ 5.384903] tls_sw_recvmsg+0x7ed/0x1960
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5.384903] ? schedule+0x6d/0x270
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+[ 5.384903] ? mutex_unlock+0x81/0xd0
+[ 5.384903] ? __pfx_mutex_unlock+0x10/0x10
+[ 5.384903] ? __pfx_tls_sw_recvmsg+0x10/0x10
+[ 5.384903] ? _raw_spin_lock_irqsave+0x8f/0xf0
+[ 5.384903] ? _raw_read_unlock_irqrestore+0x20/0x40
+[ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5
+
+The crash offset 296 corresponds to skb2->cb within skbuff_fclones:
+ - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 -
+ offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 =
+ 272 + 24 (inside sock_exterr_skb.ee)
+
+This patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure.
+
+[1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885
+[2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104
+[3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566
+[4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491
+[5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719
+
+Fixes: 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0")
+Reported-by: Xiang Mei <xmei5@asu.edu>
+Signed-off-by: Weiming Shi <bestswngs@gmail.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20251223203534.1392218-2-bestswngs@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 91f101231309d..8e4c87a39dc87 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3653,7 +3653,7 @@ void sock_enable_timestamp(struct sock *sk, enum sock_flags flag)
+ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+ int level, int type)
+ {
+- struct sock_exterr_skb *serr;
++ struct sock_extended_err ee;
+ struct sk_buff *skb;
+ int copied, err;
+
+@@ -3673,8 +3673,9 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
+
+ sock_recv_timestamp(msg, sk, skb);
+
+- serr = SKB_EXT_ERR(skb);
+- put_cmsg(msg, level, type, sizeof(serr->ee), &serr->ee);
++ /* We must use a bounce buffer for CONFIG_HARDENED_USERCOPY=y */
++ ee = SKB_EXT_ERR(skb)->ee;
++ put_cmsg(msg, level, type, sizeof(ee), &ee);
+
+ msg->msg_flags |= MSG_ERRQUEUE;
+ err = copied;
+--
+2.51.0
+
--- /dev/null
+From 6f3f461d3a583c66e6efbf1020fea95553220b79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jan 2026 10:48:21 +0200
+Subject: net: usb: pegasus: fix memory leak in update_eth_regs_async()
+
+From: Petko Manolov <petkan@nucleusys.com>
+
+[ Upstream commit afa27621a28af317523e0836dad430bec551eb54 ]
+
+When asynchronously writing to the device registers and if usb_submit_urb()
+fail, the code fail to release allocated to this point resources.
+
+Fixes: 323b34963d11 ("drivers: net: usb: pegasus: fix control urb submission")
+Signed-off-by: Petko Manolov <petkan@nucleusys.com>
+Link: https://patch.msgid.link/20260106084821.3746677-1-petko.manolov@konsulko.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/pegasus.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
+index 81ca64debc5b9..c514483134f05 100644
+--- a/drivers/net/usb/pegasus.c
++++ b/drivers/net/usb/pegasus.c
+@@ -168,6 +168,8 @@ static int update_eth_regs_async(pegasus_t *pegasus)
+ netif_device_detach(pegasus->net);
+ netif_err(pegasus, drv, pegasus->net,
+ "%s returned %d\n", __func__, ret);
++ usb_free_urb(async_urb);
++ kfree(req);
+ }
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From 66c27b8f707da4b0a9f39506f03e28d63ecc1830 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Dec 2025 07:18:53 +0000
+Subject: net: wwan: iosm: Fix memory leak in ipc_mux_deinit()
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit 92e6e0a87f6860a4710f9494f8c704d498ae60f8 ]
+
+Commit 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support")
+allocated memory for pp_qlt in ipc_mux_init() but did not free it in
+ipc_mux_deinit(). This results in a memory leak when the driver is
+unloaded.
+
+Free the allocated memory in ipc_mux_deinit() to fix the leak.
+
+Fixes: 1f52d7b62285 ("net: wwan: iosm: Enable M.2 7360 WWAN card support")
+Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
+Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Link: https://patch.msgid.link/20251230071853.1062223-1-zilin@seu.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wwan/iosm/iosm_ipc_mux.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wwan/iosm/iosm_ipc_mux.c b/drivers/net/wwan/iosm/iosm_ipc_mux.c
+index fc928b298a984..b846889fcb099 100644
+--- a/drivers/net/wwan/iosm/iosm_ipc_mux.c
++++ b/drivers/net/wwan/iosm/iosm_ipc_mux.c
+@@ -456,6 +456,7 @@ void ipc_mux_deinit(struct iosm_mux *ipc_mux)
+ struct sk_buff_head *free_list;
+ union mux_msg mux_msg;
+ struct sk_buff *skb;
++ int i;
+
+ if (!ipc_mux->initialized)
+ return;
+@@ -479,5 +480,10 @@ void ipc_mux_deinit(struct iosm_mux *ipc_mux)
+ ipc_mux->channel->dl_pipe.is_open = false;
+ }
+
++ if (ipc_mux->protocol != MUX_LITE) {
++ for (i = 0; i < IPC_MEM_MUX_IP_SESSION_ENTRIES; i++)
++ kfree(ipc_mux->ul_adb.pp_qlt[i]);
++ }
++
+ kfree(ipc_mux);
+ }
+--
+2.51.0
+
--- /dev/null
+From 571e48dbe04883fe274cc9d2e52ba93030ecc101 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 09:22:24 +0800
+Subject: netdev: preserve NETIF_F_ALL_FOR_ALL across TSO updates
+
+From: Di Zhu <zhud@hygon.cn>
+
+[ Upstream commit 02d1e1a3f9239cdb3ecf2c6d365fb959d1bf39df ]
+
+Directly increment the TSO features incurs a side effect: it will also
+directly clear the flags in NETIF_F_ALL_FOR_ALL on the master device,
+which can cause issues such as the inability to enable the nocache copy
+feature on the bonding driver.
+
+The fix is to include NETIF_F_ALL_FOR_ALL in the update mask, thereby
+preventing it from being cleared.
+
+Fixes: b0ce3508b25e ("bonding: allow TSO being set on bonding master")
+Signed-off-by: Di Zhu <zhud@hygon.cn>
+Link: https://patch.msgid.link/20251224012224.56185-1-zhud@hygon.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netdevice.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 030d9de2ba2d2..202e557496fb4 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -4998,7 +4998,8 @@ netdev_features_t netdev_increment_features(netdev_features_t all,
+ static inline netdev_features_t netdev_add_tso_features(netdev_features_t features,
+ netdev_features_t mask)
+ {
+- return netdev_increment_features(features, NETIF_F_ALL_TSO, mask);
++ return netdev_increment_features(features, NETIF_F_ALL_TSO |
++ NETIF_F_ALL_FOR_ALL, mask);
+ }
+
+ int __netdev_update_features(struct net_device *dev);
+--
+2.51.0
+
--- /dev/null
+From e53fc9aa531dc11a64bd4cbd0e01012a2a73afa1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 15:46:40 +0100
+Subject: netfilter: nf_conncount: update last_gc only when GC has been
+ performed
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 7811ba452402d58628e68faedf38745b3d485e3c ]
+
+Currently last_gc is being updated everytime a new connection is
+tracked, that means that it is updated even if a GC wasn't performed.
+With a sufficiently high packet rate, it is possible to always bypass
+the GC, causing the list to grow infinitely.
+
+Update the last_gc value only when a GC has been actually performed.
+
+Fixes: d265929930e2 ("netfilter: nf_conncount: reduce unnecessary GC")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conncount.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
+index c00b8e522c5a7..a2c5a7ba0c6fc 100644
+--- a/net/netfilter/nf_conncount.c
++++ b/net/netfilter/nf_conncount.c
+@@ -229,6 +229,7 @@ static int __nf_conncount_add(struct net *net,
+
+ nf_ct_put(found_ct);
+ }
++ list->last_gc = (u32)jiffies;
+
+ add_new_node:
+ if (WARN_ON_ONCE(list->count > INT_MAX)) {
+@@ -248,7 +249,6 @@ static int __nf_conncount_add(struct net *net,
+ conn->jiffies32 = (u32)jiffies;
+ list_add_tail(&conn->node, &list->head);
+ list->count++;
+- list->last_gc = (u32)jiffies;
+
+ out_put:
+ if (refcounted)
+--
+2.51.0
+
--- /dev/null
+From 86a21302997bdbc20b389dc38b28a3cb2b065a64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Dec 2025 12:48:26 +0000
+Subject: netfilter: nf_tables: fix memory leak in nf_tables_newrule()
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit d077e8119ddbb4fca67540f1a52453631a47f221 ]
+
+In nf_tables_newrule(), if nft_use_inc() fails, the function jumps to
+the err_release_rule label without freeing the allocated flow, leading
+to a memory leak.
+
+Fix this by adding a new label err_destroy_flow and jumping to it when
+nft_use_inc() fails. This ensures that the flow is properly released
+in this error case.
+
+Fixes: 1689f25924ada ("netfilter: nf_tables: report use refcount overflow")
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 394ee65e1d35f..43ebe3b4f886a 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4098,7 +4098,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
+
+ if (!nft_use_inc(&chain->use)) {
+ err = -EMFILE;
+- goto err_release_rule;
++ goto err_destroy_flow;
+ }
+
+ if (info->nlh->nlmsg_flags & NLM_F_REPLACE) {
+@@ -4148,6 +4148,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
+
+ err_destroy_flow_rule:
+ nft_use_dec_restore(&chain->use);
++err_destroy_flow:
+ if (flow)
+ nft_flow_rule_destroy(flow);
+ err_release_rule:
+--
+2.51.0
+
--- /dev/null
+From 2f674a52838d1879558be793ce7aeb3f9da64483 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 21:21:59 +0100
+Subject: netfilter: nft_synproxy: avoid possible data-race on update operation
+
+From: Fernando Fernandez Mancera <fmancera@suse.de>
+
+[ Upstream commit 36a3200575642846a96436d503d46544533bb943 ]
+
+During nft_synproxy eval we are reading nf_synproxy_info struct which
+can be modified on update operation concurrently. As nf_synproxy_info
+struct fits in 32 bits, use READ_ONCE/WRITE_ONCE annotations.
+
+Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
+Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_synproxy.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
+index 5d3e518259859..4d3e5a31b4125 100644
+--- a/net/netfilter/nft_synproxy.c
++++ b/net/netfilter/nft_synproxy.c
+@@ -48,7 +48,7 @@ static void nft_synproxy_eval_v4(const struct nft_synproxy *priv,
+ struct tcphdr *_tcph,
+ struct synproxy_options *opts)
+ {
+- struct nf_synproxy_info info = priv->info;
++ struct nf_synproxy_info info = READ_ONCE(priv->info);
+ struct net *net = nft_net(pkt);
+ struct synproxy_net *snet = synproxy_pernet(net);
+ struct sk_buff *skb = pkt->skb;
+@@ -79,7 +79,7 @@ static void nft_synproxy_eval_v6(const struct nft_synproxy *priv,
+ struct tcphdr *_tcph,
+ struct synproxy_options *opts)
+ {
+- struct nf_synproxy_info info = priv->info;
++ struct nf_synproxy_info info = READ_ONCE(priv->info);
+ struct net *net = nft_net(pkt);
+ struct synproxy_net *snet = synproxy_pernet(net);
+ struct sk_buff *skb = pkt->skb;
+@@ -340,7 +340,7 @@ static void nft_synproxy_obj_update(struct nft_object *obj,
+ struct nft_synproxy *newpriv = nft_obj_data(newobj);
+ struct nft_synproxy *priv = nft_obj_data(obj);
+
+- priv->info = newpriv->info;
++ WRITE_ONCE(priv->info, newpriv->info);
+ }
+
+ static struct nft_object_type nft_synproxy_obj_type;
+--
+2.51.0
+
scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch
scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch
scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch
+arm64-dts-add-off-on-delay-us-for-usdhc2-regulator.patch
+arm-dts-imx6q-ba16-fix-rtc-interrupt-level.patch
+arm64-dts-imx8mp-fix-lan8740ai-phy-reference-clock-o.patch
+netfilter-nft_synproxy-avoid-possible-data-race-on-u.patch
+gpio-pca953x-utilise-dev_err_probe-where-it-makes-se.patch
+gpio-pca953x-utilise-temporary-variable-for-struct-d.patch
+gpio-pca953x-add-support-for-level-triggered-interru.patch
+gpio-pca953x-handle-short-interrupt-pulses-on-pcal-d.patch
+netfilter-nf_tables-fix-memory-leak-in-nf_tables_new.patch
+netfilter-nf_conncount-update-last_gc-only-when-gc-h.patch
+net-marvell-prestera-fix-null-dereference-on-devlink.patch
+bridge-fix-c-vlan-preservation-in-802.1ad-vlan_tunne.patch
+net-mscc-ocelot-fix-crash-when-adding-interface-unde.patch
+inet-ping-fix-icmp-out-counting.patch
+net-sock-fix-hardened-usercopy-panic-in-sock_recv_er.patch
+netdev-preserve-netif_f_all_for_all-across-tso-updat.patch
+net-mlx5e-don-t-print-error-message-due-to-invalid-m.patch
+net-wwan-iosm-fix-memory-leak-in-ipc_mux_deinit.patch
+bnxt_en-fix-potential-data-corruption-with-hw-gro-lr.patch
+net-fix-memory-leak-in-skb_segment_list-for-gro-pack.patch
+hid-quirks-work-around-vid-pid-conflict-for-appledis.patch
+net-sched-sch_qfq-fix-null-deref-when-deactivating-i.patch
+net-usb-pegasus-fix-memory-leak-in-update_eth_regs_a.patch
+net-enetc-fix-build-warning-when-page_size-is-greate.patch
+arp-do-not-assume-dev_hard_header-does-not-change-sk.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
