--- /dev/null
+From e2c30e03ffa3b671678ef20221957bf26c72b943 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 17:18:39 +0200
+Subject: ALSA: hda/realtek: Add mic-mute LED setup for ASUS UM5606
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 41c66461cb2e8d3934a5395f27e572ebe63696b4 ]
+
+ASUS UM5606* models use the quirk to set up the bass speakers, but it
+missed the mic-mute LED configuration. Other similar models have the
+AMD ACP dmic, and the mic-mute is set up for that, but those models
+don't have AMD ACP but rather built-in mics of Realtek codec, hence
+the Realtek driver should set it up, instead.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=220125
+Link: https://patch.msgid.link/20250623151841.28810-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 30e9e26c5b2a7..57f17ddaf7860 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6611,6 +6611,7 @@ static void alc294_fixup_bass_speaker_15(struct hda_codec *codec,
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+ static const hda_nid_t conn[] = { 0x02, 0x03 };
+ snd_hda_override_conn_list(codec, 0x15, ARRAY_SIZE(conn), conn);
++ snd_hda_gen_add_micmute_led_cdev(codec, NULL);
+ }
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 25880af814d2653d07e221701415b886ceaa4375 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jun 2025 14:43:29 -0600
+Subject: ALSA: hda/realtek: Add quirks for some Clevo laptops
+
+From: Tim Crawford <tcrawford@system76.com>
+
+[ Upstream commit e41687b511d5e5437db5d2151e23c115dba30411 ]
+
+Add audio quirks to fix speaker output and headset detection on the
+following Clevo models:
+
+- V350ENC
+- V350WNPQ
+- V540TU
+- X560WNR
+- X580WNS
+
+Signed-off-by: Tim Crawford <tcrawford@system76.com>
+Link: https://patch.msgid.link/20250620204329.35878-1-tcrawford@system76.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 0bc59b6f1b9a6..e98823bd3634f 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2658,6 +2658,7 @@ static const struct hda_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
+ SND_PCI_QUIRK(0x1558, 0x3702, "Clevo X370SN[VW]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x50d3, "Clevo PC50[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x5802, "Clevo X58[05]WN[RST]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x65d1, "Clevo PB51[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x65d2, "Clevo PB51R[CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x65e1, "Clevo PB51[ED][DF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+@@ -11046,6 +11047,8 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x14a1, "Clevo L141MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x2624, "Clevo L240TU", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x28c1, "Clevo V370VND", ALC2XX_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1558, 0x35a1, "Clevo V3[56]0EN[CDE]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x35b1, "Clevo V3[57]0WN[MNP]Q", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x4018, "Clevo NV40M[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x4019, "Clevo NV40MZ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x4020, "Clevo NV40MB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+@@ -11073,6 +11076,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x51b1, "Clevo NS50AU", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x51b3, "Clevo NS70AU", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x5630, "Clevo NP50RNJS", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x5700, "Clevo X560WN[RST]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x70a1, "Clevo NB70T[HJK]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x70b3, "Clevo NK70SB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x70f2, "Clevo NH79EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+@@ -11112,6 +11116,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0xa650, "Clevo NP[567]0SN[CD]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0xa671, "Clevo NP70SN[CDE]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0xa741, "Clevo V54x_6x_TNE", ALC245_FIXUP_CLEVO_NOISY_MIC),
++ SND_PCI_QUIRK(0x1558, 0xa743, "Clevo V54x_6x_TU", ALC245_FIXUP_CLEVO_NOISY_MIC),
+ SND_PCI_QUIRK(0x1558, 0xa763, "Clevo V54x_6x_TU", ALC245_FIXUP_CLEVO_NOISY_MIC),
+ SND_PCI_QUIRK(0x1558, 0xb018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0xb019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+--
+2.39.5
+
--- /dev/null
+From 36a07ba293508dc3ce559c2457f687944281a1c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jun 2025 01:36:14 -0400
+Subject: ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
+
+From: Yasmin Fitzgerald <sunoflife1.git@gmail.com>
+
+[ Upstream commit 68cc9d3c8e44afe90e43cbbd2960da15c2f31e23 ]
+
+The HP Pavilion Laptop 15-eg100 has Realtek HDA codec ALC287.
+It needs the ALC287_FIXUP_HP_GPIO_LED quirk to enable the mute LED.
+
+Signed-off-by: Yasmin Fitzgerald <sunoflife1.git@gmail.com>
+Link: https://patch.msgid.link/20250621053832.52950-1-sunoflife1.git@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 57f17ddaf7860..0bc59b6f1b9a6 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10655,6 +10655,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x8975, "HP EliteBook x360 840 Aero G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x897d, "HP mt440 Mobile Thin Client U74", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8981, "HP Elite Dragonfly G3", ALC245_FIXUP_CS35L41_SPI_4),
++ SND_PCI_QUIRK(0x103c, 0x898a, "HP Pavilion 15-eg100", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x898e, "HP EliteBook 835 G9", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x898f, "HP EliteBook 835 G9", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x8991, "HP EliteBook 845 G9", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
+--
+2.39.5
+
--- /dev/null
+From 051966505f41eb0ec7f24669c94a8cdb345e5ca0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Jun 2025 22:58:00 +0000
+Subject: ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
+
+From: Yuzuru10 <yuzuru_10@proton.me>
+
+[ Upstream commit 7186b81807b4a08f8bf834b6bdc72d6ed8ba1587 ]
+
+This patch adds DMI-based quirk for the Acer Nitro ANV15-41,
+allowing the internal microphone to be detected correctly on
+machines with "RB" as board vendor.
+
+Signed-off-by: Yuzuru <yuzuru_10@proton.me>
+Link: https://patch.msgid.link/20250622225754.20856-1-yuzuru_10@proton.me
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index 723cb7bc12851..1689b6b22598e 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -346,6 +346,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "83Q3"),
+ }
+ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "RB"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Nitro ANV15-41"),
++ }
++ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+--
+2.39.5
+
--- /dev/null
+From 7448ce81f032cddcce5e453c57c0cb409f81da0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 08:55:48 +0900
+Subject: ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.
+
+From: Tamura Dai <kirinode0@gmail.com>
+
+[ Upstream commit 6c038b58a2dc5a008c7e7a1297f5aaa4deaaaa7e ]
+
+sof_pdata->tplg_filename can have address allocated by kstrdup()
+and can be overwritten. Memory leak was detected with kmemleak:
+
+unreferenced object 0xffff88812391ff60 (size 16):
+ comm "kworker/4:1", pid 161, jiffies 4294802931
+ hex dump (first 16 bytes):
+ 73 6f 66 2d 68 64 61 2d 67 65 6e 65 72 69 63 00 sof-hda-generic.
+ backtrace (crc 4bf1675c):
+ __kmalloc_node_track_caller_noprof+0x49c/0x6b0
+ kstrdup+0x46/0xc0
+ hda_machine_select.cold+0x1de/0x12cf [snd_sof_intel_hda_generic]
+ sof_init_environment+0x16f/0xb50 [snd_sof]
+ sof_probe_continue+0x45/0x7c0 [snd_sof]
+ sof_probe_work+0x1e/0x40 [snd_sof]
+ process_one_work+0x894/0x14b0
+ worker_thread+0x5e5/0xfb0
+ kthread+0x39d/0x760
+ ret_from_fork+0x31/0x70
+ ret_from_fork_asm+0x1a/0x30
+
+Signed-off-by: Tamura Dai <kirinode0@gmail.com>
+Link: https://patch.msgid.link/20250615235548.8591-1-kirinode0@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
+index 9c8f79e55ec5d..624598c9e2df8 100644
+--- a/sound/soc/sof/intel/hda.c
++++ b/sound/soc/sof/intel/hda.c
+@@ -1209,11 +1209,11 @@ static int check_tplg_quirk_mask(struct snd_soc_acpi_mach *mach)
+ return 0;
+ }
+
+-static char *remove_file_ext(const char *tplg_filename)
++static char *remove_file_ext(struct device *dev, const char *tplg_filename)
+ {
+ char *filename, *tmp;
+
+- filename = kstrdup(tplg_filename, GFP_KERNEL);
++ filename = devm_kstrdup(dev, tplg_filename, GFP_KERNEL);
+ if (!filename)
+ return NULL;
+
+@@ -1297,7 +1297,7 @@ struct snd_soc_acpi_mach *hda_machine_select(struct snd_sof_dev *sdev)
+ */
+ if (!sof_pdata->tplg_filename) {
+ /* remove file extension if it exists */
+- tplg_filename = remove_file_ext(mach->sof_tplg_filename);
++ tplg_filename = remove_file_ext(sdev->dev, mach->sof_tplg_filename);
+ if (!tplg_filename)
+ return NULL;
+
+--
+2.39.5
+
--- /dev/null
+From 0ec7ea83e92b1efc63fa397efa9f42b24e18e0a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 08:41:47 +0200
+Subject: atm: idt77252: Add missing `dma_map_error()`
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+[ Upstream commit c4890963350dcf4e9a909bae23665921fba4ad27 ]
+
+The DMA map functions can fail and should be tested for errors.
+
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250624064148.12815-3-fourier.thomas@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/idt77252.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
+index a876024d8a05f..63d41320cd5cf 100644
+--- a/drivers/atm/idt77252.c
++++ b/drivers/atm/idt77252.c
+@@ -852,6 +852,8 @@ queue_skb(struct idt77252_dev *card, struct vc_map *vc,
+
+ IDT77252_PRV_PADDR(skb) = dma_map_single(&card->pcidev->dev, skb->data,
+ skb->len, DMA_TO_DEVICE);
++ if (dma_mapping_error(&card->pcidev->dev, IDT77252_PRV_PADDR(skb)))
++ return -ENOMEM;
+
+ error = -EINVAL;
+
+@@ -1857,6 +1859,8 @@ add_rx_skb(struct idt77252_dev *card, int queue,
+ paddr = dma_map_single(&card->pcidev->dev, skb->data,
+ skb_end_pointer(skb) - skb->data,
+ DMA_FROM_DEVICE);
++ if (dma_mapping_error(&card->pcidev->dev, paddr))
++ goto outpoolrm;
+ IDT77252_PRV_PADDR(skb) = paddr;
+
+ if (push_rx_skb(card, skb, queue)) {
+@@ -1871,6 +1875,7 @@ add_rx_skb(struct idt77252_dev *card, int queue,
+ dma_unmap_single(&card->pcidev->dev, IDT77252_PRV_PADDR(skb),
+ skb_end_pointer(skb) - skb->data, DMA_FROM_DEVICE);
+
++outpoolrm:
+ handle = IDT77252_PRV_POOL(skb);
+ card->sbpool[POOL_QUEUE(handle)].skb[POOL_INDEX(handle)] = NULL;
+
+--
+2.39.5
+
--- /dev/null
+From 6ed30d1a7e4219382c9fb6753fd3fbfcb0187ac6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 14:39:36 -0700
+Subject: bnxt_en: Fix DCB ETS validation
+
+From: Shravya KN <shravya.k-n@broadcom.com>
+
+[ Upstream commit b74c2a2e9cc471e847abd87e50a2354c07e02040 ]
+
+In bnxt_ets_validate(), the code incorrectly loops over all possible
+traffic classes to check and add the ETS settings. Fix it to loop
+over the configured traffic classes only.
+
+The unconfigured traffic classes will default to TSA_ETS with 0
+bandwidth. Looping over these unconfigured traffic classes may
+cause the validation to fail and trigger this error message:
+
+"rejecting ETS config starving a TC\n"
+
+The .ieee_setets() will then fail.
+
+Fixes: 7df4ae9fe855 ("bnxt_en: Implement DCBNL to support host-based DCBX.")
+Reviewed-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Signed-off-by: Shravya KN <shravya.k-n@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://patch.msgid.link/20250710213938.1959625-2-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+index 0dbb880a7aa0e..71e14be2507e1 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+@@ -487,7 +487,9 @@ static int bnxt_ets_validate(struct bnxt *bp, struct ieee_ets *ets, u8 *tc)
+
+ if ((ets->tc_tx_bw[i] || ets->tc_tsa[i]) && i > bp->max_tc)
+ return -EINVAL;
++ }
+
++ for (i = 0; i < max_tc; i++) {
+ switch (ets->tc_tsa[i]) {
+ case IEEE_8021QAZ_TSA_STRICT:
+ break;
+--
+2.39.5
+
--- /dev/null
+From 3ec24d56b65260a75ff5af51e426637febd1f997 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 14:39:38 -0700
+Subject: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
+
+From: Somnath Kotur <somnath.kotur@broadcom.com>
+
+[ Upstream commit 3cdf199d4755d477972ee87110b2aebc88b3cfad ]
+
+When transmitting an XDP_REDIRECT packet, call dma_unmap_len_set()
+with the proper length instead of 0. This bug triggers this warning
+on a system with IOMMU enabled:
+
+WARNING: CPU: 36 PID: 0 at drivers/iommu/dma-iommu.c:842 __iommu_dma_unmap+0x159/0x170
+RIP: 0010:__iommu_dma_unmap+0x159/0x170
+Code: a8 00 00 00 00 48 c7 45 b0 00 00 00 00 48 c7 45 c8 00 00 00 00 48 c7 45 a0 ff ff ff ff 4c 89 45
+b8 4c 89 45 c0 e9 77 ff ff ff <0f> 0b e9 60 ff ff ff e8 8b bf 6a 00 66 66 2e 0f 1f 84 00 00 00 00
+RSP: 0018:ff22d31181150c88 EFLAGS: 00010206
+RAX: 0000000000002000 RBX: 00000000e13a0000 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+RBP: ff22d31181150cf0 R08: ff22d31181150ca8 R09: 0000000000000000
+R10: 0000000000000000 R11: ff22d311d36c9d80 R12: 0000000000001000
+R13: ff13544d10645010 R14: ff22d31181150c90 R15: ff13544d0b2bac00
+FS: 0000000000000000(0000) GS:ff13550908a00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00005be909dacff8 CR3: 0008000173408003 CR4: 0000000000f71ef0
+PKRU: 55555554
+Call Trace:
+<IRQ>
+? show_regs+0x6d/0x80
+? __warn+0x89/0x160
+? __iommu_dma_unmap+0x159/0x170
+? report_bug+0x17e/0x1b0
+? handle_bug+0x46/0x90
+? exc_invalid_op+0x18/0x80
+? asm_exc_invalid_op+0x1b/0x20
+? __iommu_dma_unmap+0x159/0x170
+? __iommu_dma_unmap+0xb3/0x170
+iommu_dma_unmap_page+0x4f/0x100
+dma_unmap_page_attrs+0x52/0x220
+? srso_alias_return_thunk+0x5/0xfbef5
+? xdp_return_frame+0x2e/0xd0
+bnxt_tx_int_xdp+0xdf/0x440 [bnxt_en]
+__bnxt_poll_work_done+0x81/0x1e0 [bnxt_en]
+bnxt_poll+0xd3/0x1e0 [bnxt_en]
+
+Fixes: f18c2b77b2e4 ("bnxt_en: optimized XDP_REDIRECT support")
+Signed-off-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://patch.msgid.link/20250710213938.1959625-4-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
+index 8726657f5cb9e..844812bd65363 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
+@@ -115,7 +115,7 @@ static void __bnxt_xmit_xdp_redirect(struct bnxt *bp,
+ tx_buf->action = XDP_REDIRECT;
+ tx_buf->xdpf = xdpf;
+ dma_unmap_addr_set(tx_buf, mapping, mapping);
+- dma_unmap_len_set(tx_buf, len, 0);
++ dma_unmap_len_set(tx_buf, len, len);
+ }
+
+ void bnxt_tx_int_xdp(struct bnxt *bp, struct bnxt_napi *bnapi, int budget)
+--
+2.39.5
+
--- /dev/null
+From 96c96d4cc04f35fba7ae34fb8a33c4442b9664c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Jun 2025 17:57:40 -0400
+Subject: bpf: Adjust free target to avoid global starvation of LRU map
+
+From: Willem de Bruijn <willemb@google.com>
+
+[ Upstream commit d4adf1c9ee7722545450608bcb095fb31512f0c6 ]
+
+BPF_MAP_TYPE_LRU_HASH can recycle most recent elements well before the
+map is full, due to percpu reservations and force shrink before
+neighbor stealing. Once a CPU is unable to borrow from the global map,
+it will once steal one elem from a neighbor and after that each time
+flush this one element to the global list and immediately recycle it.
+
+Batch value LOCAL_FREE_TARGET (128) will exhaust a 10K element map
+with 79 CPUs. CPU 79 will observe this behavior even while its
+neighbors hold 78 * 127 + 1 * 15 == 9921 free elements (99%).
+
+CPUs need not be active concurrently. The issue can appear with
+affinity migration, e.g., irqbalance. Each CPU can reserve and then
+hold onto its 128 elements indefinitely.
+
+Avoid global list exhaustion by limiting aggregate percpu caches to
+half of map size, by adjusting LOCAL_FREE_TARGET based on cpu count.
+This change has no effect on sufficiently large tables.
+
+Similar to LOCAL_NR_SCANS and lru->nr_scans, introduce a map variable
+lru->free_target. The extra field fits in a hole in struct bpf_lru.
+The cacheline is already warm where read in the hot path. The field is
+only accessed with the lru lock held.
+
+Tested-by: Anton Protopopov <a.s.protopopov@gmail.com>
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://lore.kernel.org/r/20250618215803.3587312-1-willemdebruijn.kernel@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/bpf/map_hash.rst | 8 ++-
+ Documentation/bpf/map_lru_hash_update.dot | 6 +-
+ kernel/bpf/bpf_lru_list.c | 9 ++-
+ kernel/bpf/bpf_lru_list.h | 1 +
+ tools/testing/selftests/bpf/test_lru_map.c | 72 +++++++++++-----------
+ 5 files changed, 52 insertions(+), 44 deletions(-)
+
+diff --git a/Documentation/bpf/map_hash.rst b/Documentation/bpf/map_hash.rst
+index d2343952f2cbd..8606bf958a8cf 100644
+--- a/Documentation/bpf/map_hash.rst
++++ b/Documentation/bpf/map_hash.rst
+@@ -233,10 +233,16 @@ attempts in order to enforce the LRU property which have increasing impacts on
+ other CPUs involved in the following operation attempts:
+
+ - Attempt to use CPU-local state to batch operations
+-- Attempt to fetch free nodes from global lists
++- Attempt to fetch ``target_free`` free nodes from global lists
+ - Attempt to pull any node from a global list and remove it from the hashmap
+ - Attempt to pull any node from any CPU's list and remove it from the hashmap
+
++The number of nodes to borrow from the global list in a batch, ``target_free``,
++depends on the size of the map. Larger batch size reduces lock contention, but
++may also exhaust the global structure. The value is computed at map init to
++avoid exhaustion, by limiting aggregate reservation by all CPUs to half the map
++size. With a minimum of a single element and maximum budget of 128 at a time.
++
+ This algorithm is described visually in the following diagram. See the
+ description in commit 3a08c2fd7634 ("bpf: LRU List") for a full explanation of
+ the corresponding operations:
+diff --git a/Documentation/bpf/map_lru_hash_update.dot b/Documentation/bpf/map_lru_hash_update.dot
+index a0fee349d29c2..ab10058f5b79f 100644
+--- a/Documentation/bpf/map_lru_hash_update.dot
++++ b/Documentation/bpf/map_lru_hash_update.dot
+@@ -35,18 +35,18 @@ digraph {
+ fn_bpf_lru_list_pop_free_to_local [shape=rectangle,fillcolor=2,
+ label="Flush local pending,
+ Rotate Global list, move
+- LOCAL_FREE_TARGET
++ target_free
+ from global -> local"]
+ // Also corresponds to:
+ // fn__local_list_flush()
+ // fn_bpf_lru_list_rotate()
+ fn___bpf_lru_node_move_to_free[shape=diamond,fillcolor=2,
+- label="Able to free\nLOCAL_FREE_TARGET\nnodes?"]
++ label="Able to free\ntarget_free\nnodes?"]
+
+ fn___bpf_lru_list_shrink_inactive [shape=rectangle,fillcolor=3,
+ label="Shrink inactive list
+ up to remaining
+- LOCAL_FREE_TARGET
++ target_free
+ (global LRU -> local)"]
+ fn___bpf_lru_list_shrink [shape=diamond,fillcolor=2,
+ label="> 0 entries in\nlocal free list?"]
+diff --git a/kernel/bpf/bpf_lru_list.c b/kernel/bpf/bpf_lru_list.c
+index 3dabdd137d102..2d6e1c98d8adc 100644
+--- a/kernel/bpf/bpf_lru_list.c
++++ b/kernel/bpf/bpf_lru_list.c
+@@ -337,12 +337,12 @@ static void bpf_lru_list_pop_free_to_local(struct bpf_lru *lru,
+ list) {
+ __bpf_lru_node_move_to_free(l, node, local_free_list(loc_l),
+ BPF_LRU_LOCAL_LIST_T_FREE);
+- if (++nfree == LOCAL_FREE_TARGET)
++ if (++nfree == lru->target_free)
+ break;
+ }
+
+- if (nfree < LOCAL_FREE_TARGET)
+- __bpf_lru_list_shrink(lru, l, LOCAL_FREE_TARGET - nfree,
++ if (nfree < lru->target_free)
++ __bpf_lru_list_shrink(lru, l, lru->target_free - nfree,
+ local_free_list(loc_l),
+ BPF_LRU_LOCAL_LIST_T_FREE);
+
+@@ -577,6 +577,9 @@ static void bpf_common_lru_populate(struct bpf_lru *lru, void *buf,
+ list_add(&node->list, &l->lists[BPF_LRU_LIST_T_FREE]);
+ buf += elem_size;
+ }
++
++ lru->target_free = clamp((nr_elems / num_possible_cpus()) / 2,
++ 1, LOCAL_FREE_TARGET);
+ }
+
+ static void bpf_percpu_lru_populate(struct bpf_lru *lru, void *buf,
+diff --git a/kernel/bpf/bpf_lru_list.h b/kernel/bpf/bpf_lru_list.h
+index cbd8d3720c2bb..fe2661a58ea94 100644
+--- a/kernel/bpf/bpf_lru_list.h
++++ b/kernel/bpf/bpf_lru_list.h
+@@ -58,6 +58,7 @@ struct bpf_lru {
+ del_from_htab_func del_from_htab;
+ void *del_arg;
+ unsigned int hash_offset;
++ unsigned int target_free;
+ unsigned int nr_scans;
+ bool percpu;
+ };
+diff --git a/tools/testing/selftests/bpf/test_lru_map.c b/tools/testing/selftests/bpf/test_lru_map.c
+index fda7589c50236..4ae83f4b7fc7e 100644
+--- a/tools/testing/selftests/bpf/test_lru_map.c
++++ b/tools/testing/selftests/bpf/test_lru_map.c
+@@ -138,6 +138,12 @@ static int sched_next_online(int pid, int *next_to_try)
+ return ret;
+ }
+
++/* Inverse of how bpf_common_lru_populate derives target_free from map_size. */
++static unsigned int __map_size(unsigned int tgt_free)
++{
++ return tgt_free * nr_cpus * 2;
++}
++
+ /* Size of the LRU map is 2
+ * Add key=1 (+1 key)
+ * Add key=2 (+1 key)
+@@ -231,11 +237,11 @@ static void test_lru_sanity0(int map_type, int map_flags)
+ printf("Pass\n");
+ }
+
+-/* Size of the LRU map is 1.5*tgt_free
+- * Insert 1 to tgt_free (+tgt_free keys)
+- * Lookup 1 to tgt_free/2
+- * Insert 1+tgt_free to 2*tgt_free (+tgt_free keys)
+- * => 1+tgt_free/2 to LOCALFREE_TARGET will be removed by LRU
++/* Verify that unreferenced elements are recycled before referenced ones.
++ * Insert elements.
++ * Reference a subset of these.
++ * Insert more, enough to trigger recycling.
++ * Verify that unreferenced are recycled.
+ */
+ static void test_lru_sanity1(int map_type, int map_flags, unsigned int tgt_free)
+ {
+@@ -257,7 +263,7 @@ static void test_lru_sanity1(int map_type, int map_flags, unsigned int tgt_free)
+ batch_size = tgt_free / 2;
+ assert(batch_size * 2 == tgt_free);
+
+- map_size = tgt_free + batch_size;
++ map_size = __map_size(tgt_free) + batch_size;
+ lru_map_fd = create_map(map_type, map_flags, map_size);
+ assert(lru_map_fd != -1);
+
+@@ -266,13 +272,13 @@ static void test_lru_sanity1(int map_type, int map_flags, unsigned int tgt_free)
+
+ value[0] = 1234;
+
+- /* Insert 1 to tgt_free (+tgt_free keys) */
+- end_key = 1 + tgt_free;
++ /* Insert map_size - batch_size keys */
++ end_key = 1 + __map_size(tgt_free);
+ for (key = 1; key < end_key; key++)
+ assert(!bpf_map_update_elem(lru_map_fd, &key, value,
+ BPF_NOEXIST));
+
+- /* Lookup 1 to tgt_free/2 */
++ /* Lookup 1 to batch_size */
+ end_key = 1 + batch_size;
+ for (key = 1; key < end_key; key++) {
+ assert(!bpf_map_lookup_elem_with_ref_bit(lru_map_fd, key, value));
+@@ -280,12 +286,13 @@ static void test_lru_sanity1(int map_type, int map_flags, unsigned int tgt_free)
+ BPF_NOEXIST));
+ }
+
+- /* Insert 1+tgt_free to 2*tgt_free
+- * => 1+tgt_free/2 to LOCALFREE_TARGET will be
++ /* Insert another map_size - batch_size keys
++ * Map will contain 1 to batch_size plus these latest, i.e.,
++ * => previous 1+batch_size to map_size - batch_size will have been
+ * removed by LRU
+ */
+- key = 1 + tgt_free;
+- end_key = key + tgt_free;
++ key = 1 + __map_size(tgt_free);
++ end_key = key + __map_size(tgt_free);
+ for (; key < end_key; key++) {
+ assert(!bpf_map_update_elem(lru_map_fd, &key, value,
+ BPF_NOEXIST));
+@@ -301,17 +308,8 @@ static void test_lru_sanity1(int map_type, int map_flags, unsigned int tgt_free)
+ printf("Pass\n");
+ }
+
+-/* Size of the LRU map 1.5 * tgt_free
+- * Insert 1 to tgt_free (+tgt_free keys)
+- * Update 1 to tgt_free/2
+- * => The original 1 to tgt_free/2 will be removed due to
+- * the LRU shrink process
+- * Re-insert 1 to tgt_free/2 again and do a lookup immeidately
+- * Insert 1+tgt_free to tgt_free*3/2
+- * Insert 1+tgt_free*3/2 to tgt_free*5/2
+- * => Key 1+tgt_free to tgt_free*3/2
+- * will be removed from LRU because it has never
+- * been lookup and ref bit is not set
++/* Verify that insertions exceeding map size will recycle the oldest.
++ * Verify that unreferenced elements are recycled before referenced.
+ */
+ static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free)
+ {
+@@ -334,7 +332,7 @@ static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free)
+ batch_size = tgt_free / 2;
+ assert(batch_size * 2 == tgt_free);
+
+- map_size = tgt_free + batch_size;
++ map_size = __map_size(tgt_free) + batch_size;
+ lru_map_fd = create_map(map_type, map_flags, map_size);
+ assert(lru_map_fd != -1);
+
+@@ -343,8 +341,8 @@ static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free)
+
+ value[0] = 1234;
+
+- /* Insert 1 to tgt_free (+tgt_free keys) */
+- end_key = 1 + tgt_free;
++ /* Insert map_size - batch_size keys */
++ end_key = 1 + __map_size(tgt_free);
+ for (key = 1; key < end_key; key++)
+ assert(!bpf_map_update_elem(lru_map_fd, &key, value,
+ BPF_NOEXIST));
+@@ -357,8 +355,7 @@ static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free)
+ * shrink the inactive list to get tgt_free
+ * number of free nodes.
+ *
+- * Hence, the oldest key 1 to tgt_free/2
+- * are removed from the LRU list.
++ * Hence, the oldest key is removed from the LRU list.
+ */
+ key = 1;
+ if (map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) {
+@@ -370,8 +367,7 @@ static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free)
+ BPF_EXIST));
+ }
+
+- /* Re-insert 1 to tgt_free/2 again and do a lookup
+- * immeidately.
++ /* Re-insert 1 to batch_size again and do a lookup immediately.
+ */
+ end_key = 1 + batch_size;
+ value[0] = 4321;
+@@ -387,17 +383,18 @@ static void test_lru_sanity2(int map_type, int map_flags, unsigned int tgt_free)
+
+ value[0] = 1234;
+
+- /* Insert 1+tgt_free to tgt_free*3/2 */
+- end_key = 1 + tgt_free + batch_size;
+- for (key = 1 + tgt_free; key < end_key; key++)
++ /* Insert batch_size new elements */
++ key = 1 + __map_size(tgt_free);
++ end_key = key + batch_size;
++ for (; key < end_key; key++)
+ /* These newly added but not referenced keys will be
+ * gone during the next LRU shrink.
+ */
+ assert(!bpf_map_update_elem(lru_map_fd, &key, value,
+ BPF_NOEXIST));
+
+- /* Insert 1+tgt_free*3/2 to tgt_free*5/2 */
+- end_key = key + tgt_free;
++ /* Insert map_size - batch_size elements */
++ end_key += __map_size(tgt_free);
+ for (; key < end_key; key++) {
+ assert(!bpf_map_update_elem(lru_map_fd, &key, value,
+ BPF_NOEXIST));
+@@ -500,7 +497,8 @@ static void test_lru_sanity4(int map_type, int map_flags, unsigned int tgt_free)
+ lru_map_fd = create_map(map_type, map_flags,
+ 3 * tgt_free * nr_cpus);
+ else
+- lru_map_fd = create_map(map_type, map_flags, 3 * tgt_free);
++ lru_map_fd = create_map(map_type, map_flags,
++ 3 * __map_size(tgt_free));
+ assert(lru_map_fd != -1);
+
+ expected_map_fd = create_map(BPF_MAP_TYPE_HASH, 0,
+--
+2.39.5
+
--- /dev/null
+From e76fcef681594a1eaaa9a3d77e611e50ea3a8b9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jun 2025 20:51:03 +0100
+Subject: btrfs: fix assertion when building free space tree
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 1961d20f6fa8903266ed9bd77c691924c22c8f02 ]
+
+When building the free space tree with the block group tree feature
+enabled, we can hit an assertion failure like this:
+
+ BTRFS info (device loop0 state M): rebuilding free space tree
+ assertion failed: ret == 0, in fs/btrfs/free-space-tree.c:1102
+ ------------[ cut here ]------------
+ kernel BUG at fs/btrfs/free-space-tree.c:1102!
+ Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
+ Modules linked in:
+ CPU: 1 UID: 0 PID: 6592 Comm: syz-executor322 Not tainted 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT
+ Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
+ pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : populate_free_space_tree+0x514/0x518 fs/btrfs/free-space-tree.c:1102
+ lr : populate_free_space_tree+0x514/0x518 fs/btrfs/free-space-tree.c:1102
+ sp : ffff8000a4ce7600
+ x29: ffff8000a4ce76e0 x28: ffff0000c9bc6000 x27: ffff0000ddfff3d8
+ x26: ffff0000ddfff378 x25: dfff800000000000 x24: 0000000000000001
+ x23: ffff8000a4ce7660 x22: ffff70001499cecc x21: ffff0000e1d8c160
+ x20: ffff0000e1cb7800 x19: ffff0000e1d8c0b0 x18: 00000000ffffffff
+ x17: ffff800092f39000 x16: ffff80008ad27e48 x15: ffff700011e740c0
+ x14: 1ffff00011e740c0 x13: 0000000000000004 x12: ffffffffffffffff
+ x11: ffff700011e740c0 x10: 0000000000ff0100 x9 : 94ef24f55d2dbc00
+ x8 : 94ef24f55d2dbc00 x7 : 0000000000000001 x6 : 0000000000000001
+ x5 : ffff8000a4ce6f98 x4 : ffff80008f415ba0 x3 : ffff800080548ef0
+ x2 : 0000000000000000 x1 : 0000000100000000 x0 : 000000000000003e
+ Call trace:
+ populate_free_space_tree+0x514/0x518 fs/btrfs/free-space-tree.c:1102 (P)
+ btrfs_rebuild_free_space_tree+0x14c/0x54c fs/btrfs/free-space-tree.c:1337
+ btrfs_start_pre_rw_mount+0xa78/0xe10 fs/btrfs/disk-io.c:3074
+ btrfs_remount_rw fs/btrfs/super.c:1319 [inline]
+ btrfs_reconfigure+0x828/0x2418 fs/btrfs/super.c:1543
+ reconfigure_super+0x1d4/0x6f0 fs/super.c:1083
+ do_remount fs/namespace.c:3365 [inline]
+ path_mount+0xb34/0xde0 fs/namespace.c:4200
+ do_mount fs/namespace.c:4221 [inline]
+ __do_sys_mount fs/namespace.c:4432 [inline]
+ __se_sys_mount fs/namespace.c:4409 [inline]
+ __arm64_sys_mount+0x3e8/0x468 fs/namespace.c:4409
+ __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
+ invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
+ el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
+ do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
+ el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767
+ el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786
+ el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
+ Code: f0047182 91178042 528089c3 9771d47b (d4210000)
+ ---[ end trace 0000000000000000 ]---
+
+This happens because we are processing an empty block group, which has
+no extents allocated from it, there are no items for this block group,
+including the block group item since block group items are stored in a
+dedicated tree when using the block group tree feature. It also means
+this is the block group with the highest start offset, so there are no
+higher keys in the extent root, hence btrfs_search_slot_for_read()
+returns 1 (no higher key found).
+
+Fix this by asserting 'ret' is 0 only if the block group tree feature
+is not enabled, in which case we should find a block group item for
+the block group since it's stored in the extent root and block group
+item keys are greater than extent item keys (the value for
+BTRFS_BLOCK_GROUP_ITEM_KEY is 192 and for BTRFS_EXTENT_ITEM_KEY and
+BTRFS_METADATA_ITEM_KEY the values are 168 and 169 respectively).
+In case 'ret' is 1, we just need to add a record to the free space
+tree which spans the whole block group, and we can achieve this by
+making 'ret == 0' as the while loop's condition.
+
+Reported-by: syzbot+36fae25c35159a763a2a@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/linux-btrfs/6841dca8.a00a0220.d4325.0020.GAE@google.com/
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/free-space-tree.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/fs/btrfs/free-space-tree.c b/fs/btrfs/free-space-tree.c
+index 7ba50e133921a..308abbf8855b0 100644
+--- a/fs/btrfs/free-space-tree.c
++++ b/fs/btrfs/free-space-tree.c
+@@ -1104,11 +1104,21 @@ static int populate_free_space_tree(struct btrfs_trans_handle *trans,
+ ret = btrfs_search_slot_for_read(extent_root, &key, path, 1, 0);
+ if (ret < 0)
+ goto out_locked;
+- ASSERT(ret == 0);
++ /*
++ * If ret is 1 (no key found), it means this is an empty block group,
++ * without any extents allocated from it and there's no block group
++ * item (key BTRFS_BLOCK_GROUP_ITEM_KEY) located in the extent tree
++ * because we are using the block group tree feature, so block group
++ * items are stored in the block group tree. It also means there are no
++ * extents allocated for block groups with a start offset beyond this
++ * block group's end offset (this is the last, highest, block group).
++ */
++ if (!btrfs_fs_compat_ro(trans->fs_info, BLOCK_GROUP_TREE))
++ ASSERT(ret == 0);
+
+ start = block_group->start;
+ end = block_group->start + block_group->length;
+- while (1) {
++ while (ret == 0) {
+ btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]);
+
+ if (key.type == BTRFS_EXTENT_ITEM_KEY ||
+@@ -1138,8 +1148,6 @@ static int populate_free_space_tree(struct btrfs_trans_handle *trans,
+ ret = btrfs_next_item(extent_root, path);
+ if (ret < 0)
+ goto out_locked;
+- if (ret)
+- break;
+ }
+ if (start < end) {
+ ret = __add_to_free_space_tree(trans, block_group, path2,
+--
+2.39.5
+
--- /dev/null
+From a2bd4e57a5afb51617c17eab42bb8b86335b8df8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:12:02 +0200
+Subject: can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message
+ to debug level
+
+From: Sean Nyekjaer <sean@geanix.com>
+
+[ Upstream commit 58805e9cbc6f6a28f35d90e740956e983a0e036e ]
+
+Downgrade the "msg lost in rx" message to debug level, to prevent
+flooding the kernel log with error messages.
+
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Signed-off-by: Sean Nyekjaer <sean@geanix.com>
+Link: https://patch.msgid.link/20250711-mcan_ratelimit-v3-1-7413e8e21b84@geanix.com
+[mkl: enhance commit message]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index dbd4d8796f9b0..dbcf17fb3ef25 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -665,7 +665,7 @@ static int m_can_handle_lost_msg(struct net_device *dev)
+ struct can_frame *frame;
+ u32 timestamp = 0;
+
+- netdev_err(dev, "msg lost in rxf0\n");
++ netdev_dbg(dev, "msg lost in rxf0\n");
+
+ stats->rx_errors++;
+ stats->rx_over_errors++;
+--
+2.39.5
+
--- /dev/null
+From 61859874cc69ac5a05a71c7eefde154aa87dcd10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 18:55:00 +0800
+Subject: driver: bluetooth: hci_qca:fix unable to load the BT driver
+
+From: Shuai Zhang <quic_shuaz@quicinc.com>
+
+[ Upstream commit db0ff7e15923ffa7067874604ca275e92343f1b1 ]
+
+Some modules have BT_EN enabled via a hardware pull-up,
+meaning it is not defined in the DTS and is not controlled
+through the power sequence. In such cases, fall through
+to follow the legacy flow.
+
+Signed-off-by: Shuai Zhang <quic_shuaz@quicinc.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 025b9a07c0875..e6ad01d5e1d5d 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -2363,10 +2363,17 @@ static int qca_serdev_probe(struct serdev_device *serdev)
+ */
+ qcadev->bt_power->pwrseq = devm_pwrseq_get(&serdev->dev,
+ "bluetooth");
+- if (IS_ERR(qcadev->bt_power->pwrseq))
+- return PTR_ERR(qcadev->bt_power->pwrseq);
+
+- break;
++ /*
++ * Some modules have BT_EN enabled via a hardware pull-up,
++ * meaning it is not defined in the DTS and is not controlled
++ * through the power sequence. In such cases, fall through
++ * to follow the legacy flow.
++ */
++ if (IS_ERR(qcadev->bt_power->pwrseq))
++ qcadev->bt_power->pwrseq = NULL;
++ else
++ break;
+ }
+ fallthrough;
+ case QCA_WCN3988:
+--
+2.39.5
+
--- /dev/null
+From b57ed6cfcd51574cc6c106116040b06abefadfba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jun 2025 14:00:36 +1000
+Subject: drm/nouveau/gsp: fix potential leak of memory used during acpi init
+
+From: Ben Skeggs <bskeggs@nvidia.com>
+
+[ Upstream commit d133036a0b23d3ef781d067ccdea6bbfb381e0cf ]
+
+If any of the ACPI calls fail, memory allocated for the input buffer
+would be leaked. Fix failure paths to free allocated memory.
+
+Also add checks to ensure the allocations succeeded in the first place.
+
+Reported-by: Danilo Krummrich <dakr@kernel.org>
+Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM")
+Signed-off-by: Ben Skeggs <bskeggs@nvidia.com>
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Link: https://lore.kernel.org/r/20250617040036.2932-1-bskeggs@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 20 +++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
+index fc84ca214f247..3ad4f6e9a8ac2 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
+@@ -1454,7 +1454,6 @@ r535_gsp_acpi_caps(acpi_handle handle, CAPS_METHOD_DATA *caps)
+ union acpi_object argv4 = {
+ .buffer.type = ACPI_TYPE_BUFFER,
+ .buffer.length = 4,
+- .buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL),
+ }, *obj;
+
+ caps->status = 0xffff;
+@@ -1462,17 +1461,22 @@ r535_gsp_acpi_caps(acpi_handle handle, CAPS_METHOD_DATA *caps)
+ if (!acpi_check_dsm(handle, &NVOP_DSM_GUID, NVOP_DSM_REV, BIT_ULL(0x1a)))
+ return;
+
++ argv4.buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL);
++ if (!argv4.buffer.pointer)
++ return;
++
+ obj = acpi_evaluate_dsm(handle, &NVOP_DSM_GUID, NVOP_DSM_REV, 0x1a, &argv4);
+ if (!obj)
+- return;
++ goto done;
+
+ if (WARN_ON(obj->type != ACPI_TYPE_BUFFER) ||
+ WARN_ON(obj->buffer.length != 4))
+- return;
++ goto done;
+
+ caps->status = 0;
+ caps->optimusCaps = *(u32 *)obj->buffer.pointer;
+
++done:
+ ACPI_FREE(obj);
+
+ kfree(argv4.buffer.pointer);
+@@ -1489,24 +1493,28 @@ r535_gsp_acpi_jt(acpi_handle handle, JT_METHOD_DATA *jt)
+ union acpi_object argv4 = {
+ .buffer.type = ACPI_TYPE_BUFFER,
+ .buffer.length = sizeof(caps),
+- .buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL),
+ }, *obj;
+
+ jt->status = 0xffff;
+
++ argv4.buffer.pointer = kmalloc(argv4.buffer.length, GFP_KERNEL);
++ if (!argv4.buffer.pointer)
++ return;
++
+ obj = acpi_evaluate_dsm(handle, &JT_DSM_GUID, JT_DSM_REV, 0x1, &argv4);
+ if (!obj)
+- return;
++ goto done;
+
+ if (WARN_ON(obj->type != ACPI_TYPE_BUFFER) ||
+ WARN_ON(obj->buffer.length != 4))
+- return;
++ goto done;
+
+ jt->status = 0;
+ jt->jtCaps = *(u32 *)obj->buffer.pointer;
+ jt->jtRevId = (jt->jtCaps & 0xfff00000) >> 20;
+ jt->bSBIOSCaps = 0;
+
++done:
+ ACPI_FREE(obj);
+
+ kfree(argv4.buffer.pointer);
+--
+2.39.5
+
--- /dev/null
+From 0252f137ded18ef053537e6fa102ea29602229d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 11:08:07 +0900
+Subject: drm/tegra: nvdec: Fix dma_alloc_coherent error check
+
+From: Mikko Perttunen <mperttunen@nvidia.com>
+
+[ Upstream commit 44306a684cd1699b8562a54945ddc43e2abc9eab ]
+
+Check for NULL return value with dma_alloc_coherent, in line with
+Robin's fix for vic.c in 'drm/tegra: vic: Fix DMA API misuse'.
+
+Fixes: 46f226c93d35 ("drm/tegra: Add NVDEC driver")
+Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20250702-nvdec-dma-error-check-v1-1-c388b402c53a@nvidia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/nvdec.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/nvdec.c b/drivers/gpu/drm/tegra/nvdec.c
+index 4860790666af5..14ef61b44f47c 100644
+--- a/drivers/gpu/drm/tegra/nvdec.c
++++ b/drivers/gpu/drm/tegra/nvdec.c
+@@ -261,10 +261,8 @@ static int nvdec_load_falcon_firmware(struct nvdec *nvdec)
+
+ if (!client->group) {
+ virt = dma_alloc_coherent(nvdec->dev, size, &iova, GFP_KERNEL);
+-
+- err = dma_mapping_error(nvdec->dev, iova);
+- if (err < 0)
+- return err;
++ if (!virt)
++ return -ENOMEM;
+ } else {
+ virt = tegra_drm_alloc(tegra, size, &iova);
+ if (IS_ERR(virt))
+--
+2.39.5
+
--- /dev/null
+From 5235b125fe9a1983f3f80a48de9857d640e1fbf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 00:00:52 +0200
+Subject: drm/xe/pf: Clear all LMTT pages on alloc
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Wajdeczko <michal.wajdeczko@intel.com>
+
+[ Upstream commit 705a412a367f383430fa34bada387af2e52eb043 ]
+
+Our LMEM buffer objects are not cleared by default on alloc
+and during VF provisioning we only setup LMTT PTEs for the
+actually provisioned LMEM range. But beyond that valid range
+we might leave some stale data that could either point to some
+other VFs allocations or even to the PF pages.
+
+Explicitly clear all new LMTT page to avoid the risk that a
+malicious VF would try to exploit that gap.
+
+While around add asserts to catch any undesired PTE overwrites
+and low-level debug traces to track LMTT PT life-cycle.
+
+Fixes: b1d204058218 ("drm/xe/pf: Introduce Local Memory Translation Table")
+Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Cc: Michał Winiarski <michal.winiarski@intel.com>
+Cc: Lukasz Laguna <lukasz.laguna@intel.com>
+Reviewed-by: Michał Winiarski <michal.winiarski@intel.com>
+Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com>
+Link: https://lore.kernel.org/r/20250701220052.1612-1-michal.wajdeczko@intel.com
+(cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_lmtt.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_lmtt.c b/drivers/gpu/drm/xe/xe_lmtt.c
+index 8999ac511555f..485658f69fba8 100644
+--- a/drivers/gpu/drm/xe/xe_lmtt.c
++++ b/drivers/gpu/drm/xe/xe_lmtt.c
+@@ -78,6 +78,9 @@ static struct xe_lmtt_pt *lmtt_pt_alloc(struct xe_lmtt *lmtt, unsigned int level
+ }
+
+ lmtt_assert(lmtt, xe_bo_is_vram(bo));
++ lmtt_debug(lmtt, "level=%u addr=%#llx\n", level, (u64)xe_bo_main_addr(bo, XE_PAGE_SIZE));
++
++ xe_map_memset(lmtt_to_xe(lmtt), &bo->vmap, 0, 0, bo->size);
+
+ pt->level = level;
+ pt->bo = bo;
+@@ -91,6 +94,9 @@ static struct xe_lmtt_pt *lmtt_pt_alloc(struct xe_lmtt *lmtt, unsigned int level
+
+ static void lmtt_pt_free(struct xe_lmtt_pt *pt)
+ {
++ lmtt_debug(&pt->bo->tile->sriov.pf.lmtt, "level=%u addr=%llx\n",
++ pt->level, (u64)xe_bo_main_addr(pt->bo, XE_PAGE_SIZE));
++
+ xe_bo_unpin_map_no_vm(pt->bo);
+ kfree(pt);
+ }
+@@ -226,9 +232,14 @@ static void lmtt_write_pte(struct xe_lmtt *lmtt, struct xe_lmtt_pt *pt,
+
+ switch (lmtt->ops->lmtt_pte_size(level)) {
+ case sizeof(u32):
++ lmtt_assert(lmtt, !overflows_type(pte, u32));
++ lmtt_assert(lmtt, !pte || !iosys_map_rd(&pt->bo->vmap, idx * sizeof(u32), u32));
++
+ xe_map_wr(lmtt_to_xe(lmtt), &pt->bo->vmap, idx * sizeof(u32), u32, pte);
+ break;
+ case sizeof(u64):
++ lmtt_assert(lmtt, !pte || !iosys_map_rd(&pt->bo->vmap, idx * sizeof(u64), u64));
++
+ xe_map_wr(lmtt_to_xe(lmtt), &pt->bo->vmap, idx * sizeof(u64), u64, pte);
+ break;
+ default:
+--
+2.39.5
+
--- /dev/null
+From d278783ef51f7c777e0f5706f065d18008574a28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 02:14:51 +0000
+Subject: drm/xe/pm: Correct comment of xe_pm_set_vram_threshold()
+
+From: Shuicheng Lin <shuicheng.lin@intel.com>
+
+[ Upstream commit 0539c5eaf81f3f844213bf6b3137a53e5b04b083 ]
+
+The parameter threshold is with size in MiB, not in bits.
+Correct it to avoid any confusion.
+
+v2: s/mb/MiB, s/vram/VRAM, fix return section. (Michal)
+
+Fixes: 30c399529f4c ("drm/xe: Document Xe PM component")
+Cc: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
+Link: https://lore.kernel.org/r/20250708021450.3602087-2-shuicheng.lin@intel.com
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+(cherry picked from commit 0efec0500117947f924e5ac83be40f96378af85a)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pm.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_pm.c b/drivers/gpu/drm/xe/xe_pm.c
+index 06f50aa313267..46c73ff10c747 100644
+--- a/drivers/gpu/drm/xe/xe_pm.c
++++ b/drivers/gpu/drm/xe/xe_pm.c
+@@ -682,11 +682,13 @@ void xe_pm_assert_unbounded_bridge(struct xe_device *xe)
+ }
+
+ /**
+- * xe_pm_set_vram_threshold - Set a vram threshold for allowing/blocking D3Cold
++ * xe_pm_set_vram_threshold - Set a VRAM threshold for allowing/blocking D3Cold
+ * @xe: xe device instance
+- * @threshold: VRAM size in bites for the D3cold threshold
++ * @threshold: VRAM size in MiB for the D3cold threshold
+ *
+- * Returns 0 for success, negative error code otherwise.
++ * Return:
++ * * 0 - success
++ * * -EINVAL - invalid argument
+ */
+ int xe_pm_set_vram_threshold(struct xe_device *xe, u32 threshold)
+ {
+--
+2.39.5
+
--- /dev/null
+From e92f55f98a554c31ca8048e7e25d61eb576c1240 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 16:48:32 +0800
+Subject: erofs: fix to add missing tracepoint in erofs_readahead()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit d53238b614e01266a3d36b417b60a502e0698504 ]
+
+Commit 771c994ea51f ("erofs: convert all uncompressed cases to iomap")
+converts to use iomap interface, it removed trace_erofs_readahead()
+tracepoint in the meantime, let's add it back.
+
+Fixes: 771c994ea51f ("erofs: convert all uncompressed cases to iomap")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20250707084832.2725677-1-chao@kernel.org
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/data.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/erofs/data.c b/fs/erofs/data.c
+index a2ab92ceb9325..91182d5e3a66c 100644
+--- a/fs/erofs/data.c
++++ b/fs/erofs/data.c
+@@ -391,6 +391,9 @@ static int erofs_read_folio(struct file *file, struct folio *folio)
+
+ static void erofs_readahead(struct readahead_control *rac)
+ {
++ trace_erofs_readahead(rac->mapping->host, readahead_index(rac),
++ readahead_count(rac), true);
++
+ return iomap_readahead(rac, &erofs_iomap_ops);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 53c8b250030b6fce3bf3a739d269703909759556 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2024 21:32:35 -0700
+Subject: erofs: free pclusters if no cached folio is attached
+
+From: Chunhai Guo <guochunhai@vivo.com>
+
+[ Upstream commit f5ad9f9a603f829d11ca31a0a4049e16091e8c13 ]
+
+Once a pcluster is fully decompressed and there are no attached cached
+folios, its corresponding `struct z_erofs_pcluster` will be freed. This
+will significantly reduce the frequency of calls to erofs_shrink_scan()
+and the memory allocated for `struct z_erofs_pcluster`.
+
+The tables below show approximately a 96% reduction in the calls to
+erofs_shrink_scan() and in the memory allocated for `struct
+z_erofs_pcluster` after applying this patch. The results were obtained
+by performing a test to copy a 4.1GB partition on ARM64 Android devices
+running the 6.6 kernel with an 8-core CPU and 12GB of memory.
+
+1. The reduction in calls to erofs_shrink_scan():
++-----------------+-----------+----------+---------+
+| | w/o patch | w/ patch | diff |
++-----------------+-----------+----------+---------+
+| Average (times) | 11390 | 390 | -96.57% |
++-----------------+-----------+----------+---------+
+
+2. The reduction in memory released by erofs_shrink_scan():
++-----------------+-----------+----------+---------+
+| | w/o patch | w/ patch | diff |
++-----------------+-----------+----------+---------+
+| Average (Byte) | 133612656 | 4434552 | -96.68% |
++-----------------+-----------+----------+---------+
+
+Signed-off-by: Chunhai Guo <guochunhai@vivo.com>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20241112043235.546164-1-guochunhai@vivo.com
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Stable-dep-of: d53238b614e0 ("erofs: fix to add missing tracepoint in erofs_readahead()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zdata.c | 57 ++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 38 insertions(+), 19 deletions(-)
+
+diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
+index 6b1d19d1d2f0c..4d5a1fbd7e0ad 100644
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -882,14 +882,11 @@ static void z_erofs_rcu_callback(struct rcu_head *head)
+ struct z_erofs_pcluster, rcu));
+ }
+
+-static bool erofs_try_to_release_pcluster(struct erofs_sb_info *sbi,
++static bool __erofs_try_to_release_pcluster(struct erofs_sb_info *sbi,
+ struct z_erofs_pcluster *pcl)
+ {
+- int free = false;
+-
+- spin_lock(&pcl->lockref.lock);
+ if (pcl->lockref.count)
+- goto out;
++ return false;
+
+ /*
+ * Note that all cached folios should be detached before deleted from
+@@ -897,7 +894,7 @@ static bool erofs_try_to_release_pcluster(struct erofs_sb_info *sbi,
+ * orphan old pcluster when the new one is available in the tree.
+ */
+ if (erofs_try_to_free_all_cached_folios(sbi, pcl))
+- goto out;
++ return false;
+
+ /*
+ * It's impossible to fail after the pcluster is freezed, but in order
+@@ -906,8 +903,16 @@ static bool erofs_try_to_release_pcluster(struct erofs_sb_info *sbi,
+ DBG_BUGON(__xa_erase(&sbi->managed_pslots, pcl->index) != pcl);
+
+ lockref_mark_dead(&pcl->lockref);
+- free = true;
+-out:
++ return true;
++}
++
++static bool erofs_try_to_release_pcluster(struct erofs_sb_info *sbi,
++ struct z_erofs_pcluster *pcl)
++{
++ bool free;
++
++ spin_lock(&pcl->lockref.lock);
++ free = __erofs_try_to_release_pcluster(sbi, pcl);
+ spin_unlock(&pcl->lockref.lock);
+ if (free) {
+ atomic_long_dec(&erofs_global_shrink_cnt);
+@@ -938,16 +943,25 @@ unsigned long z_erofs_shrink_scan(struct erofs_sb_info *sbi,
+ return freed;
+ }
+
+-static void z_erofs_put_pcluster(struct z_erofs_pcluster *pcl)
++static void z_erofs_put_pcluster(struct erofs_sb_info *sbi,
++ struct z_erofs_pcluster *pcl, bool try_free)
+ {
++ bool free = false;
++
+ if (lockref_put_or_lock(&pcl->lockref))
+ return;
+
+ DBG_BUGON(__lockref_is_dead(&pcl->lockref));
+- if (pcl->lockref.count == 1)
+- atomic_long_inc(&erofs_global_shrink_cnt);
+- --pcl->lockref.count;
++ if (!--pcl->lockref.count) {
++ if (try_free && xa_trylock(&sbi->managed_pslots)) {
++ free = __erofs_try_to_release_pcluster(sbi, pcl);
++ xa_unlock(&sbi->managed_pslots);
++ }
++ atomic_long_add(!free, &erofs_global_shrink_cnt);
++ }
+ spin_unlock(&pcl->lockref.lock);
++ if (free)
++ call_rcu(&pcl->rcu, z_erofs_rcu_callback);
+ }
+
+ static void z_erofs_pcluster_end(struct z_erofs_decompress_frontend *fe)
+@@ -968,7 +982,7 @@ static void z_erofs_pcluster_end(struct z_erofs_decompress_frontend *fe)
+ * any longer if the pcluster isn't hosted by ourselves.
+ */
+ if (fe->mode < Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE)
+- z_erofs_put_pcluster(pcl);
++ z_erofs_put_pcluster(EROFS_I_SB(fe->inode), pcl, false);
+
+ fe->pcl = NULL;
+ }
+@@ -1271,6 +1285,7 @@ static int z_erofs_decompress_pcluster(struct z_erofs_decompress_backend *be,
+ int i, j, jtop, err2;
+ struct page *page;
+ bool overlapped;
++ bool try_free = true;
+
+ mutex_lock(&pcl->lock);
+ be->nr_pages = PAGE_ALIGN(pcl->length + pcl->pageofs_out) >> PAGE_SHIFT;
+@@ -1328,9 +1343,12 @@ static int z_erofs_decompress_pcluster(struct z_erofs_decompress_backend *be,
+ /* managed folios are still left in compressed_bvecs[] */
+ for (i = 0; i < pclusterpages; ++i) {
+ page = be->compressed_pages[i];
+- if (!page ||
+- erofs_folio_is_managed(sbi, page_folio(page)))
++ if (!page)
+ continue;
++ if (erofs_folio_is_managed(sbi, page_folio(page))) {
++ try_free = false;
++ continue;
++ }
+ (void)z_erofs_put_shortlivedpage(be->pagepool, page);
+ WRITE_ONCE(pcl->compressed_bvecs[i].page, NULL);
+ }
+@@ -1375,6 +1393,11 @@ static int z_erofs_decompress_pcluster(struct z_erofs_decompress_backend *be,
+ /* pcluster lock MUST be taken before the following line */
+ WRITE_ONCE(pcl->next, Z_EROFS_PCLUSTER_NIL);
+ mutex_unlock(&pcl->lock);
++
++ if (z_erofs_is_inline_pcluster(pcl))
++ z_erofs_free_pcluster(pcl);
++ else
++ z_erofs_put_pcluster(sbi, pcl, try_free);
+ return err;
+ }
+
+@@ -1397,10 +1420,6 @@ static int z_erofs_decompress_queue(const struct z_erofs_decompressqueue *io,
+ owned = READ_ONCE(be.pcl->next);
+
+ err = z_erofs_decompress_pcluster(&be, err) ?: err;
+- if (z_erofs_is_inline_pcluster(be.pcl))
+- z_erofs_free_pcluster(be.pcl);
+- else
+- z_erofs_put_pcluster(be.pcl);
+ }
+ return err;
+ }
+--
+2.39.5
+
--- /dev/null
+From c433f8d3fad2e66cb51cccd45ceae42576dff8b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2025 11:44:27 +0800
+Subject: erofs: get rid of `z_erofs_next_pcluster_t`
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 5514d8478b8ef3f0ba1b77beaa65f05c12825143 ]
+
+It was originally intended for tagged pointer reservation.
+
+Now all encoded data can be represented uniformally with
+`struct z_erofs_pcluster` as described in commit bf1aa03980f4
+("erofs: sunset `struct erofs_workgroup`"), let's drop it too.
+
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20250114034429.431408-2-hsiangkao@linux.alibaba.com
+Stable-dep-of: d53238b614e0 ("erofs: fix to add missing tracepoint in erofs_readahead()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zdata.c | 80 ++++++++++++++++++------------------------------
+ 1 file changed, 29 insertions(+), 51 deletions(-)
+
+diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
+index 4d5a1fbd7e0ad..9e01b52ecad47 100644
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -12,12 +12,6 @@
+ #define Z_EROFS_PCLUSTER_MAX_PAGES (Z_EROFS_PCLUSTER_MAX_SIZE / PAGE_SIZE)
+ #define Z_EROFS_INLINE_BVECS 2
+
+-/*
+- * let's leave a type here in case of introducing
+- * another tagged pointer later.
+- */
+-typedef void *z_erofs_next_pcluster_t;
+-
+ struct z_erofs_bvec {
+ struct page *page;
+ int offset;
+@@ -48,7 +42,7 @@ struct z_erofs_pcluster {
+ struct lockref lockref;
+
+ /* A: point to next chained pcluster or TAILs */
+- z_erofs_next_pcluster_t next;
++ struct z_erofs_pcluster *next;
+
+ /* I: start block address of this pcluster */
+ erofs_off_t index;
+@@ -91,12 +85,11 @@ struct z_erofs_pcluster {
+
+ /* the end of a chain of pclusters */
+ #define Z_EROFS_PCLUSTER_TAIL ((void *) 0x700 + POISON_POINTER_DELTA)
+-#define Z_EROFS_PCLUSTER_NIL (NULL)
+
+ struct z_erofs_decompressqueue {
+ struct super_block *sb;
++ struct z_erofs_pcluster *head;
+ atomic_t pending_bios;
+- z_erofs_next_pcluster_t head;
+
+ union {
+ struct completion done;
+@@ -491,8 +484,7 @@ struct z_erofs_decompress_frontend {
+
+ struct page *pagepool;
+ struct page *candidate_bvpage;
+- struct z_erofs_pcluster *pcl;
+- z_erofs_next_pcluster_t owned_head;
++ struct z_erofs_pcluster *pcl, *head;
+ enum z_erofs_pclustermode mode;
+
+ erofs_off_t headoffset;
+@@ -502,7 +494,7 @@ struct z_erofs_decompress_frontend {
+ };
+
+ #define DECOMPRESS_FRONTEND_INIT(__i) { \
+- .inode = __i, .owned_head = Z_EROFS_PCLUSTER_TAIL, \
++ .inode = __i, .head = Z_EROFS_PCLUSTER_TAIL, \
+ .mode = Z_EROFS_PCLUSTER_FOLLOWED }
+
+ static bool z_erofs_should_alloc_cache(struct z_erofs_decompress_frontend *fe)
+@@ -750,9 +742,7 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe)
+ pcl->algorithmformat = map->m_algorithmformat;
+ pcl->length = 0;
+ pcl->partial = true;
+-
+- /* new pclusters should be claimed as type 1, primary and followed */
+- pcl->next = fe->owned_head;
++ pcl->next = fe->head;
+ pcl->pageofs_out = map->m_la & ~PAGE_MASK;
+ fe->mode = Z_EROFS_PCLUSTER_FOLLOWED;
+
+@@ -788,8 +778,7 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe)
+ goto err_out;
+ }
+ }
+- fe->owned_head = &pcl->next;
+- fe->pcl = pcl;
++ fe->head = fe->pcl = pcl;
+ return 0;
+
+ err_out:
+@@ -808,7 +797,7 @@ static int z_erofs_pcluster_begin(struct z_erofs_decompress_frontend *fe)
+
+ DBG_BUGON(fe->pcl);
+ /* must be Z_EROFS_PCLUSTER_TAIL or pointed to previous pcluster */
+- DBG_BUGON(fe->owned_head == Z_EROFS_PCLUSTER_NIL);
++ DBG_BUGON(!fe->head);
+
+ if (!(map->m_flags & EROFS_MAP_META)) {
+ while (1) {
+@@ -836,10 +825,9 @@ static int z_erofs_pcluster_begin(struct z_erofs_decompress_frontend *fe)
+ if (ret == -EEXIST) {
+ mutex_lock(&fe->pcl->lock);
+ /* check if this pcluster hasn't been linked into any chain. */
+- if (cmpxchg(&fe->pcl->next, Z_EROFS_PCLUSTER_NIL,
+- fe->owned_head) == Z_EROFS_PCLUSTER_NIL) {
++ if (!cmpxchg(&fe->pcl->next, NULL, fe->head)) {
+ /* .. so it can be attached to our submission chain */
+- fe->owned_head = &fe->pcl->next;
++ fe->head = fe->pcl;
+ fe->mode = Z_EROFS_PCLUSTER_FOLLOWED;
+ } else { /* otherwise, it belongs to an inflight chain */
+ fe->mode = Z_EROFS_PCLUSTER_INFLIGHT;
+@@ -1391,7 +1379,7 @@ static int z_erofs_decompress_pcluster(struct z_erofs_decompress_backend *be,
+ pcl->vcnt = 0;
+
+ /* pcluster lock MUST be taken before the following line */
+- WRITE_ONCE(pcl->next, Z_EROFS_PCLUSTER_NIL);
++ WRITE_ONCE(pcl->next, NULL);
+ mutex_unlock(&pcl->lock);
+
+ if (z_erofs_is_inline_pcluster(pcl))
+@@ -1409,16 +1397,14 @@ static int z_erofs_decompress_queue(const struct z_erofs_decompressqueue *io,
+ .pagepool = pagepool,
+ .decompressed_secondary_bvecs =
+ LIST_HEAD_INIT(be.decompressed_secondary_bvecs),
++ .pcl = io->head,
+ };
+- z_erofs_next_pcluster_t owned = io->head;
++ struct z_erofs_pcluster *next;
+ int err = io->eio ? -EIO : 0;
+
+- while (owned != Z_EROFS_PCLUSTER_TAIL) {
+- DBG_BUGON(owned == Z_EROFS_PCLUSTER_NIL);
+-
+- be.pcl = container_of(owned, struct z_erofs_pcluster, next);
+- owned = READ_ONCE(be.pcl->next);
+-
++ for (; be.pcl != Z_EROFS_PCLUSTER_TAIL; be.pcl = next) {
++ DBG_BUGON(!be.pcl);
++ next = READ_ONCE(be.pcl->next);
+ err = z_erofs_decompress_pcluster(&be, err) ?: err;
+ }
+ return err;
+@@ -1628,18 +1614,13 @@ enum {
+ NR_JOBQUEUES,
+ };
+
+-static void move_to_bypass_jobqueue(struct z_erofs_pcluster *pcl,
+- z_erofs_next_pcluster_t qtail[],
+- z_erofs_next_pcluster_t owned_head)
++static void z_erofs_move_to_bypass_queue(struct z_erofs_pcluster *pcl,
++ struct z_erofs_pcluster *next,
++ struct z_erofs_pcluster **qtail[])
+ {
+- z_erofs_next_pcluster_t *const submit_qtail = qtail[JQ_SUBMIT];
+- z_erofs_next_pcluster_t *const bypass_qtail = qtail[JQ_BYPASS];
+-
+ WRITE_ONCE(pcl->next, Z_EROFS_PCLUSTER_TAIL);
+-
+- WRITE_ONCE(*submit_qtail, owned_head);
+- WRITE_ONCE(*bypass_qtail, &pcl->next);
+-
++ WRITE_ONCE(*qtail[JQ_SUBMIT], next);
++ WRITE_ONCE(*qtail[JQ_BYPASS], pcl);
+ qtail[JQ_BYPASS] = &pcl->next;
+ }
+
+@@ -1674,9 +1655,9 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
+ {
+ struct super_block *sb = f->inode->i_sb;
+ struct address_space *mc = MNGD_MAPPING(EROFS_SB(sb));
+- z_erofs_next_pcluster_t qtail[NR_JOBQUEUES];
++ struct z_erofs_pcluster **qtail[NR_JOBQUEUES];
+ struct z_erofs_decompressqueue *q[NR_JOBQUEUES];
+- z_erofs_next_pcluster_t owned_head = f->owned_head;
++ struct z_erofs_pcluster *pcl, *next;
+ /* bio is NULL initially, so no need to initialize last_{index,bdev} */
+ erofs_off_t last_pa;
+ unsigned int nr_bios = 0;
+@@ -1692,22 +1673,19 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
+ qtail[JQ_SUBMIT] = &q[JQ_SUBMIT]->head;
+
+ /* by default, all need io submission */
+- q[JQ_SUBMIT]->head = owned_head;
++ q[JQ_SUBMIT]->head = next = f->head;
+
+ do {
+ struct erofs_map_dev mdev;
+- struct z_erofs_pcluster *pcl;
+ erofs_off_t cur, end;
+ struct bio_vec bvec;
+ unsigned int i = 0;
+ bool bypass = true;
+
+- DBG_BUGON(owned_head == Z_EROFS_PCLUSTER_NIL);
+- pcl = container_of(owned_head, struct z_erofs_pcluster, next);
+- owned_head = READ_ONCE(pcl->next);
+-
++ pcl = next;
++ next = READ_ONCE(pcl->next);
+ if (z_erofs_is_inline_pcluster(pcl)) {
+- move_to_bypass_jobqueue(pcl, qtail, owned_head);
++ z_erofs_move_to_bypass_queue(pcl, next, qtail);
+ continue;
+ }
+
+@@ -1779,8 +1757,8 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
+ if (!bypass)
+ qtail[JQ_SUBMIT] = &pcl->next;
+ else
+- move_to_bypass_jobqueue(pcl, qtail, owned_head);
+- } while (owned_head != Z_EROFS_PCLUSTER_TAIL);
++ z_erofs_move_to_bypass_queue(pcl, next, qtail);
++ } while (next != Z_EROFS_PCLUSTER_TAIL);
+
+ if (bio) {
+ if (erofs_is_fileio_mode(EROFS_SB(sb)))
+@@ -1812,7 +1790,7 @@ static int z_erofs_runqueue(struct z_erofs_decompress_frontend *f,
+ bool force_fg = z_erofs_is_sync_decompress(sbi, ra_folios);
+ int err;
+
+- if (f->owned_head == Z_EROFS_PCLUSTER_TAIL)
++ if (f->head == Z_EROFS_PCLUSTER_TAIL)
+ return 0;
+ z_erofs_submit_queue(f, io, &force_fg, !!ra_folios);
+
+--
+2.39.5
+
--- /dev/null
+From d729d8336aa6213455f839fa8903229f094434df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 20:08:20 +0800
+Subject: erofs: refine readahead tracepoint
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 4eb56b0761e75034dd35067a81da4c280c178262 ]
+
+ - trace_erofs_readpages => trace_erofs_readahead;
+
+ - Rename a redundant statement `nrpages = readahead_count(rac);`;
+
+ - Move the tracepoint to the beginning of z_erofs_readahead().
+
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Reviewed-by: Hongbo Li <lihongbo22@huawei.com>
+Link: https://lore.kernel.org/r/20250514120820.2739288-1-hsiangkao@linux.alibaba.com
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Stable-dep-of: d53238b614e0 ("erofs: fix to add missing tracepoint in erofs_readahead()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/fileio.c | 2 +-
+ fs/erofs/zdata.c | 5 ++---
+ include/trace/events/erofs.h | 2 +-
+ 3 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/fs/erofs/fileio.c b/fs/erofs/fileio.c
+index c8805bc732c6b..c865a7a610306 100644
+--- a/fs/erofs/fileio.c
++++ b/fs/erofs/fileio.c
+@@ -180,7 +180,7 @@ static void erofs_fileio_readahead(struct readahead_control *rac)
+ struct folio *folio;
+ int err;
+
+- trace_erofs_readpages(inode, readahead_index(rac),
++ trace_erofs_readahead(inode, readahead_index(rac),
+ readahead_count(rac), true);
+ while ((folio = readahead_folio(rac))) {
+ err = erofs_fileio_scan_folio(&io, folio);
+diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
+index f13052c3532ab..94c1e2d64df96 100644
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -1869,13 +1869,12 @@ static void z_erofs_readahead(struct readahead_control *rac)
+ {
+ struct inode *const inode = rac->mapping->host;
+ Z_EROFS_DEFINE_FRONTEND(f, inode, readahead_pos(rac));
+- struct folio *head = NULL, *folio;
+ unsigned int nrpages = readahead_count(rac);
++ struct folio *head = NULL, *folio;
+ int err;
+
++ trace_erofs_readahead(inode, readahead_index(rac), nrpages, false);
+ z_erofs_pcluster_readmore(&f, rac, true);
+- nrpages = readahead_count(rac);
+- trace_erofs_readpages(inode, readahead_index(rac), nrpages, false);
+ while ((folio = readahead_folio(rac))) {
+ folio->private = head;
+ head = folio;
+diff --git a/include/trace/events/erofs.h b/include/trace/events/erofs.h
+index ad79f1ca4fb5a..198a0c644bea1 100644
+--- a/include/trace/events/erofs.h
++++ b/include/trace/events/erofs.h
+@@ -113,7 +113,7 @@ TRACE_EVENT(erofs_read_folio,
+ __entry->raw)
+ );
+
+-TRACE_EVENT(erofs_readpages,
++TRACE_EVENT(erofs_readahead,
+
+ TP_PROTO(struct inode *inode, pgoff_t start, unsigned int nrpage,
+ bool raw),
+--
+2.39.5
+
--- /dev/null
+From 5a78329dd23f1332aa367923e64a71cc71994cb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2025 11:44:28 +0800
+Subject: erofs: tidy up zdata.c
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 6f435e94a19ad25b372bc61443afd0839b8a521c ]
+
+All small code style adjustments, no logic changes:
+
+ - z_erofs_decompress_frontend => z_erofs_frontend;
+ - z_erofs_decompress_backend => z_erofs_backend;
+ - Use Z_EROFS_DEFINE_FRONTEND() to replace DECOMPRESS_FRONTEND_INIT();
+ - `nr_folios` should be `nrpages` in z_erofs_readahead();
+ - Refine in-line comments.
+
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20250114034429.431408-3-hsiangkao@linux.alibaba.com
+Stable-dep-of: d53238b614e0 ("erofs: fix to add missing tracepoint in erofs_readahead()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zdata.c | 111 ++++++++++++++++++-----------------------------
+ 1 file changed, 43 insertions(+), 68 deletions(-)
+
+diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
+index 9e01b52ecad47..f13052c3532ab 100644
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -453,31 +453,25 @@ int __init z_erofs_init_subsystem(void)
+ }
+
+ enum z_erofs_pclustermode {
++ /* It has previously been linked into another processing chain */
+ Z_EROFS_PCLUSTER_INFLIGHT,
+ /*
+- * a weak form of Z_EROFS_PCLUSTER_FOLLOWED, the difference is that it
+- * could be dispatched into bypass queue later due to uptodated managed
+- * pages. All related online pages cannot be reused for inplace I/O (or
+- * bvpage) since it can be directly decoded without I/O submission.
++ * A weaker form of Z_EROFS_PCLUSTER_FOLLOWED; the difference is that it
++ * may be dispatched to the bypass queue later due to uptodated managed
++ * folios. All file-backed folios related to this pcluster cannot be
++ * reused for in-place I/O (or bvpage) since the pcluster may be decoded
++ * in a separate queue (and thus out of order).
+ */
+ Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE,
+ /*
+- * The pcluster was just linked to a decompression chain by us. It can
+- * also be linked with the remaining pclusters, which means if the
+- * processing page is the tail page of a pcluster, this pcluster can
+- * safely use the whole page (since the previous pcluster is within the
+- * same chain) for in-place I/O, as illustrated below:
+- * ___________________________________________________
+- * | tail (partial) page | head (partial) page |
+- * | (of the current pcl) | (of the previous pcl) |
+- * |___PCLUSTER_FOLLOWED___|_____PCLUSTER_FOLLOWED_____|
+- *
+- * [ (*) the page above can be used as inplace I/O. ]
++ * The pcluster has just been linked to our processing chain.
++ * File-backed folios (except for the head page) related to it can be
++ * used for in-place I/O (or bvpage).
+ */
+ Z_EROFS_PCLUSTER_FOLLOWED,
+ };
+
+-struct z_erofs_decompress_frontend {
++struct z_erofs_frontend {
+ struct inode *const inode;
+ struct erofs_map_blocks map;
+ struct z_erofs_bvec_iter biter;
+@@ -493,11 +487,11 @@ struct z_erofs_decompress_frontend {
+ unsigned int icur;
+ };
+
+-#define DECOMPRESS_FRONTEND_INIT(__i) { \
+- .inode = __i, .head = Z_EROFS_PCLUSTER_TAIL, \
+- .mode = Z_EROFS_PCLUSTER_FOLLOWED }
++#define Z_EROFS_DEFINE_FRONTEND(fe, i, ho) struct z_erofs_frontend fe = { \
++ .inode = i, .head = Z_EROFS_PCLUSTER_TAIL, \
++ .mode = Z_EROFS_PCLUSTER_FOLLOWED, .headoffset = ho }
+
+-static bool z_erofs_should_alloc_cache(struct z_erofs_decompress_frontend *fe)
++static bool z_erofs_should_alloc_cache(struct z_erofs_frontend *fe)
+ {
+ unsigned int cachestrategy = EROFS_I_SB(fe->inode)->opt.cache_strategy;
+
+@@ -514,7 +508,7 @@ static bool z_erofs_should_alloc_cache(struct z_erofs_decompress_frontend *fe)
+ return false;
+ }
+
+-static void z_erofs_bind_cache(struct z_erofs_decompress_frontend *fe)
++static void z_erofs_bind_cache(struct z_erofs_frontend *fe)
+ {
+ struct address_space *mc = MNGD_MAPPING(EROFS_I_SB(fe->inode));
+ struct z_erofs_pcluster *pcl = fe->pcl;
+@@ -671,7 +665,7 @@ int z_erofs_init_super(struct super_block *sb)
+ }
+
+ /* callers must be with pcluster lock held */
+-static int z_erofs_attach_page(struct z_erofs_decompress_frontend *fe,
++static int z_erofs_attach_page(struct z_erofs_frontend *fe,
+ struct z_erofs_bvec *bvec, bool exclusive)
+ {
+ struct z_erofs_pcluster *pcl = fe->pcl;
+@@ -717,7 +711,7 @@ static bool z_erofs_get_pcluster(struct z_erofs_pcluster *pcl)
+ return true;
+ }
+
+-static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe)
++static int z_erofs_register_pcluster(struct z_erofs_frontend *fe)
+ {
+ struct erofs_map_blocks *map = &fe->map;
+ struct super_block *sb = fe->inode->i_sb;
+@@ -787,7 +781,7 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe)
+ return err;
+ }
+
+-static int z_erofs_pcluster_begin(struct z_erofs_decompress_frontend *fe)
++static int z_erofs_pcluster_begin(struct z_erofs_frontend *fe)
+ {
+ struct erofs_map_blocks *map = &fe->map;
+ struct super_block *sb = fe->inode->i_sb;
+@@ -860,14 +854,9 @@ static int z_erofs_pcluster_begin(struct z_erofs_decompress_frontend *fe)
+ return 0;
+ }
+
+-/*
+- * keep in mind that no referenced pclusters will be freed
+- * only after a RCU grace period.
+- */
+ static void z_erofs_rcu_callback(struct rcu_head *head)
+ {
+- z_erofs_free_pcluster(container_of(head,
+- struct z_erofs_pcluster, rcu));
++ z_erofs_free_pcluster(container_of(head, struct z_erofs_pcluster, rcu));
+ }
+
+ static bool __erofs_try_to_release_pcluster(struct erofs_sb_info *sbi,
+@@ -909,8 +898,7 @@ static bool erofs_try_to_release_pcluster(struct erofs_sb_info *sbi,
+ return free;
+ }
+
+-unsigned long z_erofs_shrink_scan(struct erofs_sb_info *sbi,
+- unsigned long nr_shrink)
++unsigned long z_erofs_shrink_scan(struct erofs_sb_info *sbi, unsigned long nr)
+ {
+ struct z_erofs_pcluster *pcl;
+ unsigned long index, freed = 0;
+@@ -923,7 +911,7 @@ unsigned long z_erofs_shrink_scan(struct erofs_sb_info *sbi,
+ xa_unlock(&sbi->managed_pslots);
+
+ ++freed;
+- if (!--nr_shrink)
++ if (!--nr)
+ return freed;
+ xa_lock(&sbi->managed_pslots);
+ }
+@@ -952,7 +940,7 @@ static void z_erofs_put_pcluster(struct erofs_sb_info *sbi,
+ call_rcu(&pcl->rcu, z_erofs_rcu_callback);
+ }
+
+-static void z_erofs_pcluster_end(struct z_erofs_decompress_frontend *fe)
++static void z_erofs_pcluster_end(struct z_erofs_frontend *fe)
+ {
+ struct z_erofs_pcluster *pcl = fe->pcl;
+
+@@ -965,13 +953,9 @@ static void z_erofs_pcluster_end(struct z_erofs_decompress_frontend *fe)
+ if (fe->candidate_bvpage)
+ fe->candidate_bvpage = NULL;
+
+- /*
+- * if all pending pages are added, don't hold its reference
+- * any longer if the pcluster isn't hosted by ourselves.
+- */
++ /* Drop refcount if it doesn't belong to our processing chain */
+ if (fe->mode < Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE)
+ z_erofs_put_pcluster(EROFS_I_SB(fe->inode), pcl, false);
+-
+ fe->pcl = NULL;
+ }
+
+@@ -1000,7 +984,7 @@ static int z_erofs_read_fragment(struct super_block *sb, struct folio *folio,
+ return 0;
+ }
+
+-static int z_erofs_scan_folio(struct z_erofs_decompress_frontend *f,
++static int z_erofs_scan_folio(struct z_erofs_frontend *f,
+ struct folio *folio, bool ra)
+ {
+ struct inode *const inode = f->inode;
+@@ -1113,7 +1097,7 @@ static bool z_erofs_page_is_invalidated(struct page *page)
+ return !page_folio(page)->mapping && !z_erofs_is_shortlived_page(page);
+ }
+
+-struct z_erofs_decompress_backend {
++struct z_erofs_backend {
+ struct page *onstack_pages[Z_EROFS_ONSTACK_PAGES];
+ struct super_block *sb;
+ struct z_erofs_pcluster *pcl;
+@@ -1134,7 +1118,7 @@ struct z_erofs_bvec_item {
+ struct list_head list;
+ };
+
+-static void z_erofs_do_decompressed_bvec(struct z_erofs_decompress_backend *be,
++static void z_erofs_do_decompressed_bvec(struct z_erofs_backend *be,
+ struct z_erofs_bvec *bvec)
+ {
+ int poff = bvec->offset + be->pcl->pageofs_out;
+@@ -1159,8 +1143,7 @@ static void z_erofs_do_decompressed_bvec(struct z_erofs_decompress_backend *be,
+ list_add(&item->list, &be->decompressed_secondary_bvecs);
+ }
+
+-static void z_erofs_fill_other_copies(struct z_erofs_decompress_backend *be,
+- int err)
++static void z_erofs_fill_other_copies(struct z_erofs_backend *be, int err)
+ {
+ unsigned int off0 = be->pcl->pageofs_out;
+ struct list_head *p, *n;
+@@ -1201,7 +1184,7 @@ static void z_erofs_fill_other_copies(struct z_erofs_decompress_backend *be,
+ }
+ }
+
+-static void z_erofs_parse_out_bvecs(struct z_erofs_decompress_backend *be)
++static void z_erofs_parse_out_bvecs(struct z_erofs_backend *be)
+ {
+ struct z_erofs_pcluster *pcl = be->pcl;
+ struct z_erofs_bvec_iter biter;
+@@ -1226,8 +1209,7 @@ static void z_erofs_parse_out_bvecs(struct z_erofs_decompress_backend *be)
+ z_erofs_put_shortlivedpage(be->pagepool, old_bvpage);
+ }
+
+-static int z_erofs_parse_in_bvecs(struct z_erofs_decompress_backend *be,
+- bool *overlapped)
++static int z_erofs_parse_in_bvecs(struct z_erofs_backend *be, bool *overlapped)
+ {
+ struct z_erofs_pcluster *pcl = be->pcl;
+ unsigned int pclusterpages = z_erofs_pclusterpages(pcl);
+@@ -1262,8 +1244,7 @@ static int z_erofs_parse_in_bvecs(struct z_erofs_decompress_backend *be,
+ return err;
+ }
+
+-static int z_erofs_decompress_pcluster(struct z_erofs_decompress_backend *be,
+- int err)
++static int z_erofs_decompress_pcluster(struct z_erofs_backend *be, int err)
+ {
+ struct erofs_sb_info *const sbi = EROFS_SB(be->sb);
+ struct z_erofs_pcluster *pcl = be->pcl;
+@@ -1392,7 +1373,7 @@ static int z_erofs_decompress_pcluster(struct z_erofs_decompress_backend *be,
+ static int z_erofs_decompress_queue(const struct z_erofs_decompressqueue *io,
+ struct page **pagepool)
+ {
+- struct z_erofs_decompress_backend be = {
++ struct z_erofs_backend be = {
+ .sb = io->sb,
+ .pagepool = pagepool,
+ .decompressed_secondary_bvecs =
+@@ -1470,7 +1451,7 @@ static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io,
+ }
+
+ static void z_erofs_fill_bio_vec(struct bio_vec *bvec,
+- struct z_erofs_decompress_frontend *f,
++ struct z_erofs_frontend *f,
+ struct z_erofs_pcluster *pcl,
+ unsigned int nr,
+ struct address_space *mc)
+@@ -1649,7 +1630,7 @@ static void z_erofs_endio(struct bio *bio)
+ bio_put(bio);
+ }
+
+-static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
++static void z_erofs_submit_queue(struct z_erofs_frontend *f,
+ struct z_erofs_decompressqueue *fgq,
+ bool *force_fg, bool readahead)
+ {
+@@ -1782,17 +1763,16 @@ static void z_erofs_submit_queue(struct z_erofs_decompress_frontend *f,
+ z_erofs_decompress_kickoff(q[JQ_SUBMIT], nr_bios);
+ }
+
+-static int z_erofs_runqueue(struct z_erofs_decompress_frontend *f,
+- unsigned int ra_folios)
++static int z_erofs_runqueue(struct z_erofs_frontend *f, unsigned int rapages)
+ {
+ struct z_erofs_decompressqueue io[NR_JOBQUEUES];
+ struct erofs_sb_info *sbi = EROFS_I_SB(f->inode);
+- bool force_fg = z_erofs_is_sync_decompress(sbi, ra_folios);
++ bool force_fg = z_erofs_is_sync_decompress(sbi, rapages);
+ int err;
+
+ if (f->head == Z_EROFS_PCLUSTER_TAIL)
+ return 0;
+- z_erofs_submit_queue(f, io, &force_fg, !!ra_folios);
++ z_erofs_submit_queue(f, io, &force_fg, !!rapages);
+
+ /* handle bypass queue (no i/o pclusters) immediately */
+ err = z_erofs_decompress_queue(&io[JQ_BYPASS], &f->pagepool);
+@@ -1810,7 +1790,7 @@ static int z_erofs_runqueue(struct z_erofs_decompress_frontend *f,
+ * Since partial uptodate is still unimplemented for now, we have to use
+ * approximate readmore strategies as a start.
+ */
+-static void z_erofs_pcluster_readmore(struct z_erofs_decompress_frontend *f,
++static void z_erofs_pcluster_readmore(struct z_erofs_frontend *f,
+ struct readahead_control *rac, bool backmost)
+ {
+ struct inode *inode = f->inode;
+@@ -1865,12 +1845,10 @@ static void z_erofs_pcluster_readmore(struct z_erofs_decompress_frontend *f,
+ static int z_erofs_read_folio(struct file *file, struct folio *folio)
+ {
+ struct inode *const inode = folio->mapping->host;
+- struct z_erofs_decompress_frontend f = DECOMPRESS_FRONTEND_INIT(inode);
++ Z_EROFS_DEFINE_FRONTEND(f, inode, folio_pos(folio));
+ int err;
+
+ trace_erofs_read_folio(folio, false);
+- f.headoffset = (erofs_off_t)folio->index << PAGE_SHIFT;
+-
+ z_erofs_pcluster_readmore(&f, NULL, true);
+ err = z_erofs_scan_folio(&f, folio, false);
+ z_erofs_pcluster_readmore(&f, NULL, false);
+@@ -1890,17 +1868,14 @@ static int z_erofs_read_folio(struct file *file, struct folio *folio)
+ static void z_erofs_readahead(struct readahead_control *rac)
+ {
+ struct inode *const inode = rac->mapping->host;
+- struct z_erofs_decompress_frontend f = DECOMPRESS_FRONTEND_INIT(inode);
++ Z_EROFS_DEFINE_FRONTEND(f, inode, readahead_pos(rac));
+ struct folio *head = NULL, *folio;
+- unsigned int nr_folios;
++ unsigned int nrpages = readahead_count(rac);
+ int err;
+
+- f.headoffset = readahead_pos(rac);
+-
+ z_erofs_pcluster_readmore(&f, rac, true);
+- nr_folios = readahead_count(rac);
+- trace_erofs_readpages(inode, readahead_index(rac), nr_folios, false);
+-
++ nrpages = readahead_count(rac);
++ trace_erofs_readpages(inode, readahead_index(rac), nrpages, false);
+ while ((folio = readahead_folio(rac))) {
+ folio->private = head;
+ head = folio;
+@@ -1919,7 +1894,7 @@ static void z_erofs_readahead(struct readahead_control *rac)
+ z_erofs_pcluster_readmore(&f, rac, false);
+ z_erofs_pcluster_end(&f);
+
+- (void)z_erofs_runqueue(&f, nr_folios);
++ (void)z_erofs_runqueue(&f, nrpages);
+ erofs_put_metabuf(&f.map.buf);
+ erofs_release_pages(&f.pagepool);
+ }
+--
+2.39.5
+
--- /dev/null
+From 636442c38e2d0c5b89e72b209465ea5d9c5860ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jun 2025 15:29:59 +0800
+Subject: HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
+
+From: Zhang Heng <zhangheng@kylinos.cn>
+
+[ Upstream commit 1a8953f4f7746c6a515989774fe03047c522c613 ]
+
+MARTLINKTECHNOLOGY is a microphone device, when the HID interface in an
+audio device is requested to get specific report id, the following error
+may occur.
+
+[ 562.939373] usb 1-1.4.1.2: new full-speed USB device number 21 using xhci_hcd
+[ 563.104908] usb 1-1.4.1.2: New USB device found, idVendor=4c4a, idProduct=4155, bcdDevice= 1.00
+[ 563.104910] usb 1-1.4.1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+[ 563.104911] usb 1-1.4.1.2: Product: USB Composite Device
+[ 563.104912] usb 1-1.4.1.2: Manufacturer: SmartlinkTechnology
+[ 563.104913] usb 1-1.4.1.2: SerialNumber: 20201111000001
+[ 563.229499] input: SmartlinkTechnology USB Composite Device as /devices/pci0000:00/0000:00:07.1/0000:04:00.3/usb1/1-1/1-1.4/1-1.4.1/1-1.4.1.2/1-1.4.1.2:1.2/0003:4C4A:4155.000F/input/input35
+[ 563.291505] hid-generic 0003:4C4A:4155.000F: input,hidraw2: USB HID v2.01 Keyboard [SmartlinkTechnology USB Composite Device] on usb-0000:04:00.3-1.4.1.2/input2
+[ 563.291557] usbhid 1-1.4.1.2:1.3: couldn't find an input interrupt endpoint
+[ 568.506654] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110)
+[ 573.626656] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110)
+[ 578.746657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110)
+[ 583.866655] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110)
+[ 588.986657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110)
+
+Ignore HID interface. The device is working properly.
+
+Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 49dc86981287a..de6bab6a7394b 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1519,4 +1519,7 @@
+ #define USB_VENDOR_ID_SIGNOTEC 0x2133
+ #define USB_DEVICE_ID_SIGNOTEC_VIEWSONIC_PD1011 0x0018
+
++#define USB_VENDOR_ID_SMARTLINKTECHNOLOGY 0x4c4a
++#define USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155 0x4155
++
+ #endif
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 73979643315bf..e4d80307b898c 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -894,6 +894,7 @@ static const struct hid_device_id hid_ignore_list[] = {
+ #endif
+ { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SMARTLINKTECHNOLOGY, USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155) },
+ { }
+ };
+
+--
+2.39.5
+
--- /dev/null
+From b2d3ac90919baaff4469831054b09071122a608b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jun 2025 13:34:38 +0900
+Subject: HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
+
+From: Akira Inoue <niyarium@gmail.com>
+
+[ Upstream commit a8905238c3bbe13db90065ed74682418f23830c3 ]
+
+Add "Thinkpad X1 Tablet Gen 2 Keyboard" PID to hid-lenovo driver to fix trackpoint not working issue.
+
+Signed-off-by: Akira Inoue <niyarium@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-lenovo.c | 8 ++++++++
+ drivers/hid/hid-multitouch.c | 8 +++++++-
+ 3 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index c6424f6259487..49dc86981287a 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -814,6 +814,7 @@
+ #define USB_DEVICE_ID_LENOVO_TPPRODOCK 0x6067
+ #define USB_DEVICE_ID_LENOVO_X1_COVER 0x6085
+ #define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3
++#define USB_DEVICE_ID_LENOVO_X1_TAB2 0x60a4
+ #define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5
+ #define USB_DEVICE_ID_LENOVO_X12_TAB 0x60fe
+ #define USB_DEVICE_ID_LENOVO_X12_TAB2 0x61ae
+diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
+index 56e530860caef..8482852c662dd 100644
+--- a/drivers/hid/hid-lenovo.c
++++ b/drivers/hid/hid-lenovo.c
+@@ -473,6 +473,7 @@ static int lenovo_input_mapping(struct hid_device *hdev,
+ return lenovo_input_mapping_tp10_ultrabook_kbd(hdev, hi, field,
+ usage, bit, max);
+ case USB_DEVICE_ID_LENOVO_X1_TAB:
++ case USB_DEVICE_ID_LENOVO_X1_TAB2:
+ case USB_DEVICE_ID_LENOVO_X1_TAB3:
+ return lenovo_input_mapping_x1_tab_kbd(hdev, hi, field, usage, bit, max);
+ default:
+@@ -587,6 +588,7 @@ static ssize_t attr_fn_lock_store(struct device *dev,
+ break;
+ case USB_DEVICE_ID_LENOVO_TP10UBKBD:
+ case USB_DEVICE_ID_LENOVO_X1_TAB:
++ case USB_DEVICE_ID_LENOVO_X1_TAB2:
+ case USB_DEVICE_ID_LENOVO_X1_TAB3:
+ ret = lenovo_led_set_tp10ubkbd(hdev, TP10UBKBD_FN_LOCK_LED, value);
+ if (ret)
+@@ -781,6 +783,7 @@ static int lenovo_event(struct hid_device *hdev, struct hid_field *field,
+ return lenovo_event_cptkbd(hdev, field, usage, value);
+ case USB_DEVICE_ID_LENOVO_TP10UBKBD:
+ case USB_DEVICE_ID_LENOVO_X1_TAB:
++ case USB_DEVICE_ID_LENOVO_X1_TAB2:
+ case USB_DEVICE_ID_LENOVO_X1_TAB3:
+ return lenovo_event_tp10ubkbd(hdev, field, usage, value);
+ default:
+@@ -1062,6 +1065,7 @@ static int lenovo_led_brightness_set(struct led_classdev *led_cdev,
+ break;
+ case USB_DEVICE_ID_LENOVO_TP10UBKBD:
+ case USB_DEVICE_ID_LENOVO_X1_TAB:
++ case USB_DEVICE_ID_LENOVO_X1_TAB2:
+ case USB_DEVICE_ID_LENOVO_X1_TAB3:
+ ret = lenovo_led_set_tp10ubkbd(hdev, tp10ubkbd_led[led_nr], value);
+ break;
+@@ -1293,6 +1297,7 @@ static int lenovo_probe(struct hid_device *hdev,
+ break;
+ case USB_DEVICE_ID_LENOVO_TP10UBKBD:
+ case USB_DEVICE_ID_LENOVO_X1_TAB:
++ case USB_DEVICE_ID_LENOVO_X1_TAB2:
+ case USB_DEVICE_ID_LENOVO_X1_TAB3:
+ ret = lenovo_probe_tp10ubkbd(hdev);
+ break;
+@@ -1380,6 +1385,7 @@ static void lenovo_remove(struct hid_device *hdev)
+ break;
+ case USB_DEVICE_ID_LENOVO_TP10UBKBD:
+ case USB_DEVICE_ID_LENOVO_X1_TAB:
++ case USB_DEVICE_ID_LENOVO_X1_TAB2:
+ case USB_DEVICE_ID_LENOVO_X1_TAB3:
+ lenovo_remove_tp10ubkbd(hdev);
+ break;
+@@ -1430,6 +1436,8 @@ static const struct hid_device_id lenovo_devices[] = {
+ */
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB) },
++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
++ USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB2) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB3) },
+ { }
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 93b5c648ef82c..641292cfdaa6f 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -2116,12 +2116,18 @@ static const struct hid_device_id mt_devices[] = {
+ HID_DEVICE(BUS_I2C, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_7010) },
+
+- /* Lenovo X1 TAB Gen 2 */
++ /* Lenovo X1 TAB Gen 1 */
+ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT,
+ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
+ USB_VENDOR_ID_LENOVO,
+ USB_DEVICE_ID_LENOVO_X1_TAB) },
+
++ /* Lenovo X1 TAB Gen 2 */
++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT,
++ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
++ USB_VENDOR_ID_LENOVO,
++ USB_DEVICE_ID_LENOVO_X1_TAB2) },
++
+ /* Lenovo X1 TAB Gen 3 */
+ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT,
+ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
+--
+2.39.5
+
--- /dev/null
+From fb0ad43900edf881a0e8fed8b11d5f2e6ea350b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 03:47:00 -0400
+Subject: HID: nintendo: avoid bluetooth suspend/resume stalls
+
+From: Daniel J. Ogorchock <djogorchock@gmail.com>
+
+[ Upstream commit 4a0381080397e77792a5168069f174d3e56175ff ]
+
+Ensure we don't stall or panic the kernel when using bluetooth-connected
+controllers. This was reported as an issue on android devices using
+kernel 6.6 due to the resume hook which had been added for usb joycons.
+
+First, set a new state value to JOYCON_CTLR_STATE_SUSPENDED in a
+newly-added nintendo_hid_suspend. This makes sure we will not stall out
+the kernel waiting for input reports during led classdev suspend. The
+stalls could happen if connectivity is unreliable or lost to the
+controller prior to suspend.
+
+Second, since we lose connectivity during suspend, do not try
+joycon_init() for bluetooth controllers in the nintendo_hid_resume path.
+
+Tested via multiple suspend/resume flows when using the controller both
+in USB and bluetooth modes.
+
+Signed-off-by: Daniel J. Ogorchock <djogorchock@gmail.com>
+Reviewed-by: Silvan Jegen <s.jegen@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-nintendo.c | 38 ++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 36 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c
+index 55153a2f79886..2a3ae1068739d 100644
+--- a/drivers/hid/hid-nintendo.c
++++ b/drivers/hid/hid-nintendo.c
+@@ -308,6 +308,7 @@ enum joycon_ctlr_state {
+ JOYCON_CTLR_STATE_INIT,
+ JOYCON_CTLR_STATE_READ,
+ JOYCON_CTLR_STATE_REMOVED,
++ JOYCON_CTLR_STATE_SUSPENDED,
+ };
+
+ /* Controller type received as part of device info */
+@@ -2754,14 +2755,46 @@ static void nintendo_hid_remove(struct hid_device *hdev)
+
+ static int nintendo_hid_resume(struct hid_device *hdev)
+ {
+- int ret = joycon_init(hdev);
++ struct joycon_ctlr *ctlr = hid_get_drvdata(hdev);
++ int ret;
++
++ hid_dbg(hdev, "resume\n");
++ if (!joycon_using_usb(ctlr)) {
++ hid_dbg(hdev, "no-op resume for bt ctlr\n");
++ ctlr->ctlr_state = JOYCON_CTLR_STATE_READ;
++ return 0;
++ }
+
++ ret = joycon_init(hdev);
+ if (ret)
+- hid_err(hdev, "Failed to restore controller after resume");
++ hid_err(hdev,
++ "Failed to restore controller after resume: %d\n",
++ ret);
++ else
++ ctlr->ctlr_state = JOYCON_CTLR_STATE_READ;
+
+ return ret;
+ }
+
++static int nintendo_hid_suspend(struct hid_device *hdev, pm_message_t message)
++{
++ struct joycon_ctlr *ctlr = hid_get_drvdata(hdev);
++
++ hid_dbg(hdev, "suspend: %d\n", message.event);
++ /*
++ * Avoid any blocking loops in suspend/resume transitions.
++ *
++ * joycon_enforce_subcmd_rate() can result in repeated retries if for
++ * whatever reason the controller stops providing input reports.
++ *
++ * This has been observed with bluetooth controllers which lose
++ * connectivity prior to suspend (but not long enough to result in
++ * complete disconnection).
++ */
++ ctlr->ctlr_state = JOYCON_CTLR_STATE_SUSPENDED;
++ return 0;
++}
++
+ #endif
+
+ static const struct hid_device_id nintendo_hid_devices[] = {
+@@ -2800,6 +2833,7 @@ static struct hid_driver nintendo_hid_driver = {
+
+ #ifdef CONFIG_PM
+ .resume = nintendo_hid_resume,
++ .suspend = nintendo_hid_suspend,
+ #endif
+ };
+ static int __init nintendo_init(void)
+--
+2.39.5
+
--- /dev/null
+From 7295b21e10c0d6578177b1009be28061b408537e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 May 2025 13:50:15 +0800
+Subject: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
+
+From: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+
+[ Upstream commit 54bae4c17c11688339eb73a04fd24203bb6e7494 ]
+
+The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C)
+report a HID sensor interface that is not actually implemented.
+Attempting to access this non-functional sensor via iio_info causes
+system hangs as runtime PM tries to wake up an unresponsive sensor.
+
+Add these 2 devices to the HID ignore list since the sensor interface is
+non-functional by design and should not be exposed to userspace.
+
+Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 2 ++
+ drivers/hid/hid-quirks.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index de6bab6a7394b..b472140421f5a 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -311,6 +311,8 @@
+ #define USB_DEVICE_ID_ASUS_AK1D 0x1125
+ #define USB_DEVICE_ID_CHICONY_TOSHIBA_WT10A 0x1408
+ #define USB_DEVICE_ID_CHICONY_ACER_SWITCH12 0x1421
++#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA 0xb824
++#define USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2 0xb82c
+
+ #define USB_VENDOR_ID_CHUNGHWAT 0x2247
+ #define USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH 0x0001
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index e4d80307b898c..80372342c176a 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -747,6 +747,8 @@ static const struct hid_device_id hid_ignore_list[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_AVERMEDIA, USB_DEVICE_ID_AVER_FM_MR800) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_AXENTIA, USB_DEVICE_ID_AXENTIA_FM_RADIO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_BERKSHIRE, USB_DEVICE_ID_BERKSHIRE_PCWD) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_HP_5MP_CAMERA2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CIDC, 0x0103) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI470X) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_RADIO_SI4713) },
+--
+2.39.5
+
--- /dev/null
+From 1923f4e68bb6798d056e68207dc86851e9cee503 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 08:33:32 -0700
+Subject: ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
+
+From: Mingming Cao <mmc@linux.ibm.com>
+
+[ Upstream commit 01b8114b432d7baaa5e51ab229c12c4f36b8e2c6 ]
+
+The previous hardcoded definitions of NUM_RX_STATS and
+NUM_TX_STATS were not updated when new fields were added
+to the ibmvnic_{rx,tx}_queue_stats structures. Specifically,
+commit 2ee73c54a615 ("ibmvnic: Add stat for tx direct vs tx
+batched") added a fourth TX stat, but NUM_TX_STATS remained 3,
+leading to a mismatch.
+
+This patch replaces the static defines with dynamic sizeof-based
+calculations to ensure the stat arrays are correctly sized.
+This fixes incorrect indexing and prevents incomplete stat
+reporting in tools like ethtool.
+
+Fixes: 2ee73c54a615 ("ibmvnic: Add stat for tx direct vs tx batched")
+Signed-off-by: Mingming Cao <mmc@linux.ibm.com>
+Reviewed-by: Dave Marquardt <davemarq@linux.ibm.com>
+Reviewed-by: Haren Myneni <haren@linux.ibm.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250709153332.73892-1-mmc@linux.ibm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.h | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
+index a189038d88df0..246ddce753f92 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.h
++++ b/drivers/net/ethernet/ibm/ibmvnic.h
+@@ -211,7 +211,6 @@ struct ibmvnic_statistics {
+ u8 reserved[72];
+ } __packed __aligned(8);
+
+-#define NUM_TX_STATS 3
+ struct ibmvnic_tx_queue_stats {
+ u64 batched_packets;
+ u64 direct_packets;
+@@ -219,13 +218,18 @@ struct ibmvnic_tx_queue_stats {
+ u64 dropped_packets;
+ };
+
+-#define NUM_RX_STATS 3
++#define NUM_TX_STATS \
++ (sizeof(struct ibmvnic_tx_queue_stats) / sizeof(u64))
++
+ struct ibmvnic_rx_queue_stats {
+ u64 packets;
+ u64 bytes;
+ u64 interrupts;
+ };
+
++#define NUM_RX_STATS \
++ (sizeof(struct ibmvnic_rx_queue_stats) / sizeof(u64))
++
+ struct ibmvnic_acl_buffer {
+ __be32 len;
+ __be32 version;
+--
+2.39.5
+
--- /dev/null
+From 68e03e4d7c6ce1d2e162e23bfc9a1e90e7dfc9b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 19:02:18 +0800
+Subject: io_uring: make fallocate be hashed work
+
+From: Fengnan Chang <changfengnan@bytedance.com>
+
+[ Upstream commit 88a80066af1617fab444776135d840467414beb6 ]
+
+Like ftruncate and write, fallocate operations on the same file cannot
+be executed in parallel, so it is better to make fallocate be hashed
+work.
+
+Signed-off-by: Fengnan Chang <changfengnan@bytedance.com>
+Link: https://lore.kernel.org/r/20250623110218.61490-1-changfengnan@bytedance.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/opdef.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/io_uring/opdef.c b/io_uring/opdef.c
+index a2be3bbca5ffa..5dc1cba158a06 100644
+--- a/io_uring/opdef.c
++++ b/io_uring/opdef.c
+@@ -214,6 +214,7 @@ const struct io_issue_def io_issue_defs[] = {
+ },
+ [IORING_OP_FALLOCATE] = {
+ .needs_file = 1,
++ .hash_reg_file = 1,
+ .prep = io_fallocate_prep,
+ .issue = io_fallocate,
+ },
+--
+2.39.5
+
--- /dev/null
+From a6964aacea359fb160fb6dc2fd31e48108f148ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jun 2025 19:28:40 +0800
+Subject: md/raid1: Fix stack memory use after return in raid1_reshape
+
+From: Wang Jinchao <wangjinchao600@gmail.com>
+
+[ Upstream commit d67ed2ccd2d1dcfda9292c0ea8697a9d0f2f0d98 ]
+
+In the raid1_reshape function, newpool is
+allocated on the stack and assigned to conf->r1bio_pool.
+This results in conf->r1bio_pool.wait.head pointing
+to a stack address.
+Accessing this address later can lead to a kernel panic.
+
+Example access path:
+
+raid1_reshape()
+{
+ // newpool is on the stack
+ mempool_t newpool, oldpool;
+ // initialize newpool.wait.head to stack address
+ mempool_init(&newpool, ...);
+ conf->r1bio_pool = newpool;
+}
+
+raid1_read_request() or raid1_write_request()
+{
+ alloc_r1bio()
+ {
+ mempool_alloc()
+ {
+ // if pool->alloc fails
+ remove_element()
+ {
+ --pool->curr_nr;
+ }
+ }
+ }
+}
+
+mempool_free()
+{
+ if (pool->curr_nr < pool->min_nr) {
+ // pool->wait.head is a stack address
+ // wake_up() will try to access this invalid address
+ // which leads to a kernel panic
+ return;
+ wake_up(&pool->wait);
+ }
+}
+
+Fix:
+reinit conf->r1bio_pool.wait after assigning newpool.
+
+Fixes: afeee514ce7f ("md: convert to bioset_init()/mempool_init()")
+Signed-off-by: Wang Jinchao <wangjinchao600@gmail.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/linux-raid/20250612112901.3023950-1-wangjinchao600@gmail.com
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid1.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 6b6cd753d61a9..fe1599db69c84 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -3380,6 +3380,7 @@ static int raid1_reshape(struct mddev *mddev)
+ /* ok, everything is stopped */
+ oldpool = conf->r1bio_pool;
+ conf->r1bio_pool = newpool;
++ init_waitqueue_head(&conf->r1bio_pool.wait);
+
+ for (d = d2 = 0; d < conf->raid_disks; d++) {
+ struct md_rdev *rdev = conf->mirrors[d].rdev;
+--
+2.39.5
+
--- /dev/null
+From 910d7bb7a90f82419c796e77d19299a44a69e0be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jun 2025 21:24:05 +0800
+Subject: nbd: fix uaf in nbd_genl_connect() error path
+
+From: Zheng Qixing <zhengqixing@huawei.com>
+
+[ Upstream commit aa9552438ebf015fc5f9f890dbfe39f0c53cf37e ]
+
+There is a use-after-free issue in nbd:
+
+block nbd6: Receive control failed (result -104)
+block nbd6: shutting down sockets
+==================================================================
+BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022
+Write of size 4 at addr ffff8880295de478 by task kworker/u33:0/67
+
+CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full)
+Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
+Workqueue: nbd6-recv recv_work
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:408 [inline]
+ print_report+0xc3/0x670 mm/kasan/report.c:521
+ kasan_report+0xe0/0x110 mm/kasan/report.c:634
+ check_region_inline mm/kasan/generic.c:183 [inline]
+ kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
+ instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
+ atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
+ recv_work+0x694/0xa80 drivers/block/nbd.c:1022
+ process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
+ process_scheduled_works kernel/workqueue.c:3319 [inline]
+ worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
+ kthread+0x3c2/0x780 kernel/kthread.c:464
+ ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
+ ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
+ </TASK>
+
+nbd_genl_connect() does not properly stop the device on certain
+error paths after nbd_start_device() has been called. This causes
+the error path to put nbd->config while recv_work continue to use
+the config after putting it, leading to use-after-free in recv_work.
+
+This patch moves nbd_start_device() after the backend file creation.
+
+Reported-by: syzbot+48240bab47e705c53126@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/68227a04.050a0220.f2294.00b5.GAE@google.com/T/
+Fixes: 6497ef8df568 ("nbd: provide a way for userspace processes to identify device backends")
+Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20250612132405.364904-1-zhengqixing@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 450458267e6e6..c705acc4d6f4b 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -2136,9 +2136,7 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
+ goto out;
+ }
+ }
+- ret = nbd_start_device(nbd);
+- if (ret)
+- goto out;
++
+ if (info->attrs[NBD_ATTR_BACKEND_IDENTIFIER]) {
+ nbd->backend = nla_strdup(info->attrs[NBD_ATTR_BACKEND_IDENTIFIER],
+ GFP_KERNEL);
+@@ -2154,6 +2152,8 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)
+ goto out;
+ }
+ set_bit(NBD_RT_HAS_BACKEND_FILE, &config->runtime_flags);
++
++ ret = nbd_start_device(nbd);
+ out:
+ mutex_unlock(&nbd->config_lock);
+ if (!ret) {
+--
+2.39.5
+
--- /dev/null
+From 98f4f147caeb60fc8e9cdd0c094557b5ec65ddba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 03:52:51 +0000
+Subject: net: appletalk: Fix device refcount leak in atrtr_create()
+
+From: Kito Xu <veritas501@foxmail.com>
+
+[ Upstream commit 711c80f7d8b163d3ecd463cd96f07230f488e750 ]
+
+When updating an existing route entry in atrtr_create(), the old device
+reference was not being released before assigning the new device,
+leading to a device refcount leak. Fix this by calling dev_put() to
+release the old device reference before holding the new one.
+
+Fixes: c7f905f0f6d4 ("[ATALK]: Add missing dev_hold() to atrtr_create().")
+Signed-off-by: Kito Xu <veritas501@foxmail.com>
+Link: https://patch.msgid.link/tencent_E1A26771CDAB389A0396D1681A90A49E5D09@qq.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/appletalk/ddp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
+index b068651984fe3..fa7f002b14fa3 100644
+--- a/net/appletalk/ddp.c
++++ b/net/appletalk/ddp.c
+@@ -576,6 +576,7 @@ static int atrtr_create(struct rtentry *r, struct net_device *devhint)
+
+ /* Fill in the routing entry */
+ rt->target = ta->sat_addr;
++ dev_put(rt->dev); /* Release old device */
+ dev_hold(devhint);
+ rt->dev = devhint;
+ rt->flags = r->rt_flags;
+--
+2.39.5
+
--- /dev/null
+From a6a43e3612ae1ba549ba0264968b5a2dfecedc19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 11:06:17 -0700
+Subject: net: ll_temac: Fix missing tx_pending check in
+ ethtools_set_ringparam()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit e81750b4e3826fedce7362dad839cb40384d60ae ]
+
+The function ll_temac_ethtools_set_ringparam() incorrectly checked
+rx_pending twice, once correctly for RX and once mistakenly in place
+of tx_pending. This caused tx_pending to be left unchecked against
+TX_BD_NUM_MAX.
+As a result, invalid TX ring sizes may have been accepted or valid
+ones wrongly rejected based on the RX limit, leading to potential
+misconfiguration or unexpected results.
+
+This patch corrects the condition to properly validate tx_pending.
+
+Fixes: f7b261bfc35e ("net: ll_temac: Make RX/TX ring sizes configurable")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Link: https://patch.msgid.link/20250710180621.2383000-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xilinx/ll_temac_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
+index 1072e2210aed3..6b93418224e7e 100644
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -1309,7 +1309,7 @@ ll_temac_ethtools_set_ringparam(struct net_device *ndev,
+ if (ering->rx_pending > RX_BD_NUM_MAX ||
+ ering->rx_mini_pending ||
+ ering->rx_jumbo_pending ||
+- ering->rx_pending > TX_BD_NUM_MAX)
++ ering->tx_pending > TX_BD_NUM_MAX)
+ return -EINVAL;
+
+ if (netif_running(ndev))
+--
+2.39.5
+
--- /dev/null
+From 799e0a6140c1a32db142a6d02890a855923f678c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jun 2025 18:36:46 -0700
+Subject: net: mana: Record doorbell physical address in PF mode
+
+From: Long Li <longli@microsoft.com>
+
+[ Upstream commit e0fca6f2cebff539e9317a15a37dcf432e3b851a ]
+
+MANA supports RDMA in PF mode. The driver should record the doorbell
+physical address when in PF mode.
+
+The doorbell physical address is used by the RDMA driver to map
+doorbell pages of the device to user-mode applications through RDMA
+verbs interface. In the past, they have been mapped to user-mode while
+the device is in VF mode. With the support for PF mode implemented,
+also expose those pages in PF mode.
+
+Support for PF mode is implemented in
+290e5d3c49f6 ("net: mana: Add support for Multi Vports on Bare metal")
+
+Signed-off-by: Long Li <longli@microsoft.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/1750210606-12167-1-git-send-email-longli@linuxonhyperv.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microsoft/mana/gdma_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c
+index 9bac4083d8a09..876de6db63c4f 100644
+--- a/drivers/net/ethernet/microsoft/mana/gdma_main.c
++++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c
+@@ -28,6 +28,9 @@ static void mana_gd_init_pf_regs(struct pci_dev *pdev)
+ gc->db_page_base = gc->bar0_va +
+ mana_gd_r64(gc, GDMA_PF_REG_DB_PAGE_OFF);
+
++ gc->phys_db_page_base = gc->bar0_pa +
++ mana_gd_r64(gc, GDMA_PF_REG_DB_PAGE_OFF);
++
+ sriov_base_off = mana_gd_r64(gc, GDMA_SRIOV_REG_CFG_BASE_OFF);
+
+ sriov_base_va = gc->bar0_va + sriov_base_off;
+--
+2.39.5
+
--- /dev/null
+From ca72aebe5806bb4d92914b3bf201f6cb4b49f4a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 16:53:44 +0300
+Subject: net/mlx5e: Add new prio for promiscuous mode
+
+From: Jianbo Liu <jianbol@nvidia.com>
+
+[ Upstream commit 4c9fce56fa702059bbc5ab737265b68f79cbaac4 ]
+
+An optimization for promiscuous mode adds a high-priority steering
+table with a single catch-all rule to steer all traffic directly to
+the TTC table.
+
+However, a gap exists between the creation of this table and the
+insertion of the catch-all rule. Packets arriving in this brief window
+would miss as no rule was inserted yet, unnecessarily incrementing the
+'rx_steer_missed_packets' counter and dropped.
+
+This patch resolves the issue by introducing a new prio for this
+table, placing it between MLX5E_TC_PRIO and MLX5E_NIC_PRIO. By doing
+so, packets arriving during the window now fall through to the next
+prio (at MLX5E_NIC_PRIO) instead of being dropped.
+
+Fixes: 1c46d7409f30 ("net/mlx5e: Optimize promiscuous mode")
+Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/1752155624-24095-4-git-send-email-tariqt@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/fs.h | 9 +++++++--
+ drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 2 +-
+ drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 13 +++++++++----
+ 3 files changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
+index 1e8b7d3307014..b5aac0e1a68ec 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
+@@ -18,7 +18,8 @@ enum {
+
+ enum {
+ MLX5E_TC_PRIO = 0,
+- MLX5E_NIC_PRIO
++ MLX5E_PROMISC_PRIO,
++ MLX5E_NIC_PRIO,
+ };
+
+ struct mlx5e_flow_table {
+@@ -68,9 +69,13 @@ struct mlx5e_l2_table {
+ MLX5_HASH_FIELD_SEL_DST_IP |\
+ MLX5_HASH_FIELD_SEL_IPSEC_SPI)
+
+-/* NIC prio FTS */
++/* NIC promisc FT level */
+ enum {
+ MLX5E_PROMISC_FT_LEVEL,
++};
++
++/* NIC prio FTS */
++enum {
+ MLX5E_VLAN_FT_LEVEL,
+ MLX5E_L2_FT_LEVEL,
+ MLX5E_TTC_FT_LEVEL,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+index 05058710d2c79..537e732085b22 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+@@ -776,7 +776,7 @@ static int mlx5e_create_promisc_table(struct mlx5e_flow_steering *fs)
+ ft_attr.max_fte = MLX5E_PROMISC_TABLE_SIZE;
+ ft_attr.autogroup.max_num_groups = 1;
+ ft_attr.level = MLX5E_PROMISC_FT_LEVEL;
+- ft_attr.prio = MLX5E_NIC_PRIO;
++ ft_attr.prio = MLX5E_PROMISC_PRIO;
+
+ ft->t = mlx5_create_auto_grouped_flow_table(fs->ns, &ft_attr);
+ if (IS_ERR(ft->t)) {
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index 1bc88743d2dfa..7ef0a4af89e48 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -113,13 +113,16 @@
+ #define ETHTOOL_PRIO_NUM_LEVELS 1
+ #define ETHTOOL_NUM_PRIOS 11
+ #define ETHTOOL_MIN_LEVEL (KERNEL_MIN_LEVEL + ETHTOOL_NUM_PRIOS)
+-/* Promiscuous, Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy,
++/* Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy,
+ * {IPsec RoCE MPV,Alias table},IPsec RoCE policy
+ */
+-#define KERNEL_NIC_PRIO_NUM_LEVELS 11
++#define KERNEL_NIC_PRIO_NUM_LEVELS 10
+ #define KERNEL_NIC_NUM_PRIOS 1
+-/* One more level for tc */
+-#define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 1)
++/* One more level for tc, and one more for promisc */
++#define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 2)
++
++#define KERNEL_NIC_PROMISC_NUM_PRIOS 1
++#define KERNEL_NIC_PROMISC_NUM_LEVELS 1
+
+ #define KERNEL_NIC_TC_NUM_PRIOS 1
+ #define KERNEL_NIC_TC_NUM_LEVELS 3
+@@ -187,6 +190,8 @@ static struct init_tree_node {
+ ADD_NS(MLX5_FLOW_TABLE_MISS_ACTION_DEF,
+ ADD_MULTIPLE_PRIO(KERNEL_NIC_TC_NUM_PRIOS,
+ KERNEL_NIC_TC_NUM_LEVELS),
++ ADD_MULTIPLE_PRIO(KERNEL_NIC_PROMISC_NUM_PRIOS,
++ KERNEL_NIC_PROMISC_NUM_LEVELS),
+ ADD_MULTIPLE_PRIO(KERNEL_NIC_NUM_PRIOS,
+ KERNEL_NIC_PRIO_NUM_LEVELS))),
+ ADD_PRIO(0, BY_PASS_MIN_LEVEL, 0, FS_CHAINING_CAPS,
+--
+2.39.5
+
--- /dev/null
+From da8a2441de146484ad4749a13912952af8c9707d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jul 2025 16:53:43 +0300
+Subject: net/mlx5e: Fix race between DIM disable and net_dim()
+
+From: Carolina Jubran <cjubran@nvidia.com>
+
+[ Upstream commit eb41a264a3a576dc040ee37c3d9d6b7e2d9be968 ]
+
+There's a race between disabling DIM and NAPI callbacks using the dim
+pointer on the RQ or SQ.
+
+If NAPI checks the DIM state bit and sees it still set, it assumes
+`rq->dim` or `sq->dim` is valid. But if DIM gets disabled right after
+that check, the pointer might already be set to NULL, leading to a NULL
+pointer dereference in net_dim().
+
+Fix this by calling `synchronize_net()` before freeing the DIM context.
+This ensures all in-progress NAPI callbacks are finished before the
+pointer is cleared.
+
+Kernel log:
+
+BUG: kernel NULL pointer dereference, address: 0000000000000000
+...
+RIP: 0010:net_dim+0x23/0x190
+...
+Call Trace:
+ <TASK>
+ ? __die+0x20/0x60
+ ? page_fault_oops+0x150/0x3e0
+ ? common_interrupt+0xf/0xa0
+ ? sysvec_call_function_single+0xb/0x90
+ ? exc_page_fault+0x74/0x130
+ ? asm_exc_page_fault+0x22/0x30
+ ? net_dim+0x23/0x190
+ ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core]
+ ? sysvec_apic_timer_interrupt+0xb/0x90
+ mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core]
+ mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core]
+ ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core]
+ busy_poll_stop+0xa2/0x200
+ ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core]
+ ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core]
+ __napi_busy_loop+0x345/0x3b0
+ ? sysvec_call_function_single+0xb/0x90
+ ? asm_sysvec_call_function_single+0x16/0x20
+ ? sysvec_apic_timer_interrupt+0xb/0x90
+ ? pcpu_free_area+0x1e4/0x2e0
+ napi_busy_loop+0x11/0x20
+ xsk_recvmsg+0x10c/0x130
+ sock_recvmsg+0x44/0x70
+ __sys_recvfrom+0xbc/0x130
+ ? __schedule+0x398/0x890
+ __x64_sys_recvfrom+0x20/0x30
+ do_syscall_64+0x4c/0x100
+ entry_SYSCALL_64_after_hwframe+0x4b/0x53
+...
+---[ end trace 0000000000000000 ]---
+...
+---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
+
+Fixes: 445a25f6e1a2 ("net/mlx5e: Support updating coalescing configuration without resetting channels")
+Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
+Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/1752155624-24095-3-git-send-email-tariqt@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_dim.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c
+index 298bb74ec5e94..d1d629697e285 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c
+@@ -113,7 +113,7 @@ int mlx5e_dim_rx_change(struct mlx5e_rq *rq, bool enable)
+ __set_bit(MLX5E_RQ_STATE_DIM, &rq->state);
+ } else {
+ __clear_bit(MLX5E_RQ_STATE_DIM, &rq->state);
+-
++ synchronize_net();
+ mlx5e_dim_disable(rq->dim);
+ rq->dim = NULL;
+ }
+@@ -140,7 +140,7 @@ int mlx5e_dim_tx_change(struct mlx5e_txqsq *sq, bool enable)
+ __set_bit(MLX5E_SQ_STATE_DIM, &sq->state);
+ } else {
+ __clear_bit(MLX5E_SQ_STATE_DIM, &sq->state);
+-
++ synchronize_net();
+ mlx5e_dim_disable(sq->dim);
+ sq->dim = NULL;
+ }
+--
+2.39.5
+
--- /dev/null
+From 00126b1fd89b904080868139ea5b3172df1d0401 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 15:07:53 +0200
+Subject: net: phy: microchip: limit 100M workaround to link-down events on
+ LAN88xx
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit dd4360c0e8504f2f7639c7f5d07c93cfd6a98333 ]
+
+Restrict the 100Mbit forced-mode workaround to link-down transitions
+only, to prevent repeated link reset cycles in certain configurations.
+
+The workaround was originally introduced to improve signal reliability
+when switching cables between long and short distances. It temporarily
+forces the PHY into 10 Mbps before returning to 100 Mbps.
+
+However, when used with autonegotiating link partners (e.g., Intel i350),
+executing this workaround on every link change can confuse the partner
+and cause constant renegotiation loops. This results in repeated link
+down/up transitions and the PHY never reaching a stable state.
+
+Limit the workaround to only run during the PHY_NOLINK state. This ensures
+it is triggered only once per link drop, avoiding disruptive toggling
+while still preserving its intended effect.
+
+Note: I am not able to reproduce the original issue that this workaround
+addresses. I can only confirm that 100 Mbit mode works correctly in my
+test setup. Based on code inspection, I assume the workaround aims to
+reset some internal state machine or signal block by toggling speeds.
+However, a PHY reset is already performed earlier in the function via
+phy_init_hw(), which may achieve a similar effect. Without a reproducer,
+I conservatively keep the workaround but restrict its conditions.
+
+Fixes: e57cf3639c32 ("net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250709130753.3994461-3-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/microchip.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/microchip.c b/drivers/net/phy/microchip.c
+index c9b6ede7ac6ac..ffca1cec4ec99 100644
+--- a/drivers/net/phy/microchip.c
++++ b/drivers/net/phy/microchip.c
+@@ -332,7 +332,7 @@ static void lan88xx_link_change_notify(struct phy_device *phydev)
+ * As workaround, set to 10 before setting to 100
+ * at forced 100 F/H mode.
+ */
+- if (!phydev->autoneg && phydev->speed == 100) {
++ if (phydev->state == PHY_NOLINK && !phydev->autoneg && phydev->speed == 100) {
+ /* disable phy interrupt */
+ temp = phy_read(phydev, LAN88XX_INT_MASK);
+ temp &= ~LAN88XX_INT_MASK_MDINTPIN_EN_;
+--
+2.39.5
+
--- /dev/null
+From 0e547cdcf3d3213ae80399d3161df80a0cc10f02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 15:07:52 +0200
+Subject: net: phy: microchip: Use genphy_soft_reset() to purge stale LPA bits
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit b4517c363e0e005c7f81ae3be199eec68e87f122 ]
+
+Enable .soft_reset for the LAN88xx PHY driver by assigning
+genphy_soft_reset() to ensure that the phylib core performs a proper
+soft reset during reconfiguration.
+
+Previously, the driver left .soft_reset unimplemented, so calls to
+phy_init_hw() (e.g., from lan88xx_link_change_notify()) did not fully
+reset the PHY. As a result, stale contents in the Link Partner Ability
+(LPA) register could persist, causing the PHY to incorrectly report
+that the link partner advertised autonegotiation even when it did not.
+
+Using genphy_soft_reset() guarantees a clean reset of the PHY and
+corrects the false autoneg reporting in these scenarios.
+
+Fixes: ccb989e4d1ef ("net: phy: microchip: Reset LAN88xx PHY to ensure clean link state on LAN7800/7850")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250709130753.3994461-2-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/microchip.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/phy/microchip.c b/drivers/net/phy/microchip.c
+index e3a5961dced9b..c9b6ede7ac6ac 100644
+--- a/drivers/net/phy/microchip.c
++++ b/drivers/net/phy/microchip.c
+@@ -486,6 +486,7 @@ static struct phy_driver microchip_phy_driver[] = {
+ .config_init = lan88xx_config_init,
+ .config_aneg = lan88xx_config_aneg,
+ .link_change_notify = lan88xx_link_change_notify,
++ .soft_reset = genphy_soft_reset,
+
+ /* Interrupt handling is broken, do not define related
+ * functions to force polling.
+--
+2.39.5
+
--- /dev/null
+From 6fb2b2178b3c24f10399b776295d3d5e3ee8335d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jun 2025 10:27:02 +0800
+Subject: net: usb: qmi_wwan: add SIMCom 8230C composition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xiaowei Li <xiaowei.li@simcom.com>
+
+[ Upstream commit 0b39b055b5b48cbbdf5746a1ca6e3f6b0221e537 ]
+
+Add support for SIMCom 8230C which is based on Qualcomm SDX35 chip.
+0x9071: tty (DM) + tty (NMEA) + tty (AT) + rmnet
+T: Bus=01 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 8 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1e0e ProdID=9071 Rev= 5.15
+S: Manufacturer=SIMCOM
+S: Product=SDXBAAGHA-IDP _SN:D744C4C5
+S: SerialNumber=0123456789ABCDEF
+C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
+E: Ad=86(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=none
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Signed-off-by: Xiaowei Li <xiaowei.li@simcom.com>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Link: https://patch.msgid.link/tencent_21D781FAA4969FEACA6ABB460362B52C9409@qq.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 944a33361dae5..7e0608f568353 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1426,6 +1426,7 @@ static const struct usb_device_id products[] = {
+ {QMI_QUIRK_SET_DTR(0x22de, 0x9051, 2)}, /* Hucom Wireless HM-211S/K */
+ {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */
+ {QMI_QUIRK_SET_DTR(0x1e0e, 0x9001, 5)}, /* SIMCom 7100E, 7230E, 7600E ++ */
++ {QMI_QUIRK_SET_DTR(0x1e0e, 0x9071, 3)}, /* SIMCom 8230C ++ */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */
+--
+2.39.5
+
--- /dev/null
+From 8006cb2221e46c5bb76b624749a205632200de0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 12:45:17 +0000
+Subject: netfilter: flowtable: account for Ethernet header in
+ nf_flow_pppoe_proto()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 18cdb3d982da8976b28d57691eb256ec5688fad2 ]
+
+syzbot found a potential access to uninit-value in nf_flow_pppoe_proto()
+
+Blamed commit forgot the Ethernet header.
+
+BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27
+ nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27
+ nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline]
+ nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623
+ nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline]
+ nf_ingress net/core/dev.c:5742 [inline]
+ __netif_receive_skb_core+0x4aff/0x70c0 net/core/dev.c:5837
+ __netif_receive_skb_one_core net/core/dev.c:5975 [inline]
+ __netif_receive_skb+0xcc/0xac0 net/core/dev.c:6090
+ netif_receive_skb_internal net/core/dev.c:6176 [inline]
+ netif_receive_skb+0x57/0x630 net/core/dev.c:6235
+ tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485
+ tun_get_user+0x4ee0/0x6b40 drivers/net/tun.c:1938
+ tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1984
+ new_sync_write fs/read_write.c:593 [inline]
+ vfs_write+0xb4b/0x1580 fs/read_write.c:686
+ ksys_write fs/read_write.c:738 [inline]
+ __do_sys_write fs/read_write.c:749 [inline]
+
+Reported-by: syzbot+bf6ed459397e307c3ad2@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/686bc073.a00a0220.c7b3.0086.GAE@google.com/T/#u
+Fixes: 87b3593bed18 ("netfilter: flowtable: validate pppoe header")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Link: https://patch.msgid.link/20250707124517.614489-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_flow_table.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
+index b63d53bb9dd6d..1a6fca0131653 100644
+--- a/include/net/netfilter/nf_flow_table.h
++++ b/include/net/netfilter/nf_flow_table.h
+@@ -369,7 +369,7 @@ static inline __be16 __nf_flow_pppoe_proto(const struct sk_buff *skb)
+
+ static inline bool nf_flow_pppoe_proto(struct sk_buff *skb, __be16 *inner_proto)
+ {
+- if (!pskb_may_pull(skb, PPPOE_SES_HLEN))
++ if (!pskb_may_pull(skb, ETH_HLEN + PPPOE_SES_HLEN))
+ return false;
+
+ *inner_proto = __nf_flow_pppoe_proto(skb);
+--
+2.39.5
+
--- /dev/null
+From c0ab4afd12bcc70567a773cd881f832659050657 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 23:02:51 -0400
+Subject: netfs: Fix ref leak on inserted extra subreq in write retry
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 97d8e8e52cb8ab3d7675880a92626d9a4332f7a6 ]
+
+The write-retry algorithm will insert extra subrequests into the list if it
+can't get sufficient capacity to split the range that needs to be retried
+into the sequence of subrequests it currently has (for instance, if the
+cifs credit pool has fewer credits available than it did when the range was
+originally divided).
+
+However, the allocator furnishes each new subreq with 2 refs and then
+another is added for resubmission, causing one to be leaked.
+
+Fix this by replacing the ref-getting line with a neutral trace line.
+
+Fixes: 288ace2f57c9 ("netfs: New writeback implementation")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/20250701163852.2171681-6-dhowells@redhat.com
+Tested-by: Steve French <sfrench@samba.org>
+Reviewed-by: Paulo Alcantara <pc@manguebit.org>
+cc: netfs@lists.linux.dev
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/netfs/write_collect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/netfs/write_collect.c b/fs/netfs/write_collect.c
+index 7cb21da40a0a4..a968688a73234 100644
+--- a/fs/netfs/write_collect.c
++++ b/fs/netfs/write_collect.c
+@@ -285,7 +285,7 @@ static void netfs_retry_write_stream(struct netfs_io_request *wreq,
+ trace_netfs_sreq_ref(wreq->debug_id, subreq->debug_index,
+ refcount_read(&subreq->ref),
+ netfs_sreq_trace_new);
+- netfs_get_subrequest(subreq, netfs_sreq_trace_get_resubmit);
++ trace_netfs_sreq(subreq, netfs_sreq_trace_split);
+
+ list_add(&subreq->rreq_link, &to->rreq_link);
+ to = list_next_entry(to, rreq_link);
+--
+2.39.5
+
--- /dev/null
+From bcc8174ebf8b545dc1b54cc5ddf536a03571617e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 11:23:04 -0400
+Subject: raid10: cleanup memleak at raid10_make_request
+
+From: Nigel Croxon <ncroxon@redhat.com>
+
+[ Upstream commit 43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24 ]
+
+If raid10_read_request or raid10_write_request registers a new
+request and the REQ_NOWAIT flag is set, the code does not
+free the malloc from the mempool.
+
+unreferenced object 0xffff8884802c3200 (size 192):
+ comm "fio", pid 9197, jiffies 4298078271
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 88 41 02 00 00 00 00 00 .........A......
+ 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace (crc c1a049a2):
+ __kmalloc+0x2bb/0x450
+ mempool_alloc+0x11b/0x320
+ raid10_make_request+0x19e/0x650 [raid10]
+ md_handle_request+0x3b3/0x9e0
+ __submit_bio+0x394/0x560
+ __submit_bio_noacct+0x145/0x530
+ submit_bio_noacct_nocheck+0x682/0x830
+ __blkdev_direct_IO_async+0x4dc/0x6b0
+ blkdev_read_iter+0x1e5/0x3b0
+ __io_read+0x230/0x1110
+ io_read+0x13/0x30
+ io_issue_sqe+0x134/0x1180
+ io_submit_sqes+0x48c/0xe90
+ __do_sys_io_uring_enter+0x574/0x8b0
+ do_syscall_64+0x5c/0xe0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+V4: changing backing tree to see if CKI tests will pass.
+The patch code has not changed between any versions.
+
+Fixes: c9aa889b035f ("md: raid10 add nowait support")
+Signed-off-by: Nigel Croxon <ncroxon@redhat.com>
+Link: https://lore.kernel.org/linux-raid/c0787379-9caa-42f3-b5fc-369aed784400@redhat.com
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index cc194f6ec18da..5cdc599fcad3c 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1181,8 +1181,11 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio,
+ }
+ }
+
+- if (!regular_request_wait(mddev, conf, bio, r10_bio->sectors))
++ if (!regular_request_wait(mddev, conf, bio, r10_bio->sectors)) {
++ raid_end_bio_io(r10_bio);
+ return;
++ }
++
+ rdev = read_balance(conf, r10_bio, &max_sectors);
+ if (!rdev) {
+ if (err_rdev) {
+@@ -1368,8 +1371,11 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio,
+ }
+
+ sectors = r10_bio->sectors;
+- if (!regular_request_wait(mddev, conf, bio, sectors))
++ if (!regular_request_wait(mddev, conf, bio, sectors)) {
++ raid_end_bio_io(r10_bio);
+ return;
++ }
++
+ if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
+ (mddev->reshape_backwards
+ ? (bio->bi_iter.bi_sector < conf->reshape_safe &&
+--
+2.39.5
+
--- /dev/null
+From 94d20336dfc8bb55d02d9489916d4f5bf8943461 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Jun 2025 20:48:44 -0700
+Subject: riscv: vdso: Exclude .rodata from the PT_DYNAMIC segment
+
+From: Fangrui Song <i@maskray.me>
+
+[ Upstream commit e0eb1b6b0cd29ca7793c501d5960fd36ba11f110 ]
+
+.rodata is implicitly included in the PT_DYNAMIC segment due to
+inheriting the segment of the preceding .dynamic section (in both GNU ld
+and LLD). When the .rodata section's size is not a multiple of 16
+bytes on riscv64, llvm-readelf will report a "PT_DYNAMIC dynamic table
+is invalid" warning. Note: in the presence of the .dynamic section, GNU
+readelf and llvm-readelf's -d option decodes the dynamic section using
+the section.
+
+This issue arose after commit 8f8c1ff879fab60f80f3a7aec3000f47e5b03ba9
+("riscv: vdso.lds.S: remove hardcoded 0x800 .text start addr"), which
+placed .rodata directly after .dynamic by removing .eh_frame.
+
+This patch resolves the implicit inclusion into PT_DYNAMIC by explicitly
+specifying the :text output section phdr.
+
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Closes: https://github.com/ClangBuiltLinux/linux/issues/2093
+Signed-off-by: Fangrui Song <i@maskray.me>
+Tested-by: Nathan Chancellor <nathan@kernel.org>
+Link: https://lore.kernel.org/r/20250602-riscv-vdso-v1-1-0620cf63cff0@maskray.me
+Signed-off-by: Palmer Dabbelt <palmer@dabbelt.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/vdso/vdso.lds.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/vdso/vdso.lds.S b/arch/riscv/kernel/vdso/vdso.lds.S
+index cbe2a179331d2..99e51f7755393 100644
+--- a/arch/riscv/kernel/vdso/vdso.lds.S
++++ b/arch/riscv/kernel/vdso/vdso.lds.S
+@@ -31,7 +31,7 @@ SECTIONS
+ *(.data .data.* .gnu.linkonce.d.*)
+ *(.dynbss)
+ *(.bss .bss.* .gnu.linkonce.b.*)
+- }
++ } :text
+
+ .note : { *(.note.*) } :text :note
+
+--
+2.39.5
+
--- /dev/null
+From c46a5c19616f30175b00b90fe8eccb6d1daa7327 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 09:12:44 +0000
+Subject: selftests: net: lib: fix shift count out of range
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 47c84997c686b4d43b225521b732492552b84758 ]
+
+I got the following warning when writing other tests:
+
+ + handle_test_result_pass 'bond 802.3ad' '(lacp_active off)'
+ + local 'test_name=bond 802.3ad'
+ + shift
+ + local 'opt_str=(lacp_active off)'
+ + shift
+ + log_test_result 'bond 802.3ad' '(lacp_active off)' ' OK '
+ + local 'test_name=bond 802.3ad'
+ + shift
+ + local 'opt_str=(lacp_active off)'
+ + shift
+ + local 'result= OK '
+ + shift
+ + local retmsg=
+ + shift
+ /net/tools/testing/selftests/net/forwarding/../lib.sh: line 315: shift: shift count out of range
+
+This happens because an extra shift is executed even after all arguments
+have been consumed. Remove the last shift in log_test_result() to avoid
+this warning.
+
+Fixes: a923af1ceee7 ("selftests: forwarding: Convert log_test() to recognize RET values")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Link: https://patch.msgid.link/20250709091244.88395-1-liuhangbin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/lib.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh
+index 6839514a176d3..bb4d2f8d50d67 100644
+--- a/tools/testing/selftests/net/lib.sh
++++ b/tools/testing/selftests/net/lib.sh
+@@ -258,7 +258,7 @@ log_test_result()
+ local test_name=$1; shift
+ local opt_str=$1; shift
+ local result=$1; shift
+- local retmsg=$1; shift
++ local retmsg=$1
+
+ printf "TEST: %-60s [%s]\n" "$test_name $opt_str" "$result"
+ if [[ $retmsg ]]; then
+--
+2.39.5
+
--- /dev/null
+From b991cf18fc0bf210c70c312c4aeba289e37a1605 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2024 15:09:55 +0100
+Subject: selftests: net: lib: Move logging from forwarding/lib.sh here
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit b219bcfcc92e9bd50c6277ac68cb75f64b403e5e ]
+
+Many net selftests invent their own logging helpers. These really should be
+in a library sourced by these tests. Currently forwarding/lib.sh has a
+suite of perfectly fine logging helpers, but sourcing a forwarding/ library
+from a higher-level directory smells of layering violation. In this patch,
+move the logging helpers to net/lib.sh so that every net test can use them.
+
+Together with the logging helpers, it's also necessary to move
+pause_on_fail(), and EXIT_STATUS and RET.
+
+Existing lib.sh users might be using these same names for their functions
+or variables. However lib.sh is always sourced near the top of the
+file (checked), and whatever new definitions will simply override the ones
+provided by lib.sh.
+
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Amit Cohen <amcohen@nvidia.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://patch.msgid.link/edd3785a3bd72ffbe1409300989e993ee50ae98b.1731589511.git.petrm@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 47c84997c686 ("selftests: net: lib: fix shift count out of range")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/forwarding/lib.sh | 113 -----------------
+ tools/testing/selftests/net/lib.sh | 115 ++++++++++++++++++
+ 2 files changed, 115 insertions(+), 113 deletions(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
+index c992e385159c0..195360082d949 100644
+--- a/tools/testing/selftests/net/forwarding/lib.sh
++++ b/tools/testing/selftests/net/forwarding/lib.sh
+@@ -48,7 +48,6 @@ declare -A NETIFS=(
+ : "${WAIT_TIME:=5}"
+
+ # Whether to pause on, respectively, after a failure and before cleanup.
+-: "${PAUSE_ON_FAIL:=no}"
+ : "${PAUSE_ON_CLEANUP:=no}"
+
+ # Whether to create virtual interfaces, and what netdevice type they should be.
+@@ -446,22 +445,6 @@ done
+ ##############################################################################
+ # Helpers
+
+-# Exit status to return at the end. Set in case one of the tests fails.
+-EXIT_STATUS=0
+-# Per-test return value. Clear at the beginning of each test.
+-RET=0
+-
+-ret_set_ksft_status()
+-{
+- local ksft_status=$1; shift
+- local msg=$1; shift
+-
+- RET=$(ksft_status_merge $RET $ksft_status)
+- if (( $? )); then
+- retmsg=$msg
+- fi
+-}
+-
+ # Whether FAILs should be interpreted as XFAILs. Internal.
+ FAIL_TO_XFAIL=
+
+@@ -535,102 +518,6 @@ xfail_on_veth()
+ fi
+ }
+
+-log_test_result()
+-{
+- local test_name=$1; shift
+- local opt_str=$1; shift
+- local result=$1; shift
+- local retmsg=$1; shift
+-
+- printf "TEST: %-60s [%s]\n" "$test_name $opt_str" "$result"
+- if [[ $retmsg ]]; then
+- printf "\t%s\n" "$retmsg"
+- fi
+-}
+-
+-pause_on_fail()
+-{
+- if [[ $PAUSE_ON_FAIL == yes ]]; then
+- echo "Hit enter to continue, 'q' to quit"
+- read a
+- [[ $a == q ]] && exit 1
+- fi
+-}
+-
+-handle_test_result_pass()
+-{
+- local test_name=$1; shift
+- local opt_str=$1; shift
+-
+- log_test_result "$test_name" "$opt_str" " OK "
+-}
+-
+-handle_test_result_fail()
+-{
+- local test_name=$1; shift
+- local opt_str=$1; shift
+-
+- log_test_result "$test_name" "$opt_str" FAIL "$retmsg"
+- pause_on_fail
+-}
+-
+-handle_test_result_xfail()
+-{
+- local test_name=$1; shift
+- local opt_str=$1; shift
+-
+- log_test_result "$test_name" "$opt_str" XFAIL "$retmsg"
+- pause_on_fail
+-}
+-
+-handle_test_result_skip()
+-{
+- local test_name=$1; shift
+- local opt_str=$1; shift
+-
+- log_test_result "$test_name" "$opt_str" SKIP "$retmsg"
+-}
+-
+-log_test()
+-{
+- local test_name=$1
+- local opt_str=$2
+-
+- if [[ $# -eq 2 ]]; then
+- opt_str="($opt_str)"
+- fi
+-
+- if ((RET == ksft_pass)); then
+- handle_test_result_pass "$test_name" "$opt_str"
+- elif ((RET == ksft_xfail)); then
+- handle_test_result_xfail "$test_name" "$opt_str"
+- elif ((RET == ksft_skip)); then
+- handle_test_result_skip "$test_name" "$opt_str"
+- else
+- handle_test_result_fail "$test_name" "$opt_str"
+- fi
+-
+- EXIT_STATUS=$(ksft_exit_status_merge $EXIT_STATUS $RET)
+- return $RET
+-}
+-
+-log_test_skip()
+-{
+- RET=$ksft_skip retmsg= log_test "$@"
+-}
+-
+-log_test_xfail()
+-{
+- RET=$ksft_xfail retmsg= log_test "$@"
+-}
+-
+-log_info()
+-{
+- local msg=$1
+-
+- echo "INFO: $msg"
+-}
+-
+ not()
+ {
+ "$@"
+diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh
+index be8707bfb46e5..6839514a176d3 100644
+--- a/tools/testing/selftests/net/lib.sh
++++ b/tools/testing/selftests/net/lib.sh
+@@ -6,6 +6,9 @@
+
+ : "${WAIT_TIMEOUT:=20}"
+
++# Whether to pause on after a failure.
++: "${PAUSE_ON_FAIL:=no}"
++
+ BUSYWAIT_TIMEOUT=$((WAIT_TIMEOUT * 1000)) # ms
+
+ # Kselftest framework constants.
+@@ -17,6 +20,11 @@ ksft_skip=4
+ # namespace list created by setup_ns
+ NS_LIST=()
+
++# Exit status to return at the end. Set in case one of the tests fails.
++EXIT_STATUS=0
++# Per-test return value. Clear at the beginning of each test.
++RET=0
++
+ ##############################################################################
+ # Helpers
+
+@@ -233,3 +241,110 @@ tc_rule_handle_stats_get()
+ | jq ".[] | select(.options.handle == $handle) | \
+ .options.actions[0].stats$selector"
+ }
++
++ret_set_ksft_status()
++{
++ local ksft_status=$1; shift
++ local msg=$1; shift
++
++ RET=$(ksft_status_merge $RET $ksft_status)
++ if (( $? )); then
++ retmsg=$msg
++ fi
++}
++
++log_test_result()
++{
++ local test_name=$1; shift
++ local opt_str=$1; shift
++ local result=$1; shift
++ local retmsg=$1; shift
++
++ printf "TEST: %-60s [%s]\n" "$test_name $opt_str" "$result"
++ if [[ $retmsg ]]; then
++ printf "\t%s\n" "$retmsg"
++ fi
++}
++
++pause_on_fail()
++{
++ if [[ $PAUSE_ON_FAIL == yes ]]; then
++ echo "Hit enter to continue, 'q' to quit"
++ read a
++ [[ $a == q ]] && exit 1
++ fi
++}
++
++handle_test_result_pass()
++{
++ local test_name=$1; shift
++ local opt_str=$1; shift
++
++ log_test_result "$test_name" "$opt_str" " OK "
++}
++
++handle_test_result_fail()
++{
++ local test_name=$1; shift
++ local opt_str=$1; shift
++
++ log_test_result "$test_name" "$opt_str" FAIL "$retmsg"
++ pause_on_fail
++}
++
++handle_test_result_xfail()
++{
++ local test_name=$1; shift
++ local opt_str=$1; shift
++
++ log_test_result "$test_name" "$opt_str" XFAIL "$retmsg"
++ pause_on_fail
++}
++
++handle_test_result_skip()
++{
++ local test_name=$1; shift
++ local opt_str=$1; shift
++
++ log_test_result "$test_name" "$opt_str" SKIP "$retmsg"
++}
++
++log_test()
++{
++ local test_name=$1
++ local opt_str=$2
++
++ if [[ $# -eq 2 ]]; then
++ opt_str="($opt_str)"
++ fi
++
++ if ((RET == ksft_pass)); then
++ handle_test_result_pass "$test_name" "$opt_str"
++ elif ((RET == ksft_xfail)); then
++ handle_test_result_xfail "$test_name" "$opt_str"
++ elif ((RET == ksft_skip)); then
++ handle_test_result_skip "$test_name" "$opt_str"
++ else
++ handle_test_result_fail "$test_name" "$opt_str"
++ fi
++
++ EXIT_STATUS=$(ksft_exit_status_merge $EXIT_STATUS $RET)
++ return $RET
++}
++
++log_test_skip()
++{
++ RET=$ksft_skip retmsg= log_test "$@"
++}
++
++log_test_xfail()
++{
++ RET=$ksft_xfail retmsg= log_test "$@"
++}
++
++log_info()
++{
++ local msg=$1
++
++ echo "INFO: $msg"
++}
+--
+2.39.5
+
asoc-intel-sof-function-topology-lib-print-out-the-unsupported-dmic-count.patch
netlink-fix-rmem-check-in-netlink_broadcast_deliver.patch
netlink-make-sure-we-allow-at-least-one-dump-skb.patch
+netfs-fix-ref-leak-on-inserted-extra-subreq-in-write.patch
+wifi-cfg80211-fix-s1g-beacon-head-validation-in-nl80.patch
+wifi-zd1211rw-fix-potential-null-pointer-dereference.patch
+drm-tegra-nvdec-fix-dma_alloc_coherent-error-check.patch
+md-raid1-fix-stack-memory-use-after-return-in-raid1_.patch
+raid10-cleanup-memleak-at-raid10_make_request.patch
+wifi-mac80211-correctly-identify-s1g-short-beacon.patch
+wifi-mac80211-fix-non-transmitted-bssid-profile-sear.patch
+wifi-rt2x00-fix-remove-callback-type-mismatch.patch
+drm-nouveau-gsp-fix-potential-leak-of-memory-used-du.patch
+wifi-mt76-mt7925-fix-null-ptr-deref-in-mt7925_therma.patch
+nbd-fix-uaf-in-nbd_genl_connect-error-path.patch
+drm-xe-pf-clear-all-lmtt-pages-on-alloc.patch
+erofs-free-pclusters-if-no-cached-folio-is-attached.patch
+erofs-get-rid-of-z_erofs_next_pcluster_t.patch
+erofs-tidy-up-zdata.c.patch
+erofs-refine-readahead-tracepoint.patch
+erofs-fix-to-add-missing-tracepoint-in-erofs_readahe.patch
+netfilter-flowtable-account-for-ethernet-header-in-n.patch
+net-appletalk-fix-device-refcount-leak-in-atrtr_crea.patch
+ibmvnic-fix-hardcoded-num_rx_stats-num_tx_stats-with.patch
+net-phy-microchip-use-genphy_soft_reset-to-purge-sta.patch
+net-phy-microchip-limit-100m-workaround-to-link-down.patch
+selftests-net-lib-move-logging-from-forwarding-lib.s.patch
+selftests-net-lib-fix-shift-count-out-of-range.patch
+drm-xe-pm-correct-comment-of-xe_pm_set_vram_threshol.patch
+can-m_can-m_can_handle_lost_msg-downgrade-msg-lost-i.patch
+net-mlx5e-fix-race-between-dim-disable-and-net_dim.patch
+net-mlx5e-add-new-prio-for-promiscuous-mode.patch
+net-ll_temac-fix-missing-tx_pending-check-in-ethtool.patch
+bnxt_en-fix-dcb-ets-validation.patch
+bnxt_en-set-dma-unmap-len-correctly-for-xdp_redirect.patch
+ublk-sanity-check-add_dev-input-for-underflow.patch
+atm-idt77252-add-missing-dma_map_error.patch
+um-vector-reduce-stack-usage-in-vector_eth_configure.patch
+asoc-sof-intel-hda-use-devm_kstrdup-to-avoid-memleak.patch
+alsa-hda-realtek-add-mic-mute-led-setup-for-asus-um5.patch
+io_uring-make-fallocate-be-hashed-work.patch
+asoc-amd-yc-add-quirk-for-acer-nitro-anv15-41-intern.patch
+alsa-hda-realtek-enable-mute-led-on-hp-pavilion-lapt.patch
+alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch
+net-usb-qmi_wwan-add-simcom-8230c-composition.patch
+driver-bluetooth-hci_qca-fix-unable-to-load-the-bt-d.patch
+hid-lenovo-add-support-for-thinkpad-x1-tablet-thin-k.patch
+net-mana-record-doorbell-physical-address-in-pf-mode.patch
+btrfs-fix-assertion-when-building-free-space-tree.patch
+vt-add-missing-notification-when-switching-back-to-t.patch
+bpf-adjust-free-target-to-avoid-global-starvation-of.patch
+riscv-vdso-exclude-.rodata-from-the-pt_dynamic-segme.patch
+hid-add-ignore-quirk-for-smartlinktechnology.patch
+hid-quirks-add-quirk-for-2-chicony-electronics-hp-5m.patch
+hid-nintendo-avoid-bluetooth-suspend-resume-stalls.patch
--- /dev/null
+From e90a5b159273264ea3c0b4a7aa0d7af4a23e3e22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jun 2025 12:20:45 +1000
+Subject: ublk: sanity check add_dev input for underflow
+
+From: Ronnie Sahlberg <rsahlberg@whamcloud.com>
+
+[ Upstream commit 969127bf0783a4ac0c8a27e633a9e8ea1738583f ]
+
+Add additional checks that queue depth and number of queues are
+non-zero.
+
+Signed-off-by: Ronnie Sahlberg <rsahlberg@whamcloud.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20250626022046.235018-1-ronniesahlberg@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/ublk_drv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
+index 746ef36e58df2..3b1a5cdd63116 100644
+--- a/drivers/block/ublk_drv.c
++++ b/drivers/block/ublk_drv.c
+@@ -2457,7 +2457,8 @@ static int ublk_ctrl_add_dev(struct io_uring_cmd *cmd)
+ if (copy_from_user(&info, argp, sizeof(info)))
+ return -EFAULT;
+
+- if (info.queue_depth > UBLK_MAX_QUEUE_DEPTH || info.nr_hw_queues > UBLK_MAX_NR_QUEUES)
++ if (info.queue_depth > UBLK_MAX_QUEUE_DEPTH || !info.queue_depth ||
++ info.nr_hw_queues > UBLK_MAX_NR_QUEUES || !info.nr_hw_queues)
+ return -EINVAL;
+
+ if (capable(CAP_SYS_ADMIN))
+--
+2.39.5
+
--- /dev/null
+From dc3b46a8249f76a303dde807d83e2f8e49293292 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 19:08:29 +0800
+Subject: um: vector: Reduce stack usage in vector_eth_configure()
+
+From: Tiwei Bie <tiwei.btw@antgroup.com>
+
+[ Upstream commit 2d65fc13be85c336c56af7077f08ccd3a3a15a4a ]
+
+When compiling with clang (19.1.7), initializing *vp using a compound
+literal may result in excessive stack usage. Fix it by initializing the
+required fields of *vp individually.
+
+Without this patch:
+
+$ objdump -d arch/um/drivers/vector_kern.o | ./scripts/checkstack.pl x86_64 0
+...
+0x0000000000000540 vector_eth_configure [vector_kern.o]:1472
+...
+
+With this patch:
+
+$ objdump -d arch/um/drivers/vector_kern.o | ./scripts/checkstack.pl x86_64 0
+...
+0x0000000000000540 vector_eth_configure [vector_kern.o]:208
+...
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202506221017.WtB7Usua-lkp@intel.com/
+Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
+Link: https://patch.msgid.link/20250623110829.314864-1-tiwei.btw@antgroup.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/vector_kern.c | 42 +++++++++++------------------------
+ 1 file changed, 13 insertions(+), 29 deletions(-)
+
+diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c
+index 64c09db392c16..7a88b13d289f1 100644
+--- a/arch/um/drivers/vector_kern.c
++++ b/arch/um/drivers/vector_kern.c
+@@ -1592,35 +1592,19 @@ static void vector_eth_configure(
+
+ device->dev = dev;
+
+- *vp = ((struct vector_private)
+- {
+- .list = LIST_HEAD_INIT(vp->list),
+- .dev = dev,
+- .unit = n,
+- .options = get_transport_options(def),
+- .rx_irq = 0,
+- .tx_irq = 0,
+- .parsed = def,
+- .max_packet = get_mtu(def) + ETH_HEADER_OTHER,
+- /* TODO - we need to calculate headroom so that ip header
+- * is 16 byte aligned all the time
+- */
+- .headroom = get_headroom(def),
+- .form_header = NULL,
+- .verify_header = NULL,
+- .header_rxbuffer = NULL,
+- .header_txbuffer = NULL,
+- .header_size = 0,
+- .rx_header_size = 0,
+- .rexmit_scheduled = false,
+- .opened = false,
+- .transport_data = NULL,
+- .in_write_poll = false,
+- .coalesce = 2,
+- .req_size = get_req_size(def),
+- .in_error = false,
+- .bpf = NULL
+- });
++ INIT_LIST_HEAD(&vp->list);
++ vp->dev = dev;
++ vp->unit = n;
++ vp->options = get_transport_options(def);
++ vp->parsed = def;
++ vp->max_packet = get_mtu(def) + ETH_HEADER_OTHER;
++ /*
++ * TODO - we need to calculate headroom so that ip header
++ * is 16 byte aligned all the time
++ */
++ vp->headroom = get_headroom(def);
++ vp->coalesce = 2;
++ vp->req_size = get_req_size(def);
+
+ dev->features = dev->hw_features = (NETIF_F_SG | NETIF_F_FRAGLIST);
+ INIT_WORK(&vp->reset_tx, vector_reset_tx);
+--
+2.39.5
+
--- /dev/null
+From d3539d6de20519e5ebb812f1f8367cfdf2322baf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 21:41:44 -0400
+Subject: vt: add missing notification when switching back to text mode
+
+From: Nicolas Pitre <npitre@baylibre.com>
+
+[ Upstream commit ff78538e07fa284ce08cbbcb0730daa91ed16722 ]
+
+Programs using poll() on /dev/vcsa to be notified when VT changes occur
+were missing one case: the switch from gfx to text mode.
+
+Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
+Link: https://lore.kernel.org/r/9o5ro928-0pp4-05rq-70p4-ro385n21n723@onlyvoer.pbz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/vt/vt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index be5564ed8c018..5b09ce71345b6 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -4566,6 +4566,7 @@ void do_unblank_screen(int leaving_gfx)
+ set_palette(vc);
+ set_cursor(vc);
+ vt_event_post(VT_EVENT_UNBLANK, vc->vc_num, vc->vc_num);
++ notify_update(vc);
+ }
+ EXPORT_SYMBOL(do_unblank_screen);
+
+--
+2.39.5
+
--- /dev/null
+From e2c356e5a4e17d204c86ce64b552c491efd4bd73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jun 2025 21:51:18 +1000
+Subject: wifi: cfg80211: fix S1G beacon head validation in nl80211
+
+From: Lachlan Hodges <lachlan.hodges@morsemicro.com>
+
+[ Upstream commit 1fe44a86ff0ff483aa1f1332f2b08f431fa51ce8 ]
+
+S1G beacons contain fixed length optional fields that precede the
+variable length elements, ensure we take this into account when
+validating the beacon. This particular case was missed in
+1e1f706fc2ce ("wifi: cfg80211/mac80211: correctly parse S1G
+beacon optional elements").
+
+Fixes: 1d47f1198d58 ("nl80211: correctly validate S1G beacon head")
+Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
+Link: https://patch.msgid.link/20250626115118.68660-1-lachlan.hodges@morsemicro.com
+[shorten/reword subject]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/nl80211.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index c778ffa1c8efd..4eb44821c70d3 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -229,6 +229,7 @@ static int validate_beacon_head(const struct nlattr *attr,
+ unsigned int len = nla_len(attr);
+ const struct element *elem;
+ const struct ieee80211_mgmt *mgmt = (void *)data;
++ const struct ieee80211_ext *ext;
+ unsigned int fixedlen, hdrlen;
+ bool s1g_bcn;
+
+@@ -237,8 +238,10 @@ static int validate_beacon_head(const struct nlattr *attr,
+
+ s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
+ if (s1g_bcn) {
+- fixedlen = offsetof(struct ieee80211_ext,
+- u.s1g_beacon.variable);
++ ext = (struct ieee80211_ext *)mgmt;
++ fixedlen =
++ offsetof(struct ieee80211_ext, u.s1g_beacon.variable) +
++ ieee80211_s1g_optional_len(ext->frame_control);
+ hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
+ } else {
+ fixedlen = offsetof(struct ieee80211_mgmt,
+--
+2.39.5
+
--- /dev/null
+From 5aad49eb530b984dfda00537a2ad6d0443077a2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jul 2025 17:55:41 +1000
+Subject: wifi: mac80211: correctly identify S1G short beacon
+
+From: Lachlan Hodges <lachlan.hodges@morsemicro.com>
+
+[ Upstream commit c5fd399a24c8e2865524361f7dc4d4a6899be4f4 ]
+
+mac80211 identifies a short beacon by the presence of the next
+TBTT field, however the standard actually doesn't explicitly state that
+the next TBTT can't be in a long beacon or even that it is required in
+a short beacon - and as a result this validation does not work for all
+vendor implementations.
+
+The standard explicitly states that an S1G long beacon shall contain
+the S1G beacon compatibility element as the first element in a beacon
+transmitted at a TBTT that is not a TSBTT (Target Short Beacon
+Transmission Time) as per IEEE80211-2024 11.1.3.10.1. This is validated
+by 9.3.4.3 Table 9-76 which states that the S1G beacon compatibility
+element is only allowed in the full set and is not allowed in the
+minimum set of elements permitted for use within short beacons.
+
+Correctly identify short beacons by the lack of an S1G beacon
+compatibility element as the first element in an S1G beacon frame.
+
+Fixes: 9eaffe5078ca ("cfg80211: convert S1G beacon to scan results")
+Signed-off-by: Simon Wadsworth <simon@morsemicro.com>
+Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
+Link: https://patch.msgid.link/20250701075541.162619-1-lachlan.hodges@morsemicro.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/ieee80211.h | 45 ++++++++++++++++++++++++++++-----------
+ net/mac80211/mlme.c | 7 ++++--
+ 2 files changed, 38 insertions(+), 14 deletions(-)
+
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index d07c1f0ad3de3..7ecdde54e1edd 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -662,18 +662,6 @@ static inline bool ieee80211_s1g_has_cssid(__le16 fc)
+ (fc & cpu_to_le16(IEEE80211_S1G_BCN_CSSID));
+ }
+
+-/**
+- * ieee80211_is_s1g_short_beacon - check if frame is an S1G short beacon
+- * @fc: frame control bytes in little-endian byteorder
+- * Return: whether or not the frame is an S1G short beacon,
+- * i.e. it is an S1G beacon with 'next TBTT' flag set
+- */
+-static inline bool ieee80211_is_s1g_short_beacon(__le16 fc)
+-{
+- return ieee80211_is_s1g_beacon(fc) &&
+- (fc & cpu_to_le16(IEEE80211_S1G_BCN_NEXT_TBTT));
+-}
+-
+ /**
+ * ieee80211_is_atim - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_ATIM
+ * @fc: frame control bytes in little-endian byteorder
+@@ -4863,6 +4851,39 @@ static inline bool ieee80211_is_ftm(struct sk_buff *skb)
+ return false;
+ }
+
++/**
++ * ieee80211_is_s1g_short_beacon - check if frame is an S1G short beacon
++ * @fc: frame control bytes in little-endian byteorder
++ * @variable: pointer to the beacon frame elements
++ * @variable_len: length of the frame elements
++ * Return: whether or not the frame is an S1G short beacon. As per
++ * IEEE80211-2024 11.1.3.10.1, The S1G beacon compatibility element shall
++ * always be present as the first element in beacon frames generated at a
++ * TBTT (Target Beacon Transmission Time), so any frame not containing
++ * this element must have been generated at a TSBTT (Target Short Beacon
++ * Transmission Time) that is not a TBTT. Additionally, short beacons are
++ * prohibited from containing the S1G beacon compatibility element as per
++ * IEEE80211-2024 9.3.4.3 Table 9-76, so if we have an S1G beacon with
++ * either no elements or the first element is not the beacon compatibility
++ * element, we have a short beacon.
++ */
++static inline bool ieee80211_is_s1g_short_beacon(__le16 fc, const u8 *variable,
++ size_t variable_len)
++{
++ if (!ieee80211_is_s1g_beacon(fc))
++ return false;
++
++ /*
++ * If the frame does not contain at least 1 element (this is perfectly
++ * valid in a short beacon) and is an S1G beacon, we have a short
++ * beacon.
++ */
++ if (variable_len < 2)
++ return true;
++
++ return variable[0] != WLAN_EID_S1G_BCN_COMPAT;
++}
++
+ struct element {
+ u8 id;
+ u8 datalen;
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 16bb3db67eaac..fd7434995a475 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -6702,6 +6702,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
+ struct ieee80211_bss_conf *bss_conf = link->conf;
+ struct ieee80211_vif_cfg *vif_cfg = &sdata->vif.cfg;
+ struct ieee80211_mgmt *mgmt = (void *) hdr;
++ struct ieee80211_ext *ext = NULL;
+ size_t baselen;
+ struct ieee802_11_elems *elems;
+ struct ieee80211_local *local = sdata->local;
+@@ -6727,7 +6728,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
+ /* Process beacon from the current BSS */
+ bssid = ieee80211_get_bssid(hdr, len, sdata->vif.type);
+ if (ieee80211_is_s1g_beacon(mgmt->frame_control)) {
+- struct ieee80211_ext *ext = (void *) mgmt;
++ ext = (void *)mgmt;
+ variable = ext->u.s1g_beacon.variable +
+ ieee80211_s1g_optional_len(ext->frame_control);
+ }
+@@ -6914,7 +6915,9 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
+ }
+
+ if ((ncrc == link->u.mgd.beacon_crc && link->u.mgd.beacon_crc_valid) ||
+- ieee80211_is_s1g_short_beacon(mgmt->frame_control))
++ (ext && ieee80211_is_s1g_short_beacon(ext->frame_control,
++ parse_params.start,
++ parse_params.len)))
+ goto free;
+ link->u.mgd.beacon_crc = ncrc;
+ link->u.mgd.beacon_crc_valid = true;
+--
+2.39.5
+
--- /dev/null
+From c3bd3146f8bf88cad2e37f1025372f3228990c67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jun 2025 15:45:01 +0200
+Subject: wifi: mac80211: fix non-transmitted BSSID profile search
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit e1e6ebf490e55fee1ae573aa443c1d4aea5e4a40 ]
+
+When the non-transmitted BSSID profile is found, immediately return
+from the search to not return the wrong profile_len when the profile
+is found in a multiple BSSID element that isn't the last one in the
+frame.
+
+Fixes: 5023b14cf4df ("mac80211: support profile split between elements")
+Reported-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
+Link: https://patch.msgid.link/20250630154501.f26cd45a0ecd.I28e0525d06e8a99e555707301bca29265cf20dc8@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/parse.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/net/mac80211/parse.c b/net/mac80211/parse.c
+index 6da39c864f45b..922ea9a6e2412 100644
+--- a/net/mac80211/parse.c
++++ b/net/mac80211/parse.c
+@@ -758,7 +758,6 @@ static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len,
+ {
+ const struct element *elem, *sub;
+ size_t profile_len = 0;
+- bool found = false;
+
+ if (!bss || !bss->transmitted_bss)
+ return profile_len;
+@@ -809,15 +808,14 @@ static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len,
+ index[2],
+ new_bssid);
+ if (ether_addr_equal(new_bssid, bss->bssid)) {
+- found = true;
+ elems->bssid_index_len = index[1];
+ elems->bssid_index = (void *)&index[2];
+- break;
++ return profile_len;
+ }
+ }
+ }
+
+- return found ? profile_len : 0;
++ return 0;
+ }
+
+ static void
+--
+2.39.5
+
--- /dev/null
+From 4ab9903e53463a114ac94782c068be86e496e7ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jun 2025 20:49:01 +0800
+Subject: wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init()
+
+From: Henry Martin <bsdhenrymartin@gmail.com>
+
+[ Upstream commit 03ee8f73801a8f46d83dfc2bf73fb9ffa5a21602 ]
+
+devm_kasprintf() returns NULL on error. Currently, mt7925_thermal_init()
+does not check for this case, which results in a NULL pointer
+dereference.
+
+Add NULL check after devm_kasprintf() to prevent this issue.
+
+Fixes: 396e41a74a88 ("wifi: mt76: mt7925: support temperature sensor")
+Signed-off-by: Henry Martin <bsdhenryma@tencent.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://patch.msgid.link/20250625124901.1839832-1-bsdhenryma@tencent.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7925/init.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/init.c b/drivers/net/wireless/mediatek/mt76/mt7925/init.c
+index 14553dcc61c57..02899320da5c1 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/init.c
+@@ -52,6 +52,8 @@ static int mt7925_thermal_init(struct mt792x_phy *phy)
+
+ name = devm_kasprintf(&wiphy->dev, GFP_KERNEL, "mt7925_%s",
+ wiphy_name(wiphy));
++ if (!name)
++ return -ENOMEM;
+
+ hwmon = devm_hwmon_device_register_with_groups(&wiphy->dev, name, phy,
+ mt7925_hwmon_groups);
+--
+2.39.5
+
--- /dev/null
+From 93b2e1603c76a061ed8e2699d9b2fe92c629178a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 11:20:53 +0200
+Subject: wifi: rt2x00: fix remove callback type mismatch
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 2ce6ad9262256dd345cb104ba0ac6cf4aeed25a3 ]
+
+The function is used as remove callback for a platform driver.
+It was missed during the conversion from int to void
+
+Fixes: 0edb555a65d1 ("platform: Make platform_driver::remove() return void")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://patch.msgid.link/20250706092053.97724-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00soc.c | 4 +---
+ drivers/net/wireless/ralink/rt2x00/rt2x00soc.h | 2 +-
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c b/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
+index eface610178d2..f7f3a2340c392 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
+@@ -108,7 +108,7 @@ int rt2x00soc_probe(struct platform_device *pdev, const struct rt2x00_ops *ops)
+ }
+ EXPORT_SYMBOL_GPL(rt2x00soc_probe);
+
+-int rt2x00soc_remove(struct platform_device *pdev)
++void rt2x00soc_remove(struct platform_device *pdev)
+ {
+ struct ieee80211_hw *hw = platform_get_drvdata(pdev);
+ struct rt2x00_dev *rt2x00dev = hw->priv;
+@@ -119,8 +119,6 @@ int rt2x00soc_remove(struct platform_device *pdev)
+ rt2x00lib_remove_dev(rt2x00dev);
+ rt2x00soc_free_reg(rt2x00dev);
+ ieee80211_free_hw(hw);
+-
+- return 0;
+ }
+ EXPORT_SYMBOL_GPL(rt2x00soc_remove);
+
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00soc.h b/drivers/net/wireless/ralink/rt2x00/rt2x00soc.h
+index 021fd06b36272..d6226b8a10e00 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00soc.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00soc.h
+@@ -17,7 +17,7 @@
+ * SoC driver handlers.
+ */
+ int rt2x00soc_probe(struct platform_device *pdev, const struct rt2x00_ops *ops);
+-int rt2x00soc_remove(struct platform_device *pdev);
++void rt2x00soc_remove(struct platform_device *pdev);
+ #ifdef CONFIG_PM
+ int rt2x00soc_suspend(struct platform_device *pdev, pm_message_t state);
+ int rt2x00soc_resume(struct platform_device *pdev);
+--
+2.39.5
+
--- /dev/null
+From 0ab74b2f6e8831c56597eba5f7edba01f0be1f3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jun 2025 14:46:19 +0300
+Subject: wifi: zd1211rw: Fix potential NULL pointer dereference in
+ zd_mac_tx_to_dev()
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit 74b1ec9f5d627d2bdd5e5b6f3f81c23317657023 ]
+
+There is a potential NULL pointer dereference in zd_mac_tx_to_dev(). For
+example, the following is possible:
+
+ T0 T1
+zd_mac_tx_to_dev()
+ /* len == skb_queue_len(q) */
+ while (len > ZD_MAC_MAX_ACK_WAITERS) {
+
+ filter_ack()
+ spin_lock_irqsave(&q->lock, flags);
+ /* position == skb_queue_len(q) */
+ for (i=1; i<position; i++)
+ skb = __skb_dequeue(q)
+
+ if (mac->type == NL80211_IFTYPE_AP)
+ skb = __skb_dequeue(q);
+ spin_unlock_irqrestore(&q->lock, flags);
+
+ skb_dequeue() -> NULL
+
+Since there is a small gap between checking skb queue length and skb being
+unconditionally dequeued in zd_mac_tx_to_dev(), skb_dequeue() can return NULL.
+Then the pointer is passed to zd_mac_tx_status() where it is dereferenced.
+
+In order to avoid potential NULL pointer dereference due to situations like
+above, check if skb is not NULL before passing it to zd_mac_tx_status().
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 459c51ad6e1f ("zd1211rw: port to mac80211")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Link: https://patch.msgid.link/20250626114619.172631-1-d.dulov@aladdin.ru
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/zydas/zd1211rw/zd_mac.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
+index f90c33d19b399..8fd7be37e209c 100644
+--- a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
++++ b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
+@@ -583,7 +583,11 @@ void zd_mac_tx_to_dev(struct sk_buff *skb, int error)
+
+ skb_queue_tail(q, skb);
+ while (skb_queue_len(q) > ZD_MAC_MAX_ACK_WAITERS) {
+- zd_mac_tx_status(hw, skb_dequeue(q),
++ skb = skb_dequeue(q);
++ if (!skb)
++ break;
++
++ zd_mac_tx_status(hw, skb,
+ mac->ack_pending ? mac->ack_signal : 0,
+ NULL);
+ mac->ack_pending = 0;
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
