--- /dev/null
+From 9502b7df5a3c7e174f74f20324ac1fe781fc5c2d Mon Sep 17 00:00:00 2001
+From: Zhang Heng <zhangheng@kylinos.cn>
+Date: Mon, 26 Jan 2026 09:49:52 +0800
+Subject: ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO
+
+From: Zhang Heng <zhangheng@kylinos.cn>
+
+commit 9502b7df5a3c7e174f74f20324ac1fe781fc5c2d upstream.
+
+Add a DMI quirk for the Acer TravelMate P216-41-TCO fixing the
+issue where the internal microphone was not detected.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=220983
+Cc: stable@vger.kernel.org
+Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
+Link: https://patch.msgid.link/20260126014952.3674450-1-zhangheng@kylinos.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -661,6 +661,14 @@ static const struct dmi_system_id yc_acp
+ DMI_MATCH(DMI_PRODUCT_NAME, "GOH-X"),
+ }
+ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "RB"),
++ DMI_MATCH(DMI_BOARD_NAME, "XyloD5_RBU"),
++ }
++ },
++
+ {}
+ };
+
--- /dev/null
+From 9210f5ff6318163835d9e42ee68006be4da0f531 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@gmail.com>
+Date: Sun, 18 Jan 2026 17:50:30 -0300
+Subject: ASoC: fsl: imx-card: Do not force slot width to sample width
+
+From: Fabio Estevam <festevam@gmail.com>
+
+commit 9210f5ff6318163835d9e42ee68006be4da0f531 upstream.
+
+imx-card currently sets the slot width to the physical sample width
+for I2S links. This breaks controllers that use fixed-width slots
+(e.g. 32-bit FIFO words), causing the unused bits in the slot to
+contain undefined data when playing 16-bit streams.
+
+Do not override the slot width in the machine driver and let the CPU
+DAI select an appropriate default instead. This matches the behavior
+of simple-audio-card and avoids embedding controller-specific policy
+in the machine driver.
+
+On an i.MX8MP-based board using SAI as the I2S master with 32-bit slots,
+playing 16-bit audio resulted in spurious frequencies and an incorrect
+SAI data waveform, as the slot width was forced to 16 bits. After this
+change, audio artifacts are eliminated and the 16-bit samples correctly
+occupy the first half of the 32-bit slot, with the remaining bits padded
+with zeroes.
+
+Cc: stable@vger.kernel.org
+Fixes: aa736700f42f ("ASoC: imx-card: Add imx-card machine driver")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Acked-by: Shengjiu Wang <shengjiu.wang@gmail.com>
+Link: https://patch.msgid.link/20260118205030.1532696-1-festevam@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/fsl/imx-card.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/soc/fsl/imx-card.c
++++ b/sound/soc/fsl/imx-card.c
+@@ -314,7 +314,6 @@ static int imx_aif_hw_params(struct snd_
+ SND_SOC_DAIFMT_PDM;
+ } else {
+ slots = 2;
+- slot_width = params_physical_width(params);
+ fmt = (rtd->dai_link->dai_fmt & ~SND_SOC_DAIFMT_FORMAT_MASK) |
+ SND_SOC_DAIFMT_I2S;
+ }
--- /dev/null
+From 4b22ec1685ce1fc0d862dcda3225d852fb107995 Mon Sep 17 00:00:00 2001
+From: Kohei Enju <kohei@enjuk.jp>
+Date: Sat, 17 Jan 2026 16:00:45 +0000
+Subject: efivarfs: fix error propagation in efivar_entry_get()
+
+From: Kohei Enju <kohei@enjuk.jp>
+
+commit 4b22ec1685ce1fc0d862dcda3225d852fb107995 upstream.
+
+efivar_entry_get() always returns success even if the underlying
+__efivar_entry_get() fails, masking errors.
+
+This may result in uninitialized heap memory being copied to userspace
+in the efivarfs_file_read() path.
+
+Fix it by returning the error from __efivar_entry_get().
+
+Fixes: 2d82e6227ea1 ("efi: vars: Move efivar caching layer into efivarfs")
+Cc: <stable@vger.kernel.org> # v6.1+
+Signed-off-by: Kohei Enju <kohei@enjuk.jp>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/efivarfs/vars.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/efivarfs/vars.c
++++ b/fs/efivarfs/vars.c
+@@ -609,7 +609,7 @@ int efivar_entry_get(struct efivar_entry
+ err = __efivar_entry_get(entry, attributes, size, data);
+ efivar_unlock();
+
+- return 0;
++ return err;
+ }
+
+ /**
--- /dev/null
+From dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 21 Jan 2026 12:27:30 +0100
+Subject: flex_proportions: make fprop_new_period() hardirq safe
+
+From: Jan Kara <jack@suse.cz>
+
+commit dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc upstream.
+
+Bernd has reported a lockdep splat from flexible proportions code that is
+essentially complaining about the following race:
+
+<timer fires>
+run_timer_softirq - we are in softirq context
+ call_timer_fn
+ writeout_period
+ fprop_new_period
+ write_seqcount_begin(&p->sequence);
+
+ <hardirq is raised>
+ ...
+ blk_mq_end_request()
+ blk_update_request()
+ ext4_end_bio()
+ folio_end_writeback()
+ __wb_writeout_add()
+ __fprop_add_percpu_max()
+ if (unlikely(max_frac < FPROP_FRAC_BASE)) {
+ fprop_fraction_percpu()
+ seq = read_seqcount_begin(&p->sequence);
+ - sees odd sequence so loops indefinitely
+
+Note that a deadlock like this is only possible if the bdi has configured
+maximum fraction of writeout throughput which is very rare in general but
+frequent for example for FUSE bdis. To fix this problem we have to make
+sure write section of the sequence counter is irqsafe.
+
+Link: https://lkml.kernel.org/r/20260121112729.24463-2-jack@suse.cz
+Fixes: a91befde3503 ("lib/flex_proportions.c: remove local_irq_ops in fprop_new_period()")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Reported-by: Bernd Schubert <bernd@bsbernd.com>
+Link: https://lore.kernel.org/all/9b845a47-9aee-43dd-99bc-1a82bea00442@bsbernd.com/
+Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Cc: Joanne Koong <joannelkoong@gmail.com>
+Cc: Miklos Szeredi <miklos@szeredi.hu>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/flex_proportions.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/lib/flex_proportions.c
++++ b/lib/flex_proportions.c
+@@ -64,13 +64,14 @@ void fprop_global_destroy(struct fprop_g
+ bool fprop_new_period(struct fprop_global *p, int periods)
+ {
+ s64 events = percpu_counter_sum(&p->events);
++ unsigned long flags;
+
+ /*
+ * Don't do anything if there are no events.
+ */
+ if (events <= 1)
+ return false;
+- preempt_disable_nested();
++ local_irq_save(flags);
+ write_seqcount_begin(&p->sequence);
+ if (periods < 64)
+ events -= events >> periods;
+@@ -78,7 +79,7 @@ bool fprop_new_period(struct fprop_globa
+ percpu_counter_add(&p->events, -events);
+ p->period += periods;
+ write_seqcount_end(&p->sequence);
+- preempt_enable_nested();
++ local_irq_restore(flags);
+
+ return true;
+ }
--- /dev/null
+From d02f20a4de0c498fbba2b0e3c1496e72c630a91e Mon Sep 17 00:00:00 2001
+From: Martin Larsson <martin.larsson@actia.se>
+Date: Wed, 21 Jan 2026 12:57:22 +0000
+Subject: gpio: pca953x: mask interrupts in irq shutdown
+
+From: Martin Larsson <martin.larsson@actia.se>
+
+commit d02f20a4de0c498fbba2b0e3c1496e72c630a91e upstream.
+
+In the existing implementation irq_shutdown does not mask the interrupts
+in hardware. This can cause spurious interrupts from the IO expander.
+Add masking to irq_shutdown to prevent spurious interrupts.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Martin Larsson <martin.larsson@actia.se>
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Link: https://lore.kernel.org/r/20260121125631.2758346-1-martin.larsson@actia.se
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-pca953x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -811,6 +811,8 @@ static void pca953x_irq_shutdown(struct
+ clear_bit(hwirq, chip->irq_trig_fall);
+ clear_bit(hwirq, chip->irq_trig_level_low);
+ clear_bit(hwirq, chip->irq_trig_level_high);
++
++ pca953x_irq_mask(d);
+ }
+
+ static void pca953x_irq_print_chip(struct irq_data *data, struct seq_file *p)
--- /dev/null
+From dccf46179ddd6c04c14be8ed584dc54665f53f0e Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Tue, 27 Jan 2026 20:27:25 +0100
+Subject: mptcp: only reset subflow errors when propagated
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+commit dccf46179ddd6c04c14be8ed584dc54665f53f0e upstream.
+
+Some subflow socket errors need to be reported to the MPTCP socket: the
+initial subflow connect (MP_CAPABLE), and the ones from the fallback
+sockets. The others are not propagated.
+
+The issue is that sock_error() was used to retrieve the error, which was
+also resetting the sk_err field. Because of that, when notifying the
+userspace about subflow close events later on from the MPTCP worker, the
+ssk->sk_err field was always 0.
+
+Now, the error (sk_err) is only reset when propagating it to the msk.
+
+Fixes: 15cc10453398 ("mptcp: deliver ssk errors to msk")
+Cc: stable@vger.kernel.org
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-3-7f71e1bc4feb@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -796,11 +796,8 @@ static bool __mptcp_ofo_queue(struct mpt
+
+ static bool __mptcp_subflow_error_report(struct sock *sk, struct sock *ssk)
+ {
+- int err = sock_error(ssk);
+ int ssk_state;
+-
+- if (!err)
+- return false;
++ int err;
+
+ /* only propagate errors on fallen-back sockets or
+ * on MPC connect
+@@ -808,6 +805,10 @@ static bool __mptcp_subflow_error_report
+ if (sk->sk_state != TCP_SYN_SENT && !__mptcp_check_fallback(mptcp_sk(sk)))
+ return false;
+
++ err = sock_error(ssk);
++ if (!err)
++ return false;
++
+ /* We need to propagate only transition to CLOSE state.
+ * Orphaned socket will see such state change via
+ * subflow_sched_work_if_closed() and that path will properly
--- /dev/null
+From 28f24068387169722b508bba6b5257cb68b86e74 Mon Sep 17 00:00:00 2001
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Date: Mon, 5 Jan 2026 16:05:08 +0100
+Subject: pinctrl: meson: mark the GPIO controller as sleeping
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+commit 28f24068387169722b508bba6b5257cb68b86e74 upstream.
+
+The GPIO controller is configured as non-sleeping but it uses generic
+pinctrl helpers which use a mutex for synchronization.
+
+This can cause the following lockdep splat with shared GPIOs enabled on
+boards which have multiple devices using the same GPIO:
+
+BUG: sleeping function called from invalid context at
+kernel/locking/mutex.c:591
+in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 142, name:
+kworker/u25:3
+preempt_count: 1, expected: 0
+RCU nest depth: 0, expected: 0
+INFO: lockdep is turned off.
+irq event stamp: 46379
+hardirqs last enabled at (46379): [<ffff8000813acb24>]
+_raw_spin_unlock_irqrestore+0x74/0x78
+hardirqs last disabled at (46378): [<ffff8000813abf38>]
+_raw_spin_lock_irqsave+0x84/0x88
+softirqs last enabled at (46330): [<ffff8000800c71b4>]
+handle_softirqs+0x4c4/0x4dc
+softirqs last disabled at (46295): [<ffff800080010674>]
+__do_softirq+0x14/0x20
+CPU: 1 UID: 0 PID: 142 Comm: kworker/u25:3 Tainted: G C
+6.19.0-rc4-next-20260105+ #11963 PREEMPT
+Tainted: [C]=CRAP
+Hardware name: Khadas VIM3 (DT)
+Workqueue: events_unbound deferred_probe_work_func
+Call trace:
+ show_stack+0x18/0x24 (C)
+ dump_stack_lvl+0x90/0xd0
+ dump_stack+0x18/0x24
+ __might_resched+0x144/0x248
+ __might_sleep+0x48/0x98
+ __mutex_lock+0x5c/0x894
+ mutex_lock_nested+0x24/0x30
+ pinctrl_get_device_gpio_range+0x44/0x128
+ pinctrl_gpio_set_config+0x40/0xdc
+ gpiochip_generic_config+0x28/0x3c
+ gpio_do_set_config+0xa8/0x194
+ gpiod_set_config+0x34/0xfc
+ gpio_shared_proxy_set_config+0x6c/0xfc [gpio_shared_proxy]
+ gpio_do_set_config+0xa8/0x194
+ gpiod_set_transitory+0x4c/0xf0
+ gpiod_configure_flags+0xa4/0x480
+ gpiod_find_and_request+0x1a0/0x574
+ gpiod_get_index+0x58/0x84
+ devm_gpiod_get_index+0x20/0xb4
+ devm_gpiod_get+0x18/0x24
+ mmc_pwrseq_emmc_probe+0x40/0xb8
+ platform_probe+0x5c/0xac
+ really_probe+0xbc/0x298
+ __driver_probe_device+0x78/0x12c
+ driver_probe_device+0xdc/0x164
+ __device_attach_driver+0xb8/0x138
+ bus_for_each_drv+0x80/0xdc
+ __device_attach+0xa8/0x1b0
+
+Fixes: 6ac730951104 ("pinctrl: add driver for Amlogic Meson SoCs")
+Cc: stable@vger.kernel.org
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Closes: https://lore.kernel.org/all/00107523-7737-4b92-a785-14ce4e93b8cb@samsung.com/
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/meson/pinctrl-meson.c
++++ b/drivers/pinctrl/meson/pinctrl-meson.c
+@@ -618,7 +618,7 @@ static int meson_gpiolib_register(struct
+ pc->chip.set = meson_gpio_set;
+ pc->chip.base = -1;
+ pc->chip.ngpio = pc->data->num_pins;
+- pc->chip.can_sleep = false;
++ pc->chip.can_sleep = true;
+
+ ret = gpiochip_add_data(&pc->chip, pc);
+ if (ret) {
--- /dev/null
+From 0ea05c4f7527a98f5946f96c829733788934311d Mon Sep 17 00:00:00 2001
+From: Han Gao <gaohan@iscas.ac.cn>
+Date: Wed, 28 Jan 2026 03:07:11 +0800
+Subject: riscv: compat: fix COMPAT_UTS_MACHINE definition
+
+From: Han Gao <gaohan@iscas.ac.cn>
+
+commit 0ea05c4f7527a98f5946f96c829733788934311d upstream.
+
+The COMPAT_UTS_MACHINE for riscv was incorrectly defined as "riscv".
+Change it to "riscv32" to reflect the correct 32-bit compat name.
+
+Fixes: 06d0e3723647 ("riscv: compat: Add basic compat data type implementation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Han Gao <gaohan@iscas.ac.cn>
+Reviewed-by: Guo Ren (Alibaba Damo Academy) <guoren@kernel.org>
+Link: https://patch.msgid.link/20260127190711.2264664-1-gaohan@iscas.ac.cn
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/include/asm/compat.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/riscv/include/asm/compat.h
++++ b/arch/riscv/include/asm/compat.h
+@@ -2,7 +2,7 @@
+ #ifndef __ASM_COMPAT_H
+ #define __ASM_COMPAT_H
+
+-#define COMPAT_UTS_MACHINE "riscv\0\0"
++#define COMPAT_UTS_MACHINE "riscv32\0\0"
+
+ /*
+ * Architecture specific compatibility types
--- /dev/null
+From af20ae33e7dd949f2e770198e74ac8f058cb299d Mon Sep 17 00:00:00 2001
+From: Miguel Ojeda <ojeda@kernel.org>
+Date: Thu, 15 Jan 2026 19:38:32 +0100
+Subject: rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target
+
+From: Miguel Ojeda <ojeda@kernel.org>
+
+commit af20ae33e7dd949f2e770198e74ac8f058cb299d upstream.
+
+`rustfmt` is configured via the `.rustfmt.toml` file in the source tree,
+and we apply `rustfmt` to the macro expanded sources generated by the
+`.rsi` target.
+
+However, under an `O=` pointing to an external folder (i.e. not just
+a subdir), `rustfmt` will not find the file when checking the parent
+folders. Since the edition is configured in this file, this can lead to
+errors when it encounters newer syntax, e.g.
+
+ error: expected one of `!`, `.`, `::`, `;`, `?`, `where`, `{`, or an operator, found `"rust_minimal"`
+ --> samples/rust/rust_minimal.rsi:29:49
+ |
+ 28 | impl ::kernel::ModuleMetadata for RustMinimal {
+ | - while parsing this item list starting here
+ 29 | const NAME: &'static ::kernel::str::CStr = c"rust_minimal";
+ | ^^^^^^^^^^^^^^ expected one of 8 possible tokens
+ 30 | }
+ | - the item list ends here
+ |
+ = note: you may be trying to write a c-string literal
+ = note: c-string literals require Rust 2021 or later
+ = help: pass `--edition 2024` to `rustc`
+ = note: for more on editions, read https://doc.rust-lang.org/edition-guide
+
+A workaround is to use `RUSTFMT=n`, which is documented in the `Makefile`
+help for cases where macro expanded source may happen to break `rustfmt`
+for other reasons, but this is not one of those cases.
+
+One solution would be to pass `--edition`, but we want `rustfmt` to
+use the entire configuration, even if currently we essentially use the
+default configuration.
+
+Thus explicitly give the path to the config file to `rustfmt` instead.
+
+Reported-by: Alice Ryhl <aliceryhl@google.com>
+Fixes: 2f7ab1267dc9 ("Kbuild: add Rust support")
+Cc: stable@vger.kernel.org
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Gary Guo <gary@garyguo.net>
+Link: https://patch.msgid.link/20260115183832.46595-1-ojeda@kernel.org
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/Makefile.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -294,7 +294,7 @@ $(obj)/%.o: $(src)/%.rs FORCE
+ quiet_cmd_rustc_rsi_rs = $(RUSTC_OR_CLIPPY_QUIET) $(quiet_modtag) $@
+ cmd_rustc_rsi_rs = \
+ $(rust_common_cmd) -Zunpretty=expanded $< >$@; \
+- command -v $(RUSTFMT) >/dev/null && $(RUSTFMT) $@
++ command -v $(RUSTFMT) >/dev/null && $(RUSTFMT) --config-path $(srctree)/.rustfmt.toml $@
+
+ $(obj)/%.rsi: $(src)/%.rs FORCE
+ $(call if_changed_dep,rustc_rsi_rs)
--- /dev/null
+From 4747bafaa50115d9667ece446b1d2d4aba83dc7f Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Date: Sat, 13 Dec 2025 16:36:43 +0800
+Subject: scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+commit 4747bafaa50115d9667ece446b1d2d4aba83dc7f upstream.
+
+If nonemb_cmd->va fails to be allocated, free the allocation previously
+made by alloc_mcc_wrb().
+
+Fixes: 50a4b824be9e ("scsi: be2iscsi: Fix to make boot discovery non-blocking")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Link: https://patch.msgid.link/20251213083643.301240-1-lihaoxiang@isrc.iscas.ac.cn
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/be2iscsi/be_mgmt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/be2iscsi/be_mgmt.c
++++ b/drivers/scsi/be2iscsi/be_mgmt.c
+@@ -1025,6 +1025,7 @@ unsigned int beiscsi_boot_get_sinfo(stru
+ &nonemb_cmd->dma,
+ GFP_KERNEL);
+ if (!nonemb_cmd->va) {
++ free_mcc_wrb(ctrl, tag);
+ mutex_unlock(&ctrl->mbox_lock);
+ return 0;
+ }
--- /dev/null
+From 56bd3c0f749f45793d1eae1d0ddde4255c749bf6 Mon Sep 17 00:00:00 2001
+From: Thomas Fourier <fourier.thomas@gmail.com>
+Date: Mon, 12 Jan 2026 14:43:24 +0100
+Subject: scsi: qla2xxx: edif: Fix dma_free_coherent() size
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+commit 56bd3c0f749f45793d1eae1d0ddde4255c749bf6 upstream.
+
+Earlier in the function, the ha->flt buffer is allocated with size
+sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE but freed in the error
+path with size SFP_DEV_SIZE.
+
+Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Link: https://patch.msgid.link/20260112134326.55466-2-fourier.thomas@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -4482,7 +4482,7 @@ fail_lsrjt:
+ fail_elsrej:
+ dma_pool_destroy(ha->purex_dma_pool);
+ fail_flt:
+- dma_free_coherent(&ha->pdev->dev, SFP_DEV_SIZE,
++ dma_free_coherent(&ha->pdev->dev, sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE,
+ ha->flt, ha->flt_dma);
+
+ fail_flt_buffer:
--- /dev/null
+From 8467458dfa61b37e259e3485a5d3e415d08193c1 Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Tue, 27 Jan 2026 20:27:24 +0100
+Subject: selftests: mptcp: check no dup close events after error
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+commit 8467458dfa61b37e259e3485a5d3e415d08193c1 upstream.
+
+This validates the previous commit: subflow closed events are re-sent
+with less info when the initial subflow is disconnected after an error
+and each time a subflow is closed after that.
+
+In this new test, the userspace PM is involved because that's how it was
+discovered, but it is not specific to it. The initial subflow is
+terminated with a RESET, and that will cause the subflow disconnect.
+Then, a new subflow is initiated, but also got rejected, which cause a
+second subflow closed event, but not a third one.
+
+While at it, in case of failure to get the expected amount of events,
+the events are printed.
+
+The 'Fixes' tag here below is the same as the one from the previous
+commit: this patch here is not fixing anything wrong in the selftests,
+but it validates the previous fix for an issue introduced by this commit
+ID.
+
+Fixes: d82809b6c5f2 ("mptcp: avoid duplicated SUB_CLOSED events")
+Cc: stable@vger.kernel.org
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-2-7f71e1bc4feb@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_join.sh | 51 ++++++++++++++++++++++++
+ 1 file changed, 51 insertions(+)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+@@ -3569,11 +3569,32 @@ chk_evt_nr()
+ count=$(grep -cw "type:${evt}" "${evts}")
+ if [ "${count}" != "${exp}" ]; then
+ fail_test "got ${count} events, expected ${exp}"
++ cat "${evts}"
+ else
+ print_ok
+ fi
+ }
+
++# $1: ns ; $2: event type ; $3: expected count
++wait_event()
++{
++ local ns="${1}"
++ local evt_name="${2}"
++ local exp="${3}"
++
++ local evt="${!evt_name}"
++ local evts="${evts_ns1}"
++ local count
++
++ [ "${ns}" == "ns2" ] && evts="${evts_ns2}"
++
++ for _ in $(seq 100); do
++ count=$(grep -cw "type:${evt}" "${evts}")
++ [ "${count}" -ge "${exp}" ] && break
++ sleep 0.1
++ done
++}
++
+ userspace_tests()
+ {
+ # userspace pm type prevents add_addr
+@@ -3730,6 +3751,36 @@ userspace_tests()
+ kill_events_pids
+ mptcp_lib_kill_group_wait $tests_pid
+ fi
++
++ # userspace pm no duplicated spurious close events after an error
++ if reset_with_events "userspace pm no dup close events after error" &&
++ continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then
++ set_userspace_pm $ns2
++ pm_nl_set_limits $ns1 0 2
++ { timeout_test=120 test_linkfail=128 speed=slow \
++ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null
++ local tests_pid=$!
++ wait_event ns2 MPTCP_LIB_EVENT_ESTABLISHED 1
++ userspace_pm_add_sf $ns2 10.0.3.2 20
++ chk_mptcp_info subflows 1 subflows 1
++ chk_subflows_total 2 2
++
++ # force quick loss
++ ip netns exec $ns2 sysctl -q net.ipv4.tcp_syn_retries=1
++ if ip netns exec "${ns1}" ${iptables} -A INPUT -s "10.0.1.2" \
++ -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset &&
++ ip netns exec "${ns2}" ${iptables} -A INPUT -d "10.0.1.2" \
++ -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset; then
++ wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 1
++ wait_event ns1 MPTCP_LIB_EVENT_SUB_CLOSED 1
++ chk_subflows_total 1 1
++ userspace_pm_add_sf $ns2 10.0.1.2 0
++ wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2
++ chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2
++ fi
++ kill_events_pids
++ mptcp_lib_kill_group_wait $tests_pid
++ fi
+ }
+
+ endpoint_tests()
--- /dev/null
+From 2ef9e3a3845d0a20b62b01f5b731debd0364688d Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Tue, 27 Jan 2026 20:27:26 +0100
+Subject: selftests: mptcp: check subflow errors in close events
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+commit 2ef9e3a3845d0a20b62b01f5b731debd0364688d upstream.
+
+This validates the previous commit: subflow closed events should contain
+an error field when a subflow got closed with an error, e.g. reset or
+timeout.
+
+For this test, the chk_evt_nr helper has been extended to check
+attributes in the matched events.
+
+In this test, the 2 subflow closed events should have an error.
+
+The 'Fixes' tag here below is the same as the one from the previous
+commit: this patch here is not fixing anything wrong in the selftests,
+but it validates the previous fix for an issue introduced by this commit
+ID.
+
+Fixes: 15cc10453398 ("mptcp: deliver ssk errors to msk")
+Cc: stable@vger.kernel.org
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-4-7f71e1bc4feb@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_join.sh | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+@@ -3544,21 +3544,28 @@ userspace_pm_chk_get_addr()
+ fi
+ }
+
+-# $1: ns ; $2: event type ; $3: count
++# $1: ns ; $2: event type ; $3: count ; [ $4: attr ; $5: attr count ]
+ chk_evt_nr()
+ {
+ local ns=${1}
+ local evt_name="${2}"
+ local exp="${3}"
++ local attr="${4}"
++ local attr_exp="${5}"
+
+ local evts="${evts_ns1}"
+ local evt="${!evt_name}"
++ local attr_name
+ local count
+
++ if [ -n "${attr}" ]; then
++ attr_name=", ${attr}: ${attr_exp}"
++ fi
++
+ evt_name="${evt_name:16}" # without MPTCP_LIB_EVENT_
+ [ "${ns}" == "ns2" ] && evts="${evts_ns2}"
+
+- print_check "event ${ns} ${evt_name} (${exp})"
++ print_check "event ${ns} ${evt_name} (${exp}${attr_name})"
+
+ if [[ "${evt_name}" = "LISTENER_"* ]] &&
+ ! mptcp_lib_kallsyms_has "mptcp_event_pm_listener$"; then
+@@ -3570,6 +3577,16 @@ chk_evt_nr()
+ if [ "${count}" != "${exp}" ]; then
+ fail_test "got ${count} events, expected ${exp}"
+ cat "${evts}"
++ return
++ elif [ -z "${attr}" ]; then
++ print_ok
++ return
++ fi
++
++ count=$(grep -w "type:${evt}" "${evts}" | grep -c ",${attr}:")
++ if [ "${count}" != "${attr_exp}" ]; then
++ fail_test "got ${count} event attributes, expected ${attr_exp}"
++ grep -w "type:${evt}" "${evts}"
+ else
+ print_ok
+ fi
+@@ -3776,7 +3793,7 @@ userspace_tests()
+ chk_subflows_total 1 1
+ userspace_pm_add_sf $ns2 10.0.1.2 0
+ wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2
+- chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2
++ chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 error 2
+ fi
+ kill_events_pids
+ mptcp_lib_kill_group_wait $tests_pid
--- /dev/null
+From c5d5ecf21fdd9ce91e6116feb3aa83cee73352cc Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Tue, 27 Jan 2026 20:27:27 +0100
+Subject: selftests: mptcp: join: fix local endp not being tracked
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+commit c5d5ecf21fdd9ce91e6116feb3aa83cee73352cc upstream.
+
+When running this mptcp_join.sh selftest on older kernel versions not
+supporting local endpoints tracking, this test fails because 3 MP_JOIN
+ACKs have been received, while only 2 were expected.
+
+It is not clear why only 2 MP_JOIN ACKs were expected on old kernel
+versions, while 3 MP_JOIN SYN and SYN+ACK were expected. When testing on
+the v5.15.197 kernel, 3 MP_JOIN ACKs are seen, which is also what is
+expected in the selftests included in this kernel version, see commit
+f4480eaad489 ("selftests: mptcp: add missing join check").
+
+Switch the expected MP_JOIN ACKs to 3. While at it, move this
+chk_join_nr helper out of the special condition for older kernel
+versions as it is now the same as with more recent ones. Also, invert
+the condition to be more logical: what's expected on newer kernel
+versions having such helper first.
+
+Fixes: d4c81bbb8600 ("selftests: mptcp: join: support local endpoint being tracked or not")
+Cc: stable@vger.kernel.org
+Reviewed-by: Mat Martineau <martineau@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-5-7f71e1bc4feb@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_join.sh | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+@@ -2203,17 +2203,16 @@ signal_address_tests()
+ ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=1
+ speed=slow \
+ run_tests $ns1 $ns2 10.0.1.1
++ chk_join_nr 3 3 3
+
+ # It is not directly linked to the commit introducing this
+ # symbol but for the parent one which is linked anyway.
+- if ! mptcp_lib_kallsyms_has "mptcp_pm_subflow_check_next$"; then
+- chk_join_nr 3 3 2
+- chk_add_nr 4 4
+- else
+- chk_join_nr 3 3 3
++ if mptcp_lib_kallsyms_has "mptcp_pm_subflow_check_next$"; then
+ # the server will not signal the address terminating
+ # the MPC subflow
+ chk_add_nr 3 3
++ else
++ chk_add_nr 4 4
+ fi
+ fi
+ }
asoc-intel-sof_es8336-fix-headphone-gpio-logic-inver.patch
gpiolib-acpi-use-bit_ull-for-u64-mask-in-address-spa.patch
dma-pool-distinguish-between-missing-and-exhausted-a.patch
+pinctrl-meson-mark-the-gpio-controller-as-sleeping.patch
+riscv-compat-fix-compat_uts_machine-definition.patch
+rust-kbuild-give-config-path-to-rustfmt-in-.rsi-target.patch
+asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch
+scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch
+asoc-amd-yc-add-dmi-quirk-for-acer-travelmate-p216-41-tco.patch
+gpio-pca953x-mask-interrupts-in-irq-shutdown.patch
+scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch
+efivarfs-fix-error-propagation-in-efivar_entry_get.patch
+mptcp-only-reset-subflow-errors-when-propagated.patch
+selftests-mptcp-check-no-dup-close-events-after-error.patch
+selftests-mptcp-check-subflow-errors-in-close-events.patch
+selftests-mptcp-join-fix-local-endp-not-being-tracked.patch
+flex_proportions-make-fprop_new_period-hardirq-safe.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
