--- /dev/null
+From 7ce4fc40018de07f05f3035241122d992610dbfb Mon Sep 17 00:00:00 2001
+From: Gil Portnoy <dddhkts1@gmail.com>
+Date: Thu, 28 May 2026 00:00:00 +0000
+Subject: ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
+
+From: Gil Portnoy <dddhkts1@gmail.com>
+
+commit 7ce4fc40018de07f05f3035241122d992610dbfb upstream.
+
+Two concurrent same-user DHnC reconnects can both observe fp->conn == NULL
+before either sets it. ksmbd_reopen_durable_fd() checks fp->conn to guard
+against a handle already being reconnected, but the check and the binding
+assignment are not atomic: both threads pass the guard, both call
+ksmbd_conn_get() on the same fp, and both eventually reach
+kfree(fp->owner.name) -- a double-free of the owner.name slab object.
+The double-bound ksmbd_file also causes a write-UAF on the 344-byte
+ksmbd_file_cache object when a concurrent smb2_close() spins on fp->f_lock
+after the object has been freed by the losing reconnect path.
+
+KASAN on 7.1-rc5 (48-thread concurrent reconnect, 3000 cycles):
+ BUG: KASAN: double-free in ksmbd_reopen_durable_fd+0x268/0x308
+ BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xac/0x150
+ Write of size 4 at offset 24 into freed ksmbd_file_cache object
+Five double-bind windows observed; 63 total KASAN reports triggered.
+
+Fix: validate and claim fp->conn under write_lock(&global_ft.lock) so the
+check-and-claim is atomic. ksmbd_lookup_durable_fd() already treats
+fp->conn != NULL as "in use" and skips such an fp; setting fp->conn before
+dropping the lock closes the race. ksmbd_conn_get() is a non-sleeping
+refcount increment, safe under the rwlock. The rollback path on __open_id()
+failure also clears fp->conn/tcon under the lock so concurrent readers see
+a consistent state.
+
+Fixes: b1f1e80620de ("ksmbd: centralize ksmbd_conn final release to plug transport leak")
+Assisted-by: Henry (Claude):claude-opus-4
+Signed-off-by: Gil Portnoy <dddhkts1@gmail.com>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/server/vfs_cache.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/fs/smb/server/vfs_cache.c
++++ b/fs/smb/server/vfs_cache.c
+@@ -1185,19 +1185,19 @@ int ksmbd_reopen_durable_fd(struct ksmbd
+ struct ksmbd_lock *smb_lock;
+ unsigned int old_f_state;
+
++ write_lock(&global_ft.lock);
+ if (!fp->is_durable || fp->conn || fp->tcon) {
++ write_unlock(&global_ft.lock);
+ pr_err("Invalid durable fd [%p:%p]\n", fp->conn, fp->tcon);
+ return -EBADF;
+ }
+
+ if (has_file_id(fp->volatile_id)) {
++ write_unlock(&global_ft.lock);
+ pr_err("Still in use durable fd: %llu\n", fp->volatile_id);
+ return -EBADF;
+ }
+
+- old_f_state = fp->f_state;
+- fp->f_state = FP_NEW;
+-
+ /*
+ * Initialize fp's connection binding before publishing fp into the
+ * session's file table. If __open_id() is ordered first, a
+@@ -1208,11 +1208,17 @@ int ksmbd_reopen_durable_fd(struct ksmbd
+ */
+ fp->conn = ksmbd_conn_get(conn);
+ fp->tcon = work->tcon;
++ write_unlock(&global_ft.lock);
++
++ old_f_state = fp->f_state;
++ fp->f_state = FP_NEW;
+
+ __open_id(&work->sess->file_table, fp, OPEN_ID_TYPE_VOLATILE_ID);
+ if (!has_file_id(fp->volatile_id)) {
++ write_lock(&global_ft.lock);
+ fp->conn = NULL;
+ fp->tcon = NULL;
++ write_unlock(&global_ft.lock);
+ ksmbd_conn_put(conn);
+ fp->f_state = old_f_state;
+ return -EBADF;
--- /dev/null
+From 08d9eae76b85263173f8c833800e3cc409ee1be4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
+Date: Wed, 21 Jan 2026 15:14:16 +0200
+Subject: PCI: Fix BAR resize rollback path overwriting ret
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+commit 08d9eae76b85263173f8c833800e3cc409ee1be4 upstream.
+
+The commit 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback
+path") added BAR rollback to pci_do_resource_release_and_resize() in case
+of resize failure.
+
+On the rollback, pci_claim_resource() is called, which can fail and the
+code is prepared for that possibility. pci_claim_resource()'s return value,
+however, overwrites the original value of ret so
+pci_do_resource_release_and_resize() will return an incorrect value in the
+end (as pci_claim_resource() normally succeeds, in practice ret will be 0).
+
+Fix the issue by directly calling pci_claim_resource() inside the if ().
+
+Fixes: 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path")
+Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://lore.kernel.org/linux-pci/aW_w1oFQCzUxGYtu@intel.com/
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260121131417.9582-2-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/setup-bus.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/pci/setup-bus.c
++++ b/drivers/pci/setup-bus.c
+@@ -2504,8 +2504,7 @@ restore:
+
+ restore_dev_resource(dev_res);
+
+- ret = pci_claim_resource(dev, i);
+- if (ret)
++ if (pci_claim_resource(dev, i))
+ continue;
+
+ if (i < PCI_BRIDGE_RESOURCES) {
--- /dev/null
+From 5528fd38f230c906fcebb202cc94fbb8ed8f122a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
+Date: Wed, 21 Jan 2026 15:14:17 +0200
+Subject: PCI: Fix Resizable BAR restore order
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+commit 5528fd38f230c906fcebb202cc94fbb8ed8f122a upstream.
+
+The commit 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback
+path") changed BAR resize to layer rebar code and resource setup/restore
+code cleanly. Unfortunately, it did not consider how the value of the BAR
+Size field impacts the read-only bits in the Base Address Register (PCIe7
+spec, sec. 7.8.6.3). That is, it very much matters in which order the BAR
+Size and Base Address Register are restored.
+
+Post-337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path")
+during BAR resize rollback, pci_do_resource_release_and_resize() attempts
+to restore the old address to the BAR that was resized, but it can fail to
+setup the address correctly if the address has low bits set that collide
+with the bits that are still read-only. As a result, kernel's resource and
+BAR will be out-of-sync.
+
+Fix this by restoring BAR Size before rolling back the resource changes and
+restoring the BAR.
+
+Fixes: 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path")
+Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://lore.kernel.org/linux-pci/aW_w1oFQCzUxGYtu@intel.com/
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260121131417.9582-3-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/rebar.c | 18 +-----------------
+ drivers/pci/setup-bus.c | 20 ++++++++++++++++++--
+ 2 files changed, 19 insertions(+), 19 deletions(-)
+
+--- a/drivers/pci/rebar.c
++++ b/drivers/pci/rebar.c
+@@ -215,7 +215,6 @@ int pci_resize_resource(struct pci_dev *
+ int exclude_bars)
+ {
+ struct pci_host_bridge *host;
+- int old, ret;
+ u32 sizes;
+
+ /* Check if we must preserve the firmware's resource assignment */
+@@ -233,21 +232,6 @@ int pci_resize_resource(struct pci_dev *
+ if (!(sizes & BIT(size)))
+ return -EINVAL;
+
+- old = pci_rebar_get_current_size(dev, resno);
+- if (old < 0)
+- return old;
+-
+- ret = pci_rebar_set_size(dev, resno, size);
+- if (ret)
+- return ret;
+-
+- ret = pci_do_resource_release_and_resize(dev, resno, size, exclude_bars);
+- if (ret)
+- goto error_resize;
+- return 0;
+-
+-error_resize:
+- pci_rebar_set_size(dev, resno, old);
+- return ret;
++ return pci_do_resource_release_and_resize(dev, resno, size, exclude_bars);
+ }
+ EXPORT_SYMBOL(pci_resize_resource);
+--- a/drivers/pci/setup-bus.c
++++ b/drivers/pci/setup-bus.c
+@@ -2452,12 +2452,20 @@ int pci_do_resource_release_and_resize(s
+ struct resource *b_win, *r;
+ LIST_HEAD(saved);
+ unsigned int i;
+- int ret = 0;
++ int old, ret;
+
+ b_win = pbus_select_window(bus, res);
+ if (!b_win)
+ return -EINVAL;
+
++ old = pci_rebar_get_current_size(pdev, resno);
++ if (old < 0)
++ return old;
++
++ ret = pci_rebar_set_size(pdev, resno, size);
++ if (ret)
++ return ret;
++
+ pci_dev_for_each_resource(pdev, r, i) {
+ if (i >= PCI_BRIDGE_RESOURCES)
+ break;
+@@ -2490,7 +2498,15 @@ out:
+ return ret;
+
+ restore:
+- /* Revert to the old configuration */
++ /*
++ * Revert to the old configuration.
++ *
++ * BAR Size must be restored first because it affects the read-only
++ * bits in BAR (the old address might not be restorable otherwise
++ * due to low address bits).
++ */
++ pci_rebar_set_size(pdev, resno, old);
++
+ list_for_each_entry(dev_res, &saved, list) {
+ struct resource *res = dev_res->res;
+ struct pci_dev *dev = dev_res->dev;
--- /dev/null
+From ae15db3e9b639491007cc1e9e99638e4b6091781 Mon Sep 17 00:00:00 2001
+From: Thomas Richter <tmricht@linux.ibm.com>
+Date: Tue, 14 Apr 2026 14:42:41 +0200
+Subject: perf callchain: Handle multiple address spaces
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+commit ae15db3e9b639491007cc1e9e99638e4b6091781 upstream.
+
+perf test 'perf inject to convert DWARF callchains to regular ones'
+fails on s390. It was introduced with commit 92ea788d2af4e65a ("perf
+inject: Add --convert-callchain option")
+
+The failure comes the difference in output. Without the inject script to
+convert DWARF the callchains is:
+
+ # perf record -F 999 --call-graph dwarf -- perf test -w noploop
+ # perf report -i perf.data --stdio --no-children -q \
+ --percent-limit=1 > /tmp/111
+ # cat /tmp/111
+ 99.30% perf-noploop perf [.] noploop
+ |
+ ---noploop
+ run_workload (inlined)
+ cmd_test
+ run_builtin (inlined)
+ handle_internal_command
+ run_argv (inlined)
+ main
+ __libc_start_call_main
+ __libc_start_main_impl (inlined)
+ _start
+ #
+
+With the inject script step the output is:
+
+ # perf inject -i perf.data --convert-callchain -o /tmp/perf-inject-1.out
+ # perf report -i /tmp/perf-inject-1.out --stdio --no-children -q \
+ --percent-limit=1 > /tmp/222
+ # cat /tmp/222
+ 99.40% perf-noploop perf [.] noploop
+ |
+ ---noploop
+ run_workload (inlined)
+ cmd_test
+ run_builtin (inlined)
+ handle_internal_command
+ run_argv (inlined)
+ main
+ _start
+ # diff /tmp/111 /tmp/222
+ 1c1
+ < 99.30% perf-noploop perf [.] noploop
+ ---
+ > 99.40% perf-noploop perf [.] noploop
+ 10,11d9
+ < __libc_start_call_main
+ < __libc_start_main_impl (inlined)
+ #
+
+The difference are the symbols __libc_start_call_main and
+__libc_start_main_impl.
+
+On x86_64, kernel and user space share a single virtual address space,
+with the kernel mapped to the upper end of memory. The instruction
+pointer value alone is sufficient to distinguish between user space and
+kernel space addresses.
+
+This is not true for s390, which uses separate address spaces for user
+and kernel.
+
+The same virtual address can be valid in both address spaces, so the
+instruction pointer value alone cannot determine whether an address
+belongs to the kernel or user space.
+
+Instead, perf must rely on the cpumode metadata derived from the
+processor status word (PSW) at sample time.
+
+In function perf_event__convert_sample_callchain() the first part
+copies a kernel callchain and context entries, if any.
+
+It then appends additional entries ignoring the address space
+architecture. Taking that into account, the symbols at addresses
+
+ 0x3ff970348cb __libc_start_call_main
+ 0x3ff970349c5 __libc_start_main_impl
+
+(located after the kernel address space on s390) are now included.
+
+Output before:
+
+ # perf test 83
+ 83: perf inject to convert DWARF callchains to regular ones : FAILED!
+
+Output after:
+ # perf test 83
+ 83: perf inject to convert DWARF callchains to regular ones : Ok
+
+Question to Namhyung:
+
+In function perf_event__convert_sample_callchain() just before the
+for() loop this patch modifies, the kernel callchain is copied,
+see this comment and the next 5 lines:
+
+ /* copy kernel callchain and context entries */
+
+Then why is machine__kernel_ip() needed in the for() loop, when
+the kernel entries have been copied just before the loop?
+
+Note: This patch was tested on x86_64 virtual machine and succeeded.
+
+Fixes: 92ea788d2af4e65a ("perf inject: Add --convert-callchain option")
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Jan Polensky <japo@linux.ibm.com>
+Cc: linux-s390@vger.kernel.org
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/arch/common.c | 4 +++-
+ tools/perf/builtin-inject.c | 3 ++-
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/arch/common.c
++++ b/tools/perf/arch/common.c
+@@ -237,5 +237,7 @@ int perf_env__lookup_objdump(struct perf
+ */
+ bool perf_env__single_address_space(struct perf_env *env)
+ {
+- return strcmp(perf_env__arch(env), "sparc");
++ const char *arch = perf_env__arch(env);
++
++ return strcmp(arch, "s390") && strcmp(arch, "sparc");
+ }
+--- a/tools/perf/builtin-inject.c
++++ b/tools/perf/builtin-inject.c
+@@ -555,7 +555,8 @@ static int perf_event__convert_sample_ca
+
+ node = cursor->first;
+ for (k = 0; k < cursor->nr && i < PERF_MAX_STACK_DEPTH; k++) {
+- if (machine__kernel_ip(machine, node->ip))
++ if (machine->single_address_space &&
++ machine__kernel_ip(machine, node->ip))
+ /* kernel IPs were added already */;
+ else if (node->ms.sym && node->ms.sym->inlined)
+ /* we can't handle inlined callchains */;
--- /dev/null
+From e786a04b4a5461dd7e2829422314a5a6d5a664d9 Mon Sep 17 00:00:00 2001
+From: Ian Rogers <irogers@google.com>
+Date: Thu, 22 Jan 2026 09:58:46 -0800
+Subject: perf inject: With --convert-callchain ignore the dummy event for dwarf stacks
+
+From: Ian Rogers <irogers@google.com>
+
+commit e786a04b4a5461dd7e2829422314a5a6d5a664d9 upstream.
+
+On hybrid systems there is generally >1 event and a dummy event.
+
+The perf inject --convert-callchain option is failing to convert
+perf.data files on such systems reporting "--convert-callchain requires
+DWARF call graph."
+
+The failing event is the dummy event that doesn't need to be set up for
+samples.
+
+As such ignore this event when checking the evsels.
+
+Fixes: 92ea788d2af4e65a ("perf inject: Add --convert-callchain option")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-inject.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/builtin-inject.c
++++ b/tools/perf/builtin-inject.c
+@@ -2862,7 +2862,7 @@ int cmd_inject(int argc, const char **ar
+ }
+
+ evlist__for_each_entry(inject.session->evlist, evsel) {
+- if (!evsel__has_dwarf_callchain(evsel)) {
++ if (!evsel__has_dwarf_callchain(evsel) && !evsel__is_dummy_event(evsel)) {
+ pr_err("--convert-callchain requires DWARF call graph.\n");
+ goto out_delete;
+ }
--- /dev/null
+From 5c5f6fe32df2edb4f72bdca62ec2b9f20b7c5ba4 Mon Sep 17 00:00:00 2001
+From: Ian Rogers <irogers@google.com>
+Date: Sat, 6 Dec 2025 18:23:45 -0800
+Subject: perf symbol: Fix ENOENT case for filename__read_build_id
+
+From: Ian Rogers <irogers@google.com>
+
+commit 5c5f6fe32df2edb4f72bdca62ec2b9f20b7c5ba4 upstream.
+
+Some callers of filename__read_build_id assume the error value must be
+-1, fix by making them handle all < 0 values.
+
+If is_regular_file fails in filename__read_build_id then it could be
+the file is missing (ENOENT) and it would be wrong to return
+-EWOULDBLOCK in that case. Fix the logic so -EWOULDBLOCK is only
+reported if other errors with stat haven't occurred.
+
+Fixes: 834ebb5678d7 ("perf tools: Don't read build-ids from non-regular files")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Reviewed-by: James Clark <james.clark@linaro.org>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-buildid-cache.c | 6 ++++--
+ tools/perf/util/libbfd.c | 4 +++-
+ tools/perf/util/symbol-elf.c | 4 +++-
+ tools/perf/util/symbol-minimal.c | 4 +++-
+ 4 files changed, 13 insertions(+), 5 deletions(-)
+
+--- a/tools/perf/builtin-buildid-cache.c
++++ b/tools/perf/builtin-buildid-cache.c
+@@ -276,12 +276,14 @@ static bool dso__missing_buildid_cache(s
+ {
+ char filename[PATH_MAX];
+ struct build_id bid = { .size = 0, };
++ int err;
+
+ if (!dso__build_id_filename(dso, filename, sizeof(filename), false))
+ return true;
+
+- if (filename__read_build_id(filename, &bid) == -1) {
+- if (errno == ENOENT)
++ err = filename__read_build_id(filename, &bid);
++ if (err < 0) {
++ if (err == -ENOENT)
+ return false;
+
+ pr_warning("Problems with %s file, consider removing it from the cache\n",
+--- a/tools/perf/util/libbfd.c
++++ b/tools/perf/util/libbfd.c
+@@ -426,8 +426,10 @@ int libbfd__read_build_id(const char *fi
+
+ if (!filename)
+ return -EFAULT;
++
++ errno = 0;
+ if (!is_regular_file(filename))
+- return -EWOULDBLOCK;
++ return errno == 0 ? -EWOULDBLOCK : -errno;
+
+ fd = open(filename, O_RDONLY);
+ if (fd < 0)
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -916,8 +916,10 @@ int filename__read_build_id(const char *
+
+ if (!filename)
+ return -EFAULT;
++
++ errno = 0;
+ if (!is_regular_file(filename))
+- return -EWOULDBLOCK;
++ return errno == 0 ? -EWOULDBLOCK : -errno;
+
+ err = kmod_path__parse(&m, filename);
+ if (err)
+--- a/tools/perf/util/symbol-minimal.c
++++ b/tools/perf/util/symbol-minimal.c
+@@ -113,8 +113,10 @@ int filename__read_build_id(const char *
+
+ if (!filename)
+ return -EFAULT;
++
++ errno = 0;
+ if (!is_regular_file(filename))
+- return -EWOULDBLOCK;
++ return errno == 0 ? -EWOULDBLOCK : -errno;
+
+ fd = open(filename, O_RDONLY);
+ if (fd < 0)
--- /dev/null
+From f2bd5a0f59d052d16749bccf637690e51947a5d6 Mon Sep 17 00:00:00 2001
+From: Chukun Pan <amadeus@jmu.edu.cn>
+Date: Sat, 15 Nov 2025 18:00:00 +0800
+Subject: pinctrl: airoha: fix pinctrl function mismatch issue
+
+From: Chukun Pan <amadeus@jmu.edu.cn>
+
+commit f2bd5a0f59d052d16749bccf637690e51947a5d6 upstream.
+
+The blamed commit made the following changes:
+
+-#define PINCTRL_FUNC_DESC(id)...
+- .desc = PINCTRL_PINFUNCTION(#id, ...
++#define PINCTRL_FUNC_DESC(id, table)...
++ .desc = PINCTRL_PINFUNCTION(#id, ...
+
+- PINCTRL_FUNC_DESC(pon)...
++ PINCTRL_FUNC_DESC("pon", pon)...
+
+It's clear that the id of funcs doesn't match the definition.
+Remove redundant #string from the definition to fix this issue:
+pinctrl-airoha ...: invalid function mdio in map table
+
+Fixes: 4043b0c45f85 ("pinctrl: airoha: generalize pins/group/function/confs handling")
+Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
+Acked-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-airoha.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/mediatek/pinctrl-airoha.c
++++ b/drivers/pinctrl/mediatek/pinctrl-airoha.c
+@@ -35,7 +35,7 @@
+
+ #define PINCTRL_FUNC_DESC(id, table) \
+ { \
+- .desc = PINCTRL_PINFUNCTION(#id, table##_groups, \
++ .desc = PINCTRL_PINFUNCTION(id, table##_groups, \
+ ARRAY_SIZE(table##_groups)),\
+ .groups = table##_func_group, \
+ .group_size = ARRAY_SIZE(table##_func_group), \
--- /dev/null
+From 441baa79043431807115fd030d7d0bb14ed441a0 Mon Sep 17 00:00:00 2001
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+Date: Mon, 15 Jun 2026 15:47:47 -0700
+Subject: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+commit 441baa79043431807115fd030d7d0bb14ed441a0 upstream.
+
+Applications can request multiple WC pages for the same ucontext.
+As of now, only 1 WC page per ucontext is supported. Add a lock to
+avoid concurrent access and a check to fail repeated requests.
+Also, if the mmap entry insert fails for the WC, free the Doorbell
+page index mapped for the WC page.
+
+Fixes: eee6268421a2 ("RDMA/bnxt_re: Move the UAPI methods to a dedicated file")
+Fixes: 360da60d6c6e ("RDMA/bnxt_re: Enable low latency push")
+Link: https://patch.msgid.link/r/20260615224751.232802-12-selvin.xavier@broadcom.com
+Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1
+ drivers/infiniband/hw/bnxt_re/ib_verbs.h | 1
+ drivers/infiniband/hw/bnxt_re/uapi.c | 33 +++++++++++++++++++++++++------
+ 3 files changed, 29 insertions(+), 6 deletions(-)
+
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -4356,6 +4356,7 @@ int bnxt_re_alloc_ucontext(struct ib_uco
+ goto fail;
+ }
+ spin_lock_init(&uctx->sh_lock);
++ mutex_init(&uctx->wcdpi_lock);
+
+ resp.comp_mask = BNXT_RE_UCNTX_CMASK_HAVE_CCTX;
+ chip_met_rev_num = rdev->chip_ctx->chip_num;
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
+@@ -142,6 +142,7 @@ struct bnxt_re_ucontext {
+ struct bnxt_re_dev *rdev;
+ struct bnxt_qplib_dpi dpi;
+ struct bnxt_qplib_dpi wcdpi;
++ struct mutex wcdpi_lock; /* serialises WC DPI alloc/free */
+ void *shpg;
+ spinlock_t sh_lock; /* protect shpg */
+ struct rdma_user_mmap_entry *shpage_mmap;
+--- a/drivers/infiniband/hw/bnxt_re/uapi.c
++++ b/drivers/infiniband/hw/bnxt_re/uapi.c
+@@ -98,14 +98,23 @@ static int UVERBS_HANDLER(BNXT_RE_METHOD
+
+ switch (alloc_type) {
+ case BNXT_RE_ALLOC_WC_PAGE:
+- if (cctx->modes.db_push) {
++ if (cctx->modes.db_push) {
++ mutex_lock(&uctx->wcdpi_lock);
++ /* already allocated — one WC page per context */
++ if (uctx->wcdpi.dbr) {
++ mutex_unlock(&uctx->wcdpi_lock);
++ return -EEXIST;
++ }
+ if (bnxt_qplib_alloc_dpi(&rdev->qplib_res, &uctx->wcdpi,
+- uctx, BNXT_QPLIB_DPI_TYPE_WC))
++ uctx, BNXT_QPLIB_DPI_TYPE_WC)) {
++ mutex_unlock(&uctx->wcdpi_lock);
+ return -ENOMEM;
++ }
+ length = PAGE_SIZE;
+ dpi = uctx->wcdpi.dpi;
+ addr = (u64)uctx->wcdpi.umdbr;
+ mmap_flag = BNXT_RE_MMAP_WC_DB;
++ mutex_unlock(&uctx->wcdpi_lock);
+ } else {
+ return -EINVAL;
+ }
+@@ -132,8 +141,15 @@ static int UVERBS_HANDLER(BNXT_RE_METHOD
+ }
+
+ entry = bnxt_re_mmap_entry_insert(uctx, addr, mmap_flag, &mmap_offset);
+- if (!entry)
++ if (!entry) {
++ if (mmap_flag == BNXT_RE_MMAP_WC_DB) {
++ mutex_lock(&uctx->wcdpi_lock);
++ bnxt_qplib_dealloc_dpi(&rdev->qplib_res, &uctx->wcdpi);
++ uctx->wcdpi.dbr = NULL;
++ mutex_unlock(&uctx->wcdpi_lock);
++ }
+ return -ENOMEM;
++ }
+
+ uobj->object = entry;
+ uverbs_finalize_uobj_create(attrs, BNXT_RE_ALLOC_PAGE_HANDLE);
+@@ -164,11 +180,16 @@ static int alloc_page_obj_cleanup(struct
+
+ switch (entry->mmap_flag) {
+ case BNXT_RE_MMAP_WC_DB:
+- if (uctx && uctx->wcdpi.dbr) {
++ if (uctx) {
+ struct bnxt_re_dev *rdev = uctx->rdev;
+
+- bnxt_qplib_dealloc_dpi(&rdev->qplib_res, &uctx->wcdpi);
+- uctx->wcdpi.dbr = NULL;
++ mutex_lock(&uctx->wcdpi_lock);
++ if (uctx->wcdpi.dbr) {
++ bnxt_qplib_dealloc_dpi(&rdev->qplib_res,
++ &uctx->wcdpi);
++ uctx->wcdpi.dbr = NULL;
++ }
++ mutex_unlock(&uctx->wcdpi_lock);
+ }
+ break;
+ case BNXT_RE_MMAP_DBR_BAR:
--- /dev/null
+From 978b27d6ce538bb832ccd69e45802824e4301c4b Mon Sep 17 00:00:00 2001
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+Date: Mon, 15 Jun 2026 15:47:37 -0700
+Subject: RDMA/bnxt_re: Initialize dpi variable to zero
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+commit 978b27d6ce538bb832ccd69e45802824e4301c4b upstream.
+
+dpi is initialized only for BNXT_RE_ALLOC_WC_PAGE, but copied
+for all the cases. So initialize the dpi to 0.
+
+Fixes: eee6268421a2 ("RDMA/bnxt_re: Move the UAPI methods to a dedicated file")
+Fixes: 360da60d6c6e ("RDMA/bnxt_re: Enable low latency push")
+Link: https://patch.msgid.link/r/20260615224751.232802-2-selvin.xavier@broadcom.com
+Reviewed-by: Anantha Prabhu <anantha.prabhu@broadcom.com>
+Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/bnxt_re/uapi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/bnxt_re/uapi.c
++++ b/drivers/infiniband/hw/bnxt_re/uapi.c
+@@ -76,8 +76,8 @@ static int UVERBS_HANDLER(BNXT_RE_METHOD
+ struct ib_ucontext *ib_uctx;
+ struct bnxt_re_dev *rdev;
+ u64 mmap_offset;
++ u32 dpi = 0;
+ u32 length;
+- u32 dpi;
+ u64 addr;
+ int err;
+
--- /dev/null
+From f88a31308db6a856229150039b0f56d59696ed31 Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Fri, 23 Jan 2026 10:37:49 -0800
+Subject: seqlock: fix scoped_seqlock_read kernel-doc
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+commit f88a31308db6a856229150039b0f56d59696ed31 upstream.
+
+Eliminate all kernel-doc warnings in seqlock.h:
+
+- correct the macro to have "()" immediately following the macro name
+- don't include the macro parameters in the short description (first line)
+- make the parameter names in the comments match the actual macro
+ parameter names.
+- use "::" for the Example
+
+WARNING: include/linux/seqlock.h:1341 This comment starts with '/**', but isn't a kernel-doc comment.
+ * scoped_seqlock_read (lock, ss_state) - execute the read side critical
+Documentation/locking/seqlock:242: include/linux/seqlock.h:1351: WARNING:
+ Definition list ends without a blank line; unexpected unindent. [docutils]
+Warning: include/linux/seqlock.h:1357 function parameter '_seqlock' not described in 'scoped_seqlock_read'
+Warning: include/linux/seqlock.h:1357 function parameter '_target' not described in 'scoped_seqlock_read'
+
+Fixes: cc39f3872c08 ("seqlock: Introduce scoped_seqlock_read()")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://patch.msgid.link/20260123183749.3997533-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/seqlock.h | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/include/linux/seqlock.h
++++ b/include/linux/seqlock.h
+@@ -1300,15 +1300,14 @@ __scoped_seqlock_next(struct ss_tmp *sst
+ __scoped_seqlock_next(&_s, _seqlock, _target))
+
+ /**
+- * scoped_seqlock_read (lock, ss_state) - execute the read side critical
+- * section without manual sequence
+- * counter handling or calls to other
+- * helpers
+- * @lock: pointer to seqlock_t protecting the data
+- * @ss_state: one of {ss_lock, ss_lock_irqsave, ss_lockless} indicating
+- * the type of critical read section
++ * scoped_seqlock_read() - execute the read-side critical section
++ * without manual sequence counter handling
++ * or calls to other helpers
++ * @_seqlock: pointer to seqlock_t protecting the data
++ * @_target: an enum ss_state: one of {ss_lock, ss_lock_irqsave, ss_lockless}
++ * indicating the type of critical read section
+ *
+- * Example:
++ * Example::
+ *
+ * scoped_seqlock_read (&lock, ss_lock) {
+ * // read-side critical section
iommufd-propagate-allocation-failure-in-iommufd_veventq_deliver_fetch.patch
iommufd-move-vevent-memory-allocation-outside-spinlock.patch
bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch
+pinctrl-airoha-fix-pinctrl-function-mismatch-issue.patch
+perf-symbol-fix-enoent-case-for-filename__read_build_id.patch
+pci-fix-bar-resize-rollback-path-overwriting-ret.patch
+pci-fix-resizable-bar-restore-order.patch
+perf-inject-with-convert-callchain-ignore-the-dummy-event-for-dwarf-stacks.patch
+seqlock-fix-scoped_seqlock_read-kernel-doc.patch
+perf-callchain-handle-multiple-address-spaces.patch
+ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch
+rdma-bnxt_re-initialize-dpi-variable-to-zero.patch
+rdma-bnxt_re-avoid-repeated-requests-to-allocate-wc-pages.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
