--- /dev/null
+From 47c27c9c9c720bc93fdc69605d0ecd9382e99047 Mon Sep 17 00:00:00 2001
+From: Jaroslav Kysela <perex@perex.cz>
+Date: Wed, 7 Jan 2026 22:36:42 +0100
+Subject: ALSA: pcm: Improve the fix for race of buffer access at PCM OSS layer
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit 47c27c9c9c720bc93fdc69605d0ecd9382e99047 upstream.
+
+Handle the error code from snd_pcm_buffer_access_lock() in
+snd_pcm_runtime_buffer_set_silence() function.
+
+Found by Alexandros Panagiotou <apanagio@redhat.com>
+
+Fixes: 93a81ca06577 ("ALSA: pcm: Fix race of buffer access at PCM OSS layer")
+Cc: stable@vger.kernel.org # 6.15
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://patch.msgid.link/20260107213642.332954-1-perex@perex.cz
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/sound/pcm.h | 2 +-
+ sound/core/oss/pcm_oss.c | 4 +++-
+ sound/core/pcm_native.c | 9 +++++++--
+ 3 files changed, 11 insertions(+), 4 deletions(-)
+
+--- a/include/sound/pcm.h
++++ b/include/sound/pcm.h
+@@ -1429,7 +1429,7 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc
+ #define snd_pcm_lib_mmap_iomem NULL
+ #endif
+
+-void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime);
++int snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime);
+
+ /**
+ * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -1085,7 +1085,9 @@ static int snd_pcm_oss_change_params_loc
+ runtime->oss.params = 0;
+ runtime->oss.prepare = 1;
+ runtime->oss.buffer_used = 0;
+- snd_pcm_runtime_buffer_set_silence(runtime);
++ err = snd_pcm_runtime_buffer_set_silence(runtime);
++ if (err < 0)
++ goto failure;
+
+ runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size);
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -705,13 +705,18 @@ static void snd_pcm_buffer_access_unlock
+ }
+
+ /* fill the PCM buffer with the current silence format; called from pcm_oss.c */
+-void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime)
++int snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime)
+ {
+- snd_pcm_buffer_access_lock(runtime);
++ int err;
++
++ err = snd_pcm_buffer_access_lock(runtime);
++ if (err < 0)
++ return err;
+ if (runtime->dma_area)
+ snd_pcm_format_set_silence(runtime->format, runtime->dma_area,
+ bytes_to_samples(runtime, runtime->dma_bytes));
+ snd_pcm_buffer_access_unlock(runtime);
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence);
+
--- /dev/null
+From e707c591a139d1bfa4ddc83036fc820ca006a140 Mon Sep 17 00:00:00 2001
+From: Ondrej Ille <ondrej.ille@gmail.com>
+Date: Mon, 5 Jan 2026 12:16:20 +0100
+Subject: can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit.
+
+From: Ondrej Ille <ondrej.ille@gmail.com>
+
+commit e707c591a139d1bfa4ddc83036fc820ca006a140 upstream.
+
+The Secondary Sample Point Source field has been
+set to an incorrect value by some mistake in the
+past
+
+ 0b01 - SSP_SRC_NO_SSP - SSP is not used.
+
+for data bitrates above 1 MBit/s. The correct/default
+value already used for lower bitrates is
+
+ 0b00 - SSP_SRC_MEAS_N_OFFSET - SSP position = TRV_DELAY
+ (Measured Transmitter delay) + SSP_OFFSET.
+
+The related configuration register structure is described
+in section 3.1.46 SSP_CFG of the CTU CAN FD
+IP CORE Datasheet.
+
+The analysis leading to the proper configuration
+is described in section 2.8.3 Secondary sampling point
+of the datasheet.
+
+The change has been tested on AMD/Xilinx Zynq
+with the next CTU CN FD IP core versions:
+
+ - 2.6 aka master in the "integration with Zynq-7000 system" test
+ 6.12.43-rt12+ #1 SMP PREEMPT_RT kernel with CTU CAN FD git
+ driver (change already included in the driver repo)
+ - older 2.5 snapshot with mainline kernels with this patch
+ applied locally in the multiple CAN latency tester nightly runs
+ 6.18.0-rc4-rt3-dut #1 SMP PREEMPT_RT
+ 6.19.0-rc3-dut
+
+The logs, the datasheet and sources are available at
+
+ https://canbus.pages.fel.cvut.cz/
+
+Signed-off-by: Ondrej Ille <ondrej.ille@gmail.com>
+Signed-off-by: Pavel Pisa <pisa@fel.cvut.cz>
+Link: https://patch.msgid.link/20260105111620.16580-1-pisa@fel.cvut.cz
+Fixes: 2dcb8e8782d8 ("can: ctucanfd: add support for CTU CAN FD open-source IP core - bus independent part.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/ctucanfd/ctucanfd_base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/ctucanfd/ctucanfd_base.c
++++ b/drivers/net/can/ctucanfd/ctucanfd_base.c
+@@ -310,7 +310,7 @@ static int ctucan_set_secondary_sample_p
+ }
+
+ ssp_cfg = FIELD_PREP(REG_TRV_DELAY_SSP_OFFSET, ssp_offset);
+- ssp_cfg |= FIELD_PREP(REG_TRV_DELAY_SSP_SRC, 0x1);
++ ssp_cfg |= FIELD_PREP(REG_TRV_DELAY_SSP_SRC, 0x0);
+ }
+
+ ctucan_write32(priv, CTUCANFD_TRV_DELAY, ssp_cfg);
--- /dev/null
+From 7352e1d5932a0e777e39fa4b619801191f57e603 Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Tue, 23 Dec 2025 21:21:39 +0100
+Subject: can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit 7352e1d5932a0e777e39fa4b619801191f57e603 upstream.
+
+In gs_can_open(), the URBs for USB-in transfers are allocated, added to the
+parent->rx_submitted anchor and submitted. In the complete callback
+gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In
+gs_can_close() the URBs are freed by calling
+usb_kill_anchored_urbs(parent->rx_submitted).
+
+However, this does not take into account that the USB framework unanchors
+the URB before the complete function is called. This means that once an
+in-URB has been completed, it is no longer anchored and is ultimately not
+released in gs_can_close().
+
+Fix the memory leak by anchoring the URB in the
+gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor.
+
+Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260105-gs_usb-fix-memory-leak-v2-1-cc6ed6438034@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/gs_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -657,6 +657,8 @@ resubmit_urb:
+ hf, parent->hf_size_rx,
+ gs_usb_receive_bulk_callback, parent);
+
++ usb_anchor_urb(urb, &parent->rx_submitted);
++
+ rc = usb_submit_urb(urb, GFP_ATOMIC);
+
+ /* USB failure take down all interfaces */
--- /dev/null
+From d42d5715dcb559342ff356327b241c53a67584d9 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Date: Tue, 23 Dec 2025 20:32:02 +0800
+Subject: EDAC/i3200: Fix a resource leak in i3200_probe1()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+commit d42d5715dcb559342ff356327b241c53a67584d9 upstream.
+
+If edac_mc_alloc() fails, also unmap the window.
+
+ [ bp: Use separate labels, turning it into the classic unwind pattern. ]
+
+Fixes: dd8ef1db87a4 ("edac: i3200 memory controller driver")
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20251223123202.1492038-1-lihaoxiang@isrc.iscas.ac.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/edac/i3200_edac.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/edac/i3200_edac.c
++++ b/drivers/edac/i3200_edac.c
+@@ -358,10 +358,11 @@ static int i3200_probe1(struct pci_dev *
+ layers[1].type = EDAC_MC_LAYER_CHANNEL;
+ layers[1].size = nr_channels;
+ layers[1].is_virt_csrow = false;
+- mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers,
+- sizeof(struct i3200_priv));
++
++ rc = -ENOMEM;
++ mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers, sizeof(struct i3200_priv));
+ if (!mci)
+- return -ENOMEM;
++ goto unmap;
+
+ edac_dbg(3, "MC: init mci\n");
+
+@@ -421,9 +422,9 @@ static int i3200_probe1(struct pci_dev *
+ return 0;
+
+ fail:
++ edac_mc_free(mci);
++unmap:
+ iounmap(window);
+- if (mci)
+- edac_mc_free(mci);
+
+ return rc;
+ }
--- /dev/null
+From 0ff7c44106b4715fc27a2e455d9f57f1dfcfd54f Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Date: Tue, 23 Dec 2025 20:43:50 +0800
+Subject: EDAC/x38: Fix a resource leak in x38_probe1()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+commit 0ff7c44106b4715fc27a2e455d9f57f1dfcfd54f upstream.
+
+If edac_mc_alloc() fails, also unmap the window.
+
+ [ bp: Use separate labels, turning it into the classic unwind pattern. ]
+
+Fixes: df8bc08c192f ("edac x38: new MC driver module")
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20251223124350.1496325-1-lihaoxiang@isrc.iscas.ac.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/edac/x38_edac.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/edac/x38_edac.c
++++ b/drivers/edac/x38_edac.c
+@@ -341,9 +341,12 @@ static int x38_probe1(struct pci_dev *pd
+ layers[1].type = EDAC_MC_LAYER_CHANNEL;
+ layers[1].size = x38_channel_num;
+ layers[1].is_virt_csrow = false;
++
++
++ rc = -ENOMEM;
+ mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers, 0);
+ if (!mci)
+- return -ENOMEM;
++ goto unmap;
+
+ edac_dbg(3, "MC: init mci\n");
+
+@@ -403,9 +406,9 @@ static int x38_probe1(struct pci_dev *pd
+ return 0;
+
+ fail:
++ edac_mc_free(mci);
++unmap:
+ iounmap(window);
+- if (mci)
+- edac_mc_free(mci);
+
+ return rc;
+ }
--- /dev/null
+From d250bdf531d9cd4096fedbb9f172bb2ca660c868 Mon Sep 17 00:00:00 2001
+From: Yang Erkun <yangerkun@huawei.com>
+Date: Sat, 13 Dec 2025 13:57:06 +0800
+Subject: ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
+
+From: Yang Erkun <yangerkun@huawei.com>
+
+commit d250bdf531d9cd4096fedbb9f172bb2ca660c868 upstream.
+
+The error branch for ext4_xattr_inode_update_ref forget to release the
+refcount for iloc.bh. Find this when review code.
+
+Fixes: 57295e835408 ("ext4: guard against EA inode refcount underflow in xattr update")
+Signed-off-by: Yang Erkun <yangerkun@huawei.com>
+Reviewed-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
+Link: https://patch.msgid.link/20251213055706.3417529-1-yangerkun@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/xattr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -984,6 +984,7 @@ static int ext4_xattr_inode_update_ref(h
+ ext4_error_inode(ea_inode, __func__, __LINE__, 0,
+ "EA inode %lu ref wraparound: ref_count=%lld ref_change=%d",
+ ea_inode->i_ino, ref_count, ref_change);
++ brelse(iloc.bh);
+ ret = -EFSCORRUPTED;
+ goto out;
+ }
--- /dev/null
+From 05dc4a9fc8b36d4c99d76bbc02aa9ec0132de4c2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <thomas.weissschuh@linutronix.de>
+Date: Wed, 7 Jan 2026 11:39:24 +0100
+Subject: hrtimer: Fix softirq base check in update_needs_ipi()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+commit 05dc4a9fc8b36d4c99d76bbc02aa9ec0132de4c2 upstream.
+
+The 'clockid' field is not the correct way to check for a softirq base.
+
+Fix the check to correctly compare the base type instead of the clockid.
+
+Fixes: 1e7f7fbcd40c ("hrtimer: Avoid more SMP function calls in clock_was_set()")
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260107-hrtimer-clock-base-check-v1-1-afb5dbce94a1@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/time/hrtimer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -939,7 +939,7 @@ static bool update_needs_ipi(struct hrti
+ return true;
+
+ /* Extra check for softirq clock bases */
+- if (base->clockid < HRTIMER_BASE_MONOTONIC_SOFT)
++ if (base->index < HRTIMER_BASE_MONOTONIC_SOFT)
+ continue;
+ if (cpu_base->softirq_activated)
+ continue;
--- /dev/null
+From a91f86e27087f250a5d9c89bb4a427b9c30fd815 Mon Sep 17 00:00:00 2001
+From: Lisa Robinson <lisa@bytefly.space>
+Date: Sat, 17 Jan 2026 10:56:43 +0800
+Subject: LoongArch: Fix PMU counter allocation for mixed-type event groups
+
+From: Lisa Robinson <lisa@bytefly.space>
+
+commit a91f86e27087f250a5d9c89bb4a427b9c30fd815 upstream.
+
+When validating a perf event group, validate_group() unconditionally
+attempts to allocate hardware PMU counters for the leader, sibling
+events and the new event being added.
+
+This is incorrect for mixed-type groups. If a PERF_TYPE_SOFTWARE event
+is part of the group, the current code still tries to allocate a hardware
+PMU counter for it, which can wrongly consume hardware PMU resources and
+cause spurious allocation failures.
+
+Fix this by only allocating PMU counters for hardware events during group
+validation, and skipping software events.
+
+A trimmed down reproducer is as simple as this:
+
+ #include <stdio.h>
+ #include <assert.h>
+ #include <unistd.h>
+ #include <string.h>
+ #include <sys/syscall.h>
+ #include <linux/perf_event.h>
+
+ int main (int argc, char *argv[])
+ {
+ struct perf_event_attr attr = { 0 };
+ int fds[5];
+
+ attr.disabled = 1;
+ attr.exclude_kernel = 1;
+ attr.exclude_hv = 1;
+ attr.read_format = PERF_FORMAT_TOTAL_TIME_ENABLED |
+ PERF_FORMAT_TOTAL_TIME_RUNNING | PERF_FORMAT_ID | PERF_FORMAT_GROUP;
+ attr.size = sizeof (attr);
+
+ attr.type = PERF_TYPE_SOFTWARE;
+ attr.config = PERF_COUNT_SW_DUMMY;
+ fds[0] = syscall (SYS_perf_event_open, &attr, 0, -1, -1, 0);
+ assert (fds[0] >= 0);
+
+ attr.type = PERF_TYPE_HARDWARE;
+ attr.config = PERF_COUNT_HW_CPU_CYCLES;
+ fds[1] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
+ assert (fds[1] >= 0);
+
+ attr.type = PERF_TYPE_HARDWARE;
+ attr.config = PERF_COUNT_HW_INSTRUCTIONS;
+ fds[2] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
+ assert (fds[2] >= 0);
+
+ attr.type = PERF_TYPE_HARDWARE;
+ attr.config = PERF_COUNT_HW_BRANCH_MISSES;
+ fds[3] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
+ assert (fds[3] >= 0);
+
+ attr.type = PERF_TYPE_HARDWARE;
+ attr.config = PERF_COUNT_HW_CACHE_REFERENCES;
+ fds[4] = syscall (SYS_perf_event_open, &attr, 0, -1, fds[0], 0);
+ assert (fds[4] >= 0);
+
+ printf ("PASSED\n");
+
+ return 0;
+ }
+
+Cc: stable@vger.kernel.org
+Fixes: b37042b2bb7c ("LoongArch: Add perf events support")
+Signed-off-by: Lisa Robinson <lisa@bytefly.space>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kernel/perf_event.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+--- a/arch/loongarch/kernel/perf_event.c
++++ b/arch/loongarch/kernel/perf_event.c
+@@ -637,6 +637,18 @@ static const struct loongarch_perf_event
+ return pev;
+ }
+
++static inline bool loongarch_pmu_event_requires_counter(const struct perf_event *event)
++{
++ switch (event->attr.type) {
++ case PERF_TYPE_HARDWARE:
++ case PERF_TYPE_HW_CACHE:
++ case PERF_TYPE_RAW:
++ return true;
++ default:
++ return false;
++ }
++}
++
+ static int validate_group(struct perf_event *event)
+ {
+ struct cpu_hw_events fake_cpuc;
+@@ -644,15 +656,18 @@ static int validate_group(struct perf_ev
+
+ memset(&fake_cpuc, 0, sizeof(fake_cpuc));
+
+- if (loongarch_pmu_alloc_counter(&fake_cpuc, &leader->hw) < 0)
++ if (loongarch_pmu_event_requires_counter(leader) &&
++ loongarch_pmu_alloc_counter(&fake_cpuc, &leader->hw) < 0)
+ return -EINVAL;
+
+ for_each_sibling_event(sibling, leader) {
+- if (loongarch_pmu_alloc_counter(&fake_cpuc, &sibling->hw) < 0)
++ if (loongarch_pmu_event_requires_counter(sibling) &&
++ loongarch_pmu_alloc_counter(&fake_cpuc, &sibling->hw) < 0)
+ return -EINVAL;
+ }
+
+- if (loongarch_pmu_alloc_counter(&fake_cpuc, &event->hw) < 0)
++ if (loongarch_pmu_event_requires_counter(event) &&
++ loongarch_pmu_alloc_counter(&fake_cpuc, &event->hw) < 0)
+ return -EINVAL;
+
+ return 0;
--- /dev/null
+From 9814cc832b88bd040fc2a1817c2b5469d0f7e862 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Wed, 24 Dec 2025 18:30:35 -0800
+Subject: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
+
+From: SeongJae Park <sj@kernel.org>
+
+commit 9814cc832b88bd040fc2a1817c2b5469d0f7e862 upstream.
+
+When a context DAMON sysfs directory setup is failed after setup of attrs/
+directory, subdirectories of attrs/ directory are not cleaned up. As a
+result, DAMON sysfs interface is nearly broken until the system reboots,
+and the memory for the unremoved directory is leaked.
+
+Cleanup the directories under such failures.
+
+Link: https://lkml.kernel.org/r/20251225023043.18579-3-sj@kernel.org
+Fixes: c951cd3b8901 ("mm/damon: implement a minimal stub for sysfs-based DAMON interface")
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Cc: chongjiapeng <jiapeng.chong@linux.alibaba.com>
+Cc: <stable@vger.kernel.org> # 5.18.x
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/damon/sysfs.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/mm/damon/sysfs.c
++++ b/mm/damon/sysfs.c
+@@ -1772,7 +1772,7 @@ static int damon_sysfs_context_add_dirs(
+
+ err = damon_sysfs_context_set_targets(context);
+ if (err)
+- goto put_attrs_out;
++ goto rmdir_put_attrs_out;
+
+ err = damon_sysfs_context_set_schemes(context);
+ if (err)
+@@ -1782,7 +1782,8 @@ static int damon_sysfs_context_add_dirs(
+ put_targets_attrs_out:
+ kobject_put(&context->targets->kobj);
+ context->targets = NULL;
+-put_attrs_out:
++rmdir_put_attrs_out:
++ damon_sysfs_attrs_rm_dirs(context->attrs);
+ kobject_put(&context->attrs->kobj);
+ context->attrs = NULL;
+ return err;
--- /dev/null
+From b9efe36b5e3eb2e91aa3d706066428648af034fc Mon Sep 17 00:00:00 2001
+From: Aboorva Devarajan <aboorvad@linux.ibm.com>
+Date: Mon, 1 Dec 2025 11:30:09 +0530
+Subject: mm/page_alloc: make percpu_pagelist_high_fraction reads lock-free
+
+From: Aboorva Devarajan <aboorvad@linux.ibm.com>
+
+commit b9efe36b5e3eb2e91aa3d706066428648af034fc upstream.
+
+When page isolation loops indefinitely during memory offline, reading
+/proc/sys/vm/percpu_pagelist_high_fraction blocks on pcp_batch_high_lock,
+causing hung task warnings.
+
+Make procfs reads lock-free since percpu_pagelist_high_fraction is a
+simple integer with naturally atomic reads, writers still serialize via
+the mutex.
+
+This prevents hung task warnings when reading the procfs file during
+long-running memory offline operations.
+
+[akpm@linux-foundation.org: add comment, per Michal]
+ Link: https://lkml.kernel.org/r/aS_y9AuJQFydLEXo@tiehlicka
+Link: https://lkml.kernel.org/r/20251201060009.1420792-1-aboorvad@linux.ibm.com
+Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Brendan Jackman <jackmanb@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Zi Yan <ziy@nvidia.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/page_alloc.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -9067,11 +9067,19 @@ int percpu_pagelist_high_fraction_sysctl
+ int old_percpu_pagelist_high_fraction;
+ int ret;
+
++ /*
++ * Avoid using pcp_batch_high_lock for reads as the value is read
++ * atomically and a race with offlining is harmless.
++ */
++
++ if (!write)
++ return proc_dointvec_minmax(table, write, buffer, length, ppos);
++
+ mutex_lock(&pcp_batch_high_lock);
+ old_percpu_pagelist_high_fraction = percpu_pagelist_high_fraction;
+
+ ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
+- if (!write || ret < 0)
++ if (ret < 0)
+ goto out;
+
+ /* Sanity checking to avoid pcp imbalance */
--- /dev/null
+From 1809c82aa073a11b7d335ae932d81ce51a588a4a Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Wed, 14 Jan 2026 00:28:47 +0900
+Subject: net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+commit 1809c82aa073a11b7d335ae932d81ce51a588a4a upstream.
+
+Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is
+called only when the timer is enabled, we need to call
+j1939_session_deactivate_activate_next() if we cancelled the timer.
+Otherwise, refcount for j1939_session leaks, which will later appear as
+
+| unregister_netdevice: waiting for vcan0 to become free. Usage count = 2.
+
+problem.
+
+Reported-by: syzbot <syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
+Link: https://patch.msgid.link/b1212653-8fa1-44e1-be9d-12f950fb3a07@I-love.SAKURA.ne.jp
+Cc: stable@vger.kernel.org
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/can/j1939/transport.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/net/can/j1939/transport.c
++++ b/net/can/j1939/transport.c
+@@ -1699,8 +1699,16 @@ static int j1939_xtp_rx_rts_session_acti
+
+ j1939_session_timers_cancel(session);
+ j1939_session_cancel(session, J1939_XTP_ABORT_BUSY);
+- if (session->transmission)
++ if (session->transmission) {
+ j1939_session_deactivate_activate_next(session);
++ } else if (session->state == J1939_SESSION_WAITING_ABORT) {
++ /* Force deactivation for the receiver.
++ * If we rely on the timer starting in j1939_session_cancel,
++ * a second RTS call here will cancel that timer and fail
++ * to restart it because the state is already WAITING_ABORT.
++ */
++ j1939_session_deactivate_activate_next(session);
++ }
+
+ return -EBUSY;
+ }
--- /dev/null
+From 340f4fc5508c2905a1f30de229e2a4b299d55735 Mon Sep 17 00:00:00 2001
+From: Ilikara Zheng <ilikara@aosc.io>
+Date: Mon, 8 Dec 2025 21:23:40 +0800
+Subject: nvme-pci: disable secondary temp for Wodposit WPBSNM8
+
+From: Ilikara Zheng <ilikara@aosc.io>
+
+commit 340f4fc5508c2905a1f30de229e2a4b299d55735 upstream.
+
+Secondary temperature thresholds (temp2_{min,max}) were not reported
+properly on this NVMe SSD. This resulted in an error while attempting to
+read these values with sensors(1):
+
+ ERROR: Can't get value of subfeature temp2_min: I/O error
+ ERROR: Can't get value of subfeature temp2_max: I/O error
+
+Add the device to the nvme_id_table with the
+NVME_QUIRK_NO_SECONDARY_TEMP_THRESH flag to suppress access to all non-
+composite temperature thresholds.
+
+Cc: stable@vger.kernel.org
+Tested-by: Wu Haotian <rigoligo03@gmail.com>
+Signed-off-by: Ilikara Zheng <ilikara@aosc.io>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3594,6 +3594,8 @@ static const struct pci_device_id nvme_i
+ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, },
+ { PCI_DEVICE(0x1e49, 0x0041), /* ZHITAI TiPro7000 NVMe SSD */
+ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, },
++ { PCI_DEVICE(0x1fa0, 0x2283), /* Wodposit WPBSNM8-256GTP */
++ .driver_data = NVME_QUIRK_NO_SECONDARY_TEMP_THRESH, },
+ { PCI_DEVICE(0x025e, 0xf1ac), /* SOLIDIGM P44 pro SSDPFKKW020X7 */
+ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, },
+ { PCI_DEVICE(0xc0a9, 0x540a), /* Crucial P2 */
--- /dev/null
+From f2ec4723defbc66a50e0abafa830ae9f8bceb0d7 Mon Sep 17 00:00:00 2001
+From: Rafael Beims <rafael.beims@toradex.com>
+Date: Tue, 23 Dec 2025 12:02:54 -0300
+Subject: phy: freescale: imx8m-pcie: assert phy reset during power on
+
+From: Rafael Beims <rafael.beims@toradex.com>
+
+commit f2ec4723defbc66a50e0abafa830ae9f8bceb0d7 upstream.
+
+After U-Boot initializes PCIe with "pcie enum", Linux fails to detect
+an NVMe disk on some boot cycles with:
+
+ phy phy-32f00000.pcie-phy.0: phy poweron failed --> -110
+
+Discussion with NXP identified that the iMX8MP PCIe PHY PLL may fail to
+lock when re-initialized without a reset cycle [1].
+
+The issue reproduces on 7% of tested hardware platforms, with a 30-40%
+failure rate per affected device across boot cycles.
+
+Insert a reset cycle in the power-on routine to ensure the PHY is
+initialized from a known state.
+
+[1] https://community.nxp.com/t5/i-MX-Processors/iMX8MP-PCIe-initialization-in-U-Boot/m-p/2248437#M242401
+
+Signed-off-by: Rafael Beims <rafael.beims@toradex.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20251223150254.1075221-1-rafael@beims.me
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/freescale/phy-fsl-imx8m-pcie.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/phy/freescale/phy-fsl-imx8m-pcie.c
++++ b/drivers/phy/freescale/phy-fsl-imx8m-pcie.c
+@@ -91,7 +91,8 @@ static int imx8_pcie_phy_power_on(struct
+ writel(imx8_phy->tx_deemph_gen2,
+ imx8_phy->base + PCIE_PHY_TRSV_REG6);
+ break;
+- case IMX8MP: /* Do nothing. */
++ case IMX8MP:
++ reset_control_assert(imx8_phy->reset);
+ break;
+ }
+
--- /dev/null
+From 7d8f725b79e35fa47e42c88716aad8711e1168d8 Mon Sep 17 00:00:00 2001
+From: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Date: Thu, 27 Nov 2025 11:26:17 +0100
+Subject: phy: rockchip: inno-usb2: fix communication disruption in gadget mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luca Ceresoli <luca.ceresoli@bootlin.com>
+
+commit 7d8f725b79e35fa47e42c88716aad8711e1168d8 upstream.
+
+When the OTG USB port is used to power to SoC, configured as peripheral and
+used in gadget mode, communication stops without notice about 6 seconds
+after the gadget is configured and enumerated.
+
+The problem was observed on a Radxa Rock Pi S board, which can only be
+powered by the only USB-C connector. That connector is the only one usable
+in gadget mode. This implies the USB cable is connected from before boot
+and never disconnects while the kernel runs.
+
+The related code flow in the PHY driver code can be summarized as:
+
+ * the first time chg_detect_work starts (6 seconds after gadget is
+ configured and enumerated)
+ -> rockchip_chg_detect_work():
+ if chg_state is UNDEFINED:
+ property_enable(base, &rphy->phy_cfg->chg_det.opmode, false); [Y]
+
+ * rockchip_chg_detect_work() changes state and re-triggers itself a few
+ times until it reaches the DETECTED state:
+ -> rockchip_chg_detect_work():
+ if chg_state is DETECTED:
+ property_enable(base, &rphy->phy_cfg->chg_det.opmode, true); [Z]
+
+At [Y] all existing communications stop. E.g. using a CDC serial gadget,
+the /dev/tty* devices are still present on both host and device, but no
+data is transferred anymore. The later call with a 'true' argument at [Z]
+does not restore it.
+
+Due to the lack of documentation, what chg_det.opmode does exactly is not
+clear, however by code inspection it seems reasonable that is disables
+something needed to keep the communication working, and testing proves that
+disabling these lines lets gadget mode keep working. So prevent changes to
+chg_det.opmode when there is a cable connected (VBUS present).
+
+Fixes: 98898f3bc83c ("phy: rockchip-inno-usb2: support otg-port for rk3399")
+Cc: stable@vger.kernel.org
+Closes: https://lore.kernel.org/lkml/20250414185458.7767aabc@booty/
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Link: https://patch.msgid.link/20251127-rk3308-fix-usb-gadget-phy-disconnect-v2-2-dac8a02cd2ca@bootlin.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
++++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
+@@ -717,7 +717,8 @@ static void rockchip_chg_detect_work(str
+ if (!rport->suspended)
+ rockchip_usb2phy_power_off(rport->phy);
+ /* put the controller in non-driving mode */
+- property_enable(base, &rphy->phy_cfg->chg_det.opmode, false);
++ if (!vbus_attach)
++ property_enable(base, &rphy->phy_cfg->chg_det.opmode, false);
+ /* Start DCD processing stage 1 */
+ rockchip_chg_enable_dcd(rphy, true);
+ rphy->chg_state = USB_CHG_STATE_WAIT_FOR_DCD;
+@@ -780,7 +781,8 @@ static void rockchip_chg_detect_work(str
+ fallthrough;
+ case USB_CHG_STATE_DETECTED:
+ /* put the controller in normal mode */
+- property_enable(base, &rphy->phy_cfg->chg_det.opmode, true);
++ if (!vbus_attach)
++ property_enable(base, &rphy->phy_cfg->chg_det.opmode, true);
+ rockchip_usb2phy_otg_sm_work(&rport->otg_sm_work.work);
+ dev_dbg(&rport->phy->dev, "charger = %s\n",
+ chg_to_string(rphy->chg_type));
--- /dev/null
+From 028e8ca7b20fb7324f3e5db34ba8bd366d9d3acc Mon Sep 17 00:00:00 2001
+From: Louis Chauvet <louis.chauvet@bootlin.com>
+Date: Thu, 27 Nov 2025 11:26:16 +0100
+Subject: phy: rockchip: inno-usb2: fix disconnection in gadget mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Louis Chauvet <louis.chauvet@bootlin.com>
+
+commit 028e8ca7b20fb7324f3e5db34ba8bd366d9d3acc upstream.
+
+When the OTG USB port is used to power the SoC, configured as peripheral
+and used in gadget mode, there is a disconnection about 6 seconds after the
+gadget is configured and enumerated.
+
+The problem was observed on a Radxa Rock Pi S board, which can only be
+powered by the only USB-C connector. That connector is the only one usable
+in gadget mode. This implies the USB cable is connected from before boot
+and never disconnects while the kernel runs.
+
+The problem happens because of the PHY driver code flow, summarized as:
+
+ * UDC start code (triggered via configfs at any time after boot)
+ -> phy_init
+ -> rockchip_usb2phy_init
+ -> schedule_delayed_work(otg_sm_work [A], 6 sec)
+ -> phy_power_on
+ -> rockchip_usb2phy_power_on
+ -> enable clock
+ -> rockchip_usb2phy_reset
+
+ * Now the gadget interface is up and running.
+
+ * 6 seconds later otg_sm_work starts [A]
+ -> rockchip_usb2phy_otg_sm_work():
+ if (B_IDLE state && VBUS present && ...):
+ schedule_delayed_work(&rport->chg_work [B], 0);
+
+ * immediately the chg_detect_work starts [B]
+ -> rockchip_chg_detect_work():
+ if chg_state is UNDEFINED:
+ if (!rport->suspended):
+ rockchip_usb2phy_power_off() <--- [X]
+
+At [X], the PHY is powered off, causing a disconnection. This quickly
+triggers a new connection and following re-enumeration, but any connection
+that had been established during the 6 seconds is broken.
+
+The code already checks for !rport->suspended (which, somewhat
+counter-intuitively, means the PHY is powered on), so add a guard for VBUS
+as well to avoid a disconnection when a cable is connected.
+
+Fixes: 98898f3bc83c ("phy: rockchip-inno-usb2: support otg-port for rk3399")
+Cc: stable@vger.kernel.org
+Closes: https://lore.kernel.org/lkml/20250414185458.7767aabc@booty/
+Signed-off-by: Louis Chauvet <louis.chauvet@bootlin.com>
+Co-developed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Link: https://patch.msgid.link/20251127-rk3308-fix-usb-gadget-phy-disconnect-v2-1-dac8a02cd2ca@bootlin.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
++++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
+@@ -707,14 +707,16 @@ static void rockchip_chg_detect_work(str
+ container_of(work, struct rockchip_usb2phy_port, chg_work.work);
+ struct rockchip_usb2phy *rphy = dev_get_drvdata(rport->phy->dev.parent);
+ struct regmap *base = get_reg_base(rphy);
+- bool is_dcd, tmout, vout;
++ bool is_dcd, tmout, vout, vbus_attach;
+ unsigned long delay;
+
++ vbus_attach = property_enabled(rphy->grf, &rport->port_cfg->utmi_bvalid);
++
+ dev_dbg(&rport->phy->dev, "chg detection work state = %d\n",
+ rphy->chg_state);
+ switch (rphy->chg_state) {
+ case USB_CHG_STATE_UNDEFINED:
+- if (!rport->suspended)
++ if (!rport->suspended && !vbus_attach)
+ rockchip_usb2phy_power_off(rport->phy);
+ /* put the controller in non-driving mode */
+ if (!vbus_attach)
--- /dev/null
+From b246caa68037aa495390a60d080acaeb84f45fff Mon Sep 17 00:00:00 2001
+From: Wayne Chang <waynec@nvidia.com>
+Date: Fri, 12 Dec 2025 11:21:16 +0800
+Subject: phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7
+
+From: Wayne Chang <waynec@nvidia.com>
+
+commit b246caa68037aa495390a60d080acaeb84f45fff upstream.
+
+The USB2 Bias Pad Control register manages analog parameters for signal
+detection. Previously, the HS_DISCON_LEVEL relied on hardware reset
+values, which may lead to the detection failure.
+
+Explicitly configure HS_DISCON_LEVEL to 0x7. This ensures the disconnect
+threshold is sufficient to guarantee reliable detection.
+
+Fixes: bbf711682cd5 ("phy: tegra: xusb: Add Tegra186 support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Wayne Chang <waynec@nvidia.com>
+Link: https://patch.msgid.link/20251212032116.768307-1-waynec@nvidia.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/tegra/xusb-tegra186.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/phy/tegra/xusb-tegra186.c
++++ b/drivers/phy/tegra/xusb-tegra186.c
+@@ -84,6 +84,7 @@
+ #define XUSB_PADCTL_USB2_BIAS_PAD_CTL0 0x284
+ #define BIAS_PAD_PD BIT(11)
+ #define HS_SQUELCH_LEVEL(x) (((x) & 0x7) << 0)
++#define HS_DISCON_LEVEL(x) (((x) & 0x7) << 3)
+
+ #define XUSB_PADCTL_USB2_BIAS_PAD_CTL1 0x288
+ #define USB2_TRK_START_TIMER(x) (((x) & 0x7f) << 12)
+@@ -601,6 +602,8 @@ static void tegra186_utmi_bias_pad_power
+ value &= ~BIAS_PAD_PD;
+ value &= ~HS_SQUELCH_LEVEL(~0);
+ value |= HS_SQUELCH_LEVEL(priv->calib.hs_squelch);
++ value &= ~HS_DISCON_LEVEL(~0);
++ value |= HS_DISCON_LEVEL(0x7);
+ padctl_writel(padctl, value, XUSB_PADCTL_USB2_BIAS_PAD_CTL0);
+
+ udelay(1);
--- /dev/null
+From 9a49157deeb23581fc5c8189b486340d7343264a Mon Sep 17 00:00:00 2001
+From: Brian Kao <powenkao@google.com>
+Date: Thu, 18 Dec 2025 03:17:23 +0000
+Subject: scsi: core: Fix error handler encryption support
+
+From: Brian Kao <powenkao@google.com>
+
+commit 9a49157deeb23581fc5c8189b486340d7343264a upstream.
+
+Some low-level drivers (LLD) access block layer crypto fields, such as
+rq->crypt_keyslot and rq->crypt_ctx within `struct request`, to
+configure hardware for inline encryption. However, SCSI Error Handling
+(EH) commands (e.g., TEST UNIT READY, START STOP UNIT) should not
+involve any encryption setup.
+
+To prevent drivers from erroneously applying crypto settings during EH,
+this patch saves the original values of rq->crypt_keyslot and
+rq->crypt_ctx before an EH command is prepared via scsi_eh_prep_cmnd().
+These fields in the 'struct request' are then set to NULL. The original
+values are restored in scsi_eh_restore_cmnd() after the EH command
+completes.
+
+This ensures that the block layer crypto context does not leak into EH
+command execution.
+
+Signed-off-by: Brian Kao <powenkao@google.com>
+Link: https://patch.msgid.link/20251218031726.2642834-1-powenkao@google.com
+Cc: stable@vger.kernel.org
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/scsi_error.c | 24 ++++++++++++++++++++++++
+ include/scsi/scsi_eh.h | 6 ++++++
+ 2 files changed, 30 insertions(+)
+
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -995,6 +995,9 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd
+ unsigned char *cmnd, int cmnd_size, unsigned sense_bytes)
+ {
+ struct scsi_device *sdev = scmd->device;
++#ifdef CONFIG_BLK_INLINE_ENCRYPTION
++ struct request *rq = scsi_cmd_to_rq(scmd);
++#endif
+
+ /*
+ * We need saved copies of a number of fields - this is because
+@@ -1047,6 +1050,18 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd
+ (sdev->lun << 5 & 0xe0);
+
+ /*
++ * Encryption must be disabled for the commands submitted by the error handler.
++ * Hence, clear the encryption context information.
++ */
++#ifdef CONFIG_BLK_INLINE_ENCRYPTION
++ ses->rq_crypt_keyslot = rq->crypt_keyslot;
++ ses->rq_crypt_ctx = rq->crypt_ctx;
++
++ rq->crypt_keyslot = NULL;
++ rq->crypt_ctx = NULL;
++#endif
++
++ /*
+ * Zero the sense buffer. The scsi spec mandates that any
+ * untransferred sense data should be interpreted as being zero.
+ */
+@@ -1063,6 +1078,10 @@ EXPORT_SYMBOL(scsi_eh_prep_cmnd);
+ */
+ void scsi_eh_restore_cmnd(struct scsi_cmnd* scmd, struct scsi_eh_save *ses)
+ {
++#ifdef CONFIG_BLK_INLINE_ENCRYPTION
++ struct request *rq = scsi_cmd_to_rq(scmd);
++#endif
++
+ /*
+ * Restore original data
+ */
+@@ -1075,6 +1094,11 @@ void scsi_eh_restore_cmnd(struct scsi_cm
+ scmd->underflow = ses->underflow;
+ scmd->prot_op = ses->prot_op;
+ scmd->eh_eflags = ses->eh_eflags;
++
++#ifdef CONFIG_BLK_INLINE_ENCRYPTION
++ rq->crypt_keyslot = ses->rq_crypt_keyslot;
++ rq->crypt_ctx = ses->rq_crypt_ctx;
++#endif
+ }
+ EXPORT_SYMBOL(scsi_eh_restore_cmnd);
+
+--- a/include/scsi/scsi_eh.h
++++ b/include/scsi/scsi_eh.h
+@@ -41,6 +41,12 @@ struct scsi_eh_save {
+ unsigned char cmnd[32];
+ struct scsi_data_buffer sdb;
+ struct scatterlist sense_sgl;
++
++ /* struct request fields */
++#ifdef CONFIG_BLK_INLINE_ENCRYPTION
++ struct bio_crypt_ctx *rq_crypt_ctx;
++ struct blk_crypto_keyslot *rq_crypt_keyslot;
++#endif
+ };
+
+ extern void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd,
phy-broadcom-ns-usb3-fix-wvoid-pointer-to-enum-cast-.patch
dmaengine-omap-dma-fix-dma_pool-resource-leak-in-err.patch
hid-usbhid-paper-over-wrong-bnumdescriptor-field.patch
+scsi-core-fix-error-handler-encryption-support.patch
+alsa-pcm-improve-the-fix-for-race-of-buffer-access-at-pcm-oss-layer.patch
+can-gs_usb-gs_usb_receive_bulk_callback-fix-urb-memory-leak.patch
+can-ctucanfd-fix-ssp_src-in-cases-when-bit-rate-is-higher-than-1-mbit.patch
+net-can-j1939-j1939_xtp_rx_rts_session_active-deactivate-session-upon-receiving-the-second-rts.patch
+x86-kaslr-recognize-all-zone_device-users-as-physaddr-consumers.patch
+phy-rockchip-inno-usb2-fix-communication-disruption-in-gadget-mode.patch
+phy-freescale-imx8m-pcie-assert-phy-reset-during-power-on.patch
+phy-rockchip-inno-usb2-fix-disconnection-in-gadget-mode.patch
+phy-tegra-xusb-explicitly-configure-hs_discon_level-to-0x7.patch
+usb-dwc3-check-for-usb4-ip_name.patch
+usb-core-add-usb_quirk_no_bos-for-devices-that-hang-on-bos-descriptor.patch
+usb-ohci-uhci-add-soft-dependencies-on-ehci_platform.patch
+usb-serial-option-add-telit-le910-mbim-composition.patch
+usb-serial-ftdi_sio-add-support-for-picaxe-axe027-cable.patch
+nvme-pci-disable-secondary-temp-for-wodposit-wpbsnm8.patch
+ext4-fix-iloc.bh-leak-in-ext4_xattr_inode_update_ref.patch
+hrtimer-fix-softirq-base-check-in-update_needs_ipi.patch
+edac-x38-fix-a-resource-leak-in-x38_probe1.patch
+edac-i3200-fix-a-resource-leak-in-i3200_probe1.patch
+x86-resctrl-add-missing-resctrl-initialization-for-hygon.patch
+x86-resctrl-fix-memory-bandwidth-counter-width-for-hygon.patch
+mm-page_alloc-make-percpu_pagelist_high_fraction-reads-lock-free.patch
+mm-damon-sysfs-cleanup-attrs-subdirs-on-context-dir-setup-failure.patch
+loongarch-fix-pmu-counter-allocation-for-mixed-type-event-groups.patch
--- /dev/null
+From 2740ac33c87b3d0dfa022efd6ba04c6261b1abbd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Johannes=20Br=C3=BCderl?= <johannes.bruederl@gmail.com>
+Date: Sun, 7 Dec 2025 10:02:20 +0100
+Subject: usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Johannes Brüderl <johannes.bruederl@gmail.com>
+
+commit 2740ac33c87b3d0dfa022efd6ba04c6261b1abbd upstream.
+
+Add USB_QUIRK_NO_BOS quirk flag to skip requesting the BOS descriptor
+for devices that cannot handle it.
+
+Add Elgato 4K X (0fd9:009b) to the quirk table. This device hangs when
+the BOS descriptor is requested at SuperSpeed Plus (10Gbps).
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=220027
+Cc: stable <stable@kernel.org>
+Signed-off-by: Johannes Brüderl <johannes.bruederl@gmail.com>
+Link: https://patch.msgid.link/20251207090220.14807-1-johannes.bruederl@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/config.c | 5 +++++
+ drivers/usb/core/quirks.c | 3 +++
+ include/linux/usb/quirks.h | 3 +++
+ 3 files changed, 11 insertions(+)
+
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -1004,6 +1004,11 @@ int usb_get_bos_descriptor(struct usb_de
+ __u8 cap_type;
+ int ret;
+
++ if (dev->quirks & USB_QUIRK_NO_BOS) {
++ dev_dbg(ddev, "skipping BOS descriptor\n");
++ return -ENOMSG;
++ }
++
+ bos = kzalloc(sizeof(*bos), GFP_KERNEL);
+ if (!bos)
+ return -ENOMEM;
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -447,6 +447,9 @@ static const struct usb_device_id usb_qu
+ { USB_DEVICE(0x0c45, 0x7056), .driver_info =
+ USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+
++ /* Elgato 4K X - BOS descriptor fetch hangs at SuperSpeed Plus */
++ { USB_DEVICE(0x0fd9, 0x009b), .driver_info = USB_QUIRK_NO_BOS },
++
+ /* Sony Xperia XZ1 Compact (lilac) smartphone in fastboot mode */
+ { USB_DEVICE(0x0fce, 0x0dde), .driver_info = USB_QUIRK_NO_LPM },
+
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -75,4 +75,7 @@
+ /* short SET_ADDRESS request timeout */
+ #define USB_QUIRK_SHORT_SET_ADDRESS_REQ_TIMEOUT BIT(16)
+
++/* skip BOS descriptor request */
++#define USB_QUIRK_NO_BOS BIT(17)
++
+ #endif /* __LINUX_USB_QUIRKS_H */
--- /dev/null
+From 0ed91d47959cb7573c17e06487f0fb891d59dfb3 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Fri, 2 Jan 2026 21:53:46 +0000
+Subject: usb: dwc3: Check for USB4 IP_NAME
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit 0ed91d47959cb7573c17e06487f0fb891d59dfb3 upstream.
+
+Synopsys renamed DWC_usb32 IP to DWC_usb4 as of IP version 1.30. No
+functional change except checking for the IP_NAME here. The driver will
+treat the new IP_NAME as if it's DWC_usb32. Additional features for USB4
+will be introduced and checked separately.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://patch.msgid.link/e6f1827754c7a7ddc5eb7382add20bfe3a9b312f.1767390747.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.c | 2 ++
+ drivers/usb/dwc3/core.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -905,6 +905,8 @@ static bool dwc3_core_is_valid(struct dw
+
+ reg = dwc3_readl(dwc->regs, DWC3_GSNPSID);
+ dwc->ip = DWC3_GSNPS_ID(reg);
++ if (dwc->ip == DWC4_IP)
++ dwc->ip = DWC32_IP;
+
+ /* This should read as U3 followed by revision number */
+ if (DWC3_IP_IS(DWC3)) {
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -1211,6 +1211,7 @@ struct dwc3 {
+ #define DWC3_IP 0x5533
+ #define DWC31_IP 0x3331
+ #define DWC32_IP 0x3332
++#define DWC4_IP 0x3430
+
+ u32 revision;
+
--- /dev/null
+From 01ef7f1b8713a78ab1a9512cf8096d2474c70633 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhuacai@loongson.cn>
+Date: Mon, 12 Jan 2026 16:48:02 +0800
+Subject: USB: OHCI/UHCI: Add soft dependencies on ehci_platform
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+commit 01ef7f1b8713a78ab1a9512cf8096d2474c70633 upstream.
+
+Commit 9beeee6584b9aa4f ("USB: EHCI: log a warning if ehci-hcd is not
+loaded first") said that ehci-hcd should be loaded before ohci-hcd and
+uhci-hcd. However, commit 05c92da0c52494ca ("usb: ohci/uhci - add soft
+dependencies on ehci_pci") only makes ohci-pci/uhci-pci depend on ehci-
+pci, which is not enough and we may still see the warnings in boot log.
+
+To eliminate the warnings we should make ohci-hcd/uhci-hcd depend on
+ehci-hcd. But Alan said that the warning introduced by 9beeee6584b9aa4f
+is bogus, we only need the soft dependencies in the PCI level rather
+than the HCD level.
+
+However, there is really another neccessary soft dependencies between
+ohci-platform/uhci-platform and ehci-platform, which is added by this
+patch. The boot logs are below.
+
+1. ohci-platform loaded before ehci-platform:
+
+ ohci-platform 1f058000.usb: Generic Platform OHCI controller
+ ohci-platform 1f058000.usb: new USB bus registered, assigned bus number 1
+ ohci-platform 1f058000.usb: irq 28, io mem 0x1f058000
+ hub 1-0:1.0: USB hub found
+ hub 1-0:1.0: 4 ports detected
+ Warning! ehci_hcd should always be loaded before uhci_hcd and ohci_hcd, not after
+ usb 1-4: new low-speed USB device number 2 using ohci-platform
+ ehci-platform 1f050000.usb: EHCI Host Controller
+ ehci-platform 1f050000.usb: new USB bus registered, assigned bus number 2
+ ehci-platform 1f050000.usb: irq 29, io mem 0x1f050000
+ ehci-platform 1f050000.usb: USB 2.0 started, EHCI 1.00
+ usb 1-4: device descriptor read/all, error -62
+ hub 2-0:1.0: USB hub found
+ hub 2-0:1.0: 4 ports detected
+ usb 1-4: new low-speed USB device number 3 using ohci-platform
+ input: YSPRINGTECH USB OPTICAL MOUSE as /devices/platform/bus@10000000/1f058000.usb/usb1/1-4/1-4:1.0/0003:10C4:8105.0001/input/input0
+ hid-generic 0003:10C4:8105.0001: input,hidraw0: USB HID v1.11 Mouse [YSPRINGTECH USB OPTICAL MOUSE] on usb-1f058000.usb-4/input0
+
+2. ehci-platform loaded before ohci-platform:
+
+ ehci-platform 1f050000.usb: EHCI Host Controller
+ ehci-platform 1f050000.usb: new USB bus registered, assigned bus number 1
+ ehci-platform 1f050000.usb: irq 28, io mem 0x1f050000
+ ehci-platform 1f050000.usb: USB 2.0 started, EHCI 1.00
+ hub 1-0:1.0: USB hub found
+ hub 1-0:1.0: 4 ports detected
+ ohci-platform 1f058000.usb: Generic Platform OHCI controller
+ ohci-platform 1f058000.usb: new USB bus registered, assigned bus number 2
+ ohci-platform 1f058000.usb: irq 29, io mem 0x1f058000
+ hub 2-0:1.0: USB hub found
+ hub 2-0:1.0: 4 ports detected
+ usb 2-4: new low-speed USB device number 2 using ohci-platform
+ input: YSPRINGTECH USB OPTICAL MOUSE as /devices/platform/bus@10000000/1f058000.usb/usb2/2-4/2-4:1.0/0003:10C4:8105.0001/input/input0
+ hid-generic 0003:10C4:8105.0001: input,hidraw0: USB HID v1.11 Mouse [YSPRINGTECH USB OPTICAL MOUSE] on usb-1f058000.usb-4/input0
+
+In the later case, there is no re-connection for USB-1.0/1.1 devices,
+which is expected.
+
+Cc: stable <stable@kernel.org>
+Reported-by: Shengwen Xiao <atzlinux@sina.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://patch.msgid.link/20260112084802.1995923-1-chenhuacai@loongson.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/ohci-platform.c | 1 +
+ drivers/usb/host/uhci-platform.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/usb/host/ohci-platform.c
++++ b/drivers/usb/host/ohci-platform.c
+@@ -379,3 +379,4 @@ MODULE_DESCRIPTION(DRIVER_DESC);
+ MODULE_AUTHOR("Hauke Mehrtens");
+ MODULE_AUTHOR("Alan Stern");
+ MODULE_LICENSE("GPL");
++MODULE_SOFTDEP("pre: ehci_platform");
+--- a/drivers/usb/host/uhci-platform.c
++++ b/drivers/usb/host/uhci-platform.c
+@@ -194,3 +194,4 @@ static struct platform_driver uhci_platf
+ .of_match_table = platform_uhci_ids,
+ },
+ };
++MODULE_SOFTDEP("pre: ehci_platform");
--- /dev/null
+From c0afe95e62984ceea171c3ea319beaf84a21181c Mon Sep 17 00:00:00 2001
+From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+Date: Wed, 10 Dec 2025 18:01:17 -0800
+Subject: USB: serial: ftdi_sio: add support for PICAXE AXE027 cable
+
+From: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+
+commit c0afe95e62984ceea171c3ea319beaf84a21181c upstream.
+
+The vendor provides instructions to write "0403 bd90" to
+/sys/bus/usb-serial/drivers/ftdi_sio/new_id; see:
+https://picaxe.com/docs/picaxe_linux_instructions.pdf
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 2 ++
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -850,6 +850,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID, 1) },
+ { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID, 1) },
+ { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID, 1) },
++ { USB_DEVICE(FTDI_VID, FTDI_AXE027_PID) },
+ { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TURTELIZER_PID, 1) },
+ { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
+ { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -96,6 +96,8 @@
+ #define LMI_LM3S_EVAL_BOARD_PID 0xbcd9
+ #define LMI_LM3S_ICDI_BOARD_PID 0xbcda
+
++#define FTDI_AXE027_PID 0xBD90 /* PICAXE AXE027 USB download cable */
++
+ #define FTDI_TURTELIZER_PID 0xBDC8 /* JTAG/RS-232 adapter by egnite GmbH */
+
+ /* OpenDCC (www.opendcc.de) product id */
--- /dev/null
+From 8af4274ab5999831f4757dfd5bd11665ba3b1569 Mon Sep 17 00:00:00 2001
+From: Ulrich Mohr <u.mohr@semex-engcon.com>
+Date: Tue, 9 Dec 2025 21:08:41 +0100
+Subject: USB: serial: option: add Telit LE910 MBIM composition
+
+From: Ulrich Mohr <u.mohr@semex-engcon.com>
+
+commit 8af4274ab5999831f4757dfd5bd11665ba3b1569 upstream.
+
+Add support for Telit LE910 module when operating in MBIM composition
+with additional ttys. This USB product ID is used by the module
+when AT#USBCFG is set to 7.
+
+0x1252: MBIM + tty(NMEA) + tty(MODEM) + tty(MODEM) + SAP
+
+T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=1252 Rev=03.18
+S: Manufacturer=Android
+S: Product=LE910C1-EU
+S: SerialNumber=0123456789ABCDEF
+C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+
+Signed-off-by: Ulrich Mohr <u.mohr@semex-engcon.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1505,6 +1505,7 @@ static const struct usb_device_id option
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */
+ .driver_info = NCTRL(2) | RSVD(3) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x1250, 0xff, 0x00, 0x00) }, /* Telit LE910Cx (rmnet) */
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1252, 0xff) }, /* Telit LE910Cx (MBIM) */
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x1260),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
--- /dev/null
+From 269031b15c1433ff39e30fa7ea3ab8f0be9d6ae2 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Thu, 6 Nov 2025 15:13:50 -0800
+Subject: x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 269031b15c1433ff39e30fa7ea3ab8f0be9d6ae2 upstream.
+
+Commit 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems")
+is too narrow. The effect being mitigated in that commit is caused by
+ZONE_DEVICE which PCI_P2PDMA has a dependency. ZONE_DEVICE, in general,
+lets any physical address be added to the direct-map. I.e. not only ACPI
+hotplug ranges, CXL Memory Windows, or EFI Specific Purpose Memory, but
+also any PCI MMIO range for the DEVICE_PRIVATE and PCI_P2PDMA cases. Update
+the mitigation, limit KASLR entropy, to apply in all ZONE_DEVICE=y cases.
+
+Distro kernels typically have PCI_P2PDMA=y, so the practical exposure of
+this problem is limited to the PCI_P2PDMA=n case.
+
+A potential path to recover entropy would be to walk ACPI and determine the
+limits for hotplug and PCI MMIO before kernel_randomize_memory(). On
+smaller systems that could yield some KASLR address bits. This needs
+additional investigation to determine if some limited ACPI table scanning
+can happen this early without an open coded solution like
+arch/x86/boot/compressed/acpi.c needs to deploy.
+
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Kees Cook <kees@kernel.org>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Logan Gunthorpe <logang@deltatee.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
+Cc: "Liam R. Howlett" <Liam.Howlett@oracle.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Fixes: 7ffb791423c7 ("x86/kaslr: Reduce KASLR entropy on most x86 systems")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Balbir Singh <balbirs@nvidia.com>
+Tested-by: Yasunori Goto <y-goto@fujitsu.com>
+Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
+Link: http://patch.msgid.link/692e08b2516d4_261c1100a3@dwillia2-mobl4.notmuch
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/mm/kaslr.c | 10 +++++-----
+ drivers/pci/Kconfig | 6 ------
+ mm/Kconfig | 10 +++++++---
+ 3 files changed, 12 insertions(+), 14 deletions(-)
+
+--- a/arch/x86/mm/kaslr.c
++++ b/arch/x86/mm/kaslr.c
+@@ -111,12 +111,12 @@ void __init kernel_randomize_memory(void
+
+ /*
+ * Adapt physical memory region size based on available memory,
+- * except when CONFIG_PCI_P2PDMA is enabled. P2PDMA exposes the
+- * device BAR space assuming the direct map space is large enough
+- * for creating a ZONE_DEVICE mapping in the direct map corresponding
+- * to the physical BAR address.
++ * except when CONFIG_ZONE_DEVICE is enabled. ZONE_DEVICE wants to map
++ * any physical address into the direct-map. KASLR wants to reliably
++ * steal some physical address bits. Those design choices are in direct
++ * conflict.
+ */
+- if (!IS_ENABLED(CONFIG_PCI_P2PDMA) && (memory_tb < kaslr_regions[0].size_tb))
++ if (!IS_ENABLED(CONFIG_ZONE_DEVICE) && (memory_tb < kaslr_regions[0].size_tb))
+ kaslr_regions[0].size_tb = memory_tb;
+
+ /*
+--- a/drivers/pci/Kconfig
++++ b/drivers/pci/Kconfig
+@@ -184,12 +184,6 @@ config PCI_P2PDMA
+ P2P DMA transactions must be between devices behind the same root
+ port.
+
+- Enabling this option will reduce the entropy of x86 KASLR memory
+- regions. For example - on a 46 bit system, the entropy goes down
+- from 16 bits to 15 bits. The actual reduction in entropy depends
+- on the physical address bits, on processor features, kernel config
+- (5 level page table) and physical memory present on the system.
+-
+ If unsure, say N.
+
+ config PCI_LABEL
+--- a/mm/Kconfig
++++ b/mm/Kconfig
+@@ -994,10 +994,14 @@ config ZONE_DEVICE
+ Device memory hotplug support allows for establishing pmem,
+ or other device driver discovered memory regions, in the
+ memmap. This allows pfn_to_page() lookups of otherwise
+- "device-physical" addresses which is needed for using a DAX
+- mapping in an O_DIRECT operation, among other things.
++ "device-physical" addresses which is needed for DAX, PCI_P2PDMA, and
++ DEVICE_PRIVATE features among others.
+
+- If FS_DAX is enabled, then say Y.
++ Enabling this option will reduce the entropy of x86 KASLR memory
++ regions. For example - on a 46 bit system, the entropy goes down
++ from 16 bits to 15 bits. The actual reduction in entropy depends
++ on the physical address bits, on processor features, kernel config
++ (5 level page table) and physical memory present on the system.
+
+ #
+ # Helpers to mirror range of the CPU page tables of a process into device page
--- /dev/null
+From 6ee98aabdc700b5705e4f1833e2edc82a826b53b Mon Sep 17 00:00:00 2001
+From: Xiaochen Shen <shenxiaochen@open-hieco.net>
+Date: Tue, 9 Dec 2025 14:26:49 +0800
+Subject: x86/resctrl: Add missing resctrl initialization for Hygon
+
+From: Xiaochen Shen <shenxiaochen@open-hieco.net>
+
+commit 6ee98aabdc700b5705e4f1833e2edc82a826b53b upstream.
+
+Hygon CPUs supporting Platform QoS features currently undergo partial resctrl
+initialization through resctrl_cpu_detect() in the Hygon BSP init helper and
+AMD/Hygon common initialization code. However, several critical data
+structures remain uninitialized for Hygon CPUs in the following paths:
+
+ - get_mem_config()-> __rdt_get_mem_config_amd():
+ rdt_resource::membw,alloc_capable
+ hw_res::num_closid
+
+ - rdt_init_res_defs()->rdt_init_res_defs_amd():
+ rdt_resource::cache
+ hw_res::msr_base,msr_update
+
+Add the missing AMD/Hygon common initialization to ensure proper Platform QoS
+functionality on Hygon CPUs.
+
+Fixes: d8df126349da ("x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper")
+Signed-off-by: Xiaochen Shen <shenxiaochen@open-hieco.net>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20251209062650.1536952-2-shenxiaochen@open-hieco.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/resctrl/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/resctrl/core.c
++++ b/arch/x86/kernel/cpu/resctrl/core.c
+@@ -728,7 +728,8 @@ static __init bool get_mem_config(void)
+
+ if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL)
+ return __get_mem_config_intel(&hw_res->r_resctrl);
+- else if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
++ else if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD ||
++ boot_cpu_data.x86_vendor == X86_VENDOR_HYGON)
+ return __rdt_get_mem_config_amd(&hw_res->r_resctrl);
+
+ return false;
+@@ -863,7 +864,8 @@ static __init void rdt_init_res_defs(voi
+ {
+ if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL)
+ rdt_init_res_defs_intel();
+- else if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
++ else if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD ||
++ boot_cpu_data.x86_vendor == X86_VENDOR_HYGON)
+ rdt_init_res_defs_amd();
+ }
+
--- /dev/null
+From 7517e899e1b87b4c22a92c7e40d8733c48e4ec3c Mon Sep 17 00:00:00 2001
+From: Xiaochen Shen <shenxiaochen@open-hieco.net>
+Date: Tue, 9 Dec 2025 14:26:50 +0800
+Subject: x86/resctrl: Fix memory bandwidth counter width for Hygon
+
+From: Xiaochen Shen <shenxiaochen@open-hieco.net>
+
+commit 7517e899e1b87b4c22a92c7e40d8733c48e4ec3c upstream.
+
+The memory bandwidth calculation relies on reading the hardware counter
+and measuring the delta between samples. To ensure accurate measurement,
+the software reads the counter frequently enough to prevent it from
+rolling over twice between reads.
+
+The default Memory Bandwidth Monitoring (MBM) counter width is 24 bits.
+Hygon CPUs provide a 32-bit width counter, but they do not support the
+MBM capability CPUID leaf (0xF.[ECX=1]:EAX) to report the width offset
+(from 24 bits).
+
+Consequently, the kernel falls back to the 24-bit default counter width,
+which causes incorrect overflow handling on Hygon CPUs.
+
+Fix this by explicitly setting the counter width offset to 8 bits (resulting
+in a 32-bit total counter width) for Hygon CPUs.
+
+Fixes: d8df126349da ("x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper")
+Signed-off-by: Xiaochen Shen <shenxiaochen@open-hieco.net>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20251209062650.1536952-3-shenxiaochen@open-hieco.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/resctrl/core.c | 15 +++++++++++++--
+ arch/x86/kernel/cpu/resctrl/internal.h | 3 +++
+ 2 files changed, 16 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/resctrl/core.c
++++ b/arch/x86/kernel/cpu/resctrl/core.c
+@@ -896,8 +896,19 @@ void resctrl_cpu_detect(struct cpuinfo_x
+ c->x86_cache_occ_scale = ebx;
+ c->x86_cache_mbm_width_offset = eax & 0xff;
+
+- if (c->x86_vendor == X86_VENDOR_AMD && !c->x86_cache_mbm_width_offset)
+- c->x86_cache_mbm_width_offset = MBM_CNTR_WIDTH_OFFSET_AMD;
++ if (!c->x86_cache_mbm_width_offset) {
++ switch (c->x86_vendor) {
++ case X86_VENDOR_AMD:
++ c->x86_cache_mbm_width_offset = MBM_CNTR_WIDTH_OFFSET_AMD;
++ break;
++ case X86_VENDOR_HYGON:
++ c->x86_cache_mbm_width_offset = MBM_CNTR_WIDTH_OFFSET_HYGON;
++ break;
++ default:
++ /* Leave c->x86_cache_mbm_width_offset as 0 */
++ break;
++ }
++ }
+ }
+ }
+
+--- a/arch/x86/kernel/cpu/resctrl/internal.h
++++ b/arch/x86/kernel/cpu/resctrl/internal.h
+@@ -31,6 +31,9 @@
+ #define MAX_MBA_BW_AMD 0x800
+ #define MBM_CNTR_WIDTH_OFFSET_AMD 20
+
++/* Hygon MBM counter width as an offset from MBM_CNTR_WIDTH_BASE */
++#define MBM_CNTR_WIDTH_OFFSET_HYGON 8
++
+ #define RMID_VAL_ERROR BIT_ULL(63)
+ #define RMID_VAL_UNAVAIL BIT_ULL(62)
+ /*
projects / thirdparty / kernel / stable-queue.git / commitdiff
