--- /dev/null
+From 9210f5ff6318163835d9e42ee68006be4da0f531 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@gmail.com>
+Date: Sun, 18 Jan 2026 17:50:30 -0300
+Subject: ASoC: fsl: imx-card: Do not force slot width to sample width
+
+From: Fabio Estevam <festevam@gmail.com>
+
+commit 9210f5ff6318163835d9e42ee68006be4da0f531 upstream.
+
+imx-card currently sets the slot width to the physical sample width
+for I2S links. This breaks controllers that use fixed-width slots
+(e.g. 32-bit FIFO words), causing the unused bits in the slot to
+contain undefined data when playing 16-bit streams.
+
+Do not override the slot width in the machine driver and let the CPU
+DAI select an appropriate default instead. This matches the behavior
+of simple-audio-card and avoids embedding controller-specific policy
+in the machine driver.
+
+On an i.MX8MP-based board using SAI as the I2S master with 32-bit slots,
+playing 16-bit audio resulted in spurious frequencies and an incorrect
+SAI data waveform, as the slot width was forced to 16 bits. After this
+change, audio artifacts are eliminated and the 16-bit samples correctly
+occupy the first half of the 32-bit slot, with the remaining bits padded
+with zeroes.
+
+Cc: stable@vger.kernel.org
+Fixes: aa736700f42f ("ASoC: imx-card: Add imx-card machine driver")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Acked-by: Shengjiu Wang <shengjiu.wang@gmail.com>
+Link: https://patch.msgid.link/20260118205030.1532696-1-festevam@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/fsl/imx-card.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/soc/fsl/imx-card.c
++++ b/sound/soc/fsl/imx-card.c
+@@ -314,7 +314,6 @@ static int imx_aif_hw_params(struct snd_
+ SND_SOC_DAIFMT_PDM;
+ } else {
+ slots = 2;
+- slot_width = params_physical_width(params);
+ fmt = (rtd->dai_link->dai_fmt & ~SND_SOC_DAIFMT_FORMAT_MASK) |
+ SND_SOC_DAIFMT_I2S;
+ }
--- /dev/null
+From dccf46179ddd6c04c14be8ed584dc54665f53f0e Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Tue, 27 Jan 2026 20:27:25 +0100
+Subject: mptcp: only reset subflow errors when propagated
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+commit dccf46179ddd6c04c14be8ed584dc54665f53f0e upstream.
+
+Some subflow socket errors need to be reported to the MPTCP socket: the
+initial subflow connect (MP_CAPABLE), and the ones from the fallback
+sockets. The others are not propagated.
+
+The issue is that sock_error() was used to retrieve the error, which was
+also resetting the sk_err field. Because of that, when notifying the
+userspace about subflow close events later on from the MPTCP worker, the
+ssk->sk_err field was always 0.
+
+Now, the error (sk_err) is only reset when propagating it to the msk.
+
+Fixes: 15cc10453398 ("mptcp: deliver ssk errors to msk")
+Cc: stable@vger.kernel.org
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-3-7f71e1bc4feb@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -736,11 +736,8 @@ static bool __mptcp_ofo_queue(struct mpt
+
+ static bool __mptcp_subflow_error_report(struct sock *sk, struct sock *ssk)
+ {
+- int err = sock_error(ssk);
+ int ssk_state;
+-
+- if (!err)
+- return false;
++ int err;
+
+ /* only propagate errors on fallen-back sockets or
+ * on MPC connect
+@@ -748,6 +745,10 @@ static bool __mptcp_subflow_error_report
+ if (sk->sk_state != TCP_SYN_SENT && !__mptcp_check_fallback(mptcp_sk(sk)))
+ return false;
+
++ err = sock_error(ssk);
++ if (!err)
++ return false;
++
+ /* We need to propagate only transition to CLOSE state.
+ * Orphaned socket will see such state change via
+ * subflow_sched_work_if_closed() and that path will properly
--- /dev/null
+From 4f0d22ec60cee420125f4055af76caa0f373a3fe Mon Sep 17 00:00:00 2001
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Date: Mon, 26 Jan 2026 14:56:27 +0100
+Subject: pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+commit 4f0d22ec60cee420125f4055af76caa0f373a3fe upstream.
+
+GPIO controller driver should typically implement the .get_direction()
+callback as GPIOLIB internals may try to use it to determine the state
+of a pin. Add it for the LPASS LPI driver.
+
+Reported-by: Abel Vesa <abelvesa@kernel.org>
+Cc: stable@vger.kernel.org
+Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Tested-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> # X1E CRD
+Tested-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
+Signed-off-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
++++ b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
+@@ -484,6 +484,22 @@ static const struct pinconf_ops lpi_gpio
+ .pin_config_group_set = lpi_config_set,
+ };
+
++static int lpi_gpio_get_direction(struct gpio_chip *chip, unsigned int pin)
++{
++ unsigned long config = pinconf_to_config_packed(PIN_CONFIG_LEVEL, 0);
++ struct lpi_pinctrl *state = gpiochip_get_data(chip);
++ unsigned long arg;
++ int ret;
++
++ ret = lpi_config_get(state->ctrl, pin, &config);
++ if (ret)
++ return ret;
++
++ arg = pinconf_to_config_argument(config);
++
++ return arg ? GPIO_LINE_DIRECTION_OUT : GPIO_LINE_DIRECTION_IN;
++}
++
+ static int lpi_gpio_direction_input(struct gpio_chip *chip, unsigned int pin)
+ {
+ struct lpi_pinctrl *state = gpiochip_get_data(chip);
+@@ -582,6 +598,7 @@ static void lpi_gpio_dbg_show(struct seq
+ #endif
+
+ static const struct gpio_chip lpi_gpio_template = {
++ .get_direction = lpi_gpio_get_direction,
+ .direction_input = lpi_gpio_direction_input,
+ .direction_output = lpi_gpio_direction_output,
+ .get = lpi_gpio_get,
--- /dev/null
+From 4747bafaa50115d9667ece446b1d2d4aba83dc7f Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Date: Sat, 13 Dec 2025 16:36:43 +0800
+Subject: scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+commit 4747bafaa50115d9667ece446b1d2d4aba83dc7f upstream.
+
+If nonemb_cmd->va fails to be allocated, free the allocation previously
+made by alloc_mcc_wrb().
+
+Fixes: 50a4b824be9e ("scsi: be2iscsi: Fix to make boot discovery non-blocking")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Link: https://patch.msgid.link/20251213083643.301240-1-lihaoxiang@isrc.iscas.ac.cn
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/be2iscsi/be_mgmt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/be2iscsi/be_mgmt.c
++++ b/drivers/scsi/be2iscsi/be_mgmt.c
+@@ -1025,6 +1025,7 @@ unsigned int beiscsi_boot_get_sinfo(stru
+ &nonemb_cmd->dma,
+ GFP_KERNEL);
+ if (!nonemb_cmd->va) {
++ free_mcc_wrb(ctrl, tag);
+ mutex_unlock(&ctrl->mbox_lock);
+ return 0;
+ }
--- /dev/null
+From 56bd3c0f749f45793d1eae1d0ddde4255c749bf6 Mon Sep 17 00:00:00 2001
+From: Thomas Fourier <fourier.thomas@gmail.com>
+Date: Mon, 12 Jan 2026 14:43:24 +0100
+Subject: scsi: qla2xxx: edif: Fix dma_free_coherent() size
+
+From: Thomas Fourier <fourier.thomas@gmail.com>
+
+commit 56bd3c0f749f45793d1eae1d0ddde4255c749bf6 upstream.
+
+Earlier in the function, the ha->flt buffer is allocated with size
+sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE but freed in the error
+path with size SFP_DEV_SIZE.
+
+Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
+Link: https://patch.msgid.link/20260112134326.55466-2-fourier.thomas@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -4431,7 +4431,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha
+ fail_elsrej:
+ dma_pool_destroy(ha->purex_dma_pool);
+ fail_flt:
+- dma_free_coherent(&ha->pdev->dev, SFP_DEV_SIZE,
++ dma_free_coherent(&ha->pdev->dev, sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE,
+ ha->flt, ha->flt_dma);
+
+ fail_flt_buffer:
scsi-firewire-sbp-target-fix-overflow-in-sbp_make_tp.patch
gpiolib-acpi-use-bit_ull-for-u64-mask-in-address-spa.patch
dma-pool-distinguish-between-missing-and-exhausted-a.patch
+pinctrl-lpass-lpi-implement-.get_direction-for-the-gpio-driver.patch
+asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch
+scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch
+scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch
+mptcp-only-reset-subflow-errors-when-propagated.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
