--- /dev/null
+From 609c5b04a28dc1b0f3af6a7bc93055135b2d2059 Mon Sep 17 00:00:00 2001
+From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
+Date: Fri, 10 Jul 2026 23:10:03 +0545
+Subject: Bluetooth: btrtl: validate firmware patch bounds
+
+From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
+
+commit 609c5b04a28dc1b0f3af6a7bc93055135b2d2059 upstream.
+
+rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the
+firmware version. A malformed firmware patch shorter than the version field
+can make this subtraction underflow and turn the copy into an oversized
+read and write during Bluetooth setup.
+
+The existing patch_offset + patch_length check can also wrap on 32-bit
+architectures. Validate the patch length and range without arithmetic
+overflow before allocating or copying the patch.
+
+Fixes: db33c77dddc2 ("Bluetooth: btrtl: Create separate module for Realtek BT driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btrtl.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/bluetooth/btrtl.c
++++ b/drivers/bluetooth/btrtl.c
+@@ -786,8 +786,9 @@ static int rtlbt_parse_firmware(struct h
+ }
+
+ BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i);
+- min_size = patch_offset + patch_length;
+- if (btrtl_dev->fw_len < min_size)
++ if (patch_length < sizeof(epatch_info->fw_version) ||
++ patch_offset > btrtl_dev->fw_len ||
++ patch_length > btrtl_dev->fw_len - patch_offset)
+ return -EINVAL;
+
+ /* Copy the firmware into a new buffer and write the version at
--- /dev/null
+From b3fe4cbd583895987935a9bdad01c8f9d3a02310 Mon Sep 17 00:00:00 2001
+From: Julian Anastasov <ja@ssi.bg>
+Date: Wed, 8 Jul 2026 21:03:15 +0300
+Subject: ipvs: fix more places with wrong ipv6 transport offsets
+
+From: Julian Anastasov <ja@ssi.bg>
+
+commit b3fe4cbd583895987935a9bdad01c8f9d3a02310 upstream.
+
+Sashiko reports for more incorrect IPv6 transport offsets.
+
+The app code for TCP was assuming IPv4 network header
+even after the ipvsh argument was provided. This can
+cause problems with apps over IPv6. As for the only
+official app in the kernel tree (FTP) this problem is
+harmless because we use Netfilter to mangle the FTP
+ports and we do not adjust the TCP seq numbers.
+
+Also, provide correct offset of the ICMPV6 header in
+ip_vs_out_icmp_v6() for correct checksum checks when
+the IPv6 packet has extension headers.
+
+Fixes: d12e12299a69 ("ipvs: add ipv6 support to ftp")
+Fixes: 2a3b791e6e11 ("IPVS: Add/adjust Netfilter hook functions and helpers for v6")
+Cc: stable@vger.kernel.org
+Link: https://sashiko.dev/#/patchset/20260706101624.69471-1-zhaoyz24%40mails.tsinghua.edu.cn
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/ipvs/ip_vs_app.c | 10 ++++------
+ net/netfilter/ipvs/ip_vs_core.c | 3 +--
+ 2 files changed, 5 insertions(+), 8 deletions(-)
+
+--- a/net/netfilter/ipvs/ip_vs_app.c
++++ b/net/netfilter/ipvs/ip_vs_app.c
+@@ -362,14 +362,13 @@ static inline int app_tcp_pkt_out(struct
+ struct ip_vs_iphdr *ipvsh)
+ {
+ int diff;
+- const unsigned int tcp_offset = ip_hdrlen(skb);
+ struct tcphdr *th;
+ __u32 seq;
+
+- if (skb_ensure_writable(skb, tcp_offset + sizeof(*th)))
++ if (skb_ensure_writable(skb, ipvsh->len + sizeof(*th)))
+ return 0;
+
+- th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset);
++ th = (struct tcphdr *)(skb_network_header(skb) + ipvsh->len);
+
+ /*
+ * Remember seq number in case this pkt gets resized
+@@ -439,14 +438,13 @@ static inline int app_tcp_pkt_in(struct
+ struct ip_vs_iphdr *ipvsh)
+ {
+ int diff;
+- const unsigned int tcp_offset = ip_hdrlen(skb);
+ struct tcphdr *th;
+ __u32 seq;
+
+- if (skb_ensure_writable(skb, tcp_offset + sizeof(*th)))
++ if (skb_ensure_writable(skb, ipvsh->len + sizeof(*th)))
+ return 0;
+
+- th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset);
++ th = (struct tcphdr *)(skb_network_header(skb) + ipvsh->len);
+
+ /*
+ * Remember seq number in case this pkt gets resized
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1041,8 +1041,7 @@ static int ip_vs_out_icmp_v6(struct netn
+ snet.in6 = ciph.saddr.in6;
+ offset = ciph.len;
+ return handle_response_icmp(AF_INET6, skb, &snet, ciph.protocol, cp,
+- pp, offset, sizeof(struct ipv6hdr),
+- hooknum);
++ pp, offset, ipvsh->len, hooknum);
+ }
+ #endif
+
--- /dev/null
+From a2f57827bf7c695b8c72dc4511cae8e86582369d Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 8 Jul 2026 16:21:30 +0200
+Subject: ipvs: reload ip header after head reallocation
+
+From: Florian Westphal <fw@strlen.de>
+
+commit a2f57827bf7c695b8c72dc4511cae8e86582369d upstream.
+
+__ip_vs_get_out_rt() calls skb_ensure_writable() which may
+reallocate skb->head.
+
+Fixes: 8d8e20e2d7bb ("ipvs: Decrement ttl")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-sonnet-4-6
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/ipvs/ip_vs_xmit.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/net/netfilter/ipvs/ip_vs_xmit.c
++++ b/net/netfilter/ipvs/ip_vs_xmit.c
+@@ -733,13 +733,11 @@ int
+ ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+ struct ip_vs_protocol *pp, struct ip_vs_iphdr *ipvsh)
+ {
+- struct iphdr *iph = ip_hdr(skb);
+-
+- if (__ip_vs_get_out_rt(cp->ipvs, cp->af, skb, NULL, iph->daddr,
++ if (__ip_vs_get_out_rt(cp->ipvs, cp->af, skb, NULL, ip_hdr(skb)->daddr,
+ IP_VS_RT_MODE_NON_LOCAL, NULL, ipvsh) < 0)
+ goto tx_error;
+
+- ip_send_check(iph);
++ ip_send_check(ip_hdr(skb));
+
+ /* Another hack: avoid icmp_send in ip_fragment */
+ skb->ignore_df = 1;
--- /dev/null
+From 2c72eb6286347d05a885412fb076993bd5286b53 Mon Sep 17 00:00:00 2001
+From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+Date: Sun, 12 Jul 2026 21:03:43 +0800
+Subject: llc: fix SAP refcount leak when creating incoming sockets
+
+From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+
+commit 2c72eb6286347d05a885412fb076993bd5286b53 upstream.
+
+llc_sap_add_socket() takes a SAP reference for each socket added to a SAP,
+and llc_sap_remove_socket() releases it. llc_create_incoming_sock() takes
+an additional SAP reference after adding the child socket.
+
+This extra reference was balanced by an explicit llc_sap_put() in
+llc_ui_release() until commit 3100aa9d74db ("llc: fix SAP reference
+counting w.r.t. socket handling") removed that put. The corresponding hold
+in the accept path was left behind.
+
+When such a child socket is removed, only the reference taken by
+llc_sap_add_socket() is released. The extra reference keeps the SAP alive
+after its last socket is removed. Remove the obsolete hold.
+
+Fixes: 3100aa9d74db ("llc: fix SAP reference counting w.r.t. socket handling")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
+Link: https://patch.msgid.link/20260712130343.518797-1-xuanqiang.luo@linux.dev
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/llc/llc_conn.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -773,7 +773,6 @@ static struct sock *llc_create_incoming_
+ newllc->dev = dev;
+ dev_hold(dev);
+ llc_sap_add_socket(llc->sap, newsk);
+- llc_sap_hold(llc->sap);
+ out:
+ return newsk;
+ }
--- /dev/null
+From 7410d11460eb90d6c9281162ccc6a128534d897d Mon Sep 17 00:00:00 2001
+From: James Raphael Tiovalen <jamestiotio@gmail.com>
+Date: Sun, 5 Jul 2026 19:36:29 +0800
+Subject: macsec: fix promiscuity refcount leak in macsec_dev_open()
+
+From: James Raphael Tiovalen <jamestiotio@gmail.com>
+
+commit 7410d11460eb90d6c9281162ccc6a128534d897d upstream.
+
+When a MACsec interface with IFF_PROMISC set is brought up on top of a
+device that has hardware offload enabled, macsec_dev_open() first calls
+dev_set_promiscuity(real_dev, 1) and then propagates the open to the
+offload device. If that propagation fails, the error path jumps to the
+clear_allmulti label, which only reverts allmulti and the unicast
+address. The promiscuity taken on the lower device is never dropped, so
+real_dev is left permanently stuck in promiscuous mode. Its promiscuity
+count can no longer be balanced from software.
+
+Add a clear_promisc label that drops the promiscuity reference and
+route the two offload failure paths to it. The dev_set_promiscuity()
+failure itself still jumps to clear_allmulti, since on that failure the
+count was not incremented.
+
+Fixes: 3cf3227a21d1 ("net: macsec: hardware offloading infrastructure")
+Cc: stable@vger.kernel.org
+Signed-off-by: James Raphael Tiovalen <jamestiotio@gmail.com>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://patch.msgid.link/20260705113629.187490-1-jamestiotio@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/macsec.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -3609,19 +3609,22 @@ static int macsec_dev_open(struct net_de
+ ops = macsec_get_ops(netdev_priv(dev), &ctx);
+ if (!ops) {
+ err = -EOPNOTSUPP;
+- goto clear_allmulti;
++ goto clear_promisc;
+ }
+
+ ctx.secy = &macsec->secy;
+ err = macsec_offload(ops->mdo_dev_open, &ctx);
+ if (err)
+- goto clear_allmulti;
++ goto clear_promisc;
+ }
+
+ if (netif_carrier_ok(real_dev))
+ netif_carrier_on(dev);
+
+ return 0;
++clear_promisc:
++ if (dev->flags & IFF_PROMISC)
++ dev_set_promiscuity(real_dev, -1);
+ clear_allmulti:
+ if (dev->flags & IFF_ALLMULTI)
+ dev_set_allmulti(real_dev, -1);
--- /dev/null
+From 718178f524b98bc920d74bc771aed823c8b81425 Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Thu, 2 Jul 2026 16:27:45 +0800
+Subject: memstick: ms_block: reject a card that reports too many blocks
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 718178f524b98bc920d74bc771aed823c8b81425 upstream.
+
+msb_ftl_initialize() computes the zone count from the card block count
+with no bound:
+
+ msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE;
+ ...
+ for (i = 0; i < msb->zone_count; i++)
+ msb->free_block_count[i] = MS_BLOCKS_IN_ZONE;
+
+msb->block_count is a card value. msb_read_boot_blocks() reads
+number_of_blocks from the card boot page and byte swaps it.
+free_block_count is a fixed int[MS_MAX_ZONES]. MS_MAX_ZONES is 16, so the
+valid indices are 0 to 15. The init loop above indexes it by zone_count.
+msb_mark_block_used() and msb_mark_block_unused() index it by
+pba / MS_BLOCKS_IN_ZONE, for pba up to block_count - 1. A card may report
+up to 65535 blocks. A block_count above 8192 (MS_MAX_ZONES *
+MS_BLOCKS_IN_ZONE) lets the pba index reach 16. That writes past
+free_block_count[] and corrupts struct msb_data. A larger count runs the
+init loop past the end too.
+
+A real Memory Stick has at most 16 zones. So it has at most 8192 blocks.
+msb_ftl_initialize() now rejects a card that reports more than
+MS_MAX_ZONES * MS_BLOCKS_IN_ZONE blocks.
+
+Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks")
+Cc: stable@vger.kernel.org
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Signed-off-by: Ulf Hansson <ulfh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/memstick/core/ms_block.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/memstick/core/ms_block.c
++++ b/drivers/memstick/core/ms_block.c
+@@ -1339,6 +1339,10 @@ static int msb_ftl_initialize(struct msb
+ return 0;
+
+ msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE;
++ if (msb->block_count > MS_MAX_ZONES * MS_BLOCKS_IN_ZONE) {
++ pr_err("Too many blocks: %d\n", msb->block_count);
++ return -EINVAL;
++ }
+ msb->logical_block_count = msb->zone_count * 496 - 2;
+
+ msb->used_blocks_bitmap = bitmap_zalloc(msb->block_count, GFP_KERNEL);
--- /dev/null
+From 1db87818bde3d2295613660879378b43a70d31f8 Mon Sep 17 00:00:00 2001
+From: Luke Wang <ziniu.wang_1@nxp.com>
+Date: Wed, 15 Jul 2026 15:18:14 +0800
+Subject: mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume
+
+From: Luke Wang <ziniu.wang_1@nxp.com>
+
+commit 1db87818bde3d2295613660879378b43a70d31f8 upstream.
+
+SDIO devices such as WiFi may keep power during suspend, so the MMC
+core skips full card re-initialization on resume and directly restores
+the host controller's ios timing to match the card. For DDR mode,
+pm_runtime_force_resume() sets DDR_EN before the pin configuration is
+restored from sleep state.
+
+This is related to the SoC IP integration: switching pinctrl setting
+(changing alt from GPIO to USDHC) impacts the internal loopback path.
+If pinctrl configures the pad to GPIO function, once DDR_EN is set, the
+DLL delay will be fixed based on the GPIO function loopback path. When
+the pinctrl is later changed to USDHC function, the internal loopback
+path changes, making the original fixed sample point no longer suitable
+for the current loopback path. This causes persistent read CRC errors on
+subsequent data transfers.
+
+SD/eMMC running in DDR mode are unaffected as they are fully
+re-initialized from legacy timing after resume.
+
+Fix this by restoring the pinctrl state based on current timing mode
+using esdhc_change_pinstate() before pm_runtime_force_resume(). This
+ensures the correct pin configuration (e.g., 100/200MHz for UHS modes)
+is applied before DDR_EN is set. Only restore for non-wakeup devices
+since wakeup devices kept their active pin state during suspend.
+
+Fixes: 676a83855614 ("mmc: host: sdhci-esdhc-imx: refactor the system PM logic")
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Haibo Chen <haibo.chen@nxp.com>
+Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulfh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-esdhc-imx.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -2083,6 +2083,12 @@ static int sdhci_esdhc_resume(struct dev
+ struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host);
+ int ret;
+
++ if (!device_may_wakeup(dev)) {
++ ret = esdhc_change_pinstate(host, host->timing);
++ if (ret)
++ dev_warn(dev, "Failed to restore pinctrl state\n");
++ }
++
+ pm_runtime_force_resume(dev);
+
+ ret = mmc_gpio_set_cd_wake(host->mmc, false);
--- /dev/null
+From df6134b527a88b3e65ba6ae5073664af091d5fd2 Mon Sep 17 00:00:00 2001
+From: Zhiping Zhang <zhipingz@meta.com>
+Date: Thu, 2 Jul 2026 15:24:58 -0700
+Subject: net/mlx5: free mlx5_st_idx_data on final dealloc
+
+From: Zhiping Zhang <zhipingz@meta.com>
+
+commit df6134b527a88b3e65ba6ae5073664af091d5fd2 upstream.
+
+Workloads that repeatedly allocate and release mkeys carrying TPH
+steering-tag hints (e.g. churning RDMA MRs) leak one
+struct mlx5_st_idx_data per cycle; kmemleak flags it as unreferenced
+and the kmalloc slab grows over time.
+
+When the last reference to an ST table entry is dropped,
+mlx5_st_dealloc_index() removed the entry from idx_xa but the backing
+mlx5_st_idx_data allocation was never freed.
+
+Free idx_data after the xa_erase() so the lifetime of the bookkeeping
+struct matches the lifetime of the ST entry it tracks.
+
+Cc: stable@vger.kernel.org
+Fixes: 888a7776f4fb ("net/mlx5: Add support for device steering tag")
+Reviewed-by: Michael Gur <michaelgur@nvidia.com>
+Signed-off-by: Zhiping Zhang <zhipingz@meta.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20260702222507.1234467-1-zhipingz@meta.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/lib/st.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c
+@@ -154,6 +154,7 @@ int mlx5_st_dealloc_index(struct mlx5_co
+
+ if (refcount_dec_and_test(&idx_data->usecount)) {
+ xa_erase(&st->idx_xa, st_index);
++ kfree(idx_data);
+ /* We leave PCI config space as was before, no mkey will refer to it */
+ }
+
--- /dev/null
+From 3f1f755366687d051174739fb99f7d560202f60b Mon Sep 17 00:00:00 2001
+From: Asim Viladi Oglu Manizada <manizada@pm.me>
+Date: Mon, 6 Jul 2026 09:44:10 +0000
+Subject: net: openvswitch: reject oversized nested action attrs
+
+From: Asim Viladi Oglu Manizada <manizada@pm.me>
+
+commit 3f1f755366687d051174739fb99f7d560202f60b upstream.
+
+Open vSwitch stores generated flow actions as nlattrs, whose nla_len
+field is u16. Commit a1e64addf3ff ("net: openvswitch: remove
+misbehaving actions length check") allowed the total sw_flow_actions
+stream to grow beyond 64 KiB, which is valid, but also removed the last
+guard preventing a generated nested action attribute from exceeding
+U16_MAX.
+
+An oversized generated container can thus be closed with a truncated
+nla_len. A later dump or teardown then walks a structurally different
+stream than the one that was validated. In particular, an oversized
+nested CLONE/CT action may cause subsequent bytes in the generated
+stream to be interpreted as independent actions.
+
+Keep the larger total-action-stream behavior, but make nested action
+close reject generated containers that do not fit in nla_len, and return
+the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and
+CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse
+construction order before discarding failed wrappers, so resources copied
+into the rejected tails are released before the wrappers are removed.
+
+Most failed outer wrappers are discarded by truncating actions_len after
+child resources have been released. CHECK_PKT_LEN also trims its parent
+after branch resources are gone. SET/TUNNEL close failures unwind their
+known tun_dst ownership directly, and SET_TO_MASKED has no external
+ownership and truncates on close failure.
+
+Fixes: a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check")
+Cc: stable@vger.kernel.org
+Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
+Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
+Reviewed-by: Eelco Chaudron <echaudro@redhat.com>
+Reviewed-by: Aaron Conole <aconole@redhat.com>
+Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
+Link: https://patch.msgid.link/20260706094336.38639-1-manizada@pm.me
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/openvswitch/flow_netlink.c | 201 ++++++++++++++++++++++++++++++++---------
+ 1 file changed, 157 insertions(+), 44 deletions(-)
+
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -2496,13 +2496,56 @@ static inline int add_nested_action_star
+ return used;
+ }
+
+-static inline void add_nested_action_end(struct sw_flow_actions *sfa,
+- int st_offset)
++static inline int add_nested_action_end(struct sw_flow_actions *sfa,
++ int st_offset)
+ {
+- struct nlattr *a = (struct nlattr *) ((unsigned char *)sfa->actions +
+- st_offset);
++ struct nlattr *a;
++ u32 attr_len;
++
++ if (WARN_ON_ONCE(st_offset < 0 ||
++ (u32)st_offset > sfa->actions_len))
++ return -EINVAL;
++
++ attr_len = sfa->actions_len - (u32)st_offset;
++ if (WARN_ON_ONCE(attr_len < NLA_HDRLEN))
++ return -EINVAL;
++
++ if (attr_len > U16_MAX)
++ return -EMSGSIZE;
++
++ a = (struct nlattr *)((u8 *)sfa->actions + st_offset);
++ a->nla_len = attr_len;
++ return 0;
++}
++
++/* Free the generated action-list tail at @start and truncate it.
++ * If @nested, @start points to its containing nlattr header.
++ */
++static void ovs_nla_trim(struct sw_flow_actions *sfa, int start, bool nested)
++{
++ const struct nlattr *actions;
++ u32 len;
++
++ if (start < 0)
++ return;
++
++ if (WARN_ON_ONCE((u32)start > sfa->actions_len))
++ return;
+
+- a->nla_len = sfa->actions_len - st_offset;
++ actions = (const struct nlattr *)((u8 *)sfa->actions + start);
++ len = sfa->actions_len - (u32)start;
++
++ if (nested) {
++ if (len < NLA_HDRLEN)
++ goto out;
++
++ actions = (const struct nlattr *)((u8 *)actions + NLA_HDRLEN);
++ len -= NLA_HDRLEN;
++ }
++
++ ovs_nla_free_nested_actions(actions, len);
++out:
++ sfa->actions_len = start;
+ }
+
+ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
+@@ -2522,6 +2565,7 @@ static int validate_and_copy_sample(stru
+ const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1];
+ const struct nlattr *probability, *actions;
+ const struct nlattr *a;
++ int actions_start;
+ int rem, start, err;
+ struct sample_arg arg;
+
+@@ -2565,18 +2609,27 @@ static int validate_and_copy_sample(stru
+ err = ovs_nla_add_action(sfa, OVS_SAMPLE_ATTR_ARG, &arg, sizeof(arg),
+ log);
+ if (err)
+- return err;
++ goto err;
+
++ actions_start = (*sfa)->actions_len;
+ err = __ovs_nla_copy_actions(net, actions, key, sfa,
+ eth_type, vlan_tci, mpls_label_count, log,
+ depth + 1);
+
+ if (err)
+- return err;
++ goto err_free;
+
+- add_nested_action_end(*sfa, start);
++ err = add_nested_action_end(*sfa, start);
++ if (err)
++ goto err_free;
+
+ return 0;
++
++err_free:
++ ovs_nla_trim(*sfa, actions_start, false);
++err:
++ (*sfa)->actions_len = start;
++ return err;
+ }
+
+ static int validate_and_copy_dec_ttl(struct net *net,
+@@ -2624,18 +2677,31 @@ static int validate_and_copy_dec_ttl(str
+ return start;
+
+ action_start = add_nested_action_start(sfa, OVS_DEC_TTL_ATTR_ACTION, log);
+- if (action_start < 0)
+- return action_start;
++ if (action_start < 0) {
++ err = action_start;
++ goto err;
++ }
+
+ err = __ovs_nla_copy_actions(net, actions, key, sfa, eth_type,
+ vlan_tci, mpls_label_count, log,
+ depth + 1);
+ if (err)
+- return err;
++ goto err_free;
+
+- add_nested_action_end(*sfa, action_start);
+- add_nested_action_end(*sfa, start);
++ err = add_nested_action_end(*sfa, action_start);
++ if (err)
++ goto err_free;
++
++ err = add_nested_action_end(*sfa, start);
++ if (err)
++ goto err_free;
+ return 0;
++
++err_free:
++ ovs_nla_trim(*sfa, action_start, true);
++err:
++ (*sfa)->actions_len = start;
++ return err;
+ }
+
+ static int validate_and_copy_clone(struct net *net,
+@@ -2646,6 +2712,7 @@ static int validate_and_copy_clone(struc
+ u32 mpls_label_count, bool log, bool last,
+ u32 depth)
+ {
++ int actions_start;
+ int start, err;
+ u32 exec;
+
+@@ -2661,17 +2728,26 @@ static int validate_and_copy_clone(struc
+ err = ovs_nla_add_action(sfa, OVS_CLONE_ATTR_EXEC, &exec,
+ sizeof(exec), log);
+ if (err)
+- return err;
++ goto err;
+
++ actions_start = (*sfa)->actions_len;
+ err = __ovs_nla_copy_actions(net, attr, key, sfa,
+ eth_type, vlan_tci, mpls_label_count, log,
+ depth + 1);
+ if (err)
+- return err;
++ goto err_free;
+
+- add_nested_action_end(*sfa, start);
++ err = add_nested_action_end(*sfa, start);
++ if (err)
++ goto err_free;
+
+ return 0;
++
++err_free:
++ ovs_nla_trim(*sfa, actions_start, false);
++err:
++ (*sfa)->actions_len = start;
++ return err;
+ }
+
+ void ovs_match_init(struct sw_flow_match *match,
+@@ -2763,20 +2839,20 @@ static int validate_and_copy_set_tun(con
+ tun_dst = metadata_dst_alloc(key.tun_opts_len, METADATA_IP_TUNNEL,
+ GFP_KERNEL);
+
+- if (!tun_dst)
+- return -ENOMEM;
++ if (!tun_dst) {
++ err = -ENOMEM;
++ goto err;
++ }
+
+ err = dst_cache_init(&tun_dst->u.tun_info.dst_cache, GFP_KERNEL);
+- if (err) {
+- dst_release((struct dst_entry *)tun_dst);
+- return err;
+- }
++ if (err)
++ goto err_free_tun_dst;
+
+ a = __add_action(sfa, OVS_KEY_ATTR_TUNNEL_INFO, NULL,
+ sizeof(*ovs_tun), log);
+ if (IS_ERR(a)) {
+- dst_release((struct dst_entry *)tun_dst);
+- return PTR_ERR(a);
++ err = PTR_ERR(a);
++ goto err_free_tun_dst;
+ }
+
+ ovs_tun = nla_data(a);
+@@ -2797,8 +2873,16 @@ static int validate_and_copy_set_tun(con
+ ip_tunnel_info_opts_set(tun_info,
+ TUN_METADATA_OPTS(&key, key.tun_opts_len),
+ key.tun_opts_len, dst_opt_type);
+- add_nested_action_end(*sfa, start);
++ err = add_nested_action_end(*sfa, start);
++ if (WARN_ON_ONCE(err))
++ goto err_free_tun_dst;
++
++ return 0;
+
++err_free_tun_dst:
++ dst_release((struct dst_entry *)tun_dst);
++err:
++ (*sfa)->actions_len = start;
+ return err;
+ }
+
+@@ -2971,7 +3055,7 @@ static int validate_set(const struct nla
+
+ /* Convert non-masked non-tunnel set actions to masked set actions. */
+ if (!masked && key_type != OVS_KEY_ATTR_TUNNEL) {
+- int start, len = key_len * 2;
++ int err, start, len = key_len * 2;
+ struct nlattr *at;
+
+ *skip_copy = true;
+@@ -2983,8 +3067,11 @@ static int validate_set(const struct nla
+ return start;
+
+ at = __add_action(sfa, key_type, NULL, len, log);
+- if (IS_ERR(at))
+- return PTR_ERR(at);
++ if (IS_ERR(at)) {
++ err = PTR_ERR(at);
++ (*sfa)->actions_len = start;
++ return err;
++ }
+
+ memcpy(nla_data(at), nla_data(ovs_key), key_len); /* Key. */
+ memset(nla_data(at) + key_len, 0xff, key_len); /* Mask. */
+@@ -2994,7 +3081,11 @@ static int validate_set(const struct nla
+
+ mask->ipv6_label &= htonl(0x000FFFFF);
+ }
+- add_nested_action_end(*sfa, start);
++ err = add_nested_action_end(*sfa, start);
++ if (WARN_ON_ONCE(err)) {
++ (*sfa)->actions_len = start;
++ return err;
++ }
+ }
+
+ return 0;
+@@ -3040,7 +3131,8 @@ static int validate_and_copy_check_pkt_l
+ const struct nlattr *acts_if_greater, *acts_if_lesser_eq;
+ struct nlattr *a[OVS_CHECK_PKT_LEN_ATTR_MAX + 1];
+ struct check_pkt_len_arg arg;
+- int nested_acts_start;
++ int greater_acts_start = -1;
++ int lesser_acts_start = -1;
+ int start, err;
+
+ err = nla_parse_deprecated_strict(a, OVS_CHECK_PKT_LEN_ATTR_MAX,
+@@ -3075,37 +3167,58 @@ static int validate_and_copy_check_pkt_l
+ err = ovs_nla_add_action(sfa, OVS_CHECK_PKT_LEN_ATTR_ARG, &arg,
+ sizeof(arg), log);
+ if (err)
+- return err;
++ goto err_free;
+
+- nested_acts_start = add_nested_action_start(sfa,
+- OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL, log);
+- if (nested_acts_start < 0)
+- return nested_acts_start;
++ lesser_acts_start =
++ add_nested_action_start(sfa,
++ OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL,
++ log);
++ if (lesser_acts_start < 0) {
++ err = lesser_acts_start;
++ goto err_free;
++ }
+
+ err = __ovs_nla_copy_actions(net, acts_if_lesser_eq, key, sfa,
+ eth_type, vlan_tci, mpls_label_count, log,
+ depth + 1);
+
+ if (err)
+- return err;
++ goto err_free;
+
+- add_nested_action_end(*sfa, nested_acts_start);
++ err = add_nested_action_end(*sfa, lesser_acts_start);
++ if (err)
++ goto err_free;
+
+- nested_acts_start = add_nested_action_start(sfa,
+- OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER, log);
+- if (nested_acts_start < 0)
+- return nested_acts_start;
++ greater_acts_start =
++ add_nested_action_start(sfa,
++ OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER,
++ log);
++ if (greater_acts_start < 0) {
++ err = greater_acts_start;
++ goto err_free;
++ }
+
+ err = __ovs_nla_copy_actions(net, acts_if_greater, key, sfa,
+ eth_type, vlan_tci, mpls_label_count, log,
+ depth + 1);
+
+ if (err)
+- return err;
++ goto err_free;
++
++ err = add_nested_action_end(*sfa, greater_acts_start);
++ if (err)
++ goto err_free;
+
+- add_nested_action_end(*sfa, nested_acts_start);
+- add_nested_action_end(*sfa, start);
++ err = add_nested_action_end(*sfa, start);
++ if (err)
++ goto err_free;
+ return 0;
++
++err_free:
++ ovs_nla_trim(*sfa, greater_acts_start, true);
++ ovs_nla_trim(*sfa, lesser_acts_start, true);
++ ovs_nla_trim(*sfa, start, false);
++ return err;
+ }
+
+ static int validate_psample(const struct nlattr *attr)
--- /dev/null
+From 72422525f641f68bed6ca3389d29ee3f41fdea33 Mon Sep 17 00:00:00 2001
+From: Peng Fan <peng.fan@nxp.com>
+Date: Wed, 10 Jun 2026 22:39:10 +0800
+Subject: pmdomain: imx: Fix i.MX8MP power notifier
+
+From: Peng Fan <peng.fan@nxp.com>
+
+commit 72422525f641f68bed6ca3389d29ee3f41fdea33 upstream.
+
+Using imx8mm_vpu_power_notifier() for i.MX8MP is wrong, as it ungates
+the VPU clocks to provide the ADB clock, which is necessary on i.MX8MM,
+but on i.MX8MP there is a separate gate (bit 3) for the NoC. So add
+imx8mp_vpu_power_notifier() for i.MX8MP.
+
+Fixes: a1a5f15f7f6cb ("soc: imx: imx8m-blk-ctrl: add i.MX8MP VPU blk ctrl")
+Cc: stable@vger.kernel.org
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Ulf Hansson <ulfh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pmdomain/imx/imx8m-blk-ctrl.c | 27 ++++++++++++++++++++++++++-
+ 1 file changed, 26 insertions(+), 1 deletion(-)
+
+--- a/drivers/pmdomain/imx/imx8m-blk-ctrl.c
++++ b/drivers/pmdomain/imx/imx8m-blk-ctrl.c
+@@ -514,9 +514,34 @@ static const struct imx8m_blk_ctrl_domai
+ },
+ };
+
++static int imx8mp_vpu_power_notifier(struct notifier_block *nb,
++ unsigned long action, void *data)
++{
++ struct imx8m_blk_ctrl *bc = container_of(nb, struct imx8m_blk_ctrl,
++ power_nb);
++
++ if (action == GENPD_NOTIFY_ON) {
++ /*
++ * On power up we have no software backchannel to the GPC to
++ * wait for the ADB handshake to happen, so we just delay for a
++ * bit. On power down the GPC driver waits for the handshake.
++ */
++
++ udelay(5);
++
++ /* set "fuse" bits to enable the VPUs */
++ regmap_set_bits(bc->regmap, 0x8, 0xffffffff);
++ regmap_set_bits(bc->regmap, 0xc, 0xffffffff);
++ regmap_set_bits(bc->regmap, 0x10, 0xffffffff);
++ regmap_set_bits(bc->regmap, 0x14, 0xffffffff);
++ }
++
++ return NOTIFY_OK;
++}
++
+ static const struct imx8m_blk_ctrl_data imx8mp_vpu_blk_ctl_dev_data = {
+ .max_reg = 0x18,
+- .power_notifier_fn = imx8mm_vpu_power_notifier,
++ .power_notifier_fn = imx8mp_vpu_power_notifier,
+ .domains = imx8mp_vpu_blk_ctl_domain_data,
+ .num_domains = ARRAY_SIZE(imx8mp_vpu_blk_ctl_domain_data),
+ };
--- /dev/null
+From 25e252bcf1593b420b12a7231d9dd64b885a2ae2 Mon Sep 17 00:00:00 2001
+From: Peng Fan <peng.fan@nxp.com>
+Date: Wed, 10 Jun 2026 22:39:11 +0800
+Subject: pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
+
+From: Peng Fan <peng.fan@nxp.com>
+
+commit 25e252bcf1593b420b12a7231d9dd64b885a2ae2 upstream.
+
+Per errata[1]:
+ERR050531: VPU_NOC power down handshake may hang during VC8000E/VPUMIX
+power up/down cycling.
+Description: VC8000E reset de-assertion edge and AXI clock may have a
+timing issue.
+Workaround: Set bit2 (vc8000e_clk_en) of BLK_CLK_EN_CSR to 0 to gate off
+both AXI clock and VC8000E clock sent to VC8000E and AXI clock sent to
+VPU_NOC m_v_2 interface during VC8000E power up(VC8000E reset is
+de-asserted by HW)
+
+Add a bool variable is_errata_err050531 in
+'struct imx8m_blk_ctrl_domain_data' to represent whether the workaround
+is needed. If is_errata_err050531 is true, first clear the clk before
+powering up gpc, then enable the clk after powering up gpc.
+
+[1] https://www.nxp.com/webapp/Download?colCode=IMX8MP_1P33A
+
+Fixes: a1a5f15f7f6cb ("soc: imx: imx8m-blk-ctrl: add i.MX8MP VPU blk ctrl")
+Cc: stable@vger.kernel.org
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Ulf Hansson <ulfh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pmdomain/imx/imx8m-blk-ctrl.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+--- a/drivers/pmdomain/imx/imx8m-blk-ctrl.c
++++ b/drivers/pmdomain/imx/imx8m-blk-ctrl.c
+@@ -54,6 +54,15 @@ struct imx8m_blk_ctrl_domain_data {
+ * register.
+ */
+ u32 mipi_phy_rst_mask;
++
++ /*
++ * VC8000E reset de-assertion edge and AXI clock may have a timing issue.
++ * Workaround: Set bit2 (vc8000e_clk_en) of BLK_CLK_EN_CSR to 0 to gate off
++ * both AXI clock and VC8000E clock sent to VC8000E and AXI clock sent to
++ * VPU_NOC m_v_2 interface during VC8000E power up(VC8000E reset is
++ * de-asserted by HW)
++ */
++ bool is_errata_err050531;
+ };
+
+ #define DOMAIN_MAX_CLKS 4
+@@ -108,7 +117,11 @@ static int imx8m_blk_ctrl_power_on(struc
+ dev_err(bc->dev, "failed to enable clocks\n");
+ goto bus_put;
+ }
+- regmap_set_bits(bc->regmap, BLK_CLK_EN, data->clk_mask);
++
++ if (data->is_errata_err050531)
++ regmap_clear_bits(bc->regmap, BLK_CLK_EN, data->clk_mask);
++ else
++ regmap_set_bits(bc->regmap, BLK_CLK_EN, data->clk_mask);
+
+ /* power up upstream GPC domain */
+ ret = pm_runtime_get_sync(domain->power_dev);
+@@ -117,6 +130,9 @@ static int imx8m_blk_ctrl_power_on(struc
+ goto clk_disable;
+ }
+
++ if (data->is_errata_err050531)
++ regmap_set_bits(bc->regmap, BLK_CLK_EN, data->clk_mask);
++
+ /* wait for reset to propagate */
+ udelay(5);
+
+@@ -511,6 +527,7 @@ static const struct imx8m_blk_ctrl_domai
+ .clk_mask = BIT(2),
+ .path_names = (const char *[]){"vc8000e"},
+ .num_paths = 1,
++ .is_errata_err050531 = true,
+ },
+ };
+
--- /dev/null
+From bd83c98b988d2c560531084e296dbfb530aff829 Mon Sep 17 00:00:00 2001
+From: Thorsten Blum <thorsten.blum@linux.dev>
+Date: Sun, 14 Jun 2026 16:23:56 +0200
+Subject: powerpc/pseries: fix memory leak on krealloc failure in papr_init
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+commit bd83c98b988d2c560531084e296dbfb530aff829 upstream.
+
+When krealloc() fails, free the original esi_buf before returning to
+avoid a memory leak.
+
+Fixes: 3c14b73454cf ("powerpc/pseries: Interface to represent PAPR firmware attributes")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20260614142356.658212-2-thorsten.blum@linux.dev
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/platforms/pseries/papr_platform_attributes.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/arch/powerpc/platforms/pseries/papr_platform_attributes.c
++++ b/arch/powerpc/platforms/pseries/papr_platform_attributes.c
+@@ -271,11 +271,9 @@ retry:
+ esi_buf_size = ESI_HDR_SIZE + (CURR_MAX_ESI_ATTRS * max_esi_attrs);
+
+ temp_esi_buf = krealloc(esi_buf, esi_buf_size, GFP_KERNEL);
+- if (temp_esi_buf)
+- esi_buf = temp_esi_buf;
+- else
+- return -ENOMEM;
+-
++ if (!temp_esi_buf)
++ goto out_free_esi_buf;
++ esi_buf = temp_esi_buf;
+ goto retry;
+ }
+
--- /dev/null
+From 50dce2e2f84b56d8b4b406d97a1543709e8a87f5 Mon Sep 17 00:00:00 2001
+From: Abhishek Ojha <Abhishek.ojha@savoirfairelinux.com>
+Date: Wed, 15 Jul 2026 13:04:08 -0400
+Subject: regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
+
+From: Abhishek Ojha <Abhishek.ojha@savoirfairelinux.com>
+
+commit 50dce2e2f84b56d8b4b406d97a1543709e8a87f5 upstream.
+
+The LTC3676_IRQSTAT_* bit definitions do not match the IRQSTAT
+(Interrupt Request Status) register layout documented in Table 15
+of the LTC3676/LTC3676-1 datasheet:
+
+ bit 0 - Pushbutton Status Active
+ bit 1 - Hard Reset Occurred
+ bit 2 - PGOOD Timeout Occurred
+ bit 3 - Undervoltage Warning
+ bit 4 - Undervoltage Standby (Fault) Occurred
+ bit 5 - Overtemperature Warning
+ bit 6 - Overtemperature Standby (Fault) Occurred
+ bit 7 - Reserved
+
+The driver instead defines these starting at bit 3, one bit higher
+than the datasheet specifies, which causes ltc3676_regulator_isr()
+to check the wrong status bits and misreport (or miss) PGOOD
+timeout, undervoltage and thermal warning/fault conditions.
+
+Fix the bit offsets to match the datasheet.
+
+Fixes: 37b918a034fe ("regulator: Add LTC3676 support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Abhishek Ojha <Abhishek.ojha@savoirfairelinux.com>
+Link: https://patch.msgid.link/20260715170408.295552-1-Abhishek.ojha@savoirfairelinux.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/ltc3676.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/regulator/ltc3676.c
++++ b/drivers/regulator/ltc3676.c
+@@ -45,11 +45,11 @@
+ #define LTC3676_DVBxA_REF_SELECT BIT(5)
+ #define LTC3676_DVBxB_PGOOD_MASK BIT(5)
+
+-#define LTC3676_IRQSTAT_PGOOD_TIMEOUT BIT(3)
+-#define LTC3676_IRQSTAT_UNDERVOLT_WARN BIT(4)
+-#define LTC3676_IRQSTAT_UNDERVOLT_FAULT BIT(5)
+-#define LTC3676_IRQSTAT_THERMAL_WARN BIT(6)
+-#define LTC3676_IRQSTAT_THERMAL_FAULT BIT(7)
++#define LTC3676_IRQSTAT_PGOOD_TIMEOUT BIT(2)
++#define LTC3676_IRQSTAT_UNDERVOLT_WARN BIT(3)
++#define LTC3676_IRQSTAT_UNDERVOLT_FAULT BIT(4)
++#define LTC3676_IRQSTAT_THERMAL_WARN BIT(5)
++#define LTC3676_IRQSTAT_THERMAL_FAULT BIT(6)
+
+ enum ltc3676_reg {
+ LTC3676_SW1,
--- /dev/null
+From 71827776667f4e4677a4fa806bcfb24d4b8dd9d7 Mon Sep 17 00:00:00 2001
+From: Robby Cai <robby.cai@nxp.com>
+Date: Fri, 19 Jun 2026 15:31:15 +0800
+Subject: reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ
+
+From: Robby Cai <robby.cai@nxp.com>
+
+commit 71827776667f4e4677a4fa806bcfb24d4b8dd9d7 upstream.
+
+On i.MX8MQ, the MIPI CSI reset lines are active-low and not self-clearing.
+Writing '0' asserts reset and it remains asserted until explicitly
+deasserted by software.
+
+This driver previously treated the MIPI CSI reset signals as active-high,
+which led to incorrect reset assert/deassert sequencing. This issue was
+exposed by commit 6d79bb8fd2aa ("media: imx8mq-mipi-csi2: Explicitly
+release reset").
+
+Fix this by reflecting the correct reset polarity and ensuring proper
+reset handling.
+
+Fixes: c979dbf59987 ("reset: imx7: Add support for i.MX8MQ IP block variant")
+Cc: stable@vger.kernel.org # 6d79bb8fd2aa: media: imx8mq-mipi-csi2: Explicitly release reset
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Robby Cai <robby.cai@nxp.com>
+Reviewed-by: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/reset/reset-imx7.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/reset/reset-imx7.c
++++ b/drivers/reset/reset-imx7.c
+@@ -236,6 +236,12 @@ static int imx8mq_reset_set(struct reset
+
+ case IMX8MQ_RESET_PCIE_CTRL_APPS_EN:
+ case IMX8MQ_RESET_PCIE2_CTRL_APPS_EN:
++ case IMX8MQ_RESET_MIPI_CSI1_CORE_RESET:
++ case IMX8MQ_RESET_MIPI_CSI1_PHY_REF_RESET:
++ case IMX8MQ_RESET_MIPI_CSI1_ESC_RESET:
++ case IMX8MQ_RESET_MIPI_CSI2_CORE_RESET:
++ case IMX8MQ_RESET_MIPI_CSI2_PHY_REF_RESET:
++ case IMX8MQ_RESET_MIPI_CSI2_ESC_RESET:
+ case IMX8MQ_RESET_MIPI_DSI_PCLK_RESET_N:
+ case IMX8MQ_RESET_MIPI_DSI_ESC_RESET_N:
+ case IMX8MQ_RESET_MIPI_DSI_DPI_RESET_N:
--- /dev/null
+From 1a8c89f8c112c75e84ff9a140f969e372aed0c9a Mon Sep 17 00:00:00 2001
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Date: Wed, 17 Jun 2026 11:16:27 +0800
+Subject: reset: sunxi: fix memory region leak on ioremap failure
+
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+
+commit 1a8c89f8c112c75e84ff9a140f969e372aed0c9a upstream.
+
+In sunxi_reset_init(), when ioremap() fails, the memory region obtained
+via request_mem_region() is not released, leading to a resource leak.
+
+Add an err_mem_region label to properly release the memory region before
+freeing the data structure.
+
+Fixes: 8f1ae77f4666 ("reset: Add Allwinner SoCs Reset Controller Driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/reset/reset-sunxi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/reset/reset-sunxi.c
++++ b/drivers/reset/reset-sunxi.c
+@@ -44,7 +44,7 @@ static int sunxi_reset_init(struct devic
+ data->membase = ioremap(res.start, size);
+ if (!data->membase) {
+ ret = -ENOMEM;
+- goto err_alloc;
++ goto err_mem_region;
+ }
+
+ spin_lock_init(&data->lock);
+@@ -57,6 +57,8 @@ static int sunxi_reset_init(struct devic
+
+ return reset_controller_register(&data->rcdev);
+
++err_mem_region:
++ release_mem_region(res.start, size);
+ err_alloc:
+ kfree(data);
+ return ret;
--- /dev/null
+From ad6dcfa023762e37962f77ee48e752b7570e9440 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <thomas.weissschuh@linutronix.de>
+Date: Wed, 1 Jul 2026 11:21:22 +0200
+Subject: riscv: vdso: Do not use LTO for the vDSO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+commit ad6dcfa023762e37962f77ee48e752b7570e9440 upstream.
+
+With LTO enabled the compiler assumes that the vDSO functions are not
+used and optimizes them away completely. Currently this happens to
+__vdso_clock_getres(), __vdso_clock_gettime(), __vdso_getrandom(),
+__vdso_gettimeofday() and __vdso_riscv_hwprobe().
+
+Disable LTO for the vDSO, as these functions are hand-optimized anyways.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202606301855.WvkSC4kD-lkp@intel.com/
+Fixes: 021d23428bdb ("RISC-V: build: Allow LTO to be selected")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Link: https://patch.msgid.link/20260701-riscv-vdso-lto-v1-1-89db0cd82077@linutronix.de
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/kernel/vdso/Makefile | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/riscv/kernel/vdso/Makefile
++++ b/arch/riscv/kernel/vdso/Makefile
+@@ -49,9 +49,9 @@ CPPFLAGS_vdso.lds += -DHAS_VGETTIMEOFDAY
+ endif
+
+ # Disable -pg to prevent insert call site
+-CFLAGS_REMOVE_vgettimeofday.o = $(CC_FLAGS_FTRACE) $(CC_FLAGS_SCS)
+-CFLAGS_REMOVE_getrandom.o = $(CC_FLAGS_FTRACE) $(CC_FLAGS_SCS)
+-CFLAGS_REMOVE_hwprobe.o = $(CC_FLAGS_FTRACE) $(CC_FLAGS_SCS)
++CFLAGS_REMOVE_vgettimeofday.o = $(CC_FLAGS_FTRACE) $(CC_FLAGS_SCS) $(CC_FLAGS_LTO)
++CFLAGS_REMOVE_getrandom.o = $(CC_FLAGS_FTRACE) $(CC_FLAGS_SCS) $(CC_FLAGS_LTO)
++CFLAGS_REMOVE_hwprobe.o = $(CC_FLAGS_FTRACE) $(CC_FLAGS_SCS) $(CC_FLAGS_LTO)
+
+ # Force dependency
+ $(obj)/vdso.o: $(obj)/vdso.so
--- /dev/null
+From d793186aa3bb833c878ae6826c87e62c843afaa3 Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Thu, 9 Jul 2026 18:43:40 +0200
+Subject: selftests/landlock: Fix screwed up pointers in the scoped_signal_test
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Huth <thuth@redhat.com>
+
+commit d793186aa3bb833c878ae6826c87e62c843afaa3 upstream.
+
+The scoped_signal_test uses pthread_join(..., (void **)&ret)) in
+a couple of places, i.e. the return value of the thread is stored
+in the shape of a "void *" into the memory location of &ret.
+Pointers are 64-bit on modern computers, but the ret variable is
+declared as a simple "enum thread_return" which is only 32 bits.
+So the pthread_join() will overflow the ret variable by 4 byte.
+
+The problem is very visible on big endian systems like s390x
+where the test is failing: The least significant byte that carries
+the return code of the thread is not written into the ret variable
+here, but somewhere else in the stack frame, so the comparison
+for the right return code is failing here.
+
+Fix it by getting rid of the enum and defining the THREAD_* constants
+and "ret" variables as proper "void *" pointers. This way we can
+also get rid of some ugly (void *) castings in a couple of spots.
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Link: https://patch.msgid.link/20260709164340.339656-1-thuth@redhat.com
+Cc: stable@vger.kernel.org
+Fixes: c8994965013e ("selftests/landlock: Test signal scoping for threads")
+[mic: Add clang-format markups]
+Signed-off-by: Mickaël Salaün <mic@digikod.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/landlock/scoped_signal_test.c | 46 +++++++++---------
+ 1 file changed, 23 insertions(+), 23 deletions(-)
+
+--- a/tools/testing/selftests/landlock/scoped_signal_test.c
++++ b/tools/testing/selftests/landlock/scoped_signal_test.c
+@@ -249,12 +249,12 @@ TEST_F(scoped_domains, check_access_sign
+ _metadata->exit_code = KSFT_FAIL;
+ }
+
+-enum thread_return {
+- THREAD_INVALID = 0,
+- THREAD_SUCCESS = 1,
+- THREAD_ERROR = 2,
+- THREAD_TEST_FAILED = 3,
+-};
++/* clang-format off */
++#define THREAD_INVALID ((void *)0)
++#define THREAD_SUCCESS ((void *)1)
++#define THREAD_ERROR ((void *)2)
++#define THREAD_TEST_FAILED ((void *)3)
++/* clang-format on */
+
+ static void *thread_sync(void *arg)
+ {
+@@ -262,15 +262,15 @@ static void *thread_sync(void *arg)
+ char buf;
+
+ if (read(pipe_read, &buf, 1) != 1)
+- return (void *)THREAD_ERROR;
++ return THREAD_ERROR;
+
+- return (void *)THREAD_SUCCESS;
++ return THREAD_SUCCESS;
+ }
+
+ TEST(signal_scoping_thread_before)
+ {
+ pthread_t no_sandbox_thread;
+- enum thread_return ret = THREAD_INVALID;
++ void *ret = THREAD_INVALID;
+ int thread_pipe[2];
+
+ drop_caps(_metadata);
+@@ -285,7 +285,7 @@ TEST(signal_scoping_thread_before)
+ EXPECT_EQ(0, pthread_kill(no_sandbox_thread, 0));
+ EXPECT_EQ(1, write(thread_pipe[1], ".", 1));
+
+- EXPECT_EQ(0, pthread_join(no_sandbox_thread, (void **)&ret));
++ EXPECT_EQ(0, pthread_join(no_sandbox_thread, &ret));
+ EXPECT_EQ(THREAD_SUCCESS, ret);
+
+ EXPECT_EQ(0, close(thread_pipe[0]));
+@@ -295,7 +295,7 @@ TEST(signal_scoping_thread_before)
+ TEST(signal_scoping_thread_after)
+ {
+ pthread_t scoped_thread;
+- enum thread_return ret = THREAD_INVALID;
++ void *ret = THREAD_INVALID;
+ int thread_pipe[2];
+
+ drop_caps(_metadata);
+@@ -310,7 +310,7 @@ TEST(signal_scoping_thread_after)
+ EXPECT_EQ(0, pthread_kill(scoped_thread, 0));
+ EXPECT_EQ(1, write(thread_pipe[1], ".", 1));
+
+- EXPECT_EQ(0, pthread_join(scoped_thread, (void **)&ret));
++ EXPECT_EQ(0, pthread_join(scoped_thread, &ret));
+ EXPECT_EQ(THREAD_SUCCESS, ret);
+
+ EXPECT_EQ(0, close(thread_pipe[0]));
+@@ -327,20 +327,20 @@ void *thread_setuid(void *ptr)
+ char buf;
+
+ if (read(arg->pipe_read, &buf, 1) != 1)
+- return (void *)THREAD_ERROR;
++ return THREAD_ERROR;
+
+ /* libc's setuid() should update all thread's credentials. */
+ if (getuid() != arg->new_uid)
+- return (void *)THREAD_TEST_FAILED;
++ return THREAD_TEST_FAILED;
+
+- return (void *)THREAD_SUCCESS;
++ return THREAD_SUCCESS;
+ }
+
+ TEST(signal_scoping_thread_setuid)
+ {
+ struct thread_setuid_args arg;
+ pthread_t no_sandbox_thread;
+- enum thread_return ret = THREAD_INVALID;
++ void *ret = THREAD_INVALID;
+ int pipe_parent[2];
+ int prev_uid;
+
+@@ -367,7 +367,7 @@ TEST(signal_scoping_thread_setuid)
+ EXPECT_EQ(arg.new_uid, getuid());
+ EXPECT_EQ(1, write(pipe_parent[1], ".", 1));
+
+- EXPECT_EQ(0, pthread_join(no_sandbox_thread, (void **)&ret));
++ EXPECT_EQ(0, pthread_join(no_sandbox_thread, &ret));
+ EXPECT_EQ(THREAD_SUCCESS, ret);
+
+ clear_cap(_metadata, CAP_SETUID);
+@@ -688,20 +688,20 @@ static void *thread_setown_scoped(void *
+ ruleset_fd =
+ landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
+ if (ruleset_fd < 0)
+- return (void *)THREAD_ERROR;
++ return THREAD_ERROR;
+ if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) ||
+ landlock_restrict_self(ruleset_fd, 0)) {
+ close(ruleset_fd);
+- return (void *)THREAD_ERROR;
++ return THREAD_ERROR;
+ }
+ close(ruleset_fd);
+
+ /* Makes this process group own the SIGIO source. */
+ if (fcntl(fd, F_SETSIG, SIGURG) || fcntl(fd, F_SETOWN, -getpgrp()) ||
+ fcntl(fd, F_SETFL, O_ASYNC))
+- return (void *)THREAD_ERROR;
++ return THREAD_ERROR;
+
+- return (void *)THREAD_SUCCESS;
++ return THREAD_SUCCESS;
+ }
+
+ /*
+@@ -723,7 +723,7 @@ TEST(sigio_to_pgid_self)
+ {
+ int trigger[2];
+ pthread_t thread;
+- enum thread_return ret = THREAD_INVALID;
++ void *ret = THREAD_INVALID;
+ int i;
+
+ drop_caps(_metadata);
+@@ -743,7 +743,7 @@ TEST(sigio_to_pgid_self)
+ */
+ ASSERT_EQ(0, pthread_create(&thread, NULL, thread_setown_scoped,
+ &trigger[0]));
+- ASSERT_EQ(0, pthread_join(thread, (void **)&ret));
++ ASSERT_EQ(0, pthread_join(thread, &ret));
+ ASSERT_EQ(THREAD_SUCCESS, ret);
+
+ /* Fans SIGURG out to the process group. */
--- /dev/null
+From 5ab1dc6d110db6bee167a32fd94c53ea0e7ad6d2 Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Fri, 10 Jul 2026 10:16:42 +0200
+Subject: selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Huth <thuth@redhat.com>
+
+commit 5ab1dc6d110db6bee167a32fd94c53ea0e7ad6d2 upstream.
+
+MSG_OOB might be disabled in the kernel for unix sockets (by not
+selecting CONFIG_AF_UNIX_OOB), and in this case the related tests
+of the scoped_signal_test are currently failing. Add a runtime
+probe using socketpair() to detect MSG_OOB support and skip the
+test gracefully if it is unavailable.
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Link: https://patch.msgid.link/20260710081642.405916-1-thuth@redhat.com
+Cc: stable@vger.kernel.org
+Fixes: f34e9ce5f479 ("selftests/landlock: Test signal created by out-of-bound message")
+Signed-off-by: Mickaël Salaün <mic@digikod.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/landlock/scoped_signal_test.c | 21 ++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/tools/testing/selftests/landlock/scoped_signal_test.c
++++ b/tools/testing/selftests/landlock/scoped_signal_test.c
+@@ -400,6 +400,24 @@ static int setup_signal_handler(int sign
+ return sigaction(SIGURG, &sa, NULL);
+ }
+
++/*
++ * MSG_OOB might be disabled in the kernel via the CONFIG_AF_UNIX_OOB
++ * switch, so this function can be used for probing for its availability.
++ */
++static bool has_af_unix_oob(void)
++{
++ bool available = false;
++ int sp[2];
++
++ if (socketpair(AF_UNIX, SOCK_STREAM, 0, sp) == 0) {
++ available = (send(sp[0], ".", 1, MSG_OOB) == 1);
++ close(sp[0]);
++ close(sp[1]);
++ }
++
++ return available;
++}
++
+ /* clang-format off */
+ FIXTURE(fown) {};
+ /* clang-format on */
+@@ -462,6 +480,9 @@ TEST_F(fown, sigurg_socket)
+ int pipe_parent[2], pipe_child[2];
+ pid_t child;
+
++ if (!has_af_unix_oob())
++ SKIP(return, "CONFIG_AF_UNIX_OOB / MSG_OOB not available");
++
+ memset(&server_address, 0, sizeof(server_address));
+ set_unix_address(&server_address, 0);
+
s390-mm-fix-type-mismatch-in-get_align_mask.patch
selftests-rseq-fix-a-building-error-for-riscv-arch.patch
cgroup-cpuset-rebind-mm-mempolicy-to-effective_mems-not-mems_allowed.patch
+pmdomain-imx-fix-i.mx8mp-power-notifier.patch
+pmdomain-imx-fix-i.mx8mp-vc8000e-power-up-sequence.patch
+selftests-landlock-skip-scoped_signal-subtest-with-msg_oob-if-not-available.patch
+selftests-landlock-fix-screwed-up-pointers-in-the-scoped_signal_test.patch
+mmc-sdhci-esdhc-imx-restore-pinctrl-before-restoring-ios-timing-on-resume.patch
+powerpc-pseries-fix-memory-leak-on-krealloc-failure-in-papr_init.patch
+net-mlx5-free-mlx5_st_idx_data-on-final-dealloc.patch
+wifi-rt2x00-avoid-full-teardown-before-work-setup-in-probe.patch
+wifi-mwifiex-fix-roaming-to-different-channel-in-host_mlme-mode.patch
+wifi-mac80211-fix-memory-leak-in-ieee80211_register_hw.patch
+wifi-brcmfmac-cyw-fix-heap-overflow-on-a-short-auth-frame.patch
+riscv-vdso-do-not-use-lto-for-the-vdso.patch
+regulator-ltc3676-fix-incorrect-irqstat-bit-offsets.patch
+net-openvswitch-reject-oversized-nested-action-attrs.patch
+bluetooth-btrtl-validate-firmware-patch-bounds.patch
+llc-fix-sap-refcount-leak-when-creating-incoming-sockets.patch
+macsec-fix-promiscuity-refcount-leak-in-macsec_dev_open.patch
+memstick-ms_block-reject-a-card-that-reports-too-many-blocks.patch
+ipvs-fix-more-places-with-wrong-ipv6-transport-offsets.patch
+ipvs-reload-ip-header-after-head-reallocation.patch
+reset-imx7-correct-polarity-of-mipi-csi-resets-on-i.mx8mq.patch
+reset-sunxi-fix-memory-region-leak-on-ioremap-failure.patch
--- /dev/null
+From 240c8d2c717b3f8153e7e877b22a82518d78dbdc Mon Sep 17 00:00:00 2001
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+Date: Sat, 27 Jun 2026 21:13:13 +0800
+Subject: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
+
+From: Maoyi Xie <maoyixie.tju@gmail.com>
+
+commit 240c8d2c717b3f8153e7e877b22a82518d78dbdc upstream.
+
+brcmf_notify_auth_frame_rx() takes the frame length from the firmware
+event and copies the frame body with the management header offset
+subtracted:
+
+ u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data);
+ ...
+ memcpy(&mgmt_frame->u, frame,
+ mgmt_frame_len - offsetof(struct ieee80211_mgmt, u));
+
+The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len
+can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When
+mgmt_frame_len is below that, the subtraction wraps as an unsigned value to
+a huge length. The memcpy then runs far past the kzalloc'd buffer. A
+malicious or malfunctioning AP can make the frame short during the
+external SAE auth exchange, so this is a remotely triggered heap overflow.
+
+Reject frames shorter than the management header offset before the copy.
+
+Fixes: 66f909308a7c ("wifi: brcmfmac: cyw: support external SAE authentication in station mode")
+Link: https://lore.kernel.org/r/178214417708.2368577.16740907093694208834@maoyixie.com
+Cc: stable@vger.kernel.org
+Co-developed-by: Kaixuan Li <kaixuan.li@ntu.edu.sg>
+Signed-off-by: Kaixuan Li <kaixuan.li@ntu.edu.sg>
+Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Link: https://patch.msgid.link/20260627131313.3878893-1-maoyixie.tju@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
+@@ -294,6 +294,12 @@ brcmf_notify_auth_frame_rx(struct brcmf_
+ return -EINVAL;
+ }
+
++ if (mgmt_frame_len < offsetof(struct ieee80211_mgmt, u)) {
++ bphy_err(drvr, "Event %s (%d) frame too small. Ignore\n",
++ brcmf_fweh_event_name(e->event_code), e->event_code);
++ return -EINVAL;
++ }
++
+ wdev = &ifp->vif->wdev;
+ WARN_ON(!wdev);
+
--- /dev/null
+From 95fc02722edde02946d0d475221f2b2054d3d8ba Mon Sep 17 00:00:00 2001
+From: Dawei Feng <dawei.feng@seu.edu.cn>
+Date: Mon, 6 Jul 2026 22:35:07 +0800
+Subject: wifi: mac80211: fix memory leak in ieee80211_register_hw()
+
+From: Dawei Feng <dawei.feng@seu.edu.cn>
+
+commit 95fc02722edde02946d0d475221f2b2054d3d8ba upstream.
+
+If kmemdup() fails while copying supported band structures, the error
+path jumps to fail_rate. This skips rate_control_deinitialize() and
+leaks the initialized local->rate_ctrl.
+
+Fix this by adding a fail_band label that shares the rate-control cleanup
+path before falling through to the remaining teardown.
+
+The bug was first flagged by an experimental analysis tool we are
+developing for kernel memory-management bugs while analyzing
+v6.13-rc1. The tool is still under development and is not yet publicly
+available. Manual inspection confirms that the bug is still present in
+v7.1-rc7.
+
+An x86_64 allyesconfig build showed no new warnings. As we do not have a
+suitable mac80211 device/driver combination to test with, no runtime
+testing was able to be performed.
+
+Fixes: 09b4a4faf9d0 ("mac80211: introduce capability flags for VHT EXT NSS support")
+Cc: stable@vger.kernel.org
+Reviewed-by: Zilin Guan <zilin@seu.edu.cn>
+Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
+Link: https://patch.msgid.link/20260706143507.146131-1-dawei.feng@seu.edu.cn
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1575,7 +1575,7 @@ int ieee80211_register_hw(struct ieee802
+ sband = kmemdup(sband, sizeof(*sband), GFP_KERNEL);
+ if (!sband) {
+ result = -ENOMEM;
+- goto fail_rate;
++ goto fail_band;
+ }
+
+ wiphy_dbg(hw->wiphy, "copying sband (band %d) due to VHT EXT NSS BW flag\n",
+@@ -1642,6 +1642,7 @@ int ieee80211_register_hw(struct ieee802
+ #endif
+ wiphy_unregister(local->hw.wiphy);
+ fail_wiphy_register:
++ fail_band:
+ rtnl_lock();
+ rate_control_deinitialize(local);
+ ieee80211_remove_interfaces(local);
--- /dev/null
+From a707e4127c0f893c7a7703500ab56297a5bd2d51 Mon Sep 17 00:00:00 2001
+From: Rafael Beims <rafael.beims@toradex.com>
+Date: Wed, 10 Jun 2026 12:00:18 -0300
+Subject: wifi: mwifiex: fix roaming to different channel in host_mlme mode
+
+From: Rafael Beims <rafael.beims@toradex.com>
+
+commit a707e4127c0f893c7a7703500ab56297a5bd2d51 upstream.
+
+When host MLME is enabled, mwifiex_cfg80211_authenticate() transmits the
+authentication frame on a remain-on-channel (ROC) reservation so that the
+frame is sent on the target BSS's channel. The ROC is only configured
+when priv->auth_flag is zero.
+
+priv->auth_flag is set to HOST_MLME_AUTH_PENDING when the auth frame is
+queued and advances to HOST_MLME_AUTH_DONE once authentication
+completes. It is only cleared back to zero on a disconnect, deauth or
+timeout path; nothing clears it when an association succeeds. It therefore
+stays at HOST_MLME_AUTH_DONE for the whole connected session.
+
+When the station later roams to a BSS on a different channel, the next
+authentication finds auth_flag != 0, skips the ROC setup, and the auth
+frame is transmitted on the currently-associated channel instead of the
+target's channel. Authentication times out on the new AP and the device
+stays connected to the original AP.
+
+Gate the ROC setup on HOST_MLME_AUTH_PENDING instead of on auth_flag
+being completely clear. This re-arms the remain-on-channel for every new
+authentication attempt, while still suppressing a redundant ROC during
+the multi-frame SAE exchange, where auth_flag stays PENDING between the
+commit and confirm frames.
+
+This change was tested in 3 different devices:
+Verdin AM62 (IW412 SD-UART) - (16.92.21.p142)
+Verdin iMX8MM (W8997 SD-SD) - (16.68.1.p197)
+Verdin iMX8MP (W8997 SD-UART) - (16.92.21.p137)
+
+There following loop tests were performed:
+1) force roaming between two AP's, one 5GHz and one 2.4GHz, same
+SSID. Use wpa_cli to trigger the roaming behavior, sleep 2s
+between iterations.
+2) force a disconnection to AP 1 and a connection to AP 2, test
+scan. Use wpa_cli to trigger the connection changes, sleep 2s
+between iterations.
+
+Each test ran in each device for at least 3 hours.
+
+Fixes: 36995892c271 ("wifi: mwifiex: add host mlme for client mode")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-7
+Signed-off-by: Rafael Beims <rafael.beims@toradex.com>
+Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Link: https://patch.msgid.link/20260610150021.1018611-1-rafael@beims.me
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -4326,7 +4326,7 @@ mwifiex_cfg80211_authenticate(struct wip
+ return -EOPNOTSUPP;
+ }
+
+- if (!priv->auth_flag) {
++ if (!(priv->auth_flag & HOST_MLME_AUTH_PENDING)) {
+ ret = mwifiex_remain_on_chan_cfg(priv, HostCmd_ACT_GEN_SET,
+ req->bss->channel,
+ AUTH_TX_DEFAULT_WAIT_TIME);
--- /dev/null
+From 536fb3d739d75a03cb318c0c6fe799425cfea501 Mon Sep 17 00:00:00 2001
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Date: Fri, 19 Jun 2026 15:31:04 +0800
+Subject: wifi: rt2x00: avoid full teardown before work setup in probe
+
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+
+commit 536fb3d739d75a03cb318c0c6fe799425cfea501 upstream.
+
+rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for
+all probe failures. However, drv_data allocation and workqueue allocation
+can fail before intf_work, autowakeup_work and sleep_work have been
+initialized.
+
+Do not enter the full remove path until the probe has reached the point
+where those work items are set up. Return directly for drv_data allocation
+failure, and use a small early cleanup path for workqueue allocation
+failure.
+
+This issue was found by our static analysis tool and then confirmed by
+manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The
+early probe exits should not call a common teardown path that assumes the
+later work setup has already completed.
+
+A QEMU PoC forced alloc_ordered_workqueue() to fail before the work
+initializers are reached. The resulting fail path entered
+rt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with
+rt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack.
+
+Fixes: 1ebbc48520a0 ("rt2x00: Introduce concept of driver data in struct rt2x00_dev.")
+Fixes: 0439f5367c8d ("rt2x00: Move TX/RX work into dedicated workqueue")
+Cc: stable@vger.kernel.org
+Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Link: https://patch.msgid.link/20260619073104.1809161-1-runyu.xiao@seu.edu.cn
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+@@ -1382,7 +1382,7 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+ GFP_KERNEL);
+ if (!rt2x00dev->drv_data) {
+ retval = -ENOMEM;
+- goto exit;
++ return retval;
+ }
+ }
+
+@@ -1416,7 +1416,7 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+ alloc_ordered_workqueue("%s", 0, wiphy_name(rt2x00dev->hw->wiphy));
+ if (!rt2x00dev->workqueue) {
+ retval = -ENOMEM;
+- goto exit;
++ goto exit_free_drv_data;
+ }
+
+ INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
+@@ -1489,6 +1489,14 @@ exit:
+ rt2x00lib_remove_dev(rt2x00dev);
+
+ return retval;
++
++exit_free_drv_data:
++ clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
++
++ kfree(rt2x00dev->drv_data);
++ rt2x00dev->drv_data = NULL;
++
++ return retval;
+ }
+ EXPORT_SYMBOL_GPL(rt2x00lib_probe_dev);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
