--- /dev/null
+From 71e399f816a34f215c57aca1d348c8d22941efcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 10:04:58 -0500
+Subject: iio: adc: ad7949: use spi_is_bpw_supported()
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 7b86482632788acd48d7b9ee1867f5ad3a32ccbb ]
+
+Use spi_is_bpw_supported() instead of directly accessing spi->controller
+->bits_per_word_mask. bits_per_word_mask may be 0, which implies that
+8-bits-per-word is supported. spi_is_bpw_supported() takes this into
+account while spi_ctrl_mask == SPI_BPW_MASK(8) does not.
+
+Fixes: 0b2a740b424e ("iio: adc: ad7949: enable use with non 14/16-bit controllers")
+Closes: https://lore.kernel.org/linux-spi/c8b8a963-6cef-4c9b-bfef-dab2b7bd0b0f@sirena.org.uk/
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Link: https://patch.msgid.link/20250611-iio-adc-ad7949-use-spi_is_bpw_supported-v1-1-c4e15bfd326e@baylibre.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad7949.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iio/adc/ad7949.c b/drivers/iio/adc/ad7949.c
+index edd0c3a35ab73..202561cad4012 100644
+--- a/drivers/iio/adc/ad7949.c
++++ b/drivers/iio/adc/ad7949.c
+@@ -308,7 +308,6 @@ static void ad7949_disable_reg(void *reg)
+
+ static int ad7949_spi_probe(struct spi_device *spi)
+ {
+- u32 spi_ctrl_mask = spi->controller->bits_per_word_mask;
+ struct device *dev = &spi->dev;
+ const struct ad7949_adc_spec *spec;
+ struct ad7949_adc_chip *ad7949_adc;
+@@ -337,11 +336,11 @@ static int ad7949_spi_probe(struct spi_device *spi)
+ ad7949_adc->resolution = spec->resolution;
+
+ /* Set SPI bits per word */
+- if (spi_ctrl_mask & SPI_BPW_MASK(ad7949_adc->resolution)) {
++ if (spi_is_bpw_supported(spi, ad7949_adc->resolution)) {
+ spi->bits_per_word = ad7949_adc->resolution;
+- } else if (spi_ctrl_mask == SPI_BPW_MASK(16)) {
++ } else if (spi_is_bpw_supported(spi, 16)) {
+ spi->bits_per_word = 16;
+- } else if (spi_ctrl_mask == SPI_BPW_MASK(8)) {
++ } else if (spi_is_bpw_supported(spi, 8)) {
+ spi->bits_per_word = 8;
+ } else {
+ dev_err(dev, "unable to find common BPW with spi controller\n");
+--
+2.39.5
+
--- /dev/null
+From 82f7e4182d9ba7c5608d3426adbbc975db249704 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 22:53:38 +0800
+Subject: interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node
+
+From: Xilin Wu <sophon@radxa.com>
+
+[ Upstream commit 886a94f008dd1a1702ee66dd035c266f70fd9e90 ]
+
+This allows adding interconnect paths for PCIe 1 in device tree later.
+
+Fixes: 46bdcac533cc ("interconnect: qcom: Add SC7280 interconnect provider driver")
+Signed-off-by: Xilin Wu <sophon@radxa.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250613-sc7280-icc-pcie1-fix-v1-1-0b09813e3b09@radxa.com
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sc7280.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/interconnect/qcom/sc7280.c b/drivers/interconnect/qcom/sc7280.c
+index 167971f8e8bec..fdb02a87e3124 100644
+--- a/drivers/interconnect/qcom/sc7280.c
++++ b/drivers/interconnect/qcom/sc7280.c
+@@ -238,6 +238,7 @@ static struct qcom_icc_node xm_pcie3_1 = {
+ .id = SC7280_MASTER_PCIE_1,
+ .channels = 1,
+ .buswidth = 8,
++ .num_links = 1,
+ .links = { SC7280_SLAVE_ANOC_PCIE_GEM_NOC },
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 9cb0b869619a81ff26ea71dda70fbee06bf92768 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 06:09:01 -0400
+Subject: platform/mellanox: mlxbf-pmc: Remove newline char from event name
+ input
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shravan Kumar Ramani <shravankr@nvidia.com>
+
+[ Upstream commit 44e6ca8faeeed12206f3e7189c5ac618b810bb9c ]
+
+Since the input string passed via the command line appends a newline char,
+it needs to be removed before comparison with the event_list.
+
+Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver")
+Signed-off-by: Shravan Kumar Ramani <shravankr@nvidia.com>
+Reviewed-by: David Thompson <davthompson@nvidia.com>
+Link: https://lore.kernel.org/r/4978c18e33313b48fa2ae7f3aa6dbcfce40877e4.1751380187.git.shravankr@nvidia.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/mellanox/mlxbf-pmc.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c
+index fbb8128d19de4..afc07905e235e 100644
+--- a/drivers/platform/mellanox/mlxbf-pmc.c
++++ b/drivers/platform/mellanox/mlxbf-pmc.c
+@@ -15,6 +15,7 @@
+ #include <linux/hwmon.h>
+ #include <linux/platform_device.h>
+ #include <linux/string.h>
++#include <linux/string_helpers.h>
+ #include <uapi/linux/psci.h>
+
+ #define MLXBF_PMC_WRITE_REG_32 0x82000009
+@@ -1625,6 +1626,7 @@ static ssize_t mlxbf_pmc_event_store(struct device *dev,
+ attr, struct mlxbf_pmc_attribute, dev_attr);
+ unsigned int blk_num, cnt_num;
+ bool is_l3 = false;
++ char *evt_name;
+ int evt_num;
+ int err;
+
+@@ -1632,8 +1634,14 @@ static ssize_t mlxbf_pmc_event_store(struct device *dev,
+ cnt_num = attr_event->index;
+
+ if (isalpha(buf[0])) {
++ /* Remove the trailing newline character if present */
++ evt_name = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL);
++ if (!evt_name)
++ return -ENOMEM;
++
+ evt_num = mlxbf_pmc_get_event_num(pmc->block_name[blk_num],
+- buf);
++ evt_name);
++ kfree(evt_name);
+ if (evt_num < 0)
+ return -EINVAL;
+ } else {
+--
+2.39.5
+
--- /dev/null
+From 59ce39a537d61b5aa15f6d53519f909a9c603a0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 06:09:02 -0400
+Subject: platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shravan Kumar Ramani <shravankr@nvidia.com>
+
+[ Upstream commit 0e2cebd72321caeef84b6ba7084e85be0287fb4b ]
+
+For setting the enable value, the input should be 0 or 1 only. Use
+kstrtobool() in place of kstrtoint() in mlxbf_pmc_enable_store() to
+accept only valid input.
+
+Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3")
+Signed-off-by: Shravan Kumar Ramani <shravankr@nvidia.com>
+Reviewed-by: David Thompson <davthompson@nvidia.com>
+Link: https://lore.kernel.org/r/2ee618c59976bcf1379d5ddce2fc60ab5014b3a9.1751380187.git.shravankr@nvidia.com
+[ij: split kstrbool() change to own commit.]
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/mellanox/mlxbf-pmc.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c
+index d305d23cf5199..9a0220b4de3c8 100644
+--- a/drivers/platform/mellanox/mlxbf-pmc.c
++++ b/drivers/platform/mellanox/mlxbf-pmc.c
+@@ -1731,13 +1731,14 @@ static ssize_t mlxbf_pmc_enable_store(struct device *dev,
+ {
+ struct mlxbf_pmc_attribute *attr_enable = container_of(
+ attr, struct mlxbf_pmc_attribute, dev_attr);
+- unsigned int en, blk_num;
++ unsigned int blk_num;
+ u32 word;
+ int err;
++ bool en;
+
+ blk_num = attr_enable->nr;
+
+- err = kstrtouint(buf, 0, &en);
++ err = kstrtobool(buf, &en);
+ if (err < 0)
+ return err;
+
+@@ -1757,14 +1758,11 @@ static ssize_t mlxbf_pmc_enable_store(struct device *dev,
+ MLXBF_PMC_CRSPACE_PERFMON_CTL(pmc->block[blk_num].counters),
+ MLXBF_PMC_WRITE_REG_32, word);
+ } else {
+- if (en && en != 1)
+- return -EINVAL;
+-
+ err = mlxbf_pmc_config_l3_counters(blk_num, false, !!en);
+ if (err)
+ return err;
+
+- if (en == 1) {
++ if (en) {
+ err = mlxbf_pmc_config_l3_counters(blk_num, true, false);
+ if (err)
+ return err;
+--
+2.39.5
+
--- /dev/null
+From 1aae1684fee43d9b1024a384c5244d216a96cc07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 06:09:02 -0400
+Subject: platform/mellanox: mlxbf-pmc: Validate event/enable input
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shravan Kumar Ramani <shravankr@nvidia.com>
+
+[ Upstream commit f8c1311769d3b2c82688b294b4ae03e94f1c326d ]
+
+Before programming the event info, validate the event number received as input
+by checking if it exists in the event_list. Also fix a typo in the comment for
+mlxbf_pmc_get_event_name() to correctly mention that it returns the event name
+when taking the event number as input, and not the other way round.
+
+Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3")
+Signed-off-by: Shravan Kumar Ramani <shravankr@nvidia.com>
+Reviewed-by: David Thompson <davthompson@nvidia.com>
+Link: https://lore.kernel.org/r/2ee618c59976bcf1379d5ddce2fc60ab5014b3a9.1751380187.git.shravankr@nvidia.com
+[ij: split kstrbool() change to own commit.]
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/mellanox/mlxbf-pmc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c
+index afc07905e235e..d305d23cf5199 100644
+--- a/drivers/platform/mellanox/mlxbf-pmc.c
++++ b/drivers/platform/mellanox/mlxbf-pmc.c
+@@ -1068,7 +1068,7 @@ static int mlxbf_pmc_get_event_num(const char *blk, const char *evt)
+ return -ENODEV;
+ }
+
+-/* Get the event number given the name */
++/* Get the event name given the number */
+ static char *mlxbf_pmc_get_event_name(const char *blk, u32 evt)
+ {
+ const struct mlxbf_pmc_events *events;
+@@ -1648,6 +1648,9 @@ static ssize_t mlxbf_pmc_event_store(struct device *dev,
+ err = kstrtouint(buf, 0, &evt_num);
+ if (err < 0)
+ return err;
++
++ if (!mlxbf_pmc_get_event_name(pmc->block_name[blk_num], evt_num))
++ return -EINVAL;
+ }
+
+ if (strstr(pmc->block_name[blk_num], "l3cache"))
+--
+2.39.5
+
--- /dev/null
+From 21b2ca2cfcb00f73bc838c64c86e22ff32e97cb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 03:33:01 -0400
+Subject: platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo
+ UX8406CA
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rahul Chandra <rahul@chandra.net>
+
+[ Upstream commit 7dc6b2d3b5503bcafebbeaf9818112bf367107b4 ]
+
+Add a DMI quirk entry for the ASUS Zenbook Duo UX8406CA 2025 model to use
+the existing zenbook duo keyboard quirk.
+
+Signed-off-by: Rahul Chandra <rahul@chandra.net>
+Link: https://lore.kernel.org/r/20250624073301.602070-1-rahul@chandra.net
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index a5933980ade3d..90ad0045fec5f 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -529,6 +529,15 @@ static const struct dmi_system_id asus_quirks[] = {
+ },
+ .driver_data = &quirk_asus_zenbook_duo_kbd,
+ },
++ {
++ .callback = dmi_matched,
++ .ident = "ASUS Zenbook Duo UX8406CA",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "UX8406CA"),
++ },
++ .driver_data = &quirk_asus_zenbook_duo_kbd,
++ },
+ {},
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 3128a50b8a58cb429e1d157c879827270655ce50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:32:54 +0200
+Subject: platform/x86: Fix initialization order for firmware_attributes_class
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Torsten Hilbrich <torsten.hilbrich@secunet.com>
+
+[ Upstream commit 2bfe3ae1aa45f8b61cb0dc462114fd0c9636ad32 ]
+
+The think-lmi driver uses the firwmare_attributes_class. But this class
+is registered after think-lmi, causing the "think-lmi" directory in
+"/sys/class/firmware-attributes" to be missing when the driver is
+compiled as builtin.
+
+Fixes: 55922403807a ("platform/x86: think-lmi: Directly use firmware_attributes_class")
+Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
+Link: https://lore.kernel.org/r/7dce5f7f-c348-4350-ac53-d14a8e1e8034@secunet.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
+index e1b1429470674..4631c7bb22cd0 100644
+--- a/drivers/platform/x86/Makefile
++++ b/drivers/platform/x86/Makefile
+@@ -58,6 +58,8 @@ obj-$(CONFIG_X86_PLATFORM_DRIVERS_HP) += hp/
+ # Hewlett Packard Enterprise
+ obj-$(CONFIG_UV_SYSFS) += uv_sysfs.o
+
++obj-$(CONFIG_FW_ATTR_CLASS) += firmware_attributes_class.o
++
+ # IBM Thinkpad and Lenovo
+ obj-$(CONFIG_IBM_RTL) += ibm_rtl.o
+ obj-$(CONFIG_IDEAPAD_LAPTOP) += ideapad-laptop.o
+@@ -120,7 +122,6 @@ obj-$(CONFIG_SYSTEM76_ACPI) += system76_acpi.o
+ obj-$(CONFIG_TOPSTAR_LAPTOP) += topstar-laptop.o
+
+ # Platform drivers
+-obj-$(CONFIG_FW_ATTR_CLASS) += firmware_attributes_class.o
+ obj-$(CONFIG_SERIAL_MULTI_INSTANTIATE) += serial-multi-instantiate.o
+ obj-$(CONFIG_MLX_PLATFORM) += mlx-platform.o
+ obj-$(CONFIG_TOUCHSCREEN_DMI) += touchscreen_dmi.o
+--
+2.39.5
+
--- /dev/null
+From cf03ef75dfc90a763ff88e11c6e4d21af2d265dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 11:26:21 +0300
+Subject: RDMA/core: Rate limit GID cache warning messages
+
+From: Maor Gottlieb <maorg@nvidia.com>
+
+[ Upstream commit 333e4d79316c9ed5877d7aac8b8ed22efc74e96d ]
+
+The GID cache warning messages can flood the kernel log when there are
+multiple failed attempts to add GIDs. This can happen when creating many
+virtual interfaces without having enough space for their GIDs in the GID
+table.
+
+Change pr_warn to pr_warn_ratelimited to prevent log flooding while still
+maintaining visibility of the issue.
+
+Link: https://patch.msgid.link/r/fd45ed4a1078e743f498b234c3ae816610ba1b18.1750062357.git.leon@kernel.org
+Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cache.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
+index b7c078b7f7cfd..a1291f475466d 100644
+--- a/drivers/infiniband/core/cache.c
++++ b/drivers/infiniband/core/cache.c
+@@ -582,8 +582,8 @@ static int __ib_cache_gid_add(struct ib_device *ib_dev, u32 port,
+ out_unlock:
+ mutex_unlock(&table->lock);
+ if (ret)
+- pr_warn("%s: unable to add gid %pI6 error=%d\n",
+- __func__, gid->raw, ret);
++ pr_warn_ratelimited("%s: unable to add gid %pI6 error=%d\n",
++ __func__, gid->raw, ret);
+ return ret;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From a0d5883e76440d7004ec596f7ba668d9c73e9159 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jun 2025 22:58:21 +0530
+Subject: regmap: fix potential memory leak of regmap_bus
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit c871c199accb39d0f4cb941ad0dccabfc21e9214 ]
+
+When __regmap_init() is called from __regmap_init_i2c() and
+__regmap_init_spi() (and their devm versions), the bus argument
+obtained from regmap_get_i2c_bus() and regmap_get_spi_bus(), may be
+allocated using kmemdup() to support quirks. In those cases, the
+bus->free_on_exit field is set to true.
+
+However, inside __regmap_init(), buf is not freed on any error path.
+This could lead to a memory leak of regmap_bus when __regmap_init()
+fails. Fix that by freeing bus on error path when free_on_exit is set.
+
+Fixes: ea030ca68819 ("regmap-i2c: Set regmap max raw r/w from quirks")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Link: https://patch.msgid.link/20250626172823.18725-1-abdun.nihaal@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 5962ea1230a17..de4e2f3db942a 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1174,6 +1174,8 @@ struct regmap *__regmap_init(struct device *dev,
+ err_map:
+ kfree(map);
+ err:
++ if (bus && bus->free_on_exit)
++ kfree(bus);
+ return ERR_PTR(ret);
+ }
+ EXPORT_SYMBOL_GPL(__regmap_init);
+--
+2.39.5
+
--- /dev/null
+From 3b10224ca48a2ea52f843e8a9f9035778a0f09f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jun 2025 08:38:09 +0000
+Subject: regulator: core: fix NULL dereference on unbind due to stale coupling
+ data
+
+From: Alessandro Carminati <acarmina@redhat.com>
+
+[ Upstream commit ca46946a482238b0cdea459fb82fc837fb36260e ]
+
+Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can
+lead to NULL pointer dereference when regulators are accessed post-unbind.
+
+This can happen during runtime PM or other regulator operations that rely
+on coupling metadata.
+
+For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers
+a panic in regulator_lock_recursive() due to stale coupling state.
+
+Ensure n_coupled is set to 0 to prevent access to invalid pointers.
+
+Signed-off-by: Alessandro Carminati <acarmina@redhat.com>
+Link: https://patch.msgid.link/20250626083809.314842-1-acarmina@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 1f4698d724bb7..e7f2a8b659477 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -5536,6 +5536,7 @@ static void regulator_remove_coupling(struct regulator_dev *rdev)
+ ERR_PTR(err));
+ }
+
++ rdev->coupling_desc.n_coupled = 0;
+ kfree(rdev->coupling_desc.coupled_rdevs);
+ rdev->coupling_desc.coupled_rdevs = NULL;
+ }
+--
+2.39.5
+
x86-traps-initialize-dr7-by-writing-its-architectural-reset-value.patch
input-gpio-keys-fix-a-sleep-while-atomic-with-preempt_rt.patch
+virtio_net-enforce-minimum-tx-ring-size-for-reliabil.patch
+virtio_ring-fix-error-reporting-in-virtqueue_resize.patch
+regulator-core-fix-null-dereference-on-unbind-due-to.patch
+platform-x86-asus-nb-wmi-add-dmi-quirk-for-asus-zenb.patch
+rdma-core-rate-limit-gid-cache-warning-messages.patch
+interconnect-qcom-sc7280-add-missing-num_links-to-xm.patch
+iio-adc-ad7949-use-spi_is_bpw_supported.patch
+regmap-fix-potential-memory-leak-of-regmap_bus.patch
+platform-mellanox-mlxbf-pmc-remove-newline-char-from.patch
+platform-mellanox-mlxbf-pmc-validate-event-enable-in.patch
+platform-mellanox-mlxbf-pmc-use-kstrtobool-to-check-.patch
+tools-hv-fcopy-fix-incorrect-file-path-conversion.patch
+x86-hyperv-fix-usage-of-cpu_online_mask-to-get-valid.patch
+platform-x86-fix-initialization-order-for-firmware_a.patch
+staging-vchiq_arm-make-vchiq_shutdown-never-fail.patch
--- /dev/null
+From 8f077057a702cc097ae189b3bb224a0284880388 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 18:11:08 +0200
+Subject: staging: vchiq_arm: Make vchiq_shutdown never fail
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit f2b8ebfb867011ddbefbdf7b04ad62626cbc2afd ]
+
+Most of the users of vchiq_shutdown ignore the return value,
+which is bad because this could lead to resource leaks.
+So instead of changing all calls to vchiq_shutdown, it's easier
+to make vchiq_shutdown never fail.
+
+Fixes: 71bad7f08641 ("staging: add bcm2708 vchiq driver")
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Link: https://lore.kernel.org/r/20250715161108.3411-4-wahrenst@gmx.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+index 97787002080a1..20ad6b1e44bc4 100644
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -739,8 +739,7 @@ int vchiq_shutdown(struct vchiq_instance *instance)
+ struct vchiq_state *state = instance->state;
+ int ret = 0;
+
+- if (mutex_lock_killable(&state->mutex))
+- return -EAGAIN;
++ mutex_lock(&state->mutex);
+
+ /* Remove all services */
+ vchiq_shutdown_internal(state, instance);
+--
+2.39.5
+
--- /dev/null
+From 6431f765a73ea5602889fa7ba7f3ff767e610dc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Jun 2025 11:22:17 +0900
+Subject: tools/hv: fcopy: Fix incorrect file path conversion
+
+From: Yasumasa Suenaga <yasuenag@gmail.com>
+
+[ Upstream commit 0d86a8d65c1e69610bfe1a7a774f71ff111ed8c1 ]
+
+The hv_fcopy_uio_daemon fails to correctly handle file copy requests
+from Windows hosts (e.g. via Copy-VMFile) due to wchar_t size
+differences between Windows and Linux. On Linux, wchar_t is 32 bit,
+whereas Windows uses 16 bit wide characters.
+
+Fix this by ensuring that file transfers from host to Linux guest
+succeed with correctly decoded file names and paths.
+
+- Treats file name and path as __u16 arrays, not wchar_t*.
+- Allocates fixed-size buffers (W_MAX_PATH) for converted strings
+ instead of using malloc.
+- Adds a check for target path length to prevent snprintf() buffer
+ overflow.
+
+Fixes: 82b0945ce2c2 ("tools: hv: Add new fcopy application based on uio driver")
+Signed-off-by: Yasumasa Suenaga <yasuenag@gmail.com>
+Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
+Link: https://lore.kernel.org/r/20250628022217.1514-2-yasuenag@gmail.com
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Message-ID: <20250628022217.1514-2-yasuenag@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/hv/hv_fcopy_uio_daemon.c | 37 +++++++++++++---------------------
+ 1 file changed, 14 insertions(+), 23 deletions(-)
+
+diff --git a/tools/hv/hv_fcopy_uio_daemon.c b/tools/hv/hv_fcopy_uio_daemon.c
+index 12743d7f164f0..9caa24caa0801 100644
+--- a/tools/hv/hv_fcopy_uio_daemon.c
++++ b/tools/hv/hv_fcopy_uio_daemon.c
+@@ -62,8 +62,11 @@ static int hv_fcopy_create_file(char *file_name, char *path_name, __u32 flags)
+
+ filesize = 0;
+ p = path_name;
+- snprintf(target_fname, sizeof(target_fname), "%s/%s",
+- path_name, file_name);
++ if (snprintf(target_fname, sizeof(target_fname), "%s/%s",
++ path_name, file_name) >= sizeof(target_fname)) {
++ syslog(LOG_ERR, "target file name is too long: %s/%s", path_name, file_name);
++ goto done;
++ }
+
+ /*
+ * Check to see if the path is already in place; if not,
+@@ -270,7 +273,7 @@ static void wcstoutf8(char *dest, const __u16 *src, size_t dest_size)
+ {
+ size_t len = 0;
+
+- while (len < dest_size) {
++ while (len < dest_size && *src) {
+ if (src[len] < 0x80)
+ dest[len++] = (char)(*src++);
+ else
+@@ -282,27 +285,15 @@ static void wcstoutf8(char *dest, const __u16 *src, size_t dest_size)
+
+ static int hv_fcopy_start(struct hv_start_fcopy *smsg_in)
+ {
+- setlocale(LC_ALL, "en_US.utf8");
+- size_t file_size, path_size;
+- char *file_name, *path_name;
+- char *in_file_name = (char *)smsg_in->file_name;
+- char *in_path_name = (char *)smsg_in->path_name;
+-
+- file_size = wcstombs(NULL, (const wchar_t *restrict)in_file_name, 0) + 1;
+- path_size = wcstombs(NULL, (const wchar_t *restrict)in_path_name, 0) + 1;
+-
+- file_name = (char *)malloc(file_size * sizeof(char));
+- path_name = (char *)malloc(path_size * sizeof(char));
+-
+- if (!file_name || !path_name) {
+- free(file_name);
+- free(path_name);
+- syslog(LOG_ERR, "Can't allocate memory for file name and/or path name");
+- return HV_E_FAIL;
+- }
++ /*
++ * file_name and path_name should have same length with appropriate
++ * member of hv_start_fcopy.
++ */
++ char file_name[W_MAX_PATH], path_name[W_MAX_PATH];
+
+- wcstoutf8(file_name, (__u16 *)in_file_name, file_size);
+- wcstoutf8(path_name, (__u16 *)in_path_name, path_size);
++ setlocale(LC_ALL, "en_US.utf8");
++ wcstoutf8(file_name, smsg_in->file_name, W_MAX_PATH - 1);
++ wcstoutf8(path_name, smsg_in->path_name, W_MAX_PATH - 1);
+
+ return hv_fcopy_create_file(file_name, path_name, smsg_in->copy_flags);
+ }
+--
+2.39.5
+
--- /dev/null
+From f470a01e42a2570b4bb5ef080fb2c8d16dce1de5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 May 2025 11:22:36 +0200
+Subject: virtio_net: Enforce minimum TX ring size for reliability
+
+From: Laurent Vivier <lvivier@redhat.com>
+
+[ Upstream commit 24b2f5df86aaebbe7bac40304eaf5a146c02367c ]
+
+The `tx_may_stop()` logic stops TX queues if free descriptors
+(`sq->vq->num_free`) fall below the threshold of (`MAX_SKB_FRAGS` + 2).
+If the total ring size (`ring_num`) is not strictly greater than this
+value, queues can become persistently stopped or stop after minimal
+use, severely degrading performance.
+
+A single sk_buff transmission typically requires descriptors for:
+- The virtio_net_hdr (1 descriptor)
+- The sk_buff's linear data (head) (1 descriptor)
+- Paged fragments (up to MAX_SKB_FRAGS descriptors)
+
+This patch enforces that the TX ring size ('ring_num') must be strictly
+greater than (MAX_SKB_FRAGS + 2). This ensures that the ring is
+always large enough to hold at least one maximally-fragmented packet
+plus at least one additional slot.
+
+Reported-by: Lei Yang <leiyang@redhat.com>
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Link: https://patch.msgid.link/20250521092236.661410-4-lvivier@redhat.com
+Tested-by: Lei Yang <leiyang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 0408c21bb1220..fb3908798458b 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -3275,6 +3275,12 @@ static int virtnet_tx_resize(struct virtnet_info *vi, struct send_queue *sq,
+ {
+ int qindex, err;
+
++ if (ring_num <= MAX_SKB_FRAGS + 2) {
++ netdev_err(vi->dev, "tx size (%d) cannot be smaller than %d\n",
++ ring_num, MAX_SKB_FRAGS + 2);
++ return -EINVAL;
++ }
++
+ qindex = sq - vi->sq;
+
+ virtnet_tx_pause(vi, sq);
+--
+2.39.5
+
--- /dev/null
+From 99ea7e49bd314d8b846edac97b4432cb34487bc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 May 2025 11:22:34 +0200
+Subject: virtio_ring: Fix error reporting in virtqueue_resize
+
+From: Laurent Vivier <lvivier@redhat.com>
+
+[ Upstream commit 45ebc7e6c125ce93d2ddf82cd5bea20121bb0258 ]
+
+The virtqueue_resize() function was not correctly propagating error codes
+from its internal resize helper functions, specifically
+virtqueue_resize_packet() and virtqueue_resize_split(). If these helpers
+returned an error, but the subsequent call to virtqueue_enable_after_reset()
+succeeded, the original error from the resize operation would be masked.
+Consequently, virtqueue_resize() could incorrectly report success to its
+caller despite an underlying resize failure.
+
+This change restores the original code behavior:
+
+ if (vdev->config->enable_vq_after_reset(_vq))
+ return -EBUSY;
+
+ return err;
+
+Fix: commit ad48d53b5b3f ("virtio_ring: separate the logic of reset/enable from virtqueue_resize")
+Cc: xuanzhuo@linux.alibaba.com
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Link: https://patch.msgid.link/20250521092236.661410-2-lvivier@redhat.com
+Tested-by: Lei Yang <leiyang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_ring.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 147926c8bae09..c0276979675df 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -2741,7 +2741,7 @@ int virtqueue_resize(struct virtqueue *_vq, u32 num,
+ void (*recycle_done)(struct virtqueue *vq))
+ {
+ struct vring_virtqueue *vq = to_vvq(_vq);
+- int err;
++ int err, err_reset;
+
+ if (num > vq->vq.num_max)
+ return -E2BIG;
+@@ -2763,7 +2763,11 @@ int virtqueue_resize(struct virtqueue *_vq, u32 num,
+ else
+ err = virtqueue_resize_split(_vq, num);
+
+- return virtqueue_enable_after_reset(_vq);
++ err_reset = virtqueue_enable_after_reset(_vq);
++ if (err_reset)
++ return err_reset;
++
++ return err;
+ }
+ EXPORT_SYMBOL_GPL(virtqueue_resize);
+
+--
+2.39.5
+
--- /dev/null
+From b8b8099fe641def0ab075436b3f5c997d768f929 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 15:44:34 -0700
+Subject: x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
+
+From: Nuno Das Neves <nunodasneves@linux.microsoft.com>
+
+[ Upstream commit bb169f80ed5a156ec3405e0e49c6b8e9ae264718 ]
+
+Accessing cpu_online_mask here is problematic because the cpus read lock
+is not held in this context.
+
+However, cpu_online_mask isn't needed here since the effective affinity
+mask is guaranteed to be valid in this callback. So, just use
+cpumask_first() to get the cpu instead of ANDing it with cpus_online_mask
+unnecessarily.
+
+Fixes: e39397d1fd68 ("x86/hyperv: implement an MSI domain for root partition")
+Reported-by: Michael Kelley <mhklinux@outlook.com>
+Closes: https://lore.kernel.org/linux-hyperv/SN6PR02MB4157639630F8AD2D8FD8F52FD475A@SN6PR02MB4157.namprd02.prod.outlook.com/
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
+Reviewed-by: Michael Kelley <mhklinux@outlook.com>
+Link: https://lore.kernel.org/r/1751582677-30930-4-git-send-email-nunodasneves@linux.microsoft.com
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Message-ID: <1751582677-30930-4-git-send-email-nunodasneves@linux.microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/hyperv/irqdomain.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/arch/x86/hyperv/irqdomain.c b/arch/x86/hyperv/irqdomain.c
+index 3215a4a07408a..939b7081c5ab9 100644
+--- a/arch/x86/hyperv/irqdomain.c
++++ b/arch/x86/hyperv/irqdomain.c
+@@ -192,7 +192,6 @@ static void hv_irq_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
+ struct pci_dev *dev;
+ struct hv_interrupt_entry out_entry, *stored_entry;
+ struct irq_cfg *cfg = irqd_cfg(data);
+- const cpumask_t *affinity;
+ int cpu;
+ u64 status;
+
+@@ -204,8 +203,7 @@ static void hv_irq_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
+ return;
+ }
+
+- affinity = irq_data_get_effective_affinity_mask(data);
+- cpu = cpumask_first_and(affinity, cpu_online_mask);
++ cpu = cpumask_first(irq_data_get_effective_affinity_mask(data));
+
+ if (data->chip_data) {
+ /*
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
