--- /dev/null
+From 9744ede7099e8a69c04aa23fbea44c15bc390c04 Mon Sep 17 00:00:00 2001
+From: Dawid Rezler <dawidrezler.patches@gmail.com>
+Date: Sun, 20 Jul 2025 17:49:08 +0200
+Subject: ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
+
+From: Dawid Rezler <dawidrezler.patches@gmail.com>
+
+commit 9744ede7099e8a69c04aa23fbea44c15bc390c04 upstream.
+
+The mute LED on the HP Pavilion Laptop 15-eg0xxx,
+which uses the ALC287 codec, didn't work.
+This patch fixes the issue by enabling the ALC287_FIXUP_HP_GPIO_LED quirk.
+
+Tested on a physical device, the LED now works as intended.
+
+Signed-off-by: Dawid Rezler <dawidrezler.patches@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20250720154907.80815-2-dawidrezler.patches@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10668,6 +10668,7 @@ static const struct hda_quirk alc269_fix
+ SND_PCI_QUIRK(0x103c, 0x8788, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x87b7, "HP Laptop 14-fq0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
+ SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x87cc, "HP Pavilion 15-eg0xxx", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x87d3, "HP Laptop 15-gw0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
+ SND_PCI_QUIRK(0x103c, 0x87df, "HP ProBook 430 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x87e5, "HP ProBook 440 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
--- /dev/null
+From 21c8ed9047b7f44c1c49b889d4ba2f555d9ee17e Mon Sep 17 00:00:00 2001
+From: Edip Hazuri <edip@medip.dev>
+Date: Fri, 18 Jul 2025 00:26:26 +0300
+Subject: ALSA: hda/realtek - Add mute LED support for HP Victus 15-fa0xxx
+
+From: Edip Hazuri <edip@medip.dev>
+
+commit 21c8ed9047b7f44c1c49b889d4ba2f555d9ee17e upstream.
+
+The mute led on this laptop is using ALC245 but requires a quirk to work
+This patch enables the existing quirk for the device.
+
+Tested on my Victus 15-fa0xxx Laptop. The LED behaviour works
+as intended.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Edip Hazuri <edip@medip.dev>
+Link: https://patch.msgid.link/20250717212625.366026-2-edip@medip.dev
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10747,6 +10747,7 @@ static const struct hda_quirk alc269_fix
+ SND_PCI_QUIRK(0x103c, 0x8a2e, "HP Envy 16", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x8a30, "HP Envy 17", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x8a31, "HP Envy 15", ALC287_FIXUP_CS35L41_I2C_2),
++ SND_PCI_QUIRK(0x103c, 0x8a4f, "HP Victus 15-fa0xxx (MB 8A4F)", ALC245_FIXUP_HP_MUTE_LED_COEFBIT),
+ SND_PCI_QUIRK(0x103c, 0x8a6e, "HP EDNA 360", ALC287_FIXUP_CS35L41_I2C_4),
+ SND_PCI_QUIRK(0x103c, 0x8a74, "HP ProBook 440 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8a78, "HP Dev One", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
--- /dev/null
+From d42e6c20de6192f8e4ab4cf10be8c694ef27e8cb Mon Sep 17 00:00:00 2001
+From: Ada Couprie Diaz <ada.coupriediaz@arm.com>
+Date: Fri, 18 Jul 2025 15:28:14 +0100
+Subject: arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
+
+From: Ada Couprie Diaz <ada.coupriediaz@arm.com>
+
+commit d42e6c20de6192f8e4ab4cf10be8c694ef27e8cb upstream.
+
+`cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change
+to different stacks along with the Shadow Call Stack if it is enabled.
+Those two stack changes cannot be done atomically and both functions
+can be interrupted by SErrors or Debug Exceptions which, though unlikely,
+is very much broken : if interrupted, we can end up with mismatched stacks
+and Shadow Call Stack leading to clobbered stacks.
+
+In `cpu_switch_to()`, it can happen when SP_EL0 points to the new task,
+but x18 stills points to the old task's SCS. When the interrupt handler
+tries to save the task's SCS pointer, it will save the old task
+SCS pointer (x18) into the new task struct (pointed to by SP_EL0),
+clobbering it.
+
+In `call_on_irq_stack()`, it can happen when switching from the task stack
+to the IRQ stack and when switching back. In both cases, we can be
+interrupted when the SCS pointer points to the IRQ SCS, but SP points to
+the task stack. The nested interrupt handler pushes its return addresses
+on the IRQ SCS. It then detects that SP points to the task stack,
+calls `call_on_irq_stack()` and clobbers the task SCS pointer with
+the IRQ SCS pointer, which it will also use !
+
+This leads to tasks returning to addresses on the wrong SCS,
+or even on the IRQ SCS, triggering kernel panics via CONFIG_VMAP_STACK
+or FPAC if enabled.
+
+This is possible on a default config, but unlikely.
+However, when enabling CONFIG_ARM64_PSEUDO_NMI, DAIF is unmasked and
+instead the GIC is responsible for filtering what interrupts the CPU
+should receive based on priority.
+Given the goal of emulating NMIs, pseudo-NMIs can be received by the CPU
+even in `cpu_switch_to()` and `call_on_irq_stack()`, possibly *very*
+frequently depending on the system configuration and workload, leading
+to unpredictable kernel panics.
+
+Completely mask DAIF in `cpu_switch_to()` and restore it when returning.
+Do the same in `call_on_irq_stack()`, but restore and mask around
+the branch.
+Mask DAIF even if CONFIG_SHADOW_CALL_STACK is not enabled for consistency
+of behaviour between all configurations.
+
+Introduce and use an assembly macro for saving and masking DAIF,
+as the existing one saves but only masks IF.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ada Couprie Diaz <ada.coupriediaz@arm.com>
+Reported-by: Cristian Prundeanu <cpru@amazon.com>
+Fixes: 59b37fe52f49 ("arm64: Stash shadow stack pointer in the task struct on interrupt")
+Tested-by: Cristian Prundeanu <cpru@amazon.com>
+Acked-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20250718142814.133329-1-ada.coupriediaz@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/include/asm/assembler.h | 5 +++++
+ arch/arm64/kernel/entry.S | 6 ++++++
+ 2 files changed, 11 insertions(+)
+
+--- a/arch/arm64/include/asm/assembler.h
++++ b/arch/arm64/include/asm/assembler.h
+@@ -41,6 +41,11 @@
+ /*
+ * Save/restore interrupts.
+ */
++ .macro save_and_disable_daif, flags
++ mrs \flags, daif
++ msr daifset, #0xf
++ .endm
++
+ .macro save_and_disable_irq, flags
+ mrs \flags, daif
+ msr daifset, #3
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -825,6 +825,7 @@ SYM_CODE_END(__bp_harden_el1_vectors)
+ *
+ */
+ SYM_FUNC_START(cpu_switch_to)
++ save_and_disable_daif x11
+ mov x10, #THREAD_CPU_CONTEXT
+ add x8, x0, x10
+ mov x9, sp
+@@ -848,6 +849,7 @@ SYM_FUNC_START(cpu_switch_to)
+ ptrauth_keys_install_kernel x1, x8, x9, x10
+ scs_save x0
+ scs_load_current
++ restore_irq x11
+ ret
+ SYM_FUNC_END(cpu_switch_to)
+ NOKPROBE(cpu_switch_to)
+@@ -874,6 +876,7 @@ NOKPROBE(ret_from_fork)
+ * Calls func(regs) using this CPU's irq stack and shadow irq stack.
+ */
+ SYM_FUNC_START(call_on_irq_stack)
++ save_and_disable_daif x9
+ #ifdef CONFIG_SHADOW_CALL_STACK
+ get_current_task x16
+ scs_save x16
+@@ -888,8 +891,10 @@ SYM_FUNC_START(call_on_irq_stack)
+
+ /* Move to the new stack and call the function there */
+ add sp, x16, #IRQ_STACK_SIZE
++ restore_irq x9
+ blr x1
+
++ save_and_disable_daif x9
+ /*
+ * Restore the SP from the FP, and restore the FP and LR from the frame
+ * record.
+@@ -897,6 +902,7 @@ SYM_FUNC_START(call_on_irq_stack)
+ mov sp, x29
+ ldp x29, x30, [sp], #16
+ scs_load_current
++ restore_irq x9
+ ret
+ SYM_FUNC_END(call_on_irq_stack)
+ NOKPROBE(call_on_irq_stack)
--- /dev/null
+From 696e123aa36bf0bc72bda98df96dd8f379a6e854 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 22 Jul 2025 11:25:42 +0200
+Subject: ASoC: mediatek: common: fix device and OF node leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 696e123aa36bf0bc72bda98df96dd8f379a6e854 upstream.
+
+Make sure to drop the references to the accdet OF node and platform
+device taken by of_parse_phandle() and of_find_device_by_node() after
+looking up the sound component during probe.
+
+Fixes: cf536e2622e2 ("ASoC: mediatek: common: Handle mediatek,accdet property")
+Cc: stable@vger.kernel.org # 6.15
+Cc: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20250722092542.32754-1-johan@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/mediatek/common/mtk-soundcard-driver.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/mediatek/common/mtk-soundcard-driver.c b/sound/soc/mediatek/common/mtk-soundcard-driver.c
+index 713a368f79cf..95a083939f3e 100644
+--- a/sound/soc/mediatek/common/mtk-soundcard-driver.c
++++ b/sound/soc/mediatek/common/mtk-soundcard-driver.c
+@@ -262,9 +262,13 @@ int mtk_soundcard_common_probe(struct platform_device *pdev)
+ soc_card_data->accdet = accdet_comp;
+ else
+ dev_err(&pdev->dev, "No sound component found from mediatek,accdet property\n");
++
++ put_device(&accdet_pdev->dev);
+ } else {
+ dev_err(&pdev->dev, "No device found from mediatek,accdet property\n");
+ }
++
++ of_node_put(accdet_node);
+ }
+
+ platform_node = of_parse_phandle(pdev->dev.of_node, "mediatek,platform", 0);
+--
+2.50.1
+
--- /dev/null
+From ee9f3a81ab08dfe0538dbd1746f81fd4d5147fdc Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Thu, 17 Jul 2025 10:23:08 +0800
+Subject: dpaa2-eth: Fix device reference count leak in MAC endpoint handling
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit ee9f3a81ab08dfe0538dbd1746f81fd4d5147fdc upstream.
+
+The fsl_mc_get_endpoint() function uses device_find_child() for
+localization, which implicitly calls get_device() to increment the
+device's reference count before returning the pointer. However, the
+caller dpaa2_eth_connect_mac() fails to properly release this
+reference in multiple scenarios. We should call put_device() to
+decrement reference count properly.
+
+As comment of device_find_child() says, 'NOTE: you will need to drop
+the reference with put_device() after use'.
+
+Found by code review.
+
+Cc: stable@vger.kernel.org
+Fixes: 719479230893 ("dpaa2-eth: add MAC/PHY support through phylink")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250717022309.3339976-2-make24@iscas.ac.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -4655,12 +4655,19 @@ static int dpaa2_eth_connect_mac(struct
+ return PTR_ERR(dpmac_dev);
+ }
+
+- if (IS_ERR(dpmac_dev) || dpmac_dev->dev.type != &fsl_mc_bus_dpmac_type)
++ if (IS_ERR(dpmac_dev))
+ return 0;
+
++ if (dpmac_dev->dev.type != &fsl_mc_bus_dpmac_type) {
++ err = 0;
++ goto out_put_device;
++ }
++
+ mac = kzalloc(sizeof(struct dpaa2_mac), GFP_KERNEL);
+- if (!mac)
+- return -ENOMEM;
++ if (!mac) {
++ err = -ENOMEM;
++ goto out_put_device;
++ }
+
+ mac->mc_dev = dpmac_dev;
+ mac->mc_io = priv->mc_io;
+@@ -4694,6 +4701,8 @@ err_close_mac:
+ dpaa2_mac_close(mac);
+ err_free_mac:
+ kfree(mac);
++out_put_device:
++ put_device(&dpmac_dev->dev);
+ return err;
+ }
+
--- /dev/null
+From 96e056ffba912ef18a72177f71956a5b347b5177 Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Thu, 17 Jul 2025 10:23:09 +0800
+Subject: dpaa2-switch: Fix device reference count leak in MAC endpoint handling
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit 96e056ffba912ef18a72177f71956a5b347b5177 upstream.
+
+The fsl_mc_get_endpoint() function uses device_find_child() for
+localization, which implicitly calls get_device() to increment the
+device's reference count before returning the pointer. However, the
+caller dpaa2_switch_port_connect_mac() fails to properly release this
+reference in multiple scenarios. We should call put_device() to
+decrement reference count properly.
+
+As comment of device_find_child() says, 'NOTE: you will need to drop
+the reference with put_device() after use'.
+
+Found by code review.
+
+Cc: stable@vger.kernel.org
+Fixes: 84cba72956fd ("dpaa2-switch: integrate the MAC endpoint support")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250717022309.3339976-3-make24@iscas.ac.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+@@ -1448,12 +1448,19 @@ static int dpaa2_switch_port_connect_mac
+ if (PTR_ERR(dpmac_dev) == -EPROBE_DEFER)
+ return PTR_ERR(dpmac_dev);
+
+- if (IS_ERR(dpmac_dev) || dpmac_dev->dev.type != &fsl_mc_bus_dpmac_type)
++ if (IS_ERR(dpmac_dev))
+ return 0;
+
++ if (dpmac_dev->dev.type != &fsl_mc_bus_dpmac_type) {
++ err = 0;
++ goto out_put_device;
++ }
++
+ mac = kzalloc(sizeof(*mac), GFP_KERNEL);
+- if (!mac)
+- return -ENOMEM;
++ if (!mac) {
++ err = -ENOMEM;
++ goto out_put_device;
++ }
+
+ mac->mc_dev = dpmac_dev;
+ mac->mc_io = port_priv->ethsw_data->mc_io;
+@@ -1483,6 +1490,8 @@ err_close_mac:
+ dpaa2_mac_close(mac);
+ err_free_mac:
+ kfree(mac);
++out_put_device:
++ put_device(&dpmac_dev->dev);
+ return err;
+ }
+
--- /dev/null
+From 536fd741c7ac907d63166cdae1081b1febfab613 Mon Sep 17 00:00:00 2001
+From: Jacek Kowalski <jacek@jacekk.info>
+Date: Mon, 30 Jun 2025 10:33:39 +0200
+Subject: e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
+
+From: Jacek Kowalski <jacek@jacekk.info>
+
+commit 536fd741c7ac907d63166cdae1081b1febfab613 upstream.
+
+As described by Vitaly Lifshits:
+
+> Starting from Tiger Lake, LAN NVM is locked for writes by SW, so the
+> driver cannot perform checksum validation and correction. This means
+> that all NVM images must leave the factory with correct checksum and
+> checksum valid bit set. Since Tiger Lake devices were the first to have
+> this lock, some systems in the field did not meet this requirement.
+> Therefore, for these transitional devices we skip checksum update and
+> verification, if the valid bit is not set.
+
+Signed-off-by: Jacek Kowalski <jacek@jacekk.info>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Vitaly Lifshits <vitaly.lifshits@intel.com>
+Fixes: 4051f68318ca9 ("e1000e: Do not take care about recovery NVM checksum")
+Cc: stable@vger.kernel.org
+Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000e/ich8lan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -4274,6 +4274,8 @@ static s32 e1000_validate_nvm_checksum_i
+ ret_val = e1000e_update_nvm_checksum(hw);
+ if (ret_val)
+ return ret_val;
++ } else if (hw->mac.type == e1000_pch_tgp) {
++ return 0;
+ }
+ }
+
--- /dev/null
+From 61114910a5f6a71d0b6ea3b95082dfe031b19dfe Mon Sep 17 00:00:00 2001
+From: Jacek Kowalski <jacek@jacekk.info>
+Date: Mon, 30 Jun 2025 10:35:00 +0200
+Subject: e1000e: ignore uninitialized checksum word on tgp
+
+From: Jacek Kowalski <jacek@jacekk.info>
+
+commit 61114910a5f6a71d0b6ea3b95082dfe031b19dfe upstream.
+
+As described by Vitaly Lifshits:
+
+> Starting from Tiger Lake, LAN NVM is locked for writes by SW, so the
+> driver cannot perform checksum validation and correction. This means
+> that all NVM images must leave the factory with correct checksum and
+> checksum valid bit set.
+
+Unfortunately some systems have left the factory with an uninitialized
+value of 0xFFFF at register address 0x3F (checksum word location).
+So on Tiger Lake platform we ignore the computed checksum when such
+condition is encountered.
+
+Signed-off-by: Jacek Kowalski <jacek@jacekk.info>
+Tested-by: Vlad URSU <vlad@ursu.me>
+Fixes: 4051f68318ca9 ("e1000e: Do not take care about recovery NVM checksum")
+Cc: stable@vger.kernel.org
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Vitaly Lifshits <vitaly.lifshits@intel.com>
+Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000e/defines.h | 3 +++
+ drivers/net/ethernet/intel/e1000e/nvm.c | 6 ++++++
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/net/ethernet/intel/e1000e/defines.h
++++ b/drivers/net/ethernet/intel/e1000e/defines.h
+@@ -638,6 +638,9 @@
+ /* For checksumming, the sum of all words in the NVM should equal 0xBABA. */
+ #define NVM_SUM 0xBABA
+
++/* Uninitialized ("empty") checksum word value */
++#define NVM_CHECKSUM_UNINITIALIZED 0xFFFF
++
+ /* PBA (printed board assembly) number words */
+ #define NVM_PBA_OFFSET_0 8
+ #define NVM_PBA_OFFSET_1 9
+--- a/drivers/net/ethernet/intel/e1000e/nvm.c
++++ b/drivers/net/ethernet/intel/e1000e/nvm.c
+@@ -558,6 +558,12 @@ s32 e1000e_validate_nvm_checksum_generic
+ checksum += nvm_data;
+ }
+
++ if (hw->mac.type == e1000_pch_tgp &&
++ nvm_data == NVM_CHECKSUM_UNINITIALIZED) {
++ e_dbg("Uninitialized NVM Checksum on TGP platform - ignoring\n");
++ return 0;
++ }
++
+ if (checksum != (u16)NVM_SUM) {
+ e_dbg("NVM Checksum Invalid\n");
+ return -E1000_ERR_NVM;
--- /dev/null
+From b03f15c0192b184078206760c839054ae6eb4eaa Mon Sep 17 00:00:00 2001
+From: Praveen Kaligineedi <pkaligineedi@google.com>
+Date: Thu, 17 Jul 2025 19:20:24 +0000
+Subject: gve: Fix stuck TX queue for DQ queue format
+
+From: Praveen Kaligineedi <pkaligineedi@google.com>
+
+commit b03f15c0192b184078206760c839054ae6eb4eaa upstream.
+
+gve_tx_timeout was calculating missed completions in a way that is only
+relevant in the GQ queue format. Additionally, it was attempting to
+disable device interrupts, which is not needed in either GQ or DQ queue
+formats.
+
+As a result, TX timeouts with the DQ queue format likely would have
+triggered early resets without kicking the queue at all.
+
+This patch drops the check for pending work altogether and always kicks
+the queue after validating the queue has not seen a TX timeout too
+recently.
+
+Cc: stable@vger.kernel.org
+Fixes: 87a7f321bb6a ("gve: Recover from queue stall due to missed IRQ")
+Co-developed-by: Tim Hostetler <thostet@google.com>
+Signed-off-by: Tim Hostetler <thostet@google.com>
+Signed-off-by: Praveen Kaligineedi <pkaligineedi@google.com>
+Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
+Link: https://patch.msgid.link/20250717192024.1820931-1-hramamurthy@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/google/gve/gve_main.c | 71 +++++++++++++++--------------
+ 1 file changed, 39 insertions(+), 32 deletions(-)
+
+--- a/drivers/net/ethernet/google/gve/gve_main.c
++++ b/drivers/net/ethernet/google/gve/gve_main.c
+@@ -1916,49 +1916,56 @@ static void gve_turnup_and_check_status(
+ gve_handle_link_status(priv, GVE_DEVICE_STATUS_LINK_STATUS_MASK & status);
+ }
+
+-static void gve_tx_timeout(struct net_device *dev, unsigned int txqueue)
++static struct gve_notify_block *gve_get_tx_notify_block(struct gve_priv *priv,
++ unsigned int txqueue)
+ {
+- struct gve_notify_block *block;
+- struct gve_tx_ring *tx = NULL;
+- struct gve_priv *priv;
+- u32 last_nic_done;
+- u32 current_time;
+ u32 ntfy_idx;
+
+- netdev_info(dev, "Timeout on tx queue, %d", txqueue);
+- priv = netdev_priv(dev);
+ if (txqueue > priv->tx_cfg.num_queues)
+- goto reset;
++ return NULL;
+
+ ntfy_idx = gve_tx_idx_to_ntfy(priv, txqueue);
+ if (ntfy_idx >= priv->num_ntfy_blks)
+- goto reset;
++ return NULL;
++
++ return &priv->ntfy_blocks[ntfy_idx];
++}
++
++static bool gve_tx_timeout_try_q_kick(struct gve_priv *priv,
++ unsigned int txqueue)
++{
++ struct gve_notify_block *block;
++ u32 current_time;
+
+- block = &priv->ntfy_blocks[ntfy_idx];
+- tx = block->tx;
++ block = gve_get_tx_notify_block(priv, txqueue);
++
++ if (!block)
++ return false;
+
+ current_time = jiffies_to_msecs(jiffies);
+- if (tx->last_kick_msec + MIN_TX_TIMEOUT_GAP > current_time)
+- goto reset;
++ if (block->tx->last_kick_msec + MIN_TX_TIMEOUT_GAP > current_time)
++ return false;
++
++ netdev_info(priv->dev, "Kicking queue %d", txqueue);
++ napi_schedule(&block->napi);
++ block->tx->last_kick_msec = current_time;
++ return true;
++}
++
++static void gve_tx_timeout(struct net_device *dev, unsigned int txqueue)
++{
++ struct gve_notify_block *block;
++ struct gve_priv *priv;
++
++ netdev_info(dev, "Timeout on tx queue, %d", txqueue);
++ priv = netdev_priv(dev);
++
++ if (!gve_tx_timeout_try_q_kick(priv, txqueue))
++ gve_schedule_reset(priv);
+
+- /* Check to see if there are missed completions, which will allow us to
+- * kick the queue.
+- */
+- last_nic_done = gve_tx_load_event_counter(priv, tx);
+- if (last_nic_done - tx->done) {
+- netdev_info(dev, "Kicking queue %d", txqueue);
+- iowrite32be(GVE_IRQ_MASK, gve_irq_doorbell(priv, block));
+- napi_schedule(&block->napi);
+- tx->last_kick_msec = current_time;
+- goto out;
+- } // Else reset.
+-
+-reset:
+- gve_schedule_reset(priv);
+-
+-out:
+- if (tx)
+- tx->queue_timeout++;
++ block = gve_get_tx_notify_block(priv, txqueue);
++ if (block)
++ block->tx->queue_timeout++;
+ priv->tx_timeo_cnt++;
+ }
+
--- /dev/null
+From 4ff12d82dac119b4b99b5a78b5af3bf2474c0a36 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <haoxiang_li2024@163.com>
+Date: Thu, 3 Jul 2025 17:52:32 +0800
+Subject: ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
+
+From: Haoxiang Li <haoxiang_li2024@163.com>
+
+commit 4ff12d82dac119b4b99b5a78b5af3bf2474c0a36 upstream.
+
+Add check for the return value of devm_kmemdup()
+to prevent potential null pointer dereference.
+
+Fixes: c76488109616 ("ice: Implement Dynamic Device Personalization (DDP) download")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_ddp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/intel/ice/ice_ddp.c
++++ b/drivers/net/ethernet/intel/ice/ice_ddp.c
+@@ -2301,6 +2301,8 @@ enum ice_ddp_state ice_copy_and_init_pkg
+ return ICE_DDP_PKG_ERR;
+
+ buf_copy = devm_kmemdup(ice_hw_to_dev(hw), buf, len, GFP_KERNEL);
++ if (!buf_copy)
++ return ICE_DDP_PKG_ERR;
+
+ state = ice_init_pkg(hw, buf_copy, len);
+ if (!ice_is_init_pkg_successful(state)) {
--- /dev/null
+From 6ade153349c6bb990d170cecc3e8bdd8628119ab Mon Sep 17 00:00:00 2001
+From: Marco Elver <elver@google.com>
+Date: Wed, 16 Jul 2025 17:23:28 +0200
+Subject: kasan: use vmalloc_dump_obj() for vmalloc error reports
+
+From: Marco Elver <elver@google.com>
+
+commit 6ade153349c6bb990d170cecc3e8bdd8628119ab upstream.
+
+Since 6ee9b3d84775 ("kasan: remove kasan_find_vm_area() to prevent
+possible deadlock"), more detailed info about the vmalloc mapping and the
+origin was dropped due to potential deadlocks.
+
+While fixing the deadlock is necessary, that patch was too quick in
+killing an otherwise useful feature, and did no due-diligence in
+understanding if an alternative option is available.
+
+Restore printing more helpful vmalloc allocation info in KASAN reports
+with the help of vmalloc_dump_obj(). Example report:
+
+| BUG: KASAN: vmalloc-out-of-bounds in vmalloc_oob+0x4c9/0x610
+| Read of size 1 at addr ffffc900002fd7f3 by task kunit_try_catch/493
+|
+| CPU: [...]
+| Call Trace:
+| <TASK>
+| dump_stack_lvl+0xa8/0xf0
+| print_report+0x17e/0x810
+| kasan_report+0x155/0x190
+| vmalloc_oob+0x4c9/0x610
+| [...]
+|
+| The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900002fd000 allocated at vmalloc_oob+0x36/0x610
+| The buggy address belongs to the physical page:
+| page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x126364
+| flags: 0x200000000000000(node=0|zone=2)
+| raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000
+| raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
+| page dumped because: kasan: bad access detected
+|
+| [..]
+
+Link: https://lkml.kernel.org/r/20250716152448.3877201-1-elver@google.com
+Fixes: 6ee9b3d84775 ("kasan: remove kasan_find_vm_area() to prevent possible deadlock")
+Signed-off-by: Marco Elver <elver@google.com>
+Suggested-by: Uladzislau Rezki <urezki@gmail.com>
+Acked-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Andrey Konovalov <andreyknvl@gmail.com>
+Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Yeoreum Yun <yeoreum.yun@arm.com>
+Cc: Yunseong Kim <ysk@kzalloc.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/kasan/report.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/mm/kasan/report.c
++++ b/mm/kasan/report.c
+@@ -399,7 +399,9 @@ static void print_address_description(vo
+ }
+
+ if (is_vmalloc_addr(addr)) {
+- pr_err("The buggy address %px belongs to a vmalloc virtual mapping\n", addr);
++ pr_err("The buggy address belongs to a");
++ if (!vmalloc_dump_obj(addr))
++ pr_cont(" vmalloc virtual mapping\n");
+ page = vmalloc_to_page(addr);
+ }
+
--- /dev/null
+From 9f1e8cd0b7c4c944e9921b52a6661b5eda2705ab Mon Sep 17 00:00:00 2001
+From: Jinjiang Tu <tujinjiang@huawei.com>
+Date: Fri, 27 Jun 2025 20:57:46 +0800
+Subject: mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
+
+From: Jinjiang Tu <tujinjiang@huawei.com>
+
+commit 9f1e8cd0b7c4c944e9921b52a6661b5eda2705ab upstream.
+
+In shrink_folio_list(), the hwpoisoned folio may be large folio, which
+can't be handled by unmap_poisoned_folio(). For THP, try_to_unmap_one()
+must be passed with TTU_SPLIT_HUGE_PMD to split huge PMD first and then
+retry. Without TTU_SPLIT_HUGE_PMD, we will trigger null-ptr deref of
+pvmw.pte. Even we passed TTU_SPLIT_HUGE_PMD, we will trigger a
+WARN_ON_ONCE due to the page isn't in swapcache.
+
+Since UCE is rare in real world, and race with reclaimation is more rare,
+just skipping the hwpoisoned large folio is enough. memory_failure() will
+handle it if the UCE is triggered again.
+
+This happens when memory reclaim for large folio races with
+memory_failure(), and will lead to kernel panic. The race is as
+follows:
+
+cpu0 cpu1
+ shrink_folio_list memory_failure
+ TestSetPageHWPoison
+ unmap_poisoned_folio
+ --> trigger BUG_ON due to
+ unmap_poisoned_folio couldn't
+ handle large folio
+
+[tujinjiang@huawei.com: add comment to unmap_poisoned_folio()]
+ Link: https://lkml.kernel.org/r/69fd4e00-1b13-d5f7-1c82-705c7d977ea4@huawei.com
+Link: https://lkml.kernel.org/r/20250627125747.3094074-2-tujinjiang@huawei.com
+Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>
+Fixes: 1b0449544c64 ("mm/vmscan: don't try to reclaim hwpoison folio")
+Reported-by: syzbot+3b220254df55d8ca8a61@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/68412d57.050a0220.2461cf.000e.GAE@google.com/
+Acked-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
+Acked-by: Zi Yan <ziy@nvidia.com>
+Reviewed-by: Oscar Salvador <osalvador@suse.de>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/memory-failure.c | 4 ++++
+ mm/vmscan.c | 8 ++++++++
+ 2 files changed, 12 insertions(+)
+
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1561,6 +1561,10 @@ static int get_hwpoison_page(struct page
+ return ret;
+ }
+
++/*
++ * The caller must guarantee the folio isn't large folio, except hugetlb.
++ * try_to_unmap() can't handle it.
++ */
+ int unmap_poisoned_folio(struct folio *folio, unsigned long pfn, bool must_kill)
+ {
+ enum ttu_flags ttu = TTU_IGNORE_MLOCK | TTU_SYNC | TTU_HWPOISON;
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -1128,6 +1128,14 @@ retry:
+ goto keep;
+
+ if (folio_contain_hwpoisoned_page(folio)) {
++ /*
++ * unmap_poisoned_folio() can't handle large
++ * folio, just skip it. memory_failure() will
++ * handle it if the UCE is triggered again.
++ */
++ if (folio_test_large(folio))
++ goto keep_locked;
++
+ unmap_poisoned_folio(folio, folio_pfn(folio), false);
+ folio_unlock(folio);
+ folio_put(folio);
--- /dev/null
+From 694d6b99923eb05a8fd188be44e26077d19f0e21 Mon Sep 17 00:00:00 2001
+From: Harry Yoo <harry.yoo@oracle.com>
+Date: Fri, 4 Jul 2025 19:30:53 +0900
+Subject: mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
+
+From: Harry Yoo <harry.yoo@oracle.com>
+
+commit 694d6b99923eb05a8fd188be44e26077d19f0e21 upstream.
+
+Commit 48b4800a1c6a ("zsmalloc: page migration support") added support for
+migrating zsmalloc pages using the movable_operations migration framework.
+However, the commit did not take into account that zsmalloc supports
+migration only when CONFIG_COMPACTION is enabled. Tracing shows that
+zsmalloc was still passing the __GFP_MOVABLE flag even when compaction is
+not supported.
+
+This can result in unmovable pages being allocated from movable page
+blocks (even without stealing page blocks), ZONE_MOVABLE and CMA area.
+
+Possible user visible effects:
+- Some ZONE_MOVABLE memory can be not actually movable
+- CMA allocation can fail because of this
+- Increased memory fragmentation due to ignoring the page mobility
+ grouping feature
+I'm not really sure who uses kernels without compaction support, though :(
+
+
+To fix this, clear the __GFP_MOVABLE flag when
+!IS_ENABLED(CONFIG_COMPACTION).
+
+Link: https://lkml.kernel.org/r/20250704103053.6913-1-harry.yoo@oracle.com
+Fixes: 48b4800a1c6a ("zsmalloc: page migration support")
+Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Cc: Minchan Kim <minchan@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/zsmalloc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/mm/zsmalloc.c
++++ b/mm/zsmalloc.c
+@@ -1053,6 +1053,9 @@ static struct zspage *alloc_zspage(struc
+ if (!zspage)
+ return NULL;
+
++ if (!IS_ENABLED(CONFIG_COMPACTION))
++ gfp &= ~__GFP_MOVABLE;
++
+ zspage->magic = ZSPAGE_MAGIC;
+ zspage->pool = pool;
+ zspage->class = class->index;
--- /dev/null
+From 4aead50caf67e01020c8be1945c3201e8a972a27 Mon Sep 17 00:00:00 2001
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Date: Thu, 10 Jul 2025 22:49:08 +0900
+Subject: nilfs2: reject invalid file types when reading inodes
+
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+
+commit 4aead50caf67e01020c8be1945c3201e8a972a27 upstream.
+
+To prevent inodes with invalid file types from tripping through the vfs
+and causing malfunctions or assertion failures, add a missing sanity check
+when reading an inode from a block device. If the file type is not valid,
+treat it as a filesystem error.
+
+Link: https://lkml.kernel.org/r/20250710134952.29862-1-konishi.ryusuke@gmail.com
+Fixes: 05fe58fdc10d ("nilfs2: inode operations")
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nilfs2/inode.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/fs/nilfs2/inode.c
++++ b/fs/nilfs2/inode.c
+@@ -472,11 +472,18 @@ static int __nilfs_read_inode(struct sup
+ inode->i_op = &nilfs_symlink_inode_operations;
+ inode_nohighmem(inode);
+ inode->i_mapping->a_ops = &nilfs_aops;
+- } else {
++ } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
++ S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
+ inode->i_op = &nilfs_special_inode_operations;
+ init_special_inode(
+ inode, inode->i_mode,
+ huge_decode_dev(le64_to_cpu(raw_inode->i_device_code)));
++ } else {
++ nilfs_error(sb,
++ "invalid file type bits in mode 0%o for inode %lu",
++ inode->i_mode, ino);
++ err = -EIO;
++ goto failed_unmap;
+ }
+ nilfs_ifile_unmap_inode(raw_inode);
+ brelse(bh);
--- /dev/null
+From 8c493cc91f3a1102ad2f8c75ae0cf80f0a057488 Mon Sep 17 00:00:00 2001
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Date: Tue, 1 Jul 2025 12:17:31 +0530
+Subject: PCI/pwrctrl: Create pwrctrl devices only when CONFIG_PCI_PWRCTRL is enabled
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+commit 8c493cc91f3a1102ad2f8c75ae0cf80f0a057488 upstream.
+
+If devicetree describes power supplies related to a PCI device, we
+unnecessarily created a pwrctrl device even if CONFIG_PCI_PWRCTL was not
+enabled.
+
+We only need pci_pwrctrl_create_device() when CONFIG_PCI_PWRCTRL is
+enabled. Compile it out when CONFIG_PCI_PWRCTRL is not enabled.
+
+When pci_pwrctrl_create_device() creates and returns a pwrctrl device,
+pci_scan_device() doesn't enumerate the PCI device. It assumes the pwrctrl
+core will rescan the bus after turning on the power. However, if
+CONFIG_PCI_PWRCTRL is not enabled, the rescan never happens, which breaks
+PCI enumeration on any system that describes power supplies in devicetree
+but does not use pwrctrl.
+
+Jim reported that some brcmstb platforms break this way. The brcmstb
+driver is still broken if CONFIG_PCI_PWRCTRL is enabled, but this commit at
+least allows brcmstb to work when it's NOT enabled.
+
+Fixes: 957f40d039a9 ("PCI/pwrctrl: Move creation of pwrctrl devices to pci_scan_device()")
+Reported-by: Jim Quinlan <james.quinlan@broadcom.com>
+Link: https://lore.kernel.org/r/CA+-6iNwgaByXEYD3j=-+H_PKAxXRU78svPMRHDKKci8AGXAUPg@mail.gmail.com
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Cc: stable@vger.kernel.org # v6.15
+Link: https://patch.msgid.link/20250701064731.52901-1-manivannan.sadhasivam@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/probe.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -2508,6 +2508,7 @@ bool pci_bus_read_dev_vendor_id(struct p
+ }
+ EXPORT_SYMBOL(pci_bus_read_dev_vendor_id);
+
++#if IS_ENABLED(CONFIG_PCI_PWRCTRL)
+ static struct platform_device *pci_pwrctrl_create_device(struct pci_bus *bus, int devfn)
+ {
+ struct pci_host_bridge *host = pci_find_host_bridge(bus);
+@@ -2537,6 +2538,12 @@ static struct platform_device *pci_pwrct
+
+ return pdev;
+ }
++#else
++static struct platform_device *pci_pwrctrl_create_device(struct pci_bus *bus, int devfn)
++{
++ return NULL;
++}
++#endif
+
+ /*
+ * Read the config data for a PCI device, sanity-check it,
--- /dev/null
+From 91a229bb7ba86b2592c3f18c54b7b2c5e6fe0f95 Mon Sep 17 00:00:00 2001
+From: Akinobu Mita <akinobu.mita@gmail.com>
+Date: Sat, 19 Jul 2025 20:26:04 +0900
+Subject: resource: fix false warning in __request_region()
+
+From: Akinobu Mita <akinobu.mita@gmail.com>
+
+commit 91a229bb7ba86b2592c3f18c54b7b2c5e6fe0f95 upstream.
+
+A warning is raised when __request_region() detects a conflict with a
+resource whose resource.desc is IORES_DESC_DEVICE_PRIVATE_MEMORY.
+
+But this warning is only valid for iomem_resources.
+The hmem device resource uses resource.desc as the numa node id, which can
+cause spurious warnings.
+
+This warning appeared on a machine with multiple cxl memory expanders.
+One of the NUMA node id is 6, which is the same as the value of
+IORES_DESC_DEVICE_PRIVATE_MEMORY.
+
+In this environment it was just a spurious warning, but when I saw the
+warning I suspected a real problem so it's better to fix it.
+
+This change fixes this by restricting the warning to only iomem_resource.
+This also adds a missing new line to the warning message.
+
+Link: https://lkml.kernel.org/r/20250719112604.25500-1-akinobu.mita@gmail.com
+Fixes: 7dab174e2e27 ("dax/hmem: Move hmem device registration to dax_hmem.ko")
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/resource.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/kernel/resource.c
++++ b/kernel/resource.c
+@@ -1279,8 +1279,9 @@ static int __request_region_locked(struc
+ * become unavailable to other users. Conflicts are
+ * not expected. Warn to aid debugging if encountered.
+ */
+- if (conflict->desc == IORES_DESC_DEVICE_PRIVATE_MEMORY) {
+- pr_warn("Unaddressable device %s %pR conflicts with %pR",
++ if (parent == &iomem_resource &&
++ conflict->desc == IORES_DESC_DEVICE_PRIVATE_MEMORY) {
++ pr_warn("Unaddressable device %s %pR conflicts with %pR\n",
+ conflict->name, conflict, res);
+ }
+ if (conflict != parent) {
--- /dev/null
+From 7563fcbfd484b347b776aeed4d7dac78b30884aa Mon Sep 17 00:00:00 2001
+From: Zi Yan <ziy@nvidia.com>
+Date: Tue, 8 Jul 2025 21:27:59 -0400
+Subject: selftests/mm: fix split_huge_page_test for folio_split() tests
+
+From: Zi Yan <ziy@nvidia.com>
+
+commit 7563fcbfd484b347b776aeed4d7dac78b30884aa upstream.
+
+PID_FMT does not have an offset field, so folio_split() tests are not
+performed. Add PID_FMT_OFFSET with an offset field and use it to perform
+folio_split() tests.
+
+Link: https://lkml.kernel.org/r/20250709012800.3225727-1-ziy@nvidia.com
+Fixes: 80a5c494c89f ("selftests/mm: add tests for folio_split(), buddy allocator like split")
+Signed-off-by: Zi Yan <ziy@nvidia.com>
+Tested-by: Baolin Wang <baolin.wang@linux.alibaba.com>
+Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
+Reviewed-by: Donet Tom <donettom@linux.ibm.com>
+Tested-by : Donet Tom <donettom@linux.ibm.com>
+Cc: Barry Song <baohua@kernel.org>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Dev Jain <dev.jain@arm.com>
+Cc: Liam Howlett <liam.howlett@oracle.com>
+Cc: Mariano Pache <npache@redhat.com>
+Cc: Ryan Roberts <ryan.roberts@arm.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/mm/split_huge_page_test.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/mm/split_huge_page_test.c b/tools/testing/selftests/mm/split_huge_page_test.c
+index aa7400ed0e99..f0d9c035641d 100644
+--- a/tools/testing/selftests/mm/split_huge_page_test.c
++++ b/tools/testing/selftests/mm/split_huge_page_test.c
+@@ -31,6 +31,7 @@ uint64_t pmd_pagesize;
+ #define INPUT_MAX 80
+
+ #define PID_FMT "%d,0x%lx,0x%lx,%d"
++#define PID_FMT_OFFSET "%d,0x%lx,0x%lx,%d,%d"
+ #define PATH_FMT "%s,0x%lx,0x%lx,%d"
+
+ #define PFN_MASK ((1UL<<55)-1)
+@@ -483,7 +484,7 @@ void split_thp_in_pagecache_to_order_at(size_t fd_size, const char *fs_loc,
+ write_debugfs(PID_FMT, getpid(), (uint64_t)addr,
+ (uint64_t)addr + fd_size, order);
+ else
+- write_debugfs(PID_FMT, getpid(), (uint64_t)addr,
++ write_debugfs(PID_FMT_OFFSET, getpid(), (uint64_t)addr,
+ (uint64_t)addr + fd_size, order, offset);
+
+ for (i = 0; i < fd_size; i++)
+--
+2.50.1
+
--- /dev/null
+From 37848a456fc38c191aedfe41f662cc24db8c23d9 Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Tue, 15 Jul 2025 20:43:28 +0200
+Subject: selftests: mptcp: connect: also cover alt modes
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+commit 37848a456fc38c191aedfe41f662cc24db8c23d9 upstream.
+
+The "mmap" and "sendfile" alternate modes for mptcp_connect.sh/.c are
+available from the beginning, but only tested when mptcp_connect.sh is
+manually launched with "-m mmap" or "-m sendfile", not via the
+kselftests helpers.
+
+The MPTCP CI was manually running "mptcp_connect.sh -m mmap", but not
+"-m sendfile". Plus other CIs, especially the ones validating the stable
+releases, were not validating these alternate modes.
+
+To make sure these modes are validated by these CIs, add two new test
+programs executing mptcp_connect.sh with the alternate modes.
+
+Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp")
+Cc: stable@vger.kernel.org
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20250715-net-mptcp-sft-connect-alt-v2-1-8230ddd82454@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/Makefile | 3 ++-
+ tools/testing/selftests/net/mptcp/mptcp_connect_mmap.sh | 5 +++++
+ tools/testing/selftests/net/mptcp/mptcp_connect_sendfile.sh | 5 +++++
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+ create mode 100755 tools/testing/selftests/net/mptcp/mptcp_connect_mmap.sh
+ create mode 100755 tools/testing/selftests/net/mptcp/mptcp_connect_sendfile.sh
+
+--- a/tools/testing/selftests/net/mptcp/Makefile
++++ b/tools/testing/selftests/net/mptcp/Makefile
+@@ -4,7 +4,8 @@ top_srcdir = ../../../../..
+
+ CFLAGS += -Wall -Wl,--no-as-needed -O2 -g -I$(top_srcdir)/usr/include $(KHDR_INCLUDES)
+
+-TEST_PROGS := mptcp_connect.sh pm_netlink.sh mptcp_join.sh diag.sh \
++TEST_PROGS := mptcp_connect.sh mptcp_connect_mmap.sh mptcp_connect_sendfile.sh \
++ pm_netlink.sh mptcp_join.sh diag.sh \
+ simult_flows.sh mptcp_sockopt.sh userspace_pm.sh
+
+ TEST_GEN_FILES = mptcp_connect pm_nl_ctl mptcp_sockopt mptcp_inq mptcp_diag
+--- /dev/null
++++ b/tools/testing/selftests/net/mptcp/mptcp_connect_mmap.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++# SPDX-License-Identifier: GPL-2.0
++
++MPTCP_LIB_KSFT_TEST="$(basename "${0}" .sh)" \
++ "$(dirname "${0}")/mptcp_connect.sh" -m mmap "${@}"
+--- /dev/null
++++ b/tools/testing/selftests/net/mptcp/mptcp_connect_sendfile.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++# SPDX-License-Identifier: GPL-2.0
++
++MPTCP_LIB_KSFT_TEST="$(basename "${0}" .sh)" \
++ "$(dirname "${0}")/mptcp_connect.sh" -m sendfile "${@}"
--- /dev/null
+From fdf0f60a2bb02ba581d9e71d583e69dd0714a521 Mon Sep 17 00:00:00 2001
+From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
+Date: Tue, 15 Jul 2025 20:43:29 +0200
+Subject: selftests: mptcp: connect: also cover checksum
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+commit fdf0f60a2bb02ba581d9e71d583e69dd0714a521 upstream.
+
+The checksum mode has been added a while ago, but it is only validated
+when manually launching mptcp_connect.sh with "-C".
+
+The different CIs were then not validating these MPTCP Connect tests
+with checksum enabled. To make sure they do, add a new test program
+executing mptcp_connect.sh with the checksum mode.
+
+Fixes: 94d66ba1d8e4 ("selftests: mptcp: enable checksum in mptcp_connect.sh")
+Cc: stable@vger.kernel.org
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20250715-net-mptcp-sft-connect-alt-v2-2-8230ddd82454@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/Makefile | 2 +-
+ tools/testing/selftests/net/mptcp/mptcp_connect_checksum.sh | 5 +++++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+ create mode 100755 tools/testing/selftests/net/mptcp/mptcp_connect_checksum.sh
+
+--- a/tools/testing/selftests/net/mptcp/Makefile
++++ b/tools/testing/selftests/net/mptcp/Makefile
+@@ -5,7 +5,7 @@ top_srcdir = ../../../../..
+ CFLAGS += -Wall -Wl,--no-as-needed -O2 -g -I$(top_srcdir)/usr/include $(KHDR_INCLUDES)
+
+ TEST_PROGS := mptcp_connect.sh mptcp_connect_mmap.sh mptcp_connect_sendfile.sh \
+- pm_netlink.sh mptcp_join.sh diag.sh \
++ mptcp_connect_checksum.sh pm_netlink.sh mptcp_join.sh diag.sh \
+ simult_flows.sh mptcp_sockopt.sh userspace_pm.sh
+
+ TEST_GEN_FILES = mptcp_connect pm_nl_ctl mptcp_sockopt mptcp_inq mptcp_diag
+--- /dev/null
++++ b/tools/testing/selftests/net/mptcp/mptcp_connect_checksum.sh
+@@ -0,0 +1,5 @@
++#!/bin/bash
++# SPDX-License-Identifier: GPL-2.0
++
++MPTCP_LIB_KSFT_TEST="$(basename "${0}" .sh)" \
++ "$(dirname "${0}")/mptcp_connect.sh" -C "${@}"
i2c-virtio-avoid-hang-by-using-interruptible-completion-wait.patch
bus-fsl-mc-fix-potential-double-device-reference-in-fsl_mc_get_endpoint.patch
sprintf.h-requires-stdarg.h.patch
+alsa-hda-realtek-add-mute-led-support-for-hp-pavilion-15-eg0xxx.patch
+alsa-hda-realtek-add-mute-led-support-for-hp-victus-15-fa0xxx.patch
+arm64-entry-mask-daif-in-cpu_switch_to-call_on_irq_stack.patch
+asoc-mediatek-common-fix-device-and-of-node-leak.patch
+dpaa2-eth-fix-device-reference-count-leak-in-mac-endpoint-handling.patch
+dpaa2-switch-fix-device-reference-count-leak-in-mac-endpoint-handling.patch
+e1000e-disregard-nvm-checksum-on-tgp-when-valid-checksum-bit-is-not-set.patch
+e1000e-ignore-uninitialized-checksum-word-on-tgp.patch
+gve-fix-stuck-tx-queue-for-dq-queue-format.patch
+ice-fix-a-null-pointer-dereference-in-ice_copy_and_init_pkg.patch
+kasan-use-vmalloc_dump_obj-for-vmalloc-error-reports.patch
+nilfs2-reject-invalid-file-types-when-reading-inodes.patch
+pci-pwrctrl-create-pwrctrl-devices-only-when-config_pci_pwrctrl-is-enabled.patch
+resource-fix-false-warning-in-__request_region.patch
+selftests-mptcp-connect-also-cover-alt-modes.patch
+selftests-mptcp-connect-also-cover-checksum.patch
+selftests-mm-fix-split_huge_page_test-for-folio_split-tests.patch
+mm-vmscan-fix-hwpoisoned-large-folio-handling-in-shrink_folio_list.patch
+mm-zsmalloc-do-not-pass-__gfp_movable-if-config_compaction-n.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
