--- /dev/null
+From 1585cf83e98db32463e5d54161b06a5f01fe9976 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 7 Feb 2026 14:13:17 +0100
+Subject: ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 1585cf83e98db32463e5d54161b06a5f01fe9976 upstream.
+
+It was reported that we need the same quirk for HP ZBook Studio G4
+(SSID 103c:826b) as other HP models to make the mute-LED working.
+
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/64d78753-b9ff-4c64-8920-64d8d31cd20c@gmail.com
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221002
+Link: https://patch.msgid.link/20260207131324.2428030-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/hda/codecs/conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/hda/codecs/conexant.c
++++ b/sound/hda/codecs/conexant.c
+@@ -1081,6 +1081,7 @@ static const struct hda_quirk cxt5066_fi
+ SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
+ SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO),
+ SND_PCI_QUIRK(0x103c, 0x8231, "HP ProBook 450 G4", CXT_FIXUP_MUTE_LED_GPIO),
++ SND_PCI_QUIRK(0x103c, 0x826b, "HP ZBook Studio G4", CXT_FIXUP_MUTE_LED_GPIO),
+ SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
--- /dev/null
+From 6c0568b7741a346088fd6dfced2d871f7d481d06 Mon Sep 17 00:00:00 2001
+From: Zenm Chen <zenmchen@gmail.com>
+Date: Thu, 29 Jan 2026 10:28:19 +0800
+Subject: Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB
+
+From: Zenm Chen <zenmchen@gmail.com>
+
+commit 6c0568b7741a346088fd6dfced2d871f7d481d06 upstream.
+
+Add USB ID 7392:e611 for Edimax EW-7611UXB which is RTL8851BU-based
+Wi-Fi + Bluetooth adapter.
+
+The information in /sys/kernel/debug/usb/devices about the Bluetooth
+device is listed as the below:
+
+T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 6 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=7392 ProdID=e611 Rev= 0.00
+S: Manufacturer=Realtek
+S: Product=802.11ax WLAN Adapter
+S: SerialNumber=00e04c000001
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA
+A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtw89_8851bu_git
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Cc: stable@vger.kernel.org # 6.6.x
+Signed-off-by: Zenm Chen <zenmchen@gmail.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -527,6 +527,8 @@ static const struct usb_device_id quirks
+ BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x2001, 0x332a), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
++ { USB_DEVICE(0x7392, 0xe611), .driver_info = BTUSB_REALTEK |
++ BTUSB_WIDEBAND_SPEECH },
+
+ /* Realtek 8852AE Bluetooth devices */
+ { USB_DEVICE(0x0bda, 0x2852), .driver_info = BTUSB_REALTEK |
--- /dev/null
+From 48329301969f6d21b2ef35f678e40f72b59eac94 Mon Sep 17 00:00:00 2001
+From: Thorsten Blum <thorsten.blum@linux.dev>
+Date: Thu, 27 Nov 2025 15:01:57 +0100
+Subject: crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+commit 48329301969f6d21b2ef35f678e40f72b59eac94 upstream.
+
+The local variable 'i' is initialized with -EINVAL, but the for loop
+immediately overwrites it and -EINVAL is never returned.
+
+If no empty compression mode can be found, the function would return the
+out-of-bounds index IAA_COMP_MODES_MAX, which would cause an invalid
+array access in add_iaa_compression_mode().
+
+Fix both issues by returning either a valid index or -EINVAL.
+
+Cc: stable@vger.kernel.org
+Fixes: b190447e0fa3 ("crypto: iaa - Add compression mode management along with fixed mode")
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Acked-by: Kanchana P Sridhar <kanchana.p.sridhar@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/intel/iaa/iaa_crypto_main.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- a/drivers/crypto/intel/iaa/iaa_crypto_main.c
++++ b/drivers/crypto/intel/iaa/iaa_crypto_main.c
+@@ -221,15 +221,13 @@ static struct iaa_compression_mode *iaa_
+
+ static int find_empty_iaa_compression_mode(void)
+ {
+- int i = -EINVAL;
++ int i;
+
+- for (i = 0; i < IAA_COMP_MODES_MAX; i++) {
+- if (iaa_compression_modes[i])
+- continue;
+- break;
+- }
++ for (i = 0; i < IAA_COMP_MODES_MAX; i++)
++ if (!iaa_compression_modes[i])
++ return i;
+
+- return i;
++ return -EINVAL;
+ }
+
+ static struct iaa_compression_mode *find_iaa_compression_mode(const char *name, int *idx)
--- /dev/null
+From 5565a72b24fa7935a9f30af386e92c8c9dfb23b9 Mon Sep 17 00:00:00 2001
+From: Thorsten Blum <thorsten.blum@linux.dev>
+Date: Wed, 26 Nov 2025 10:46:13 +0100
+Subject: crypto: octeontx - Fix length check to avoid truncation in ucode_load_store
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+commit 5565a72b24fa7935a9f30af386e92c8c9dfb23b9 upstream.
+
+OTX_CPT_UCODE_NAME_LENGTH limits the microcode name to 64 bytes. If a
+user writes a string of exactly 64 characters, the original code used
+'strlen(buf) > 64' to check the length, but then strscpy() copies only
+63 characters before adding a NUL terminator, silently truncating the
+copied string.
+
+Fix this off-by-one error by using 'count' directly for the length check
+to ensure long names are rejected early and copied without truncation.
+
+Cc: stable@vger.kernel.org
+Fixes: d9110b0b01ff ("crypto: marvell - add support for OCTEON TX CPT engine")
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c
++++ b/drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c
+@@ -1326,7 +1326,7 @@ static ssize_t ucode_load_store(struct d
+ int del_grp_idx = -1;
+ int ucode_idx = 0;
+
+- if (strlen(buf) > OTX_CPT_UCODE_NAME_LENGTH)
++ if (count >= OTX_CPT_UCODE_NAME_LENGTH)
+ return -EINVAL;
+
+ eng_grps = container_of(attr, struct otx_cpt_eng_grps, ucode_load_attr);
--- /dev/null
+From 1562b1fb7e17c1b3addb15e125c718b2be7f5512 Mon Sep 17 00:00:00 2001
+From: Kees Cook <kees@kernel.org>
+Date: Fri, 6 Feb 2026 19:49:54 -0800
+Subject: crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
+
+From: Kees Cook <kees@kernel.org>
+
+commit 1562b1fb7e17c1b3addb15e125c718b2be7f5512 upstream.
+
+The existing allocation of scatterlists in omap_crypto_copy_sg_lists()
+was allocating an array of scatterlist pointers, not scatterlist objects,
+resulting in a 4x too small allocation.
+
+Use sizeof(*new_sg) to get the correct object size.
+
+Fixes: 74ed87e7e7f7 ("crypto: omap - add base support library for common routines")
+Signed-off-by: Kees Cook <kees@kernel.org>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/omap-crypto.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/omap-crypto.c
++++ b/drivers/crypto/omap-crypto.c
+@@ -21,7 +21,7 @@ static int omap_crypto_copy_sg_lists(int
+ struct scatterlist *tmp;
+
+ if (!(flags & OMAP_CRYPTO_FORCE_SINGLE_ENTRY)) {
+- new_sg = kmalloc_array(n, sizeof(*sg), GFP_KERNEL);
++ new_sg = kmalloc_array(n, sizeof(*new_sg), GFP_KERNEL);
+ if (!new_sg)
+ return -ENOMEM;
+
--- /dev/null
+From b505047ffc8057555900d2d3a005d033e6967382 Mon Sep 17 00:00:00 2001
+From: Bibo Mao <maobibo@loongson.cn>
+Date: Tue, 13 Jan 2026 11:05:54 +0800
+Subject: crypto: virtio - Add spinlock protection with virtqueue notification
+
+From: Bibo Mao <maobibo@loongson.cn>
+
+commit b505047ffc8057555900d2d3a005d033e6967382 upstream.
+
+When VM boots with one virtio-crypto PCI device and builtin backend,
+run openssl benchmark command with multiple processes, such as
+ openssl speed -evp aes-128-cbc -engine afalg -seconds 10 -multi 32
+
+openssl processes will hangup and there is error reported like this:
+ virtio_crypto virtio0: dataq.0:id 3 is not a head!
+
+It seems that the data virtqueue need protection when it is handled
+for virtio done notification. If the spinlock protection is added
+in virtcrypto_done_task(), openssl benchmark with multiple processes
+works well.
+
+Fixes: fed93fb62e05 ("crypto: virtio - Handle dataq logic with tasklet")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bibo Mao <maobibo@loongson.cn>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/virtio/virtio_crypto_core.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/crypto/virtio/virtio_crypto_core.c
++++ b/drivers/crypto/virtio/virtio_crypto_core.c
+@@ -75,15 +75,20 @@ static void virtcrypto_done_task(unsigne
+ struct data_queue *data_vq = (struct data_queue *)data;
+ struct virtqueue *vq = data_vq->vq;
+ struct virtio_crypto_request *vc_req;
++ unsigned long flags;
+ unsigned int len;
+
++ spin_lock_irqsave(&data_vq->lock, flags);
+ do {
+ virtqueue_disable_cb(vq);
+ while ((vc_req = virtqueue_get_buf(vq, &len)) != NULL) {
++ spin_unlock_irqrestore(&data_vq->lock, flags);
+ if (vc_req->alg_cb)
+ vc_req->alg_cb(vc_req, len);
++ spin_lock_irqsave(&data_vq->lock, flags);
+ }
+ } while (!virtqueue_enable_cb(vq));
++ spin_unlock_irqrestore(&data_vq->lock, flags);
+ }
+
+ static void virtcrypto_dataq_callback(struct virtqueue *vq)
--- /dev/null
+From 14f86a1155cca1176abf55987b2fce7f7fcb2455 Mon Sep 17 00:00:00 2001
+From: Bibo Mao <maobibo@loongson.cn>
+Date: Tue, 13 Jan 2026 11:05:55 +0800
+Subject: crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req
+
+From: Bibo Mao <maobibo@loongson.cn>
+
+commit 14f86a1155cca1176abf55987b2fce7f7fcb2455 upstream.
+
+With function virtio_crypto_skcipher_crypt_req(), there is already
+virtqueue_kick() call with spinlock held in function
+__virtio_crypto_skcipher_do_req(). Remove duplicated virtqueue_kick()
+function call here.
+
+Fixes: d79b5d0bbf2e ("crypto: virtio - support crypto engine framework")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bibo Mao <maobibo@loongson.cn>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/virtio/virtio_crypto_skcipher_algs.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/crypto/virtio/virtio_crypto_skcipher_algs.c
++++ b/drivers/crypto/virtio/virtio_crypto_skcipher_algs.c
+@@ -541,8 +541,6 @@ int virtio_crypto_skcipher_crypt_req(
+ if (ret < 0)
+ return ret;
+
+- virtqueue_kick(data_vq->vq);
+-
+ return 0;
+ }
+
--- /dev/null
+From 05ce49a902be15dc93854cbfc20161205a9ee446 Mon Sep 17 00:00:00 2001
+From: Mehdi Ben Hadj Khelifa <mehdi.benhadjkhelifa@gmail.com>
+Date: Mon, 1 Dec 2025 23:23:06 +0100
+Subject: hfs: ensure sb->s_fs_info is always cleaned up
+
+From: Mehdi Ben Hadj Khelifa <mehdi.benhadjkhelifa@gmail.com>
+
+commit 05ce49a902be15dc93854cbfc20161205a9ee446 upstream.
+
+When hfs was converted to the new mount api a bug was introduced by
+changing the allocation pattern of sb->s_fs_info. If setup_bdev_super()
+fails after a new superblock has been allocated by sget_fc(), but before
+hfs_fill_super() takes ownership of the filesystem-specific s_fs_info
+data it was leaked.
+
+Fix this by freeing sb->s_fs_info in hfs_kill_super().
+
+Cc: stable@vger.kernel.org
+Fixes: ffcd06b6d13b ("hfs: convert hfs to use the new mount api")
+Reported-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6
+Tested-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Mehdi Ben Hadj Khelifa <mehdi.benhadjkhelifa@gmail.com>
+Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Link: https://lore.kernel.org/r/20251201222843.82310-2-mehdi.benhadjkhelifa@gmail.com
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/hfs/mdb.c | 35 ++++++++++++++---------------------
+ fs/hfs/super.c | 10 +++++++++-
+ 2 files changed, 23 insertions(+), 22 deletions(-)
+
+--- a/fs/hfs/mdb.c
++++ b/fs/hfs/mdb.c
+@@ -92,7 +92,7 @@ int hfs_mdb_get(struct super_block *sb)
+ /* See if this is an HFS filesystem */
+ bh = sb_bread512(sb, part_start + HFS_MDB_BLK, mdb);
+ if (!bh)
+- goto out;
++ return -EIO;
+
+ if (mdb->drSigWord == cpu_to_be16(HFS_SUPER_MAGIC))
+ break;
+@@ -102,13 +102,14 @@ int hfs_mdb_get(struct super_block *sb)
+ * (should do this only for cdrom/loop though)
+ */
+ if (hfs_part_find(sb, &part_start, &part_size))
+- goto out;
++ return -EIO;
+ }
+
+ HFS_SB(sb)->alloc_blksz = size = be32_to_cpu(mdb->drAlBlkSiz);
+ if (!size || (size & (HFS_SECTOR_SIZE - 1))) {
+ pr_err("bad allocation block size %d\n", size);
+- goto out_bh;
++ brelse(bh);
++ return -EIO;
+ }
+
+ size = min(HFS_SB(sb)->alloc_blksz, (u32)PAGE_SIZE);
+@@ -125,14 +126,16 @@ int hfs_mdb_get(struct super_block *sb)
+ brelse(bh);
+ if (!sb_set_blocksize(sb, size)) {
+ pr_err("unable to set blocksize to %u\n", size);
+- goto out;
++ return -EIO;
+ }
+
+ bh = sb_bread512(sb, part_start + HFS_MDB_BLK, mdb);
+ if (!bh)
+- goto out;
+- if (mdb->drSigWord != cpu_to_be16(HFS_SUPER_MAGIC))
+- goto out_bh;
++ return -EIO;
++ if (mdb->drSigWord != cpu_to_be16(HFS_SUPER_MAGIC)) {
++ brelse(bh);
++ return -EIO;
++ }
+
+ HFS_SB(sb)->mdb_bh = bh;
+ HFS_SB(sb)->mdb = mdb;
+@@ -174,7 +177,7 @@ int hfs_mdb_get(struct super_block *sb)
+
+ HFS_SB(sb)->bitmap = kzalloc(8192, GFP_KERNEL);
+ if (!HFS_SB(sb)->bitmap)
+- goto out;
++ return -EIO;
+
+ /* read in the bitmap */
+ block = be16_to_cpu(mdb->drVBMSt) + part_start;
+@@ -185,7 +188,7 @@ int hfs_mdb_get(struct super_block *sb)
+ bh = sb_bread(sb, off >> sb->s_blocksize_bits);
+ if (!bh) {
+ pr_err("unable to read volume bitmap\n");
+- goto out;
++ return -EIO;
+ }
+ off2 = off & (sb->s_blocksize - 1);
+ len = min((int)sb->s_blocksize - off2, size);
+@@ -199,12 +202,12 @@ int hfs_mdb_get(struct super_block *sb)
+ HFS_SB(sb)->ext_tree = hfs_btree_open(sb, HFS_EXT_CNID, hfs_ext_keycmp);
+ if (!HFS_SB(sb)->ext_tree) {
+ pr_err("unable to open extent tree\n");
+- goto out;
++ return -EIO;
+ }
+ HFS_SB(sb)->cat_tree = hfs_btree_open(sb, HFS_CAT_CNID, hfs_cat_keycmp);
+ if (!HFS_SB(sb)->cat_tree) {
+ pr_err("unable to open catalog tree\n");
+- goto out;
++ return -EIO;
+ }
+
+ attrib = mdb->drAtrb;
+@@ -229,12 +232,6 @@ int hfs_mdb_get(struct super_block *sb)
+ }
+
+ return 0;
+-
+-out_bh:
+- brelse(bh);
+-out:
+- hfs_mdb_put(sb);
+- return -EIO;
+ }
+
+ /*
+@@ -359,8 +356,6 @@ void hfs_mdb_close(struct super_block *s
+ * Release the resources associated with the in-core MDB. */
+ void hfs_mdb_put(struct super_block *sb)
+ {
+- if (!HFS_SB(sb))
+- return;
+ /* free the B-trees */
+ hfs_btree_close(HFS_SB(sb)->ext_tree);
+ hfs_btree_close(HFS_SB(sb)->cat_tree);
+@@ -373,6 +368,4 @@ void hfs_mdb_put(struct super_block *sb)
+ unload_nls(HFS_SB(sb)->nls_disk);
+
+ kfree(HFS_SB(sb)->bitmap);
+- kfree(HFS_SB(sb));
+- sb->s_fs_info = NULL;
+ }
+--- a/fs/hfs/super.c
++++ b/fs/hfs/super.c
+@@ -431,10 +431,18 @@ static int hfs_init_fs_context(struct fs
+ return 0;
+ }
+
++static void hfs_kill_super(struct super_block *sb)
++{
++ struct hfs_sb_info *hsb = HFS_SB(sb);
++
++ kill_block_super(sb);
++ kfree(hsb);
++}
++
+ static struct file_system_type hfs_fs_type = {
+ .owner = THIS_MODULE,
+ .name = "hfs",
+- .kill_sb = kill_block_super,
++ .kill_sb = hfs_kill_super,
+ .fs_flags = FS_REQUIRES_DEV,
+ .init_fs_context = hfs_init_fs_context,
+ };
--- /dev/null
+From ed527ef0c264e4bed6c7b2a158ddf516b17f5f66 Mon Sep 17 00:00:00 2001
+From: Edward Adam Davis <eadavis@qq.com>
+Date: Sat, 20 Dec 2025 03:04:25 +0900
+Subject: nilfs2: Fix potential block overflow that cause system hang
+
+From: Edward Adam Davis <eadavis@qq.com>
+
+commit ed527ef0c264e4bed6c7b2a158ddf516b17f5f66 upstream.
+
+When a user executes the FITRIM command, an underflow can occur when
+calculating nblocks if end_block is too small. Since nblocks is of
+type sector_t, which is u64, a negative nblocks value will become a
+very large positive integer. This ultimately leads to the block layer
+function __blkdev_issue_discard() taking an excessively long time to
+process the bio chain, and the ns_segctor_sem lock remains held for a
+long period. This prevents other tasks from acquiring the ns_segctor_sem
+lock, resulting in the hang reported by syzbot in [1].
+
+If the ending block is too small, typically if it is smaller than 4KiB
+range, depending on the usage of the segment 0, it may be possible to
+attempt a discard request beyond the device size causing the hang.
+
+Exiting successfully and assign the discarded size (0 in this case)
+to range->len.
+
+Although the start and len values in the user input range are too small,
+a conservative strategy is adopted here to safely ignore them, which is
+equivalent to a no-op; it will not perform any trimming and will not
+throw an error.
+
+[1]
+task:segctord state:D stack:28968 pid:6093 tgid:6093 ppid:2 task_flags:0x200040 flags:0x00080000
+Call Trace:
+ rwbase_write_lock+0x3dd/0x750 kernel/locking/rwbase_rt.c:272
+ nilfs_transaction_lock+0x253/0x4c0 fs/nilfs2/segment.c:357
+ nilfs_segctor_thread_construct fs/nilfs2/segment.c:2569 [inline]
+ nilfs_segctor_thread+0x6ec/0xe00 fs/nilfs2/segment.c:2684
+
+[ryusuke: corrected part of the commit message about the consequences]
+
+Fixes: 82e11e857be3 ("nilfs2: add nilfs_sufile_trim_fs to trim clean segs")
+Reported-by: syzbot+7eedce5eb281acd832f0@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=7eedce5eb281acd832f0
+Signed-off-by: Edward Adam Davis <eadavis@qq.com>
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nilfs2/sufile.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/nilfs2/sufile.c
++++ b/fs/nilfs2/sufile.c
+@@ -1093,6 +1093,9 @@ int nilfs_sufile_trim_fs(struct inode *s
+ else
+ end_block = start_block + len - 1;
+
++ if (end_block < nilfs->ns_first_data_block)
++ goto out;
++
+ segnum = nilfs_get_segnum_of_block(nilfs, start_block);
+ segnum_end = nilfs_get_segnum_of_block(nilfs, end_block);
+
+@@ -1191,6 +1194,7 @@ int nilfs_sufile_trim_fs(struct inode *s
+ out_sem:
+ up_read(&NILFS_MDT(sufile)->mi_sem);
+
++out:
+ range->len = ndiscarded << nilfs->ns_blocksize_bits;
+ return ret;
+ }
--- /dev/null
+From b0335ee4fb94832a4ef68774ca7e7b33b473c7a6 Mon Sep 17 00:00:00 2001
+From: Shreyas Deodhar <sdeodhar@marvell.com>
+Date: Wed, 10 Dec 2025 15:45:58 +0530
+Subject: scsi: qla2xxx: Allow recovery for tape devices
+
+From: Shreyas Deodhar <sdeodhar@marvell.com>
+
+commit b0335ee4fb94832a4ef68774ca7e7b33b473c7a6 upstream.
+
+Tape device doesn't show up after RSCNs. To fix this, remove tape
+device specific checks which allows recovery of tape devices.
+
+Fixes: 44c57f205876 ("scsi: qla2xxx: Changes to support FCP2 Target")
+Cc: stable@vger.kernel.org
+Signed-off-by: Shreyas Deodhar <sdeodhar@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Reviewed-by: Himanshu Madhani <hmadhani2024@gmail.com>
+Link: https://patch.msgid.link/20251210101604.431868-7-njavali@marvell.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qla2xxx/qla_gs.c | 3 ---
+ drivers/scsi/qla2xxx/qla_init.c | 9 ---------
+ 2 files changed, 12 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3266,9 +3266,6 @@ login_logout:
+ atomic_read(&fcport->state) == FCS_ONLINE) ||
+ do_delete) {
+ if (fcport->loop_id != FC_NO_LOOP_ID) {
+- if (fcport->flags & FCF_FCP2_DEVICE)
+- continue;
+-
+ ql_log(ql_log_warn, vha, 0x20f0,
+ "%s %d %8phC post del sess\n",
+ __func__, __LINE__,
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -1859,15 +1859,6 @@ void qla2x00_handle_rscn(scsi_qla_host_t
+ case RSCN_PORT_ADDR:
+ fcport = qla2x00_find_fcport_by_nportid(vha, &ea->id, 1);
+ if (fcport) {
+- if (ql2xfc2target &&
+- fcport->flags & FCF_FCP2_DEVICE &&
+- atomic_read(&fcport->state) == FCS_ONLINE) {
+- ql_dbg(ql_dbg_disc, vha, 0x2115,
+- "Delaying session delete for FCP2 portid=%06x %8phC ",
+- fcport->d_id.b24, fcport->port_name);
+- return;
+- }
+-
+ if (vha->hw->flags.edif_enabled && DBELL_ACTIVE(vha)) {
+ /*
+ * On ipsec start by remote port, Target port
--- /dev/null
+From 8890bf450e0b6b283f48ac619fca5ac2f14ddd62 Mon Sep 17 00:00:00 2001
+From: Anil Gurumurthy <agurumurthy@marvell.com>
+Date: Wed, 10 Dec 2025 15:45:59 +0530
+Subject: scsi: qla2xxx: Delay module unload while fabric scan in progress
+
+From: Anil Gurumurthy <agurumurthy@marvell.com>
+
+commit 8890bf450e0b6b283f48ac619fca5ac2f14ddd62 upstream.
+
+System crash seen during load/unload test in a loop.
+
+[105954.384919] RBP: ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086
+[105954.384920] R10: 000000000000000f R11: ffffa31240904be5 R12: ffff914605f868e0
+[105954.384921] R13: ffff914605f86910 R14: 0000000000008010 R15: 00000000ddb7c000
+[105954.384923] FS: 0000000000000000(0000) GS:ffff9163fec40000(0000) knlGS:0000000000000000
+[105954.384925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[105954.384926] CR2: 000055d31ce1d6a0 CR3: 0000000119f5e001 CR4: 0000000000770ee0
+[105954.384928] PKRU: 55555554
+[105954.384929] Call Trace:
+[105954.384931] <IRQ>
+[105954.384934] qla24xx_sp_unmap+0x1f3/0x2a0 [qla2xxx]
+[105954.384962] ? qla_async_scan_sp_done+0x114/0x1f0 [qla2xxx]
+[105954.384980] ? qla24xx_els_ct_entry+0x4de/0x760 [qla2xxx]
+[105954.384999] ? __wake_up_common+0x80/0x190
+[105954.385004] ? qla24xx_process_response_queue+0xc2/0xaa0 [qla2xxx]
+[105954.385023] ? qla24xx_msix_rsp_q+0x44/0xb0 [qla2xxx]
+[105954.385040] ? __handle_irq_event_percpu+0x3d/0x190
+[105954.385044] ? handle_irq_event+0x58/0xb0
+[105954.385046] ? handle_edge_irq+0x93/0x240
+[105954.385050] ? __common_interrupt+0x41/0xa0
+[105954.385055] ? common_interrupt+0x3e/0xa0
+[105954.385060] ? asm_common_interrupt+0x22/0x40
+
+The root cause of this was that there was a free (dma_free_attrs) in the
+interrupt context. There was a device discovery/fabric scan in
+progress. A module unload was issued which set the UNLOADING flag. As
+part of the discovery, after receiving an interrupt a work queue was
+scheduled (which involved a work to be queued). Since the UNLOADING
+flag is set, the work item was not allocated and the mapped memory had
+to be freed. The free occurred in interrupt context leading to system
+crash. Delay the driver unload until the fabric scan is complete to
+avoid the crash.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/all/202512090414.07Waorz0-lkp@intel.com/
+Fixes: 783e0dc4f66a ("qla2xxx: Check for device state before unloading the driver.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Anil Gurumurthy <agurumurthy@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Reviewed-by: Himanshu Madhani <hmadhani2024@gmail.com>
+Link: https://patch.msgid.link/20251210101604.431868-8-njavali@marvell.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1182,7 +1182,8 @@ qla2x00_wait_for_hba_ready(scsi_qla_host
+ while ((qla2x00_reset_active(vha) || ha->dpc_active ||
+ ha->flags.mbox_busy) ||
+ test_bit(FX00_RESET_RECOVERY, &vha->dpc_flags) ||
+- test_bit(FX00_TARGET_SCAN, &vha->dpc_flags)) {
++ test_bit(FX00_TARGET_SCAN, &vha->dpc_flags) ||
++ (vha->scan.scan_flags & SF_SCANNING)) {
+ if (test_bit(UNLOADING, &base_vha->dpc_flags))
+ break;
+ msleep(1000);
--- /dev/null
+From 7adbd2b7809066c75f0433e5e2a8e114b429f30f Mon Sep 17 00:00:00 2001
+From: Anil Gurumurthy <agurumurthy@marvell.com>
+Date: Wed, 10 Dec 2025 15:46:00 +0530
+Subject: scsi: qla2xxx: Free sp in error path to fix system crash
+
+From: Anil Gurumurthy <agurumurthy@marvell.com>
+
+commit 7adbd2b7809066c75f0433e5e2a8e114b429f30f upstream.
+
+System crash seen during load/unload test in a loop,
+
+[61110.449331] qla2xxx [0000:27:00.0]-0042:0: Disabled MSI-X.
+[61110.467494] =============================================================================
+[61110.467498] BUG qla2xxx_srbs (Tainted: G OE -------- --- ): Objects remaining in qla2xxx_srbs on __kmem_cache_shutdown()
+[61110.467501] -----------------------------------------------------------------------------
+
+[61110.467502] Slab 0x000000000ffc8162 objects=51 used=1 fp=0x00000000e25d3d85 flags=0x57ffffc0010200(slab|head|node=1|zone=2|lastcpupid=0x1fffff)
+[61110.467509] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1
+[61110.467513] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023
+[61110.467515] Call Trace:
+[61110.467516] <TASK>
+[61110.467519] dump_stack_lvl+0x34/0x48
+[61110.467526] slab_err.cold+0x53/0x67
+[61110.467534] __kmem_cache_shutdown+0x16e/0x320
+[61110.467540] kmem_cache_destroy+0x51/0x160
+[61110.467544] qla2x00_module_exit+0x93/0x99 [qla2xxx]
+[61110.467607] ? __do_sys_delete_module.constprop.0+0x178/0x280
+[61110.467613] ? syscall_trace_enter.constprop.0+0x145/0x1d0
+[61110.467616] ? do_syscall_64+0x5c/0x90
+[61110.467619] ? exc_page_fault+0x62/0x150
+[61110.467622] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd
+[61110.467626] </TASK>
+[61110.467627] Disabling lock debugging due to kernel taint
+[61110.467635] Object 0x0000000026f7e6e6 @offset=16000
+[61110.467639] ------------[ cut here ]------------
+[61110.467639] kmem_cache_destroy qla2xxx_srbs: Slab cache still has objects when called from qla2x00_module_exit+0x93/0x99 [qla2xxx]
+[61110.467659] WARNING: CPU: 53 PID: 455206 at mm/slab_common.c:520 kmem_cache_destroy+0x14d/0x160
+[61110.467718] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G B OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1
+[61110.467720] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023
+[61110.467721] RIP: 0010:kmem_cache_destroy+0x14d/0x160
+[61110.467724] Code: 99 7d 07 00 48 89 ef e8 e1 6a 07 00 eb b3 48 8b 55 60 48 8b 4c 24 20 48 c7 c6 70 fc 66 90 48 c7 c7 f8 ef a1 90 e8 e1 ed 7c 00 <0f> 0b eb 93 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 55 48 89
+[61110.467725] RSP: 0018:ffffa304e489fe80 EFLAGS: 00010282
+[61110.467727] RAX: 0000000000000000 RBX: ffffffffc0d9a860 RCX: 0000000000000027
+[61110.467729] RDX: ffff8fd5ff9598a8 RSI: 0000000000000001 RDI: ffff8fd5ff9598a0
+[61110.467730] RBP: ffff8fb6aaf78700 R08: 0000000000000000 R09: 0000000100d863b7
+[61110.467731] R10: ffffa304e489fd20 R11: ffffffff913bef48 R12: 0000000040002000
+[61110.467731] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+[61110.467733] FS: 00007f64c89fb740(0000) GS:ffff8fd5ff940000(0000) knlGS:0000000000000000
+[61110.467734] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[61110.467735] CR2: 00007f0f02bfe000 CR3: 00000020ad6dc005 CR4: 0000000000770ee0
+[61110.467736] PKRU: 55555554
+[61110.467737] Call Trace:
+[61110.467738] <TASK>
+[61110.467739] qla2x00_module_exit+0x93/0x99 [qla2xxx]
+[61110.467755] ? __do_sys_delete_module.constprop.0+0x178/0x280
+
+Free sp in the error path to fix the crash.
+
+Fixes: f352eeb75419 ("scsi: qla2xxx: Add ability to use GPNFT/GNNFT for RSCN handling")
+Cc: stable@vger.kernel.org
+Signed-off-by: Anil Gurumurthy <agurumurthy@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Reviewed-by: Himanshu Madhani <hmadhani2024@gmail.com>
+Link: https://patch.msgid.link/20251210101604.431868-9-njavali@marvell.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qla2xxx/qla_gs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3532,8 +3532,8 @@ int qla_fab_async_scan(scsi_qla_host_t *
+ if (vha->scan.scan_flags & SF_SCANNING) {
+ spin_unlock_irqrestore(&vha->work_lock, flags);
+ ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0x2012,
+- "%s: scan active\n", __func__);
+- return rval;
++ "%s: scan active for sp:%p\n", __func__, sp);
++ goto done_free_sp;
+ }
+ vha->scan.scan_flags |= SF_SCANNING;
+ if (!sp)
--- /dev/null
+From 42b2dab4340d39b71334151e10c6d7d9b0040ffa Mon Sep 17 00:00:00 2001
+From: Anil Gurumurthy <agurumurthy@marvell.com>
+Date: Wed, 10 Dec 2025 15:46:02 +0530
+Subject: scsi: qla2xxx: Query FW again before proceeding with login
+
+From: Anil Gurumurthy <agurumurthy@marvell.com>
+
+commit 42b2dab4340d39b71334151e10c6d7d9b0040ffa upstream.
+
+Issue occurred during a continuous reboot test of several thousand
+iterations specific to a fabric topo with dual mode target where it
+sends a PLOGI/PRLI and then sends a LOGO. The initiator was also in the
+process of discovery and sent a PLOGI to the switch. It then queried a
+list of ports logged in via mbx 75h and the GPDB response indicated that
+the target was logged in. This caused a mismatch in the states between
+the driver and FW. Requery the FW for the state and proceed with the
+rest of discovery process.
+
+Fixes: a4239945b8ad ("scsi: qla2xxx: Add switch command to simplify fabric discovery")
+Cc: stable@vger.kernel.org
+Signed-off-by: Anil Gurumurthy <agurumurthy@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Reviewed-by: Himanshu Madhani <hmadhani2024@gmail.com>
+Link: https://patch.msgid.link/20251210101604.431868-11-njavali@marvell.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 19 +++++++++++++++++--
+ drivers/scsi/qla2xxx/qla_isr.c | 19 +++++++++++++++++--
+ 2 files changed, 34 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -2462,8 +2462,23 @@ qla24xx_handle_plogi_done_event(struct s
+ ea->sp->gen1, fcport->rscn_gen,
+ ea->data[0], ea->data[1], ea->iop[0], ea->iop[1]);
+
+- if ((fcport->fw_login_state == DSC_LS_PLOGI_PEND) ||
+- (fcport->fw_login_state == DSC_LS_PRLI_PEND)) {
++ if (fcport->fw_login_state == DSC_LS_PLOGI_PEND) {
++ ql_dbg(ql_dbg_disc, vha, 0x20ea,
++ "%s %d %8phC Remote is trying to login\n",
++ __func__, __LINE__, fcport->port_name);
++ /*
++ * If we get here, there is port thats already logged in,
++ * but it's state has not moved ahead. Recheck with FW on
++ * what state it is in and proceed ahead
++ */
++ if (!N2N_TOPO(vha->hw)) {
++ fcport->fw_login_state = DSC_LS_PRLI_COMP;
++ qla24xx_post_gpdb_work(vha, fcport, 0);
++ }
++ return;
++ }
++
++ if (fcport->fw_login_state == DSC_LS_PRLI_PEND) {
+ ql_dbg(ql_dbg_disc, vha, 0x20ea,
+ "%s %d %8phC Remote is trying to login\n",
+ __func__, __LINE__, fcport->port_name);
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -1676,13 +1676,28 @@ skip_rio:
+
+ /* Port logout */
+ fcport = qla2x00_find_fcport_by_loopid(vha, mb[1]);
+- if (!fcport)
++ if (!fcport) {
++ ql_dbg(ql_dbg_async, vha, 0x5011,
++ "Could not find fcport:%04x %04x %04x\n",
++ mb[1], mb[2], mb[3]);
+ break;
+- if (atomic_read(&fcport->state) != FCS_ONLINE)
++ }
++
++ if (atomic_read(&fcport->state) != FCS_ONLINE) {
++ ql_dbg(ql_dbg_async, vha, 0x5012,
++ "Port state is not online State:0x%x \n",
++ atomic_read(&fcport->state));
++ ql_dbg(ql_dbg_async, vha, 0x5012,
++ "Scheduling session for deletion \n");
++ fcport->logout_on_delete = 0;
++ qlt_schedule_sess_for_deletion(fcport);
+ break;
++ }
++
+ ql_dbg(ql_dbg_async, vha, 0x508a,
+ "Marking port lost loopid=%04x portid=%06x.\n",
+ fcport->loop_id, fcport->d_id.b24);
++
+ if (qla_ini_mode_enabled(vha)) {
+ fcport->logout_on_delete = 0;
+ qlt_schedule_sess_for_deletion(fcport);
--- /dev/null
+From b6df15aec8c3441357d4da0eaf4339eb20f5999f Mon Sep 17 00:00:00 2001
+From: Anil Gurumurthy <agurumurthy@marvell.com>
+Date: Wed, 10 Dec 2025 15:46:01 +0530
+Subject: scsi: qla2xxx: Validate sp before freeing associated memory
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Anil Gurumurthy <agurumurthy@marvell.com>
+
+commit b6df15aec8c3441357d4da0eaf4339eb20f5999f upstream.
+
+System crash with the following signature
+[154563.214890] nvme nvme2: NVME-FC{1}: controller connect complete
+[154564.169363] qla2xxx [0000:b0:00.1]-3002:2: nvme: Sched: Set ZIO exchange threshold to 3.
+[154564.169405] qla2xxx [0000:b0:00.1]-ffffff:2: SET ZIO Activity exchange threshold to 5.
+[154565.539974] qla2xxx [0000:b0:00.1]-5013:2: RSCN database changed – 0078 0080 0000.
+[154565.545744] qla2xxx [0000:b0:00.1]-5013:2: RSCN database changed – 0078 00a0 0000.
+[154565.545857] qla2xxx [0000:b0:00.1]-11a2:2: FEC=enabled (data rate).
+[154565.552760] qla2xxx [0000:b0:00.1]-11a2:2: FEC=enabled (data rate).
+[154565.553079] BUG: kernel NULL pointer dereference, address: 00000000000000f8
+[154565.553080] #PF: supervisor read access in kernel mode
+[154565.553082] #PF: error_code(0x0000) - not-present page
+[154565.553084] PGD 80000010488ab067 P4D 80000010488ab067 PUD 104978a067 PMD 0
+[154565.553089] Oops: 0000 1 PREEMPT SMP PTI
+[154565.553092] CPU: 10 PID: 858 Comm: qla2xxx_2_dpc Kdump: loaded Tainted: G OE ------- --- 5.14.0-503.11.1.el9_5.x86_64 #1
+[154565.553096] Hardware name: HPE Synergy 660 Gen10/Synergy 660 Gen10 Compute Module, BIOS I43 09/30/2024
+[154565.553097] RIP: 0010:qla_fab_async_scan.part.0+0x40b/0x870 [qla2xxx]
+[154565.553141] Code: 00 00 e8 58 a3 ec d4 49 89 e9 ba 12 20 00 00 4c 89 e6 49 c7 c0 00 ee a8 c0 48 c7 c1 66 c0 a9 c0 bf 00 80 00 10 e8 15 69 00 00 <4c> 8b 8d f8 00 00 00 4d 85 c9 74 35 49 8b 84 24 00 19 00 00 48 8b
+[154565.553143] RSP: 0018:ffffb4dbc8aebdd0 EFLAGS: 00010286
+[154565.553145] RAX: 0000000000000000 RBX: ffff8ec2cf0908d0 RCX: 0000000000000002
+[154565.553147] RDX: 0000000000000000 RSI: ffffffffc0a9c896 RDI: ffffb4dbc8aebd47
+[154565.553148] RBP: 0000000000000000 R08: ffffb4dbc8aebd45 R09: 0000000000ffff0a
+[154565.553150] R10: 0000000000000000 R11: 000000000000000f R12: ffff8ec2cf0908d0
+[154565.553151] R13: ffff8ec2cf090900 R14: 0000000000000102 R15: ffff8ec2cf084000
+[154565.553152] FS: 0000000000000000(0000) GS:ffff8ed27f800000(0000) knlGS:0000000000000000
+[154565.553154] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[154565.553155] CR2: 00000000000000f8 CR3: 000000113ae0a005 CR4: 00000000007706f0
+[154565.553157] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[154565.553158] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[154565.553159] PKRU: 55555554
+[154565.553160] Call Trace:
+[154565.553162] <TASK>
+[154565.553165] ? show_trace_log_lvl+0x1c4/0x2df
+[154565.553172] ? show_trace_log_lvl+0x1c4/0x2df
+[154565.553177] ? qla_fab_async_scan.part.0+0x40b/0x870 [qla2xxx]
+[154565.553215] ? __die_body.cold+0x8/0xd
+[154565.553218] ? page_fault_oops+0x134/0x170
+[154565.553223] ? snprintf+0x49/0x70
+[154565.553229] ? exc_page_fault+0x62/0x150
+[154565.553238] ? asm_exc_page_fault+0x22/0x30
+
+Check for sp being non NULL before freeing any associated memory
+
+Fixes: a4239945b8ad ("scsi: qla2xxx: Add switch command to simplify fabric discovery")
+Cc: stable@vger.kernel.org
+Signed-off-by: Anil Gurumurthy <agurumurthy@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Reviewed-by: Himanshu Madhani <hmadhani2024@gmail.com>
+Link: https://patch.msgid.link/20251210101604.431868-10-njavali@marvell.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/qla2xxx/qla_gs.c | 34 ++++++++++++++++++----------------
+ 1 file changed, 18 insertions(+), 16 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3701,23 +3701,25 @@ int qla_fab_async_scan(scsi_qla_host_t *
+ return rval;
+
+ done_free_sp:
+- if (sp->u.iocb_cmd.u.ctarg.req) {
+- dma_free_coherent(&vha->hw->pdev->dev,
+- sp->u.iocb_cmd.u.ctarg.req_allocated_size,
+- sp->u.iocb_cmd.u.ctarg.req,
+- sp->u.iocb_cmd.u.ctarg.req_dma);
+- sp->u.iocb_cmd.u.ctarg.req = NULL;
+- }
+- if (sp->u.iocb_cmd.u.ctarg.rsp) {
+- dma_free_coherent(&vha->hw->pdev->dev,
+- sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
+- sp->u.iocb_cmd.u.ctarg.rsp,
+- sp->u.iocb_cmd.u.ctarg.rsp_dma);
+- sp->u.iocb_cmd.u.ctarg.rsp = NULL;
+- }
++ if (sp) {
++ if (sp->u.iocb_cmd.u.ctarg.req) {
++ dma_free_coherent(&vha->hw->pdev->dev,
++ sp->u.iocb_cmd.u.ctarg.req_allocated_size,
++ sp->u.iocb_cmd.u.ctarg.req,
++ sp->u.iocb_cmd.u.ctarg.req_dma);
++ sp->u.iocb_cmd.u.ctarg.req = NULL;
++ }
++ if (sp->u.iocb_cmd.u.ctarg.rsp) {
++ dma_free_coherent(&vha->hw->pdev->dev,
++ sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,
++ sp->u.iocb_cmd.u.ctarg.rsp,
++ sp->u.iocb_cmd.u.ctarg.rsp_dma);
++ sp->u.iocb_cmd.u.ctarg.rsp = NULL;
++ }
+
+- /* ref: INIT */
+- kref_put(&sp->cmd_kref, qla2x00_sp_release);
++ /* ref: INIT */
++ kref_put(&sp->cmd_kref, qla2x00_sp_release);
++ }
+
+ spin_lock_irqsave(&vha->work_lock, flags);
+ vha->scan.scan_flags &= ~SF_SCANNING;
smb-client-let-smbd_post_send_negotiate_req-use-smbd_post_send.patch
smb-client-let-send_done-handle-a-completion-without-ib_send_signaled.patch
driver-core-enforce-device_lock-for-driver_match_device.patch
+bluetooth-btusb-add-usb-id-7392-e611-for-edimax-ew-7611uxb.patch
+alsa-hda-conexant-add-quirk-for-hp-zbook-studio-g4.patch
+crypto-iaa-fix-out-of-bounds-index-in-find_empty_iaa_compression_mode.patch
+crypto-octeontx-fix-length-check-to-avoid-truncation-in-ucode_load_store.patch
+crypto-omap-allocate-omap_crypto_force_copy-scatterlists-correctly.patch
+crypto-virtio-add-spinlock-protection-with-virtqueue-notification.patch
+crypto-virtio-remove-duplicated-virtqueue_kick-in-virtio_crypto_skcipher_crypt_req.patch
+nilfs2-fix-potential-block-overflow-that-cause-system-hang.patch
+hfs-ensure-sb-s_fs_info-is-always-cleaned-up.patch
+wifi-rtw88-fix-alignment-fault-in-rtw_core_enable_beacon.patch
+scsi-qla2xxx-validate-sp-before-freeing-associated-memory.patch
+scsi-qla2xxx-allow-recovery-for-tape-devices.patch
+scsi-qla2xxx-delay-module-unload-while-fabric-scan-in-progress.patch
+scsi-qla2xxx-free-sp-in-error-path-to-fix-system-crash.patch
+scsi-qla2xxx-query-fw-again-before-proceeding-with-login.patch
--- /dev/null
+From 0177aa828d966117ea30a44f2e1890fdb356118e Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 24 Dec 2025 01:24:21 +0200
+Subject: wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+commit 0177aa828d966117ea30a44f2e1890fdb356118e upstream.
+
+rtw_core_enable_beacon() reads 4 bytes from an address that is not a
+multiple of 4. This results in a crash on some systems.
+
+Do 1 byte reads/writes instead.
+
+Unable to handle kernel paging request at virtual address ffff8000827e0522
+Mem abort info:
+ ESR = 0x0000000096000021
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x21: alignment fault
+Data abort info:
+ ISV = 0, ISS = 0x00000021, ISS2 = 0x00000000
+ CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+ GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000005492000
+[ffff8000827e0522] pgd=0000000000000000, p4d=10000001021d9403, pud=10000001021da403, pmd=100000011061c403, pte=00780000f3200f13
+Internal error: Oops: 0000000096000021 [#1] SMP
+Modules linked in: [...] rtw88_8822ce rtw88_8822c rtw88_pci rtw88_core [...]
+CPU: 0 UID: 0 PID: 73 Comm: kworker/u32:2 Tainted: G W 6.17.9 #1-NixOS VOLUNTARY
+Tainted: [W]=WARN
+Hardware name: FriendlyElec NanoPC-T6 LTS (DT)
+Workqueue: phy0 rtw_c2h_work [rtw88_core]
+pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : rtw_pci_read32+0x18/0x40 [rtw88_pci]
+lr : rtw_core_enable_beacon+0xe0/0x148 [rtw88_core]
+sp : ffff800080cc3ca0
+x29: ffff800080cc3ca0 x28: ffff0001031fc240 x27: ffff000102100828
+x26: ffffd2cb7c9b4088 x25: ffff0001031fc2c0 x24: ffff000112fdef00
+x23: ffff000112fdef18 x22: ffff000111c29970 x21: 0000000000000001
+x20: 0000000000000001 x19: ffff000111c22040 x18: 0000000000000000
+x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
+x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
+x11: 0000000000000000 x10: 0000000000000000 x9 : ffffd2cb6507c090
+x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
+x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
+x2 : 0000000000007f10 x1 : 0000000000000522 x0 : ffff8000827e0522
+Call trace:
+ rtw_pci_read32+0x18/0x40 [rtw88_pci] (P)
+ rtw_hw_scan_chan_switch+0x124/0x1a8 [rtw88_core]
+ rtw_fw_c2h_cmd_handle+0x254/0x290 [rtw88_core]
+ rtw_c2h_work+0x50/0x98 [rtw88_core]
+ process_one_work+0x178/0x3f8
+ worker_thread+0x208/0x418
+ kthread+0x120/0x220
+ ret_from_fork+0x10/0x20
+Code: d28fe202 8b020000 f9524400 8b214000 (b9400000)
+---[ end trace 0000000000000000 ]---
+
+Fixes: ad6741b1e044 ("wifi: rtw88: Stop high queue during scan")
+Cc: stable@vger.kernel.org
+Closes: https://github.com/lwfinger/rtw88/issues/418
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/6345300d-8c93-464c-9b05-d0d9af3c97ad@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -2444,10 +2444,10 @@ void rtw_core_enable_beacon(struct rtw_d
+
+ if (enable) {
+ rtw_write32_set(rtwdev, REG_BCN_CTRL, BIT_EN_BCN_FUNCTION);
+- rtw_write32_clr(rtwdev, REG_TXPAUSE, BIT_HIGH_QUEUE);
++ rtw_write8_clr(rtwdev, REG_TXPAUSE, BIT_HIGH_QUEUE);
+ } else {
+ rtw_write32_clr(rtwdev, REG_BCN_CTRL, BIT_EN_BCN_FUNCTION);
+- rtw_write32_set(rtwdev, REG_TXPAUSE, BIT_HIGH_QUEUE);
++ rtw_write8_set(rtwdev, REG_TXPAUSE, BIT_HIGH_QUEUE);
+ }
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
