--- /dev/null
+From 9104a43b3616b1fdf92b3fda87001cae31b6802f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 10:04:58 -0500
+Subject: iio: adc: ad7949: use spi_is_bpw_supported()
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 7b86482632788acd48d7b9ee1867f5ad3a32ccbb ]
+
+Use spi_is_bpw_supported() instead of directly accessing spi->controller
+->bits_per_word_mask. bits_per_word_mask may be 0, which implies that
+8-bits-per-word is supported. spi_is_bpw_supported() takes this into
+account while spi_ctrl_mask == SPI_BPW_MASK(8) does not.
+
+Fixes: 0b2a740b424e ("iio: adc: ad7949: enable use with non 14/16-bit controllers")
+Closes: https://lore.kernel.org/linux-spi/c8b8a963-6cef-4c9b-bfef-dab2b7bd0b0f@sirena.org.uk/
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Link: https://patch.msgid.link/20250611-iio-adc-ad7949-use-spi_is_bpw_supported-v1-1-c4e15bfd326e@baylibre.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad7949.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iio/adc/ad7949.c b/drivers/iio/adc/ad7949.c
+index edd0c3a35ab73..202561cad4012 100644
+--- a/drivers/iio/adc/ad7949.c
++++ b/drivers/iio/adc/ad7949.c
+@@ -308,7 +308,6 @@ static void ad7949_disable_reg(void *reg)
+
+ static int ad7949_spi_probe(struct spi_device *spi)
+ {
+- u32 spi_ctrl_mask = spi->controller->bits_per_word_mask;
+ struct device *dev = &spi->dev;
+ const struct ad7949_adc_spec *spec;
+ struct ad7949_adc_chip *ad7949_adc;
+@@ -337,11 +336,11 @@ static int ad7949_spi_probe(struct spi_device *spi)
+ ad7949_adc->resolution = spec->resolution;
+
+ /* Set SPI bits per word */
+- if (spi_ctrl_mask & SPI_BPW_MASK(ad7949_adc->resolution)) {
++ if (spi_is_bpw_supported(spi, ad7949_adc->resolution)) {
+ spi->bits_per_word = ad7949_adc->resolution;
+- } else if (spi_ctrl_mask == SPI_BPW_MASK(16)) {
++ } else if (spi_is_bpw_supported(spi, 16)) {
+ spi->bits_per_word = 16;
+- } else if (spi_ctrl_mask == SPI_BPW_MASK(8)) {
++ } else if (spi_is_bpw_supported(spi, 8)) {
+ spi->bits_per_word = 8;
+ } else {
+ dev_err(dev, "unable to find common BPW with spi controller\n");
+--
+2.39.5
+
--- /dev/null
+From 921993c094b40e06189a9691a014dfae21a958af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jun 2025 22:53:38 +0800
+Subject: interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node
+
+From: Xilin Wu <sophon@radxa.com>
+
+[ Upstream commit 886a94f008dd1a1702ee66dd035c266f70fd9e90 ]
+
+This allows adding interconnect paths for PCIe 1 in device tree later.
+
+Fixes: 46bdcac533cc ("interconnect: qcom: Add SC7280 interconnect provider driver")
+Signed-off-by: Xilin Wu <sophon@radxa.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250613-sc7280-icc-pcie1-fix-v1-1-0b09813e3b09@radxa.com
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sc7280.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/interconnect/qcom/sc7280.c b/drivers/interconnect/qcom/sc7280.c
+index a626dbc719995..728589ec80264 100644
+--- a/drivers/interconnect/qcom/sc7280.c
++++ b/drivers/interconnect/qcom/sc7280.c
+@@ -165,6 +165,7 @@ static struct qcom_icc_node xm_pcie3_1 = {
+ .id = SC7280_MASTER_PCIE_1,
+ .channels = 1,
+ .buswidth = 8,
++ .num_links = 1,
+ .links = { SC7280_SLAVE_ANOC_PCIE_GEM_NOC },
+ };
+
+--
+2.39.5
+
--- /dev/null
+From feac823eb4c63b201e988d6f28a4637b8b10b36e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:32:54 +0200
+Subject: platform/x86: Fix initialization order for firmware_attributes_class
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Torsten Hilbrich <torsten.hilbrich@secunet.com>
+
+[ Upstream commit 2bfe3ae1aa45f8b61cb0dc462114fd0c9636ad32 ]
+
+The think-lmi driver uses the firwmare_attributes_class. But this class
+is registered after think-lmi, causing the "think-lmi" directory in
+"/sys/class/firmware-attributes" to be missing when the driver is
+compiled as builtin.
+
+Fixes: 55922403807a ("platform/x86: think-lmi: Directly use firmware_attributes_class")
+Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
+Link: https://lore.kernel.org/r/7dce5f7f-c348-4350-ac53-d14a8e1e8034@secunet.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
+index b457de5abf7d7..8012de299174f 100644
+--- a/drivers/platform/x86/Makefile
++++ b/drivers/platform/x86/Makefile
+@@ -58,6 +58,8 @@ obj-$(CONFIG_X86_PLATFORM_DRIVERS_HP) += hp/
+ # Hewlett Packard Enterprise
+ obj-$(CONFIG_UV_SYSFS) += uv_sysfs.o
+
++obj-$(CONFIG_FW_ATTR_CLASS) += firmware_attributes_class.o
++
+ # IBM Thinkpad and Lenovo
+ obj-$(CONFIG_IBM_RTL) += ibm_rtl.o
+ obj-$(CONFIG_IDEAPAD_LAPTOP) += ideapad-laptop.o
+@@ -108,7 +110,6 @@ obj-$(CONFIG_SYSTEM76_ACPI) += system76_acpi.o
+ obj-$(CONFIG_TOPSTAR_LAPTOP) += topstar-laptop.o
+
+ # Platform drivers
+-obj-$(CONFIG_FW_ATTR_CLASS) += firmware_attributes_class.o
+ obj-$(CONFIG_SERIAL_MULTI_INSTANTIATE) += serial-multi-instantiate.o
+ obj-$(CONFIG_MLX_PLATFORM) += mlx-platform.o
+ obj-$(CONFIG_TOUCHSCREEN_DMI) += touchscreen_dmi.o
+--
+2.39.5
+
--- /dev/null
+From 12198e12f8dbd5f128ca475c21d0932129005563 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Jun 2025 11:26:21 +0300
+Subject: RDMA/core: Rate limit GID cache warning messages
+
+From: Maor Gottlieb <maorg@nvidia.com>
+
+[ Upstream commit 333e4d79316c9ed5877d7aac8b8ed22efc74e96d ]
+
+The GID cache warning messages can flood the kernel log when there are
+multiple failed attempts to add GIDs. This can happen when creating many
+virtual interfaces without having enough space for their GIDs in the GID
+table.
+
+Change pr_warn to pr_warn_ratelimited to prevent log flooding while still
+maintaining visibility of the issue.
+
+Link: https://patch.msgid.link/r/fd45ed4a1078e743f498b234c3ae816610ba1b18.1750062357.git.leon@kernel.org
+Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cache.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
+index 0b88203720b05..77c0b89259911 100644
+--- a/drivers/infiniband/core/cache.c
++++ b/drivers/infiniband/core/cache.c
+@@ -582,8 +582,8 @@ static int __ib_cache_gid_add(struct ib_device *ib_dev, u32 port,
+ out_unlock:
+ mutex_unlock(&table->lock);
+ if (ret)
+- pr_warn("%s: unable to add gid %pI6 error=%d\n",
+- __func__, gid->raw, ret);
++ pr_warn_ratelimited("%s: unable to add gid %pI6 error=%d\n",
++ __func__, gid->raw, ret);
+ return ret;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 273037f313041c4662593a44c14ebb451a82caf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jun 2025 22:58:21 +0530
+Subject: regmap: fix potential memory leak of regmap_bus
+
+From: Abdun Nihaal <abdun.nihaal@gmail.com>
+
+[ Upstream commit c871c199accb39d0f4cb941ad0dccabfc21e9214 ]
+
+When __regmap_init() is called from __regmap_init_i2c() and
+__regmap_init_spi() (and their devm versions), the bus argument
+obtained from regmap_get_i2c_bus() and regmap_get_spi_bus(), may be
+allocated using kmemdup() to support quirks. In those cases, the
+bus->free_on_exit field is set to true.
+
+However, inside __regmap_init(), buf is not freed on any error path.
+This could lead to a memory leak of regmap_bus when __regmap_init()
+fails. Fix that by freeing bus on error path when free_on_exit is set.
+
+Fixes: ea030ca68819 ("regmap-i2c: Set regmap max raw r/w from quirks")
+Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
+Link: https://patch.msgid.link/20250626172823.18725-1-abdun.nihaal@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 3011f7f9381b7..1209e01f8c7f9 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1173,6 +1173,8 @@ struct regmap *__regmap_init(struct device *dev,
+ err_map:
+ kfree(map);
+ err:
++ if (bus && bus->free_on_exit)
++ kfree(bus);
+ return ERR_PTR(ret);
+ }
+ EXPORT_SYMBOL_GPL(__regmap_init);
+--
+2.39.5
+
--- /dev/null
+From 1ac2ed4ddef45f6d91060900922f01f7d34dab00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jun 2025 08:38:09 +0000
+Subject: regulator: core: fix NULL dereference on unbind due to stale coupling
+ data
+
+From: Alessandro Carminati <acarmina@redhat.com>
+
+[ Upstream commit ca46946a482238b0cdea459fb82fc837fb36260e ]
+
+Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can
+lead to NULL pointer dereference when regulators are accessed post-unbind.
+
+This can happen during runtime PM or other regulator operations that rely
+on coupling metadata.
+
+For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers
+a panic in regulator_lock_recursive() due to stale coupling state.
+
+Ensure n_coupled is set to 0 to prevent access to invalid pointers.
+
+Signed-off-by: Alessandro Carminati <acarmina@redhat.com>
+Link: https://patch.msgid.link/20250626083809.314842-1-acarmina@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index d2e21dc61dd7d..1d49612eeb7e5 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -5422,6 +5422,7 @@ static void regulator_remove_coupling(struct regulator_dev *rdev)
+ ERR_PTR(err));
+ }
+
++ rdev->coupling_desc.n_coupled = 0;
+ kfree(rdev->coupling_desc.coupled_rdevs);
+ rdev->coupling_desc.coupled_rdevs = NULL;
+ }
+--
+2.39.5
+
input-gpio-keys-fix-a-sleep-while-atomic-with-preempt_rt.patch
+virtio_ring-fix-error-reporting-in-virtqueue_resize.patch
+regulator-core-fix-null-dereference-on-unbind-due-to.patch
+rdma-core-rate-limit-gid-cache-warning-messages.patch
+interconnect-qcom-sc7280-add-missing-num_links-to-xm.patch
+iio-adc-ad7949-use-spi_is_bpw_supported.patch
+regmap-fix-potential-memory-leak-of-regmap_bus.patch
+x86-hyperv-fix-usage-of-cpu_online_mask-to-get-valid.patch
+platform-x86-fix-initialization-order-for-firmware_a.patch
+staging-vchiq_arm-make-vchiq_shutdown-never-fail.patch
--- /dev/null
+From 7fd3a21522017d478ffd73572469f355601008ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 18:11:08 +0200
+Subject: staging: vchiq_arm: Make vchiq_shutdown never fail
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit f2b8ebfb867011ddbefbdf7b04ad62626cbc2afd ]
+
+Most of the users of vchiq_shutdown ignore the return value,
+which is bad because this could lead to resource leaks.
+So instead of changing all calls to vchiq_shutdown, it's easier
+to make vchiq_shutdown never fail.
+
+Fixes: 71bad7f08641 ("staging: add bcm2708 vchiq driver")
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Link: https://lore.kernel.org/r/20250715161108.3411-4-wahrenst@gmx.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+index 92aa98bbdc662..6028558f96111 100644
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -720,8 +720,7 @@ int vchiq_shutdown(struct vchiq_instance *instance)
+ int status = 0;
+ struct vchiq_state *state = instance->state;
+
+- if (mutex_lock_killable(&state->mutex))
+- return -EAGAIN;
++ mutex_lock(&state->mutex);
+
+ /* Remove all services */
+ vchiq_shutdown_internal(state, instance);
+--
+2.39.5
+
--- /dev/null
+From 84282271e19f0c86258dd92364ea707e48fbcc36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 May 2025 11:22:34 +0200
+Subject: virtio_ring: Fix error reporting in virtqueue_resize
+
+From: Laurent Vivier <lvivier@redhat.com>
+
+[ Upstream commit 45ebc7e6c125ce93d2ddf82cd5bea20121bb0258 ]
+
+The virtqueue_resize() function was not correctly propagating error codes
+from its internal resize helper functions, specifically
+virtqueue_resize_packet() and virtqueue_resize_split(). If these helpers
+returned an error, but the subsequent call to virtqueue_enable_after_reset()
+succeeded, the original error from the resize operation would be masked.
+Consequently, virtqueue_resize() could incorrectly report success to its
+caller despite an underlying resize failure.
+
+This change restores the original code behavior:
+
+ if (vdev->config->enable_vq_after_reset(_vq))
+ return -EBUSY;
+
+ return err;
+
+Fix: commit ad48d53b5b3f ("virtio_ring: separate the logic of reset/enable from virtqueue_resize")
+Cc: xuanzhuo@linux.alibaba.com
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Link: https://patch.msgid.link/20250521092236.661410-2-lvivier@redhat.com
+Tested-by: Lei Yang <leiyang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_ring.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index c5f04234d9511..db4582687b958 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -2739,7 +2739,7 @@ int virtqueue_resize(struct virtqueue *_vq, u32 num,
+ void (*recycle)(struct virtqueue *vq, void *buf))
+ {
+ struct vring_virtqueue *vq = to_vvq(_vq);
+- int err;
++ int err, err_reset;
+
+ if (num > vq->vq.num_max)
+ return -E2BIG;
+@@ -2759,7 +2759,11 @@ int virtqueue_resize(struct virtqueue *_vq, u32 num,
+ else
+ err = virtqueue_resize_split(_vq, num);
+
+- return virtqueue_enable_after_reset(_vq);
++ err_reset = virtqueue_enable_after_reset(_vq);
++ if (err_reset)
++ return err_reset;
++
++ return err;
+ }
+ EXPORT_SYMBOL_GPL(virtqueue_resize);
+
+--
+2.39.5
+
--- /dev/null
+From ecd7fd90af0f8c6435ce5487742f89938ec86d26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 15:44:34 -0700
+Subject: x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
+
+From: Nuno Das Neves <nunodasneves@linux.microsoft.com>
+
+[ Upstream commit bb169f80ed5a156ec3405e0e49c6b8e9ae264718 ]
+
+Accessing cpu_online_mask here is problematic because the cpus read lock
+is not held in this context.
+
+However, cpu_online_mask isn't needed here since the effective affinity
+mask is guaranteed to be valid in this callback. So, just use
+cpumask_first() to get the cpu instead of ANDing it with cpus_online_mask
+unnecessarily.
+
+Fixes: e39397d1fd68 ("x86/hyperv: implement an MSI domain for root partition")
+Reported-by: Michael Kelley <mhklinux@outlook.com>
+Closes: https://lore.kernel.org/linux-hyperv/SN6PR02MB4157639630F8AD2D8FD8F52FD475A@SN6PR02MB4157.namprd02.prod.outlook.com/
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
+Reviewed-by: Michael Kelley <mhklinux@outlook.com>
+Link: https://lore.kernel.org/r/1751582677-30930-4-git-send-email-nunodasneves@linux.microsoft.com
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Message-ID: <1751582677-30930-4-git-send-email-nunodasneves@linux.microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/hyperv/irqdomain.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/arch/x86/hyperv/irqdomain.c b/arch/x86/hyperv/irqdomain.c
+index 42c70d28ef272..865ae4be233b3 100644
+--- a/arch/x86/hyperv/irqdomain.c
++++ b/arch/x86/hyperv/irqdomain.c
+@@ -192,7 +192,6 @@ static void hv_irq_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
+ struct pci_dev *dev;
+ struct hv_interrupt_entry out_entry, *stored_entry;
+ struct irq_cfg *cfg = irqd_cfg(data);
+- const cpumask_t *affinity;
+ int cpu;
+ u64 status;
+
+@@ -204,8 +203,7 @@ static void hv_irq_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
+ return;
+ }
+
+- affinity = irq_data_get_effective_affinity_mask(data);
+- cpu = cpumask_first_and(affinity, cpu_online_mask);
++ cpu = cpumask_first(irq_data_get_effective_affinity_mask(data));
+
+ if (data->chip_data) {
+ /*
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
