From: Greg Kroah-Hartman Date: Fri, 20 Mar 2026 17:05:49 +0000 (+0100) Subject: 6.19-stable patches X-Git-Tag: v6.1.167~89 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2059cb89e311628f52b3463890aa9c7ccd59e03f;p=thirdparty%2Fkernel%2Fstable-queue.git 6.19-stable patches added patches: cifs-open-files-should-not-hold-ref-on-superblock.patch crypto-atmel-sha204a-fix-oom-tfm_count-leak.patch drm-i915-dsc-add-helper-for-writing-dsc-selective-update-et-parameters.patch drm-i915-dsc-add-selective-update-register-definitions.patch drm-i915-psr-write-dsc-parameters-on-selective-update-in-et-mode.patch drm-xe-fix-memory-leak-in-xe_vm_madvise_ioctl.patch firmware-stratix10-svc-add-multi-svc-clients-support.patch firmware-stratix10-svc-delete-some-stray-tabs.patch ipmi-consolidate-the-run-to-completion-checking-for-xmit-msgs-lock.patch ipmi-msghandler-handle-error-returns-from-the-smi-sender.patch ksmbd-unset-conn-binding-on-failed-binding-request.patch ksmbd-use-volume-uuid-in-fs_object_id_information.patch loongarch-check-return-values-for-set_memory_-rw-rox.patch net-macb-introduce-gem_init_rx_ring.patch net-macb-reinitialize-tx-rx-queue-pointer-registers-and-rx-ring-during-resume.patch netconsole-fix-sysdata_release_enabled_show-checking-wrong-flag.patch smb-client-fix-krb5-mount-with-username-option.patch --- diff --git a/queue-6.19/cifs-open-files-should-not-hold-ref-on-superblock.patch b/queue-6.19/cifs-open-files-should-not-hold-ref-on-superblock.patch new file mode 100644 index 0000000000..1927f0ddda --- /dev/null +++ b/queue-6.19/cifs-open-files-should-not-hold-ref-on-superblock.patch @@ -0,0 +1,217 @@ +From stable+bounces-227162-greg=kroah.com@vger.kernel.org Wed Mar 18 22:03:28 2026 +From: Sasha Levin +Date: Wed, 18 Mar 2026 17:03:22 -0400 +Subject: cifs: open files should not hold ref on superblock +To: stable@vger.kernel.org +Cc: Shyam Prasad N , Steve French , Sasha Levin +Message-ID: <20260318210322.1281192-1-sashal@kernel.org> + +From: Shyam Prasad N + +[ Upstream commit 340cea84f691c5206561bb2e0147158fe02070be ] + +Today whenever we deal with a file, in addition to holding +a reference on the dentry, we also get a reference on the +superblock. This happens in two cases: +1. when a new cinode is allocated +2. when an oplock break is being processed + +The reasoning for holding the superblock ref was to make sure +that when umount happens, if there are users of inodes and +dentries, it does not try to clean them up and wait for the +last ref to superblock to be dropped by last of such users. + +But the side effect of doing that is that umount silently drops +a ref on the superblock and we could have deferred closes and +lease breaks still holding these refs. + +Ideally, we should ensure that all of these users of inodes and +dentries are cleaned up at the time of umount, which is what this +code is doing. + +This code change allows these code paths to use a ref on the +dentry (and hence the inode). That way, umount is +ensured to clean up SMB client resources when it's the last +ref on the superblock (For ex: when same objects are shared). + +The code change also moves the call to close all the files in +deferred close list to the umount code path. It also waits for +oplock_break workers to be flushed before calling +kill_anon_super (which eventually frees up those objects). + +Fixes: 24261fc23db9 ("cifs: delay super block destruction until all cifsFileInfo objects are gone") +Fixes: 705c79101ccf ("smb: client: fix use-after-free in cifs_oplock_break") +Cc: +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +[ replaced kmalloc_obj() with kmalloc(sizeof(...)) ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/cifsfs.c | 7 +++++-- + fs/smb/client/cifsproto.h | 1 + + fs/smb/client/file.c | 11 ----------- + fs/smb/client/misc.c | 42 ++++++++++++++++++++++++++++++++++++++++++ + fs/smb/client/trace.h | 2 ++ + 5 files changed, 50 insertions(+), 13 deletions(-) + +--- a/fs/smb/client/cifsfs.c ++++ b/fs/smb/client/cifsfs.c +@@ -331,10 +331,14 @@ static void cifs_kill_sb(struct super_bl + + /* + * We need to release all dentries for the cached directories +- * before we kill the sb. ++ * and close all deferred file handles before we kill the sb. + */ + if (cifs_sb->root) { + close_all_cached_dirs(cifs_sb); ++ cifs_close_all_deferred_files_sb(cifs_sb); ++ ++ /* Wait for all pending oplock breaks to complete */ ++ flush_workqueue(cifsoplockd_wq); + + /* finally release root dentry */ + dput(cifs_sb->root); +@@ -865,7 +869,6 @@ static void cifs_umount_begin(struct sup + spin_unlock(&tcon->tc_lock); + spin_unlock(&cifs_tcp_ses_lock); + +- cifs_close_all_deferred_files(tcon); + /* cancel_brl_requests(tcon); */ /* BB mark all brl mids as exiting */ + /* cancel_notify_requests(tcon); */ + if (tcon->ses && tcon->ses->server) { +--- a/fs/smb/client/cifsproto.h ++++ b/fs/smb/client/cifsproto.h +@@ -302,6 +302,7 @@ extern void cifs_close_deferred_file(str + + extern void cifs_close_all_deferred_files(struct cifs_tcon *cifs_tcon); + ++void cifs_close_all_deferred_files_sb(struct cifs_sb_info *cifs_sb); + void cifs_close_deferred_file_under_dentry(struct cifs_tcon *cifs_tcon, + struct dentry *dentry); + +--- a/fs/smb/client/file.c ++++ b/fs/smb/client/file.c +@@ -705,8 +705,6 @@ struct cifsFileInfo *cifs_new_fileinfo(s + mutex_init(&cfile->fh_mutex); + spin_lock_init(&cfile->file_info_lock); + +- cifs_sb_active(inode->i_sb); +- + /* + * If the server returned a read oplock and we have mandatory brlocks, + * set oplock level to None. +@@ -761,7 +759,6 @@ static void cifsFileInfo_put_final(struc + struct inode *inode = d_inode(cifs_file->dentry); + struct cifsInodeInfo *cifsi = CIFS_I(inode); + struct cifsLockInfo *li, *tmp; +- struct super_block *sb = inode->i_sb; + + /* + * Delete any outstanding lock records. We'll lose them when the file +@@ -779,7 +776,6 @@ static void cifsFileInfo_put_final(struc + + cifs_put_tlink(cifs_file->tlink); + dput(cifs_file->dentry); +- cifs_sb_deactive(sb); + kfree(cifs_file->symlink_target); + kfree(cifs_file); + } +@@ -3151,12 +3147,6 @@ void cifs_oplock_break(struct work_struc + __u64 persistent_fid, volatile_fid; + __u16 net_fid; + +- /* +- * Hold a reference to the superblock to prevent it and its inodes from +- * being freed while we are accessing cinode. Otherwise, _cifsFileInfo_put() +- * may release the last reference to the sb and trigger inode eviction. +- */ +- cifs_sb_active(sb); + wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS, + TASK_UNINTERRUPTIBLE); + +@@ -3229,7 +3219,6 @@ oplock_break_ack: + cifs_put_tlink(tlink); + out: + cifs_done_oplock_break(cinode); +- cifs_sb_deactive(sb); + } + + static int cifs_swap_activate(struct swap_info_struct *sis, +--- a/fs/smb/client/misc.c ++++ b/fs/smb/client/misc.c +@@ -28,6 +28,11 @@ + #include "fs_context.h" + #include "cached_dir.h" + ++struct tcon_list { ++ struct list_head entry; ++ struct cifs_tcon *tcon; ++}; ++ + /* The xid serves as a useful identifier for each incoming vfs request, + in a similar way to the mid which is useful to track each sent smb, + and CurrentXid can also provide a running counter (although it +@@ -839,6 +844,43 @@ cifs_close_all_deferred_files(struct cif + kfree(tmp_list); + } + } ++ ++void cifs_close_all_deferred_files_sb(struct cifs_sb_info *cifs_sb) ++{ ++ struct rb_root *root = &cifs_sb->tlink_tree; ++ struct rb_node *node; ++ struct cifs_tcon *tcon; ++ struct tcon_link *tlink; ++ struct tcon_list *tmp_list, *q; ++ LIST_HEAD(tcon_head); ++ ++ spin_lock(&cifs_sb->tlink_tree_lock); ++ for (node = rb_first(root); node; node = rb_next(node)) { ++ tlink = rb_entry(node, struct tcon_link, tl_rbnode); ++ tcon = tlink_tcon(tlink); ++ if (IS_ERR(tcon)) ++ continue; ++ tmp_list = kmalloc(sizeof(struct tcon_list), GFP_ATOMIC); ++ if (tmp_list == NULL) ++ break; ++ tmp_list->tcon = tcon; ++ /* Take a reference on tcon to prevent it from being freed */ ++ spin_lock(&tcon->tc_lock); ++ ++tcon->tc_count; ++ trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, ++ netfs_trace_tcon_ref_get_close_defer_files); ++ spin_unlock(&tcon->tc_lock); ++ list_add_tail(&tmp_list->entry, &tcon_head); ++ } ++ spin_unlock(&cifs_sb->tlink_tree_lock); ++ ++ list_for_each_entry_safe(tmp_list, q, &tcon_head, entry) { ++ cifs_close_all_deferred_files(tmp_list->tcon); ++ list_del(&tmp_list->entry); ++ cifs_put_tcon(tmp_list->tcon, netfs_trace_tcon_ref_put_close_defer_files); ++ kfree(tmp_list); ++ } ++} + + void cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon, + struct dentry *dentry) +--- a/fs/smb/client/trace.h ++++ b/fs/smb/client/trace.h +@@ -177,6 +177,7 @@ + EM(netfs_trace_tcon_ref_get_cached_laundromat, "GET Ch-Lau") \ + EM(netfs_trace_tcon_ref_get_cached_lease_break, "GET Ch-Lea") \ + EM(netfs_trace_tcon_ref_get_cancelled_close, "GET Cn-Cls") \ ++ EM(netfs_trace_tcon_ref_get_close_defer_files, "GET Cl-Def") \ + EM(netfs_trace_tcon_ref_get_dfs_refer, "GET DfsRef") \ + EM(netfs_trace_tcon_ref_get_find, "GET Find ") \ + EM(netfs_trace_tcon_ref_get_find_sess_tcon, "GET FndSes") \ +@@ -188,6 +189,7 @@ + EM(netfs_trace_tcon_ref_put_cancelled_close, "PUT Cn-Cls") \ + EM(netfs_trace_tcon_ref_put_cancelled_close_fid, "PUT Cn-Fid") \ + EM(netfs_trace_tcon_ref_put_cancelled_mid, "PUT Cn-Mid") \ ++ EM(netfs_trace_tcon_ref_put_close_defer_files, "PUT Cl-Def") \ + EM(netfs_trace_tcon_ref_put_mnt_ctx, "PUT MntCtx") \ + EM(netfs_trace_tcon_ref_put_dfs_refer, "PUT DfsRfr") \ + EM(netfs_trace_tcon_ref_put_reconnect_server, "PUT Reconn") \ diff --git a/queue-6.19/crypto-atmel-sha204a-fix-oom-tfm_count-leak.patch b/queue-6.19/crypto-atmel-sha204a-fix-oom-tfm_count-leak.patch new file mode 100644 index 0000000000..56572f312d --- /dev/null +++ b/queue-6.19/crypto-atmel-sha204a-fix-oom-tfm_count-leak.patch @@ -0,0 +1,41 @@ +From stable+bounces-227186-greg=kroah.com@vger.kernel.org Thu Mar 19 01:36:02 2026 +From: Sasha Levin +Date: Wed, 18 Mar 2026 20:35:55 -0400 +Subject: crypto: atmel-sha204a - Fix OOM ->tfm_count leak +To: stable@vger.kernel.org +Cc: Thorsten Blum , Herbert Xu , Sasha Levin +Message-ID: <20260319003555.1847154-1-sashal@kernel.org> + +From: Thorsten Blum + +[ Upstream commit d240b079a37e90af03fd7dfec94930eb6c83936e ] + +If memory allocation fails, decrement ->tfm_count to avoid blocking +future reads. + +Cc: stable@vger.kernel.org +Fixes: da001fb651b0 ("crypto: atmel-i2c - add support for SHA204A random number generator") +Signed-off-by: Thorsten Blum +Signed-off-by: Herbert Xu +[ adapted kmalloc_obj() macro to kmalloc(sizeof()) ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/atmel-sha204a.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/atmel-sha204a.c ++++ b/drivers/crypto/atmel-sha204a.c +@@ -52,9 +52,10 @@ static int atmel_sha204a_rng_read_nonblo + rng->priv = 0; + } else { + work_data = kmalloc(sizeof(*work_data), GFP_ATOMIC); +- if (!work_data) ++ if (!work_data) { ++ atomic_dec(&i2c_priv->tfm_count); + return -ENOMEM; +- ++ } + work_data->ctx = i2c_priv; + work_data->client = i2c_priv->client; + diff --git a/queue-6.19/drm-i915-dsc-add-helper-for-writing-dsc-selective-update-et-parameters.patch b/queue-6.19/drm-i915-dsc-add-helper-for-writing-dsc-selective-update-et-parameters.patch new file mode 100644 index 0000000000..44c9103907 --- /dev/null +++ b/queue-6.19/drm-i915-dsc-add-helper-for-writing-dsc-selective-update-et-parameters.patch @@ -0,0 +1,83 @@ +From bb5f1cd10101c2567bff4d0e760b74aee7c42f44 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jouni=20H=C3=B6gander?= +Date: Wed, 4 Mar 2026 13:30:10 +0200 +Subject: drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jouni Högander + +commit bb5f1cd10101c2567bff4d0e760b74aee7c42f44 upstream. + +There are slice row per frame and pic height configuration in DSC Selective +Update Parameter Set 1 register. Add helper for configuring these. + +v2: + - Add WARN_ON_ONCE if vdsc instances per pipe > 2 + - instead of checking vdsc instances per pipe being > 1 check == 2 + +Bspec: 71709 +Signed-off-by: Jouni Högander +Reviewed-by: Ankit Nautiyal +Link: https://patch.msgid.link/20260304113011.626542-4-jouni.hogander@intel.com +(cherry picked from commit c8698d61aeb3f70fe33761ee9d3d0e131b5bc2eb) +Signed-off-by: Tvrtko Ursulin +[tursulin: fixup forward declaration conflict] +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_vdsc.c | 23 +++++++++++++++++++++++ + drivers/gpu/drm/i915/display/intel_vdsc.h | 3 +++ + 2 files changed, 26 insertions(+) + +--- a/drivers/gpu/drm/i915/display/intel_vdsc.c ++++ b/drivers/gpu/drm/i915/display/intel_vdsc.c +@@ -767,6 +767,29 @@ void intel_dsc_dp_pps_write(struct intel + sizeof(dp_dsc_pps_sdp)); + } + ++void intel_dsc_su_et_parameters_configure(struct intel_dsb *dsb, struct intel_encoder *encoder, ++ const struct intel_crtc_state *crtc_state, int su_lines) ++{ ++ struct intel_display *display = to_intel_display(crtc_state); ++ struct intel_crtc *crtc = to_intel_crtc(crtc_state->uapi.crtc); ++ const struct drm_dsc_config *vdsc_cfg = &crtc_state->dsc.config; ++ enum pipe pipe = crtc->pipe; ++ int vdsc_instances_per_pipe = intel_dsc_get_vdsc_per_pipe(crtc_state); ++ int slice_row_per_frame = su_lines / vdsc_cfg->slice_height; ++ u32 val; ++ ++ drm_WARN_ON_ONCE(display->drm, su_lines % vdsc_cfg->slice_height); ++ drm_WARN_ON_ONCE(display->drm, vdsc_instances_per_pipe > 2); ++ ++ val = DSC_SUPS0_SU_SLICE_ROW_PER_FRAME(slice_row_per_frame); ++ val |= DSC_SUPS0_SU_PIC_HEIGHT(su_lines); ++ ++ intel_de_write_dsb(display, dsb, LNL_DSC0_SU_PARAMETER_SET_0(pipe), val); ++ ++ if (vdsc_instances_per_pipe == 2) ++ intel_de_write_dsb(display, dsb, LNL_DSC1_SU_PARAMETER_SET_0(pipe), val); ++} ++ + static i915_reg_t dss_ctl1_reg(struct intel_crtc *crtc, enum transcoder cpu_transcoder) + { + return is_pipe_dsc(crtc, cpu_transcoder) ? +--- a/drivers/gpu/drm/i915/display/intel_vdsc.h ++++ b/drivers/gpu/drm/i915/display/intel_vdsc.h +@@ -13,6 +13,7 @@ struct drm_printer; + enum transcoder; + struct intel_crtc; + struct intel_crtc_state; ++struct intel_dsb; + struct intel_encoder; + + bool intel_dsc_source_support(const struct intel_crtc_state *crtc_state); +@@ -31,6 +32,8 @@ void intel_dsc_dsi_pps_write(struct inte + const struct intel_crtc_state *crtc_state); + void intel_dsc_dp_pps_write(struct intel_encoder *encoder, + const struct intel_crtc_state *crtc_state); ++void intel_dsc_su_et_parameters_configure(struct intel_dsb *dsb, struct intel_encoder *encoder, ++ const struct intel_crtc_state *crtc_state, int su_lines); + void intel_vdsc_state_dump(struct drm_printer *p, int indent, + const struct intel_crtc_state *crtc_state); + int intel_vdsc_min_cdclk(const struct intel_crtc_state *crtc_state); diff --git a/queue-6.19/drm-i915-dsc-add-selective-update-register-definitions.patch b/queue-6.19/drm-i915-dsc-add-selective-update-register-definitions.patch new file mode 100644 index 0000000000..2a2108f16a --- /dev/null +++ b/queue-6.19/drm-i915-dsc-add-selective-update-register-definitions.patch @@ -0,0 +1,48 @@ +From c2c79c6d5b939ae8a42ddb884f576bddae685672 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jouni=20H=C3=B6gander?= +Date: Wed, 4 Mar 2026 13:30:09 +0200 +Subject: drm/i915/dsc: Add Selective Update register definitions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jouni Högander + +commit c2c79c6d5b939ae8a42ddb884f576bddae685672 upstream. + +Add definitions for DSC_SU_PARAMETER_SET_0_DSC0 and +DSC_SU_PARAMETER_SET_0_DSC1 registers. These are for Selective Update Early +Transport configuration. + +Bspec: 71709 +Signed-off-by: Jouni Högander +Reviewed-by: Ankit Nautiyal +Link: https://patch.msgid.link/20260304113011.626542-3-jouni.hogander@intel.com +(cherry picked from commit 24f96d903daf3dcf8fafe84d3d22b80ef47ba493) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_vdsc_regs.h | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/gpu/drm/i915/display/intel_vdsc_regs.h ++++ b/drivers/gpu/drm/i915/display/intel_vdsc_regs.h +@@ -196,6 +196,18 @@ + #define DSC_PPS18_NSL_BPG_OFFSET(offset) REG_FIELD_PREP(DSC_PPS18_NSL_BPG_OFFSET_MASK, offset) + #define DSC_PPS18_SL_OFFSET_ADJ(offset) REG_FIELD_PREP(DSC_PPS18_SL_OFFSET_ADJ_MASK, offset) + ++#define _LNL_DSC0_SU_PARAMETER_SET_0_PA 0x78064 ++#define _LNL_DSC1_SU_PARAMETER_SET_0_PA 0x78164 ++#define _LNL_DSC0_SU_PARAMETER_SET_0_PB 0x78264 ++#define _LNL_DSC1_SU_PARAMETER_SET_0_PB 0x78364 ++#define LNL_DSC0_SU_PARAMETER_SET_0(pipe) _MMIO_PIPE((pipe), _LNL_DSC0_SU_PARAMETER_SET_0_PA, _LNL_DSC0_SU_PARAMETER_SET_0_PB) ++#define LNL_DSC1_SU_PARAMETER_SET_0(pipe) _MMIO_PIPE((pipe), _LNL_DSC1_SU_PARAMETER_SET_0_PA, _LNL_DSC1_SU_PARAMETER_SET_0_PB) ++ ++#define DSC_SUPS0_SU_SLICE_ROW_PER_FRAME_MASK REG_GENMASK(31, 20) ++#define DSC_SUPS0_SU_SLICE_ROW_PER_FRAME(rows) REG_FIELD_PREP(DSC_SUPS0_SU_SLICE_ROW_PER_FRAME_MASK, (rows)) ++#define DSC_SUPS0_SU_PIC_HEIGHT_MASK REG_GENMASK(15, 0) ++#define DSC_SUPS0_SU_PIC_HEIGHT(h) REG_FIELD_PREP(DSC_SUPS0_SU_PIC_HEIGHT_MASK, (h)) ++ + /* Icelake Rate Control Buffer Threshold Registers */ + #define DSCA_RC_BUF_THRESH_0 _MMIO(0x6B230) + #define DSCA_RC_BUF_THRESH_0_UDW _MMIO(0x6B230 + 4) diff --git a/queue-6.19/drm-i915-psr-write-dsc-parameters-on-selective-update-in-et-mode.patch b/queue-6.19/drm-i915-psr-write-dsc-parameters-on-selective-update-in-et-mode.patch new file mode 100644 index 0000000000..e8b49de5a5 --- /dev/null +++ b/queue-6.19/drm-i915-psr-write-dsc-parameters-on-selective-update-in-et-mode.patch @@ -0,0 +1,59 @@ +From 5923a6e0459fdd3edac4ad5abccb24d777d8f1b6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jouni=20H=C3=B6gander?= +Date: Wed, 4 Mar 2026 13:30:11 +0200 +Subject: drm/i915/psr: Write DSC parameters on Selective Update in ET mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jouni Högander + +commit 5923a6e0459fdd3edac4ad5abccb24d777d8f1b6 upstream. + +There are slice row per frame and pic height parameters in DSC that needs +to be configured on every Selective Update in Early Transport mode. Use +helper provided by DSC code to configure these on Selective Update when in +Early Transport mode. Also fill crtc_state->psr2_su_area with full frame +area on full frame update for DSC calculation. + +v2: move psr2_su_area under skip_sel_fetch_set_loop label + +Bspec: 68927, 71709 +Fixes: 467e4e061c44 ("drm/i915/psr: Enable psr2 early transport as possible") +Cc: # v6.9+ +Signed-off-by: Jouni Högander +Reviewed-by: Ankit Nautiyal +Link: https://patch.msgid.link/20260304113011.626542-5-jouni.hogander@intel.com +(cherry picked from commit 3140af2fab505a4cd47d516284529bf1585628be) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_psr.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/gpu/drm/i915/display/intel_psr.c ++++ b/drivers/gpu/drm/i915/display/intel_psr.c +@@ -2597,6 +2597,12 @@ void intel_psr2_program_trans_man_trk_ct + + intel_de_write_dsb(display, dsb, PIPE_SRCSZ_ERLY_TPT(crtc->pipe), + crtc_state->pipe_srcsz_early_tpt); ++ ++ if (!crtc_state->dsc.compression_enable) ++ return; ++ ++ intel_dsc_su_et_parameters_configure(dsb, encoder, crtc_state, ++ drm_rect_height(&crtc_state->psr2_su_area)); + } + + static void psr2_man_trk_ctl_calc(struct intel_crtc_state *crtc_state, +@@ -3017,6 +3023,10 @@ int intel_psr2_sel_fetch_update(struct i + } + + skip_sel_fetch_set_loop: ++ if (full_update) ++ clip_area_update(&crtc_state->psr2_su_area, &crtc_state->pipe_src, ++ &crtc_state->pipe_src); ++ + psr2_man_trk_ctl_calc(crtc_state, full_update); + crtc_state->pipe_srcsz_early_tpt = + psr2_pipe_srcsz_early_tpt_calc(crtc_state, full_update); diff --git a/queue-6.19/drm-xe-fix-memory-leak-in-xe_vm_madvise_ioctl.patch b/queue-6.19/drm-xe-fix-memory-leak-in-xe_vm_madvise_ioctl.patch new file mode 100644 index 0000000000..9f8b1c50f6 --- /dev/null +++ b/queue-6.19/drm-xe-fix-memory-leak-in-xe_vm_madvise_ioctl.patch @@ -0,0 +1,51 @@ +From stable+bounces-227156-greg=kroah.com@vger.kernel.org Wed Mar 18 21:41:48 2026 +From: Sasha Levin +Date: Wed, 18 Mar 2026 16:41:41 -0400 +Subject: drm/xe: Fix memory leak in xe_vm_madvise_ioctl +To: stable@vger.kernel.org +Cc: Varun Gupta , Shuicheng Lin , Matthew Brost , Tejas Upadhyay , Rodrigo Vivi , Sasha Levin +Message-ID: <20260318204141.1139130-1-sashal@kernel.org> + +From: Varun Gupta + +[ Upstream commit 0cfe9c4838f1147713f6b5c02094cd4dc0c598fa ] + +When check_bo_args_are_sane() validation fails, jump to the new +free_vmas cleanup label to properly free the allocated resources. +This ensures proper cleanup in this error path. + +Fixes: 293032eec4ba ("drm/xe/bo: Update atomic_access attribute on madvise") +Cc: stable@vger.kernel.org # v6.18+ +Reviewed-by: Shuicheng Lin +Signed-off-by: Varun Gupta +Reviewed-by: Matthew Brost +Link: https://patch.msgid.link/20260223175145.1532801-1-varun.gupta@intel.com +Signed-off-by: Tejas Upadhyay +(cherry picked from commit 29bd06faf727a4b76663e4be0f7d770e2d2a7965) +Signed-off-by: Rodrigo Vivi +[ changed old goto target from `madv_fini` to `unlock_vm` ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_vm_madvise.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/xe/xe_vm_madvise.c ++++ b/drivers/gpu/drm/xe/xe_vm_madvise.c +@@ -390,7 +390,7 @@ int xe_vm_madvise_ioctl(struct drm_devic + madvise_range.num_vmas, + args->atomic.val)) { + err = -EINVAL; +- goto unlock_vm; ++ goto free_vmas; + } + } + +@@ -426,6 +426,7 @@ int xe_vm_madvise_ioctl(struct drm_devic + err_fini: + if (madvise_range.has_bo_vmas) + drm_exec_fini(&exec); ++free_vmas: + kfree(madvise_range.vmas); + madvise_range.vmas = NULL; + unlock_vm: diff --git a/queue-6.19/firmware-stratix10-svc-add-multi-svc-clients-support.patch b/queue-6.19/firmware-stratix10-svc-add-multi-svc-clients-support.patch new file mode 100644 index 0000000000..6202061724 --- /dev/null +++ b/queue-6.19/firmware-stratix10-svc-add-multi-svc-clients-support.patch @@ -0,0 +1,526 @@ +From stable+bounces-227288-greg=kroah.com@vger.kernel.org Thu Mar 19 14:18:57 2026 +From: Sasha Levin +Date: Thu, 19 Mar 2026 09:18:09 -0400 +Subject: firmware: stratix10-svc: Add Multi SVC clients support +To: stable@vger.kernel.org +Cc: Muhammad Amirul Asyraf Mohamad Jamian , Ang Tien Sung , "Fong, Yan Kei" , Dinh Nguyen , Sasha Levin +Message-ID: <20260319131809.2432986-2-sashal@kernel.org> + +From: Muhammad Amirul Asyraf Mohamad Jamian + +[ Upstream commit 22fd7f7fed2ae3702f90d1985c326354e86b9c75 ] + +In the current implementation, SVC client drivers such as socfpga-hwmon, +intel_fcs, stratix10-soc, stratix10-rsu each send an SMC command that +triggers a single thread in the stratix10-svc driver. Upon receiving a +callback, the initiating client driver sends a stratix10-svc-done signal, +terminating the thread without waiting for other pending SMC commands to +complete. This leads to a timeout issue in the firmware SVC mailbox service +when multiple client drivers send SMC commands concurrently. + +To resolve this issue, a dedicated thread is now created per channel. The +stratix10-svc driver will support up to the number of channels defined by +SVC_NUM_CHANNEL. Thread synchronization is handled using a mutex to prevent +simultaneous issuance of SMC commands by multiple threads. + +SVC_NUM_DATA_IN_FIFO is reduced from 32 to 8, since each channel now has +its own dedicated FIFO and the SDM processes commands one at a time. +8 entries per channel is sufficient while keeping the total aggregate +capacity the same (4 channels x 8 = 32 entries). + +Additionally, a thread task is now validated before invoking kthread_stop +when the user aborts, ensuring safe termination. + +Timeout values have also been adjusted to accommodate the increased load +from concurrent client driver activity. + +Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") +Cc: stable@vger.kernel.org +Signed-off-by: Ang Tien Sung +Signed-off-by: Fong, Yan Kei +Signed-off-by: Muhammad Amirul Asyraf Mohamad Jamian +Link: https://lore.kernel.org/all/20260305093151.2678-1-muhammad.amirul.asyraf.mohamad.jamian@altera.com +Signed-off-by: Dinh Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/stratix10-svc.c | 228 +++++++++++--------- + include/linux/firmware/intel/stratix10-svc-client.h | 8 + 2 files changed, 130 insertions(+), 106 deletions(-) + +--- a/drivers/firmware/stratix10-svc.c ++++ b/drivers/firmware/stratix10-svc.c +@@ -37,15 +37,14 @@ + * service layer will return error to FPGA manager when timeout occurs, + * timeout is set to 30 seconds (30 * 1000) at Intel Stratix10 SoC. + */ +-#define SVC_NUM_DATA_IN_FIFO 32 ++#define SVC_NUM_DATA_IN_FIFO 8 + #define SVC_NUM_CHANNEL 4 +-#define FPGA_CONFIG_DATA_CLAIM_TIMEOUT_MS 200 ++#define FPGA_CONFIG_DATA_CLAIM_TIMEOUT_MS 2000 + #define FPGA_CONFIG_STATUS_TIMEOUT_SEC 30 + #define BYTE_TO_WORD_SIZE 4 + + /* stratix10 service layer clients */ + #define STRATIX10_RSU "stratix10-rsu" +-#define INTEL_FCS "intel-fcs" + + /* Maximum number of SDM client IDs. */ + #define MAX_SDM_CLIENT_IDS 16 +@@ -105,11 +104,9 @@ struct stratix10_svc_chan; + /** + * struct stratix10_svc - svc private data + * @stratix10_svc_rsu: pointer to stratix10 RSU device +- * @intel_svc_fcs: pointer to the FCS device + */ + struct stratix10_svc { + struct platform_device *stratix10_svc_rsu; +- struct platform_device *intel_svc_fcs; + }; + + /** +@@ -251,12 +248,10 @@ struct stratix10_async_ctrl { + * @num_active_client: number of active service client + * @node: list management + * @genpool: memory pool pointing to the memory region +- * @task: pointer to the thread task which handles SMC or HVC call +- * @svc_fifo: a queue for storing service message data + * @complete_status: state for completion +- * @svc_fifo_lock: protect access to service message data queue + * @invoke_fn: function to issue secure monitor call or hypervisor call + * @svc: manages the list of client svc drivers ++ * @sdm_lock: only allows a single command single response to SDM + * @actrl: async control structure + * + * This struct is used to create communication channels for service clients, to +@@ -269,12 +264,10 @@ struct stratix10_svc_controller { + int num_active_client; + struct list_head node; + struct gen_pool *genpool; +- struct task_struct *task; +- struct kfifo svc_fifo; + struct completion complete_status; +- spinlock_t svc_fifo_lock; + svc_invoke_fn *invoke_fn; + struct stratix10_svc *svc; ++ struct mutex sdm_lock; + struct stratix10_async_ctrl actrl; + }; + +@@ -283,6 +276,9 @@ struct stratix10_svc_controller { + * @ctrl: pointer to service controller which is the provider of this channel + * @scl: pointer to service client which owns the channel + * @name: service client name associated with the channel ++ * @task: pointer to the thread task which handles SMC or HVC call ++ * @svc_fifo: a queue for storing service message data (separate fifo for every channel) ++ * @svc_fifo_lock: protect access to service message data queue (locking pending fifo) + * @lock: protect access to the channel + * @async_chan: reference to asynchronous channel object for this channel + * +@@ -293,6 +289,9 @@ struct stratix10_svc_chan { + struct stratix10_svc_controller *ctrl; + struct stratix10_svc_client *scl; + char *name; ++ struct task_struct *task; ++ struct kfifo svc_fifo; ++ spinlock_t svc_fifo_lock; + spinlock_t lock; + struct stratix10_async_chan *async_chan; + }; +@@ -527,10 +526,10 @@ static void svc_thread_recv_status_ok(st + */ + static int svc_normal_to_secure_thread(void *data) + { +- struct stratix10_svc_controller +- *ctrl = (struct stratix10_svc_controller *)data; +- struct stratix10_svc_data *pdata; +- struct stratix10_svc_cb_data *cbdata; ++ struct stratix10_svc_chan *chan = (struct stratix10_svc_chan *)data; ++ struct stratix10_svc_controller *ctrl = chan->ctrl; ++ struct stratix10_svc_data *pdata = NULL; ++ struct stratix10_svc_cb_data *cbdata = NULL; + struct arm_smccc_res res; + unsigned long a0, a1, a2, a3, a4, a5, a6, a7; + int ret_fifo = 0; +@@ -555,12 +554,12 @@ static int svc_normal_to_secure_thread(v + a6 = 0; + a7 = 0; + +- pr_debug("smc_hvc_shm_thread is running\n"); ++ pr_debug("%s: %s: Thread is running!\n", __func__, chan->name); + + while (!kthread_should_stop()) { +- ret_fifo = kfifo_out_spinlocked(&ctrl->svc_fifo, ++ ret_fifo = kfifo_out_spinlocked(&chan->svc_fifo, + pdata, sizeof(*pdata), +- &ctrl->svc_fifo_lock); ++ &chan->svc_fifo_lock); + + if (!ret_fifo) + continue; +@@ -569,9 +568,25 @@ static int svc_normal_to_secure_thread(v + (unsigned int)pdata->paddr, pdata->command, + (unsigned int)pdata->size); + ++ /* SDM can only process one command at a time */ ++ pr_debug("%s: %s: Thread is waiting for mutex!\n", ++ __func__, chan->name); ++ if (mutex_lock_interruptible(&ctrl->sdm_lock)) { ++ /* item already dequeued; notify client to unblock it */ ++ cbdata->status = BIT(SVC_STATUS_ERROR); ++ cbdata->kaddr1 = NULL; ++ cbdata->kaddr2 = NULL; ++ cbdata->kaddr3 = NULL; ++ if (pdata->chan->scl) ++ pdata->chan->scl->receive_cb(pdata->chan->scl, ++ cbdata); ++ break; ++ } ++ + switch (pdata->command) { + case COMMAND_RECONFIG_DATA_CLAIM: + svc_thread_cmd_data_claim(ctrl, pdata, cbdata); ++ mutex_unlock(&ctrl->sdm_lock); + continue; + case COMMAND_RECONFIG: + a0 = INTEL_SIP_SMC_FPGA_CONFIG_START; +@@ -700,10 +715,11 @@ static int svc_normal_to_secure_thread(v + break; + default: + pr_warn("it shouldn't happen\n"); +- break; ++ mutex_unlock(&ctrl->sdm_lock); ++ continue; + } +- pr_debug("%s: before SMC call -- a0=0x%016x a1=0x%016x", +- __func__, ++ pr_debug("%s: %s: before SMC call -- a0=0x%016x a1=0x%016x", ++ __func__, chan->name, + (unsigned int)a0, + (unsigned int)a1); + pr_debug(" a2=0x%016x\n", (unsigned int)a2); +@@ -712,8 +728,8 @@ static int svc_normal_to_secure_thread(v + pr_debug(" a5=0x%016x\n", (unsigned int)a5); + ctrl->invoke_fn(a0, a1, a2, a3, a4, a5, a6, a7, &res); + +- pr_debug("%s: after SMC call -- res.a0=0x%016x", +- __func__, (unsigned int)res.a0); ++ pr_debug("%s: %s: after SMC call -- res.a0=0x%016x", ++ __func__, chan->name, (unsigned int)res.a0); + pr_debug(" res.a1=0x%016x, res.a2=0x%016x", + (unsigned int)res.a1, (unsigned int)res.a2); + pr_debug(" res.a3=0x%016x\n", (unsigned int)res.a3); +@@ -728,6 +744,7 @@ static int svc_normal_to_secure_thread(v + cbdata->kaddr2 = NULL; + cbdata->kaddr3 = NULL; + pdata->chan->scl->receive_cb(pdata->chan->scl, cbdata); ++ mutex_unlock(&ctrl->sdm_lock); + continue; + } + +@@ -801,6 +818,8 @@ static int svc_normal_to_secure_thread(v + break; + + } ++ ++ mutex_unlock(&ctrl->sdm_lock); + } + + kfree(cbdata); +@@ -1696,22 +1715,33 @@ int stratix10_svc_send(struct stratix10_ + if (!p_data) + return -ENOMEM; + +- /* first client will create kernel thread */ +- if (!chan->ctrl->task) { +- chan->ctrl->task = +- kthread_run_on_cpu(svc_normal_to_secure_thread, +- (void *)chan->ctrl, +- cpu, "svc_smc_hvc_thread"); +- if (IS_ERR(chan->ctrl->task)) { ++ /* first caller creates the per-channel kthread */ ++ if (!chan->task) { ++ struct task_struct *task; ++ ++ task = kthread_run_on_cpu(svc_normal_to_secure_thread, ++ (void *)chan, ++ cpu, "svc_smc_hvc_thread"); ++ if (IS_ERR(task)) { + dev_err(chan->ctrl->dev, + "failed to create svc_smc_hvc_thread\n"); + kfree(p_data); + return -EINVAL; + } ++ ++ spin_lock(&chan->lock); ++ if (chan->task) { ++ /* another caller won the race; discard our thread */ ++ spin_unlock(&chan->lock); ++ kthread_stop(task); ++ } else { ++ chan->task = task; ++ spin_unlock(&chan->lock); ++ } + } + +- pr_debug("%s: sent P-va=%p, P-com=%x, P-size=%u\n", __func__, +- p_msg->payload, p_msg->command, ++ pr_debug("%s: %s: sent P-va=%p, P-com=%x, P-size=%u\n", __func__, ++ chan->name, p_msg->payload, p_msg->command, + (unsigned int)p_msg->payload_length); + + if (list_empty(&svc_data_mem)) { +@@ -1747,12 +1777,16 @@ int stratix10_svc_send(struct stratix10_ + p_data->arg[2] = p_msg->arg[2]; + p_data->size = p_msg->payload_length; + p_data->chan = chan; +- pr_debug("%s: put to FIFO pa=0x%016x, cmd=%x, size=%u\n", __func__, +- (unsigned int)p_data->paddr, p_data->command, +- (unsigned int)p_data->size); +- ret = kfifo_in_spinlocked(&chan->ctrl->svc_fifo, p_data, ++ pr_debug("%s: %s: put to FIFO pa=0x%016x, cmd=%x, size=%u\n", ++ __func__, ++ chan->name, ++ (unsigned int)p_data->paddr, ++ p_data->command, ++ (unsigned int)p_data->size); ++ ++ ret = kfifo_in_spinlocked(&chan->svc_fifo, p_data, + sizeof(*p_data), +- &chan->ctrl->svc_fifo_lock); ++ &chan->svc_fifo_lock); + + kfree(p_data); + +@@ -1773,11 +1807,12 @@ EXPORT_SYMBOL_GPL(stratix10_svc_send); + */ + void stratix10_svc_done(struct stratix10_svc_chan *chan) + { +- /* stop thread when thread is running AND only one active client */ +- if (chan->ctrl->task && chan->ctrl->num_active_client <= 1) { +- pr_debug("svc_smc_hvc_shm_thread is stopped\n"); +- kthread_stop(chan->ctrl->task); +- chan->ctrl->task = NULL; ++ /* stop thread when thread is running */ ++ if (chan->task) { ++ pr_debug("%s: %s: svc_smc_hvc_shm_thread is stopping\n", ++ __func__, chan->name); ++ kthread_stop(chan->task); ++ chan->task = NULL; + } + } + EXPORT_SYMBOL_GPL(stratix10_svc_done); +@@ -1817,8 +1852,8 @@ void *stratix10_svc_allocate_memory(stru + pmem->paddr = pa; + pmem->size = s; + list_add_tail(&pmem->node, &svc_data_mem); +- pr_debug("%s: va=%p, pa=0x%016x\n", __func__, +- pmem->vaddr, (unsigned int)pmem->paddr); ++ pr_debug("%s: %s: va=%p, pa=0x%016x\n", __func__, ++ chan->name, pmem->vaddr, (unsigned int)pmem->paddr); + + return (void *)va; + } +@@ -1855,6 +1890,13 @@ static const struct of_device_id stratix + {}, + }; + ++static const char * const chan_names[SVC_NUM_CHANNEL] = { ++ SVC_CLIENT_FPGA, ++ SVC_CLIENT_RSU, ++ SVC_CLIENT_FCS, ++ SVC_CLIENT_HWMON ++}; ++ + static int stratix10_svc_drv_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -1862,11 +1904,11 @@ static int stratix10_svc_drv_probe(struc + struct stratix10_svc_chan *chans; + struct gen_pool *genpool; + struct stratix10_svc_sh_memory *sh_memory; +- struct stratix10_svc *svc; ++ struct stratix10_svc *svc = NULL; + + svc_invoke_fn *invoke_fn; + size_t fifo_size; +- int ret; ++ int ret, i = 0; + + /* get SMC or HVC function */ + invoke_fn = get_invoke_func(dev); +@@ -1905,8 +1947,8 @@ static int stratix10_svc_drv_probe(struc + controller->num_active_client = 0; + controller->chans = chans; + controller->genpool = genpool; +- controller->task = NULL; + controller->invoke_fn = invoke_fn; ++ INIT_LIST_HEAD(&controller->node); + init_completion(&controller->complete_status); + + ret = stratix10_svc_async_init(controller); +@@ -1917,32 +1959,20 @@ static int stratix10_svc_drv_probe(struc + } + + fifo_size = sizeof(struct stratix10_svc_data) * SVC_NUM_DATA_IN_FIFO; +- ret = kfifo_alloc(&controller->svc_fifo, fifo_size, GFP_KERNEL); +- if (ret) { +- dev_err(dev, "failed to allocate FIFO\n"); +- goto err_async_exit; +- } +- spin_lock_init(&controller->svc_fifo_lock); ++ mutex_init(&controller->sdm_lock); + +- chans[0].scl = NULL; +- chans[0].ctrl = controller; +- chans[0].name = SVC_CLIENT_FPGA; +- spin_lock_init(&chans[0].lock); +- +- chans[1].scl = NULL; +- chans[1].ctrl = controller; +- chans[1].name = SVC_CLIENT_RSU; +- spin_lock_init(&chans[1].lock); +- +- chans[2].scl = NULL; +- chans[2].ctrl = controller; +- chans[2].name = SVC_CLIENT_FCS; +- spin_lock_init(&chans[2].lock); +- +- chans[3].scl = NULL; +- chans[3].ctrl = controller; +- chans[3].name = SVC_CLIENT_HWMON; +- spin_lock_init(&chans[3].lock); ++ for (i = 0; i < SVC_NUM_CHANNEL; i++) { ++ chans[i].scl = NULL; ++ chans[i].ctrl = controller; ++ chans[i].name = (char *)chan_names[i]; ++ spin_lock_init(&chans[i].lock); ++ ret = kfifo_alloc(&chans[i].svc_fifo, fifo_size, GFP_KERNEL); ++ if (ret) { ++ dev_err(dev, "failed to allocate FIFO %d\n", i); ++ goto err_free_fifos; ++ } ++ spin_lock_init(&chans[i].svc_fifo_lock); ++ } + + list_add_tail(&controller->node, &svc_ctrl); + platform_set_drvdata(pdev, controller); +@@ -1951,7 +1981,7 @@ static int stratix10_svc_drv_probe(struc + svc = devm_kzalloc(dev, sizeof(*svc), GFP_KERNEL); + if (!svc) { + ret = -ENOMEM; +- goto err_free_kfifo; ++ goto err_free_fifos; + } + controller->svc = svc; + +@@ -1959,51 +1989,43 @@ static int stratix10_svc_drv_probe(struc + if (!svc->stratix10_svc_rsu) { + dev_err(dev, "failed to allocate %s device\n", STRATIX10_RSU); + ret = -ENOMEM; +- goto err_free_kfifo; ++ goto err_free_fifos; + } + + ret = platform_device_add(svc->stratix10_svc_rsu); +- if (ret) { +- platform_device_put(svc->stratix10_svc_rsu); +- goto err_free_kfifo; +- } +- +- svc->intel_svc_fcs = platform_device_alloc(INTEL_FCS, 1); +- if (!svc->intel_svc_fcs) { +- dev_err(dev, "failed to allocate %s device\n", INTEL_FCS); +- ret = -ENOMEM; +- goto err_unregister_rsu_dev; +- } +- +- ret = platform_device_add(svc->intel_svc_fcs); +- if (ret) { +- platform_device_put(svc->intel_svc_fcs); +- goto err_unregister_rsu_dev; +- } ++ if (ret) ++ goto err_put_device; + + ret = of_platform_default_populate(dev_of_node(dev), NULL, dev); + if (ret) +- goto err_unregister_fcs_dev; ++ goto err_unregister_rsu_dev; + + pr_info("Intel Service Layer Driver Initialized\n"); + + return 0; + +-err_unregister_fcs_dev: +- platform_device_unregister(svc->intel_svc_fcs); + err_unregister_rsu_dev: + platform_device_unregister(svc->stratix10_svc_rsu); +-err_free_kfifo: +- kfifo_free(&controller->svc_fifo); +-err_async_exit: ++ goto err_free_fifos; ++err_put_device: ++ platform_device_put(svc->stratix10_svc_rsu); ++err_free_fifos: ++ /* only remove from list if list_add_tail() was reached */ ++ if (!list_empty(&controller->node)) ++ list_del(&controller->node); ++ /* free only the FIFOs that were successfully allocated */ ++ while (i--) ++ kfifo_free(&chans[i].svc_fifo); + stratix10_svc_async_exit(controller); + err_destroy_pool: + gen_pool_destroy(genpool); ++ + return ret; + } + + static void stratix10_svc_drv_remove(struct platform_device *pdev) + { ++ int i; + struct stratix10_svc_controller *ctrl = platform_get_drvdata(pdev); + struct stratix10_svc *svc = ctrl->svc; + +@@ -2011,14 +2033,16 @@ static void stratix10_svc_drv_remove(str + + of_platform_depopulate(ctrl->dev); + +- platform_device_unregister(svc->intel_svc_fcs); + platform_device_unregister(svc->stratix10_svc_rsu); + +- kfifo_free(&ctrl->svc_fifo); +- if (ctrl->task) { +- kthread_stop(ctrl->task); +- ctrl->task = NULL; ++ for (i = 0; i < SVC_NUM_CHANNEL; i++) { ++ if (ctrl->chans[i].task) { ++ kthread_stop(ctrl->chans[i].task); ++ ctrl->chans[i].task = NULL; ++ } ++ kfifo_free(&ctrl->chans[i].svc_fifo); + } ++ + if (ctrl->genpool) + gen_pool_destroy(ctrl->genpool); + list_del(&ctrl->node); +--- a/include/linux/firmware/intel/stratix10-svc-client.h ++++ b/include/linux/firmware/intel/stratix10-svc-client.h +@@ -68,12 +68,12 @@ + * timeout value used in Stratix10 FPGA manager driver. + * timeout value used in RSU driver + */ +-#define SVC_RECONFIG_REQUEST_TIMEOUT_MS 300 +-#define SVC_RECONFIG_BUFFER_TIMEOUT_MS 720 +-#define SVC_RSU_REQUEST_TIMEOUT_MS 300 ++#define SVC_RECONFIG_REQUEST_TIMEOUT_MS 5000 ++#define SVC_RECONFIG_BUFFER_TIMEOUT_MS 5000 ++#define SVC_RSU_REQUEST_TIMEOUT_MS 2000 + #define SVC_FCS_REQUEST_TIMEOUT_MS 2000 + #define SVC_COMPLETED_TIMEOUT_MS 30000 +-#define SVC_HWMON_REQUEST_TIMEOUT_MS 300 ++#define SVC_HWMON_REQUEST_TIMEOUT_MS 2000 + + struct stratix10_svc_chan; + diff --git a/queue-6.19/firmware-stratix10-svc-delete-some-stray-tabs.patch b/queue-6.19/firmware-stratix10-svc-delete-some-stray-tabs.patch new file mode 100644 index 0000000000..c261d8b3c0 --- /dev/null +++ b/queue-6.19/firmware-stratix10-svc-delete-some-stray-tabs.patch @@ -0,0 +1,54 @@ +From stable+bounces-227287-greg=kroah.com@vger.kernel.org Thu Mar 19 14:18:55 2026 +From: Sasha Levin +Date: Thu, 19 Mar 2026 09:18:08 -0400 +Subject: firmware: stratix10-svc: Delete some stray tabs +To: stable@vger.kernel.org +Cc: Dan Carpenter , Dinh Nguyen , Sasha Levin +Message-ID: <20260319131809.2432986-1-sashal@kernel.org> + +From: Dan Carpenter + +[ Upstream commit 9e51d1da5b245c9bf97fc49b06cca7e901c0fe94 ] + +These lines are indented one tab too far. Delete the extra tabs +for readability. + +Signed-off-by: Dan Carpenter +Signed-off-by: Dinh Nguyen +Stable-dep-of: 22fd7f7fed2a ("firmware: stratix10-svc: Add Multi SVC clients support") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/stratix10-svc.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/firmware/stratix10-svc.c ++++ b/drivers/firmware/stratix10-svc.c +@@ -1317,7 +1317,7 @@ int stratix10_svc_async_send(struct stra + dev_dbg(ctrl->dev, + "Async message sent with transaction_id 0x%02x\n", + handle->transaction_id); +- *handler = handle; ++ *handler = handle; + return 0; + case INTEL_SIP_SMC_STATUS_BUSY: + dev_warn(ctrl->dev, "Mailbox is busy, try after some time\n"); +@@ -1702,12 +1702,12 @@ int stratix10_svc_send(struct stratix10_ + kthread_run_on_cpu(svc_normal_to_secure_thread, + (void *)chan->ctrl, + cpu, "svc_smc_hvc_thread"); +- if (IS_ERR(chan->ctrl->task)) { +- dev_err(chan->ctrl->dev, +- "failed to create svc_smc_hvc_thread\n"); +- kfree(p_data); +- return -EINVAL; +- } ++ if (IS_ERR(chan->ctrl->task)) { ++ dev_err(chan->ctrl->dev, ++ "failed to create svc_smc_hvc_thread\n"); ++ kfree(p_data); ++ return -EINVAL; ++ } + } + + pr_debug("%s: sent P-va=%p, P-com=%x, P-size=%u\n", __func__, diff --git a/queue-6.19/ipmi-consolidate-the-run-to-completion-checking-for-xmit-msgs-lock.patch b/queue-6.19/ipmi-consolidate-the-run-to-completion-checking-for-xmit-msgs-lock.patch new file mode 100644 index 0000000000..7fdeb9a268 --- /dev/null +++ b/queue-6.19/ipmi-consolidate-the-run-to-completion-checking-for-xmit-msgs-lock.patch @@ -0,0 +1,117 @@ +From stable+bounces-226349-greg=kroah.com@vger.kernel.org Tue Mar 17 18:02:04 2026 +From: Sasha Levin +Date: Tue, 17 Mar 2026 12:51:54 -0400 +Subject: ipmi: Consolidate the run to completion checking for xmit msgs lock +To: stable@vger.kernel.org +Cc: Corey Minyard , Breno Leitao , Sasha Levin +Message-ID: <20260317165155.226620-1-sashal@kernel.org> + +From: Corey Minyard + +[ Upstream commit 1d90e6c1a56f6ab83e5c9d30ded19e7ac8155713 ] + +It made things hard to read, move the check to a function. + +Signed-off-by: Corey Minyard +Reviewed-by: Breno Leitao +Stable-dep-of: 62cd145453d5 ("ipmi:msghandler: Handle error returns from the SMI sender") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/ipmi/ipmi_msghandler.c | 42 ++++++++++++++++++++---------------- + 1 file changed, 24 insertions(+), 18 deletions(-) + +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -602,6 +602,22 @@ static int __ipmi_bmc_register(struct ip + static int __scan_channels(struct ipmi_smi *intf, + struct ipmi_device_id *id, bool rescan); + ++static void ipmi_lock_xmit_msgs(struct ipmi_smi *intf, int run_to_completion, ++ unsigned long *flags) ++{ ++ if (run_to_completion) ++ return; ++ spin_lock_irqsave(&intf->xmit_msgs_lock, *flags); ++} ++ ++static void ipmi_unlock_xmit_msgs(struct ipmi_smi *intf, int run_to_completion, ++ unsigned long *flags) ++{ ++ if (run_to_completion) ++ return; ++ spin_unlock_irqrestore(&intf->xmit_msgs_lock, *flags); ++} ++ + static void free_ipmi_user(struct kref *ref) + { + struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount); +@@ -1878,11 +1894,9 @@ static void smi_send(struct ipmi_smi *in + int run_to_completion = READ_ONCE(intf->run_to_completion); + unsigned long flags = 0; + +- if (!run_to_completion) +- spin_lock_irqsave(&intf->xmit_msgs_lock, flags); ++ ipmi_lock_xmit_msgs(intf, run_to_completion, &flags); + smi_msg = smi_add_send_msg(intf, smi_msg, priority); +- if (!run_to_completion) +- spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags); ++ ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags); + + if (smi_msg) + handlers->sender(intf->send_info, smi_msg); +@@ -4826,8 +4840,7 @@ static void smi_work(struct work_struct + * message delivery. + */ + restart: +- if (!run_to_completion) +- spin_lock_irqsave(&intf->xmit_msgs_lock, flags); ++ ipmi_lock_xmit_msgs(intf, run_to_completion, &flags); + if (intf->curr_msg == NULL && !intf->in_shutdown) { + struct list_head *entry = NULL; + +@@ -4843,8 +4856,7 @@ restart: + intf->curr_msg = newmsg; + } + } +- if (!run_to_completion) +- spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags); ++ ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags); + + if (newmsg) { + cc = intf->handlers->sender(intf->send_info, newmsg); +@@ -4852,13 +4864,9 @@ restart: + if (newmsg->recv_msg) + deliver_err_response(intf, + newmsg->recv_msg, cc); +- if (!run_to_completion) +- spin_lock_irqsave(&intf->xmit_msgs_lock, +- flags); ++ ipmi_lock_xmit_msgs(intf, run_to_completion, &flags); + intf->curr_msg = NULL; +- if (!run_to_completion) +- spin_unlock_irqrestore(&intf->xmit_msgs_lock, +- flags); ++ ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags); + ipmi_free_smi_msg(newmsg); + newmsg = NULL; + goto restart; +@@ -4928,16 +4936,14 @@ void ipmi_smi_msg_received(struct ipmi_s + spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock, + flags); + +- if (!run_to_completion) +- spin_lock_irqsave(&intf->xmit_msgs_lock, flags); ++ ipmi_lock_xmit_msgs(intf, run_to_completion, &flags); + /* + * We can get an asynchronous event or receive message in addition + * to commands we send. + */ + if (msg == intf->curr_msg) + intf->curr_msg = NULL; +- if (!run_to_completion) +- spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags); ++ ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags); + + if (run_to_completion) + smi_work(&intf->smi_work); diff --git a/queue-6.19/ipmi-msghandler-handle-error-returns-from-the-smi-sender.patch b/queue-6.19/ipmi-msghandler-handle-error-returns-from-the-smi-sender.patch new file mode 100644 index 0000000000..b721828312 --- /dev/null +++ b/queue-6.19/ipmi-msghandler-handle-error-returns-from-the-smi-sender.patch @@ -0,0 +1,216 @@ +From stable+bounces-226350-greg=kroah.com@vger.kernel.org Tue Mar 17 18:02:07 2026 +From: Sasha Levin +Date: Tue, 17 Mar 2026 12:51:55 -0400 +Subject: ipmi:msghandler: Handle error returns from the SMI sender +To: stable@vger.kernel.org +Cc: Corey Minyard , "Rafael J. Wysocki" , Sasha Levin +Message-ID: <20260317165155.226620-2-sashal@kernel.org> + +From: Corey Minyard + +[ Upstream commit 62cd145453d577113f993efd025f258dd86aa183 ] + +It used to be, until recently, that the sender operation on the low +level interfaces would not fail. That's not the case any more with +recent changes. + +So check the return value from the sender operation, and propagate it +back up from there and handle the errors in all places. + +Reported-by: Rafael J. Wysocki +Fixes: bc3a9d217755 ("ipmi:si: Gracefully handle if the BMC is non-functional") +Cc: stable@vger.kernel.org # 4.18 +Signed-off-by: Corey Minyard +Reviewed-by: Rafael J. Wysocki (Intel) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/ipmi/ipmi_msghandler.c | 100 ++++++++++++++++++++++++------------ + 1 file changed, 68 insertions(+), 32 deletions(-) + +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -1887,19 +1887,32 @@ static struct ipmi_smi_msg *smi_add_send + return smi_msg; + } + +-static void smi_send(struct ipmi_smi *intf, ++static int smi_send(struct ipmi_smi *intf, + const struct ipmi_smi_handlers *handlers, + struct ipmi_smi_msg *smi_msg, int priority) + { + int run_to_completion = READ_ONCE(intf->run_to_completion); + unsigned long flags = 0; ++ int rv = 0; + + ipmi_lock_xmit_msgs(intf, run_to_completion, &flags); + smi_msg = smi_add_send_msg(intf, smi_msg, priority); + ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags); + +- if (smi_msg) +- handlers->sender(intf->send_info, smi_msg); ++ if (smi_msg) { ++ rv = handlers->sender(intf->send_info, smi_msg); ++ if (rv) { ++ ipmi_lock_xmit_msgs(intf, run_to_completion, &flags); ++ intf->curr_msg = NULL; ++ ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags); ++ /* ++ * Something may have been added to the transmit ++ * queue, so schedule a check for that. ++ */ ++ queue_work(system_wq, &intf->smi_work); ++ } ++ } ++ return rv; + } + + static bool is_maintenance_mode_cmd(struct kernel_ipmi_msg *msg) +@@ -2312,6 +2325,7 @@ static int i_ipmi_request(struct ipmi_us + struct ipmi_recv_msg *recv_msg; + int run_to_completion = READ_ONCE(intf->run_to_completion); + int rv = 0; ++ bool in_seq_table = false; + + if (supplied_recv) { + recv_msg = supplied_recv; +@@ -2365,33 +2379,50 @@ static int i_ipmi_request(struct ipmi_us + rv = i_ipmi_req_ipmb(intf, addr, msgid, msg, smi_msg, recv_msg, + source_address, source_lun, + retries, retry_time_ms); ++ in_seq_table = true; + } else if (is_ipmb_direct_addr(addr)) { + rv = i_ipmi_req_ipmb_direct(intf, addr, msgid, msg, smi_msg, + recv_msg, source_lun); + } else if (is_lan_addr(addr)) { + rv = i_ipmi_req_lan(intf, addr, msgid, msg, smi_msg, recv_msg, + source_lun, retries, retry_time_ms); ++ in_seq_table = true; + } else { +- /* Unknown address type. */ ++ /* Unknown address type. */ + ipmi_inc_stat(intf, sent_invalid_commands); + rv = -EINVAL; + } + +- if (rv) { +-out_err: +- if (!supplied_smi) +- ipmi_free_smi_msg(smi_msg); +- if (!supplied_recv) +- ipmi_free_recv_msg(recv_msg); +- } else { ++ if (!rv) { + dev_dbg(intf->si_dev, "Send: %*ph\n", + smi_msg->data_size, smi_msg->data); + +- smi_send(intf, intf->handlers, smi_msg, priority); ++ rv = smi_send(intf, intf->handlers, smi_msg, priority); ++ if (rv != IPMI_CC_NO_ERROR) ++ /* smi_send() returns an IPMI err, return a Linux one. */ ++ rv = -EIO; ++ if (rv && in_seq_table) { ++ /* ++ * If it's in the sequence table, it will be ++ * retried later, so ignore errors. ++ */ ++ rv = 0; ++ /* But we need to fix the timeout. */ ++ intf_start_seq_timer(intf, smi_msg->msgid); ++ ipmi_free_smi_msg(smi_msg); ++ smi_msg = NULL; ++ } + } ++out_err: + if (!run_to_completion) + mutex_unlock(&intf->users_mutex); + ++ if (rv) { ++ if (!supplied_smi) ++ ipmi_free_smi_msg(smi_msg); ++ if (!supplied_recv) ++ ipmi_free_recv_msg(recv_msg); ++ } + return rv; + } + +@@ -3965,12 +3996,12 @@ static int handle_ipmb_get_msg_cmd(struc + dev_dbg(intf->si_dev, "Invalid command: %*ph\n", + msg->data_size, msg->data); + +- smi_send(intf, intf->handlers, msg, 0); +- /* +- * We used the message, so return the value that +- * causes it to not be freed or queued. +- */ +- rv = -1; ++ if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR) ++ /* ++ * We used the message, so return the value that ++ * causes it to not be freed or queued. ++ */ ++ rv = -1; + } else if (!IS_ERR(recv_msg)) { + /* Extract the source address from the data. */ + ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr; +@@ -4044,12 +4075,12 @@ static int handle_ipmb_direct_rcv_cmd(st + msg->data[4] = IPMI_INVALID_CMD_COMPLETION_CODE; + msg->data_size = 5; + +- smi_send(intf, intf->handlers, msg, 0); +- /* +- * We used the message, so return the value that +- * causes it to not be freed or queued. +- */ +- rv = -1; ++ if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR) ++ /* ++ * We used the message, so return the value that ++ * causes it to not be freed or queued. ++ */ ++ rv = -1; + } else if (!IS_ERR(recv_msg)) { + /* Extract the source address from the data. */ + daddr = (struct ipmi_ipmb_direct_addr *)&recv_msg->addr; +@@ -4189,7 +4220,7 @@ static int handle_lan_get_msg_cmd(struct + struct ipmi_smi_msg *msg) + { + struct cmd_rcvr *rcvr; +- int rv = 0; ++ int rv = 0; /* Free by default */ + unsigned char netfn; + unsigned char cmd; + unsigned char chan; +@@ -4242,12 +4273,12 @@ static int handle_lan_get_msg_cmd(struct + dev_dbg(intf->si_dev, "Invalid command: %*ph\n", + msg->data_size, msg->data); + +- smi_send(intf, intf->handlers, msg, 0); +- /* +- * We used the message, so return the value that +- * causes it to not be freed or queued. +- */ +- rv = -1; ++ if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR) ++ /* ++ * We used the message, so return the value that ++ * causes it to not be freed or queued. ++ */ ++ rv = -1; + } else if (!IS_ERR(recv_msg)) { + /* Extract the source address from the data. */ + lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr; +@@ -5056,7 +5087,12 @@ static void check_msg_timeout(struct ipm + ipmi_inc_stat(intf, + retransmitted_ipmb_commands); + +- smi_send(intf, intf->handlers, smi_msg, 0); ++ /* If this fails we'll retry later or timeout. */ ++ if (smi_send(intf, intf->handlers, smi_msg, 0) != IPMI_CC_NO_ERROR) { ++ /* But fix the timeout. */ ++ intf_start_seq_timer(intf, smi_msg->msgid); ++ ipmi_free_smi_msg(smi_msg); ++ } + } else + ipmi_free_smi_msg(smi_msg); + diff --git a/queue-6.19/ksmbd-unset-conn-binding-on-failed-binding-request.patch b/queue-6.19/ksmbd-unset-conn-binding-on-failed-binding-request.patch new file mode 100644 index 0000000000..99ed0600eb --- /dev/null +++ b/queue-6.19/ksmbd-unset-conn-binding-on-failed-binding-request.patch @@ -0,0 +1,35 @@ +From 282343cf8a4a5a3603b1cb0e17a7083e4a593b03 Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Fri, 13 Mar 2026 10:00:58 +0900 +Subject: ksmbd: unset conn->binding on failed binding request + +From: Namjae Jeon + +commit 282343cf8a4a5a3603b1cb0e17a7083e4a593b03 upstream. + +When a multichannel SMB2_SESSION_SETUP request with +SMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn->binding = true +but never clears it on the error path. This leaves the connection in +a binding state where all subsequent ksmbd_session_lookup_all() calls +fall back to the global sessions table. This fix it by clearing +conn->binding = false in the error path. + +Cc: stable@vger.kernel.org +Reported-by: Hyunwoo Kim +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/server/smb2pdu.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -1947,6 +1947,7 @@ out_err: + } + } + smb2_set_err_rsp(work); ++ conn->binding = false; + } else { + unsigned int iov_len; + diff --git a/queue-6.19/ksmbd-use-volume-uuid-in-fs_object_id_information.patch b/queue-6.19/ksmbd-use-volume-uuid-in-fs_object_id_information.patch new file mode 100644 index 0000000000..438f106c4d --- /dev/null +++ b/queue-6.19/ksmbd-use-volume-uuid-in-fs_object_id_information.patch @@ -0,0 +1,47 @@ +From 3a64125730cabc34fccfbc230c2667c2e14f7308 Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Fri, 13 Mar 2026 10:01:29 +0900 +Subject: ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION + +From: Namjae Jeon + +commit 3a64125730cabc34fccfbc230c2667c2e14f7308 upstream. + +Use sb->s_uuid for a proper volume identifier as the primary choice. +For filesystems that do not provide a UUID, fall back to stfs.f_fsid +obtained from vfs_statfs(). + +Cc: stable@vger.kernel.org +Reported-by: Hyunwoo Kim +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/server/smb2pdu.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -5452,7 +5452,6 @@ static int smb2_get_info_filesystem(stru + struct smb2_query_info_req *req, + struct smb2_query_info_rsp *rsp) + { +- struct ksmbd_session *sess = work->sess; + struct ksmbd_conn *conn = work->conn; + struct ksmbd_share_config *share = work->tcon->share_conf; + int fsinfoclass = 0; +@@ -5589,10 +5588,11 @@ static int smb2_get_info_filesystem(stru + + info = (struct object_id_info *)(rsp->Buffer); + +- if (!user_guest(sess->user)) +- memcpy(info->objid, user_passkey(sess->user), 16); ++ if (path.mnt->mnt_sb->s_uuid_len == 16) ++ memcpy(info->objid, path.mnt->mnt_sb->s_uuid.b, ++ path.mnt->mnt_sb->s_uuid_len); + else +- memset(info->objid, 0, 16); ++ memcpy(info->objid, &stfs.f_fsid, sizeof(stfs.f_fsid)); + + info->extended_info.magic = cpu_to_le32(EXTENDED_INFO_MAGIC); + info->extended_info.version = cpu_to_le32(1); diff --git a/queue-6.19/loongarch-check-return-values-for-set_memory_-rw-rox.patch b/queue-6.19/loongarch-check-return-values-for-set_memory_-rw-rox.patch new file mode 100644 index 0000000000..516b15c0ed --- /dev/null +++ b/queue-6.19/loongarch-check-return-values-for-set_memory_-rw-rox.patch @@ -0,0 +1,57 @@ +From stable+bounces-227538-greg=kroah.com@vger.kernel.org Fri Mar 20 13:45:45 2026 +From: Sasha Levin +Date: Fri, 20 Mar 2026 08:42:26 -0400 +Subject: LoongArch: Check return values for set_memory_{rw,rox} +To: stable@vger.kernel.org +Cc: Tiezhu Yang , Huacai Chen , Sasha Levin +Message-ID: <20260320124226.4124820-1-sashal@kernel.org> + +From: Tiezhu Yang + +[ Upstream commit 431ce839dad66d0d56fb604785452c6a57409f35 ] + +set_memory_rw() and set_memory_rox() may fail, so we should check the +return values and return immediately in larch_insn_text_copy(). + +Cc: stable@vger.kernel.org +Signed-off-by: Tiezhu Yang +Signed-off-by: Huacai Chen +[ kept `stop_machine()` instead of `stop_machine_cpuslocked()` ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/kernel/inst.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/arch/loongarch/kernel/inst.c ++++ b/arch/loongarch/kernel/inst.c +@@ -260,6 +260,7 @@ static int text_copy_cb(void *data) + int larch_insn_text_copy(void *dst, void *src, size_t len) + { + int ret = 0; ++ int err = 0; + size_t start, end; + struct insn_copy copy = { + .dst = dst, +@@ -271,9 +272,19 @@ int larch_insn_text_copy(void *dst, void + start = round_down((size_t)dst, PAGE_SIZE); + end = round_up((size_t)dst + len, PAGE_SIZE); + +- set_memory_rw(start, (end - start) / PAGE_SIZE); ++ err = set_memory_rw(start, (end - start) / PAGE_SIZE); ++ if (err) { ++ pr_info("%s: set_memory_rw() failed\n", __func__); ++ return err; ++ } ++ + ret = stop_machine(text_copy_cb, ©, cpu_online_mask); +- set_memory_rox(start, (end - start) / PAGE_SIZE); ++ ++ err = set_memory_rox(start, (end - start) / PAGE_SIZE); ++ if (err) { ++ pr_info("%s: set_memory_rox() failed\n", __func__); ++ return err; ++ } + + return ret; + } diff --git a/queue-6.19/net-macb-introduce-gem_init_rx_ring.patch b/queue-6.19/net-macb-introduce-gem_init_rx_ring.patch new file mode 100644 index 0000000000..cfafbdab0d --- /dev/null +++ b/queue-6.19/net-macb-introduce-gem_init_rx_ring.patch @@ -0,0 +1,56 @@ +From stable+bounces-227536-greg=kroah.com@vger.kernel.org Fri Mar 20 13:42:39 2026 +From: Sasha Levin +Date: Fri, 20 Mar 2026 08:42:02 -0400 +Subject: net: macb: Introduce gem_init_rx_ring() +To: stable@vger.kernel.org +Cc: Kevin Hao , Simon Horman , Jakub Kicinski , Sasha Levin +Message-ID: <20260320124203.4124440-1-sashal@kernel.org> + +From: Kevin Hao + +[ Upstream commit 1a7124ecd655bcaf1845197fe416aa25cff4c3ea ] + +Extract the initialization code for the GEM RX ring into a new function. +This change will be utilized in a subsequent patch. No functional changes +are introduced. + +Signed-off-by: Kevin Hao +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260312-macb-versal-v1-1-467647173fa4@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 718d0766ce4c ("net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cadence/macb_main.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -2669,6 +2669,14 @@ static void macb_init_tieoff(struct macb + desc->ctrl = 0; + } + ++static void gem_init_rx_ring(struct macb_queue *queue) ++{ ++ queue->rx_tail = 0; ++ queue->rx_prepared_head = 0; ++ ++ gem_rx_refill(queue); ++} ++ + static void gem_init_rings(struct macb *bp) + { + struct macb_queue *queue; +@@ -2686,10 +2694,7 @@ static void gem_init_rings(struct macb * + queue->tx_head = 0; + queue->tx_tail = 0; + +- queue->rx_tail = 0; +- queue->rx_prepared_head = 0; +- +- gem_rx_refill(queue); ++ gem_init_rx_ring(queue); + } + + macb_init_tieoff(bp); diff --git a/queue-6.19/net-macb-reinitialize-tx-rx-queue-pointer-registers-and-rx-ring-during-resume.patch b/queue-6.19/net-macb-reinitialize-tx-rx-queue-pointer-registers-and-rx-ring-during-resume.patch new file mode 100644 index 0000000000..b46dc4995a --- /dev/null +++ b/queue-6.19/net-macb-reinitialize-tx-rx-queue-pointer-registers-and-rx-ring-during-resume.patch @@ -0,0 +1,61 @@ +From stable+bounces-227537-greg=kroah.com@vger.kernel.org Fri Mar 20 13:45:09 2026 +From: Sasha Levin +Date: Fri, 20 Mar 2026 08:42:03 -0400 +Subject: net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume +To: stable@vger.kernel.org +Cc: Kevin Hao , Quanyang Wang , Simon Horman , Jakub Kicinski , Sasha Levin +Message-ID: <20260320124203.4124440-2-sashal@kernel.org> + +From: Kevin Hao + +[ Upstream commit 718d0766ce4c7634ce62fa78b526ea7263487edd ] + +On certain platforms, such as AMD Versal boards, the tx/rx queue pointer +registers are cleared after suspend, and the rx queue pointer register +is also disabled during suspend if WOL is enabled. Previously, we assumed +that these registers would be restored by macb_mac_link_up(). However, +in commit bf9cf80cab81, macb_init_buffers() was moved from +macb_mac_link_up() to macb_open(). Therefore, we should call +macb_init_buffers() to reinitialize the tx/rx queue pointer registers +during resume. + +Due to the reset of these two registers, we also need to adjust the +tx/rx rings accordingly. The tx ring will be handled by +gem_shuffle_tx_rings() in macb_mac_link_up(), so we only need to +initialize the rx ring here. + +Fixes: bf9cf80cab81 ("net: macb: Fix tx/rx malfunction after phy link down and up") +Reported-by: Quanyang Wang +Signed-off-by: Kevin Hao +Tested-by: Quanyang Wang +Cc: stable@vger.kernel.org +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20260312-macb-versal-v1-2-467647173fa4@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/cadence/macb_main.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -5949,8 +5949,18 @@ static int __maybe_unused macb_resume(st + rtnl_unlock(); + } + ++ if (!(bp->caps & MACB_CAPS_MACB_IS_EMAC)) ++ macb_init_buffers(bp); ++ + for (q = 0, queue = bp->queues; q < bp->num_queues; + ++q, ++queue) { ++ if (!(bp->caps & MACB_CAPS_MACB_IS_EMAC)) { ++ if (macb_is_gem(bp)) ++ gem_init_rx_ring(queue); ++ else ++ macb_init_rx_ring(queue); ++ } ++ + napi_enable(&queue->napi_rx); + napi_enable(&queue->napi_tx); + } diff --git a/queue-6.19/netconsole-fix-sysdata_release_enabled_show-checking-wrong-flag.patch b/queue-6.19/netconsole-fix-sysdata_release_enabled_show-checking-wrong-flag.patch new file mode 100644 index 0000000000..362fad4500 --- /dev/null +++ b/queue-6.19/netconsole-fix-sysdata_release_enabled_show-checking-wrong-flag.patch @@ -0,0 +1,43 @@ +From stable+bounces-227189-greg=kroah.com@vger.kernel.org Thu Mar 19 01:41:42 2026 +From: Sasha Levin +Date: Wed, 18 Mar 2026 20:41:31 -0400 +Subject: netconsole: fix sysdata_release_enabled_show checking wrong flag +To: stable@vger.kernel.org +Cc: Breno Leitao , Jakub Kicinski , Sasha Levin +Message-ID: <20260319004131.1853033-1-sashal@kernel.org> + +From: Breno Leitao + +[ Upstream commit 5af6e8b54927f7a8d3c7fd02b1bdc09e93d5c079 ] + +sysdata_release_enabled_show() checks SYSDATA_TASKNAME instead of +SYSDATA_RELEASE, causing the configfs release_enabled attribute to +reflect the taskname feature state rather than the release feature +state. This is a copy-paste error from the adjacent +sysdata_taskname_enabled_show() function. + +The corresponding _store function already uses the correct +SYSDATA_RELEASE flag. + +Fixes: 343f90227070 ("netconsole: implement configfs for release_enabled") +Signed-off-by: Breno Leitao +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260302-sysdata_release_fix-v1-1-e5090f677c7c@debian.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/netconsole.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/netconsole.c ++++ b/drivers/net/netconsole.c +@@ -508,7 +508,7 @@ static ssize_t sysdata_release_enabled_s + bool release_enabled; + + mutex_lock(&dynamic_netconsole_mutex); +- release_enabled = !!(nt->sysdata_fields & SYSDATA_TASKNAME); ++ release_enabled = !!(nt->sysdata_fields & SYSDATA_RELEASE); + mutex_unlock(&dynamic_netconsole_mutex); + + return sysfs_emit(buf, "%d\n", release_enabled); diff --git a/queue-6.19/series b/queue-6.19/series index 12837b238e..8ccb8ef129 100644 --- a/queue-6.19/series +++ b/queue-6.19/series @@ -21,3 +21,20 @@ crypto-padlock-sha-disable-for-zhaoxin-processor.patch bluetooth-l2cap-fix-type-confusion-in-l2cap_ecred_reconf_rsp.patch bluetooth-l2cap-validate-l2cap_info_rsp-payload-length-before-access.patch drm-amd-fix-hang-on-amdgpu-unload-by-using-pci_dev_is_disconnected.patch +smb-client-fix-krb5-mount-with-username-option.patch +ksmbd-unset-conn-binding-on-failed-binding-request.patch +ksmbd-use-volume-uuid-in-fs_object_id_information.patch +drm-i915-dsc-add-selective-update-register-definitions.patch +drm-i915-dsc-add-helper-for-writing-dsc-selective-update-et-parameters.patch +drm-i915-psr-write-dsc-parameters-on-selective-update-in-et-mode.patch +loongarch-check-return-values-for-set_memory_-rw-rox.patch +net-macb-introduce-gem_init_rx_ring.patch +net-macb-reinitialize-tx-rx-queue-pointer-registers-and-rx-ring-during-resume.patch +firmware-stratix10-svc-delete-some-stray-tabs.patch +firmware-stratix10-svc-add-multi-svc-clients-support.patch +netconsole-fix-sysdata_release_enabled_show-checking-wrong-flag.patch +crypto-atmel-sha204a-fix-oom-tfm_count-leak.patch +cifs-open-files-should-not-hold-ref-on-superblock.patch +drm-xe-fix-memory-leak-in-xe_vm_madvise_ioctl.patch +ipmi-consolidate-the-run-to-completion-checking-for-xmit-msgs-lock.patch +ipmi-msghandler-handle-error-returns-from-the-smi-sender.patch diff --git a/queue-6.19/smb-client-fix-krb5-mount-with-username-option.patch b/queue-6.19/smb-client-fix-krb5-mount-with-username-option.patch new file mode 100644 index 0000000000..211bbacf39 --- /dev/null +++ b/queue-6.19/smb-client-fix-krb5-mount-with-username-option.patch @@ -0,0 +1,67 @@ +From 12b4c5d98cd7ca46d5035a57bcd995df614c14e1 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Fri, 13 Mar 2026 00:03:38 -0300 +Subject: smb: client: fix krb5 mount with username option + +From: Paulo Alcantara + +commit 12b4c5d98cd7ca46d5035a57bcd995df614c14e1 upstream. + +Customer reported that some of their krb5 mounts were failing against +a single server as the client was trying to mount the shares with +wrong credentials. It turned out the client was reusing SMB session +from first mount to try mounting the other shares, even though a +different username= option had been specified to the other mounts. + +By using username mount option along with sec=krb5 to search for +principals from keytab is supported by cifs.upcall(8) since +cifs-utils-4.8. So fix this by matching username mount option in +match_session() even with Kerberos. + +For example, the second mount below should fail with -ENOKEY as there +is no 'foobar' principal in keytab (/etc/krb5.keytab). The client +ends up reusing SMB session from first mount to perform the second +one, which is wrong. + +``` +$ ktutil +ktutil: add_entry -password -p testuser -k 1 -e aes256-cts +Password for testuser@ZELDA.TEST: +ktutil: write_kt /etc/krb5.keytab +ktutil: quit +$ klist -ke +Keytab name: FILE:/etc/krb5.keytab +KVNO Principal + ---- ---------------------------------------------------------------- + 1 testuser@ZELDA.TEST (aes256-cts-hmac-sha1-96) +$ mount.cifs //w22-root2/scratch /mnt/1 -o sec=krb5,username=testuser +$ mount.cifs //w22-root2/scratch /mnt/2 -o sec=krb5,username=foobar +$ mount -t cifs | grep -Po 'username=\K\w+' +testuser +testuser +``` + +Reported-by: Oscar Santos +Signed-off-by: Paulo Alcantara (Red Hat) +Cc: David Howells +Cc: linux-cifs@vger.kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/connect.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -1952,6 +1952,10 @@ static int match_session(struct cifs_ses + case Kerberos: + if (!uid_eq(ctx->cred_uid, ses->cred_uid)) + return 0; ++ if (strncmp(ses->user_name ?: "", ++ ctx->username ?: "", ++ CIFS_MAX_USERNAME_LEN)) ++ return 0; + break; + case NTLMv2: + case RawNTLMSSP: