From: Sasha Levin Date: Sat, 27 Dec 2025 19:35:16 +0000 (-0500) Subject: Fixes for all trees X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=488d8b4fffbcf54b7db99f67860969e94516e782;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for all trees Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch b/queue-5.10/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch new file mode 100644 index 0000000000..e281391724 --- /dev/null +++ b/queue-5.10/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch @@ -0,0 +1,48 @@ +From 0c809025c311e8fb57dd71489821450f2f418252 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 17:04:33 +0800 +Subject: ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path + +From: Haotian Zhang + +[ Upstream commit 5032347c04ba7ff9ba878f262e075d745c06a2a8 ] + +When pdacf_config() fails, snd_pdacf_probe() returns the error code +directly without freeing the sound card resources allocated by +snd_card_new(), which leads to a memory leak. + +Add proper error handling to free the sound card and clear the card +list entry when pdacf_config() fails. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Suggested-by: Takashi Iwai +Signed-off-by: Haotian Zhang +Link: https://patch.msgid.link/20251215090433.211-1-vulab@iscas.ac.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c +index 27d9da6d61e8..3a354616af19 100644 +--- a/sound/pcmcia/pdaudiocf/pdaudiocf.c ++++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c +@@ -133,7 +133,13 @@ static int snd_pdacf_probe(struct pcmcia_device *link) + link->config_index = 1; + link->config_regs = PRESENT_OPTION; + +- return pdacf_config(link); ++ err = pdacf_config(link); ++ if (err < 0) { ++ card_list[i] = NULL; ++ snd_card_free(card); ++ return err; ++ } ++ return 0; + } + + +-- +2.51.0 + diff --git a/queue-5.10/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch b/queue-5.10/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch new file mode 100644 index 0000000000..00c6101d36 --- /dev/null +++ b/queue-5.10/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch @@ -0,0 +1,74 @@ +From 7120f1d9b714187babb1623f97193d58b3e9bc0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 10:46:30 +0800 +Subject: ALSA: usb-mixer: us16x08: validate meter packet indices + +From: Shipei Qu + +[ Upstream commit 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e ] + +get_meter_levels_from_urb() parses the 64-byte meter packets sent by +the device and fills the per-channel arrays meter_level[], +comp_level[] and master_level[] in struct snd_us16x08_meter_store. + +Currently the function derives the channel index directly from the +meter packet (MUB2(meter_urb, s) - 1) and uses it to index those +arrays without validating the range. If the packet contains a +negative or out-of-range channel number, the driver may write past +the end of these arrays. + +Introduce a local channel variable and validate it before updating the +arrays. We reject negative indices, limit meter_level[] and +comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[] +updates with ARRAY_SIZE(master_level). + +Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk") +Reported-by: DARKNAVY (@DarkNavyOrg) +Closes: https://lore.kernel.org/tencent_21C112743C44C1A2517FF219@qq.com +Signed-off-by: Shipei Qu +Link: https://patch.msgid.link/20251217024630.59576-1-qu@darknavy.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_us16x08.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c +index 3959bbad0c4f..723b11cb0c1b 100644 +--- a/sound/usb/mixer_us16x08.c ++++ b/sound/usb/mixer_us16x08.c +@@ -656,17 +656,25 @@ static void get_meter_levels_from_urb(int s, + u8 *meter_urb) + { + int val = MUC2(meter_urb, s) + (MUC3(meter_urb, s) << 8); ++ int ch = MUB2(meter_urb, s) - 1; ++ ++ if (ch < 0) ++ return; + + if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 && + MUA2(meter_urb, s) == 0x04 && MUB0(meter_urb, s) == 0x62) { +- if (MUC0(meter_urb, s) == 0x72) +- store->meter_level[MUB2(meter_urb, s) - 1] = val; +- if (MUC0(meter_urb, s) == 0xb2) +- store->comp_level[MUB2(meter_urb, s) - 1] = val; ++ if (ch < SND_US16X08_MAX_CHANNELS) { ++ if (MUC0(meter_urb, s) == 0x72) ++ store->meter_level[ch] = val; ++ if (MUC0(meter_urb, s) == 0xb2) ++ store->comp_level[ch] = val; ++ } + } + if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 && +- MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) +- store->master_level[MUB2(meter_urb, s) - 1] = val; ++ MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) { ++ if (ch < ARRAY_SIZE(store->master_level)) ++ store->master_level[ch] = val; ++ } + } + + /* Function to retrieve current meter values from the device. +-- +2.51.0 + diff --git a/queue-5.10/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch b/queue-5.10/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch new file mode 100644 index 0000000000..d130844cef --- /dev/null +++ b/queue-5.10/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch @@ -0,0 +1,47 @@ +From a491baa26499b4c22d0f7b5ea5f8033aacc16c1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 12:26:52 +0800 +Subject: ALSA: vxpocket: Fix resource leak in vxpocket_probe error path + +From: Haotian Zhang + +[ Upstream commit 2a03b40deacbd293ac9aed0f9b11197dad54fe5f ] + +When vxpocket_config() fails, vxpocket_probe() returns the error code +directly without freeing the sound card resources allocated by +snd_card_new(), which leads to a memory leak. + +Add proper error handling to free the sound card and clear the +allocation bit when vxpocket_config() fails. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Haotian Zhang +Link: https://patch.msgid.link/20251215042652.695-1-vulab@iscas.ac.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pcmcia/vx/vxpocket.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c +index afd30a90c807..16081c51b938 100644 +--- a/sound/pcmcia/vx/vxpocket.c ++++ b/sound/pcmcia/vx/vxpocket.c +@@ -320,7 +320,13 @@ static int vxpocket_probe(struct pcmcia_device *p_dev) + + vxp->p_dev = p_dev; + +- return vxpocket_config(p_dev); ++ err = vxpocket_config(p_dev); ++ if (err < 0) { ++ card_alloc &= ~(1 << i); ++ snd_card_free(card); ++ return err; ++ } ++ return 0; + } + + static void vxpocket_detach(struct pcmcia_device *link) +-- +2.51.0 + diff --git a/queue-5.10/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch b/queue-5.10/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch new file mode 100644 index 0000000000..f3cd81e893 --- /dev/null +++ b/queue-5.10/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch @@ -0,0 +1,79 @@ +From f5462f39425b1f0c2011fe3c021a5e95b411f128 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 16:16:26 +0100 +Subject: clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & + pcie_x4 + +From: Josua Mayer + +[ Upstream commit f0e6bc0c3ef4b4afb299bd6912586cafd5d864e9 ] + +CP110 based platforms rely on the bootloader for pci port +initialization. +TF-A actively prevents non-uboot re-configuration of pci lanes, and many +boards do not have software control over the pci card reset. + +If a pci port had link at boot-time and the clock is stopped at a later +point, the link fails and can not be recovered. + +PCI controller driver probe - and by extension ownership of a driver for +the pci clocks - may be delayed especially on large modular kernels, +causing the clock core to start disabling unused clocks. + +Add the CLK_IGNORE_UNUSED flag to the three pci port's clocks to ensure +they are not stopped before the pci controller driver has taken +ownership and tested for an existing link. + +This fixes failed pci link detection when controller driver probes late, +e.g. with arm64 defconfig and CONFIG_PHY_MVEBU_CP110_COMPHY=m. + +Closes: https://lore.kernel.org/r/b71596c7-461b-44b6-89ab-3cfbd492639f@solid-run.com +Signed-off-by: Josua Mayer +Reviewed-by: Andrew Lunn +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/cp110-system-controller.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c +index 84c8900542e4..b477396917ad 100644 +--- a/drivers/clk/mvebu/cp110-system-controller.c ++++ b/drivers/clk/mvebu/cp110-system-controller.c +@@ -110,6 +110,25 @@ static const char * const gate_base_names[] = { + [CP110_GATE_EIP197] = "eip197" + }; + ++static unsigned long gate_flags(const u8 bit_idx) ++{ ++ switch (bit_idx) { ++ case CP110_GATE_PCIE_X1_0: ++ case CP110_GATE_PCIE_X1_1: ++ case CP110_GATE_PCIE_X4: ++ /* ++ * If a port had an active link at boot time, stopping ++ * the clock creates a failed state from which controller ++ * driver can not recover. ++ * Prevent stopping this clock till after a driver has taken ++ * ownership. ++ */ ++ return CLK_IGNORE_UNUSED; ++ default: ++ return 0; ++ } ++}; ++ + struct cp110_gate_clk { + struct clk_hw hw; + struct regmap *regmap; +@@ -171,6 +190,7 @@ static struct clk_hw *cp110_register_gate(const char *name, + init.ops = &cp110_gate_ops; + init.parent_names = &parent_name; + init.num_parents = 1; ++ init.flags = gate_flags(bit_idx); + + gate->regmap = regmap; + gate->bit_idx = bit_idx; +-- +2.51.0 + diff --git a/queue-5.10/exfat-fix-remount-failure-in-different-process-envir.patch b/queue-5.10/exfat-fix-remount-failure-in-different-process-envir.patch new file mode 100644 index 0000000000..d7de1c3eba --- /dev/null +++ b/queue-5.10/exfat-fix-remount-failure-in-different-process-envir.patch @@ -0,0 +1,60 @@ +From 033e86aba7b87d4da5dbde804105e324b3f63493 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 17:51:10 +0800 +Subject: exfat: fix remount failure in different process environments + +From: Yuezhang Mo + +[ Upstream commit 51fc7b4ce10ccab8ea5e4876bcdc42cf5202a0ef ] + +The kernel test robot reported that the exFAT remount operation +failed. The reason for the failure was that the process's umask +is different between mount and remount, causing fs_fmask and +fs_dmask are changed. + +Potentially, both gid and uid may also be changed. Therefore, when +initializing fs_context for remount, inherit these mount options +from the options used during mount. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-lkp/202511251637.81670f5c-lkp@intel.com +Signed-off-by: Yuezhang Mo +Signed-off-by: Namjae Jeon +Signed-off-by: Sasha Levin +--- + fs/exfat/super.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/fs/exfat/super.c b/fs/exfat/super.c +index dfe298bc3782..b8ddb6fb50e9 100644 +--- a/fs/exfat/super.c ++++ b/fs/exfat/super.c +@@ -757,10 +757,21 @@ static int exfat_init_fs_context(struct fs_context *fc) + ratelimit_state_init(&sbi->ratelimit, DEFAULT_RATELIMIT_INTERVAL, + DEFAULT_RATELIMIT_BURST); + +- sbi->options.fs_uid = current_uid(); +- sbi->options.fs_gid = current_gid(); +- sbi->options.fs_fmask = current->fs->umask; +- sbi->options.fs_dmask = current->fs->umask; ++ if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE && fc->root) { ++ struct super_block *sb = fc->root->d_sb; ++ struct exfat_mount_options *cur_opts = &EXFAT_SB(sb)->options; ++ ++ sbi->options.fs_uid = cur_opts->fs_uid; ++ sbi->options.fs_gid = cur_opts->fs_gid; ++ sbi->options.fs_fmask = cur_opts->fs_fmask; ++ sbi->options.fs_dmask = cur_opts->fs_dmask; ++ } else { ++ sbi->options.fs_uid = current_uid(); ++ sbi->options.fs_gid = current_gid(); ++ sbi->options.fs_fmask = current->fs->umask; ++ sbi->options.fs_dmask = current->fs->umask; ++ } ++ + sbi->options.allow_utime = -1; + sbi->options.iocharset = exfat_default_iocharset; + sbi->options.errors = EXFAT_ERRORS_RO; +-- +2.51.0 + diff --git a/queue-5.10/firmware-imx-scu-irq-init-workqueue-before-request-m.patch b/queue-5.10/firmware-imx-scu-irq-init-workqueue-before-request-m.patch new file mode 100644 index 0000000000..574bffe5a1 --- /dev/null +++ b/queue-5.10/firmware-imx-scu-irq-init-workqueue-before-request-m.patch @@ -0,0 +1,46 @@ +From 88478308cce6de653256ea26dd15a0fc7ef506d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Oct 2025 09:56:26 +0800 +Subject: firmware: imx: scu-irq: Init workqueue before request mbox channel + +From: Peng Fan + +[ Upstream commit 81fb53feb66a3aefbf6fcab73bb8d06f5b0c54ad ] + +With mailbox channel requested, there is possibility that interrupts may +come in, so need to make sure the workqueue is initialized before +the queue is scheduled by mailbox rx callback. + +Reviewed-by: Frank Li +Signed-off-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/firmware/imx/imx-scu-irq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/imx/imx-scu-irq.c b/drivers/firmware/imx/imx-scu-irq.c +index 32b1ca4e1050..06c49a61a079 100644 +--- a/drivers/firmware/imx/imx-scu-irq.c ++++ b/drivers/firmware/imx/imx-scu-irq.c +@@ -148,6 +148,8 @@ int imx_scu_enable_general_irq_channel(struct device *dev) + cl->dev = dev; + cl->rx_callback = imx_scu_irq_callback; + ++ INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler); ++ + /* SCU general IRQ uses general interrupt channel 3 */ + ch = mbox_request_channel_byname(cl, "gip3"); + if (IS_ERR(ch)) { +@@ -157,8 +159,6 @@ int imx_scu_enable_general_irq_channel(struct device *dev) + return ret; + } + +- INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler); +- + if (!of_parse_phandle_with_args(dev->of_node, "mboxes", + "#mbox-cells", 0, &spec)) { + i = of_alias_get_id(spec.np, "mu"); +-- +2.51.0 + diff --git a/queue-5.10/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch b/queue-5.10/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch new file mode 100644 index 0000000000..8df0a7d025 --- /dev/null +++ b/queue-5.10/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch @@ -0,0 +1,85 @@ +From a0c04cf2b222d45b6906c6eae4ce0d2ea95a841f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:42:38 +0800 +Subject: ipmi: Fix __scan_channels() failing to rescan channels + +From: Jinhui Guo + +[ Upstream commit 6bd30d8fc523fb880b4be548e8501bc0fe8f42d4 ] + +channel_handler() sets intf->channels_ready to true but never +clears it, so __scan_channels() skips any rescan. When the BMC +firmware changes a rescan is required. Allow it by clearing +the flag before starting a new scan. + +Signed-off-by: Jinhui Guo +Message-ID: <20250930074239.2353-3-guojinhui.liam@bytedance.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_msghandler.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 117454a5603b..a72cd57dd8a5 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -605,7 +605,8 @@ static void __ipmi_bmc_unregister(struct ipmi_smi *intf); + static int __ipmi_bmc_register(struct ipmi_smi *intf, + struct ipmi_device_id *id, + bool guid_set, guid_t *guid, int intf_num); +-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id); ++static int __scan_channels(struct ipmi_smi *intf, ++ struct ipmi_device_id *id, bool rescan); + + + /** +@@ -2556,7 +2557,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, + if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num)) + need_waiter(intf); /* Retry later on an error. */ + else +- __scan_channels(intf, &id); ++ __scan_channels(intf, &id, false); + + + if (!intf_set) { +@@ -2576,7 +2577,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, + goto out_noprocessing; + } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id))) + /* Version info changes, scan the channels again. */ +- __scan_channels(intf, &bmc->fetch_id); ++ __scan_channels(intf, &bmc->fetch_id, true); + + bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; + +@@ -3326,10 +3327,17 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) + /* + * Must be holding intf->bmc_reg_mutex to call this. + */ +-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id) ++static int __scan_channels(struct ipmi_smi *intf, ++ struct ipmi_device_id *id, ++ bool rescan) + { + int rv; + ++ if (rescan) { ++ /* Clear channels_ready to force channels rescan. */ ++ intf->channels_ready = false; ++ } ++ + if (ipmi_version_major(id) > 1 + || (ipmi_version_major(id) == 1 + && ipmi_version_minor(id) >= 5)) { +@@ -3501,7 +3509,7 @@ int ipmi_add_smi(struct module *owner, + } + + mutex_lock(&intf->bmc_reg_mutex); +- rv = __scan_channels(intf, &id); ++ rv = __scan_channels(intf, &id, false); + mutex_unlock(&intf->bmc_reg_mutex); + if (rv) + goto out_err_bmc_reg; +-- +2.51.0 + diff --git a/queue-5.10/ipmi-fix-the-race-between-__scan_channels-and-delive.patch b/queue-5.10/ipmi-fix-the-race-between-__scan_channels-and-delive.patch new file mode 100644 index 0000000000..d237332b3f --- /dev/null +++ b/queue-5.10/ipmi-fix-the-race-between-__scan_channels-and-delive.patch @@ -0,0 +1,90 @@ +From 19706b832e48b7bfb8f38a62535e98b87ae41b3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:42:37 +0800 +Subject: ipmi: Fix the race between __scan_channels() and deliver_response() + +From: Jinhui Guo + +[ Upstream commit 936750fdba4c45e13bbd17f261bb140dd55f5e93 ] + +The race window between __scan_channels() and deliver_response() causes +the parameters of some channels to be set to 0. + +1.[CPUA] __scan_channels() issues an IPMI request and waits with + wait_event() until all channels have been scanned. + wait_event() internally calls might_sleep(), which might + yield the CPU. (Moreover, an interrupt can preempt + wait_event() and force the task to yield the CPU.) +2.[CPUB] deliver_response() is invoked when the CPU receives the + IPMI response. After processing a IPMI response, + deliver_response() directly assigns intf->wchannels to + intf->channel_list and sets intf->channels_ready to true. + However, not all channels are actually ready for use. +3.[CPUA] Since intf->channels_ready is already true, wait_event() + never enters __wait_event(). __scan_channels() immediately + clears intf->null_user_handler and exits. +4.[CPUB] Once intf->null_user_handler is set to NULL, deliver_response() + ignores further IPMI responses, leaving the remaining + channels zero-initialized and unusable. + +CPUA CPUB +------------------------------- ----------------------------- +__scan_channels() + intf->null_user_handler + = channel_handler; + send_channel_info_cmd(intf, + 0); + wait_event(intf->waitq, + intf->channels_ready); + do { + might_sleep(); + deliver_response() + channel_handler() + intf->channel_list = + intf->wchannels + set; + intf->channels_ready = true; + send_channel_info_cmd(intf, + intf->curr_channel); + if (condition) + break; + __wait_event(wq_head, + condition); + } while(0) + intf->null_user_handler + = NULL; + deliver_response() + if (!msg->user) + if (intf->null_user_handler) + rv = -EINVAL; + return rv; +------------------------------- ----------------------------- + +Fix the race between __scan_channels() and deliver_response() by +deferring both the assignment intf->channel_list = intf->wchannels +and the flag intf->channels_ready = true until all channels have +been successfully scanned or until the IPMI request has failed. + +Signed-off-by: Jinhui Guo +Message-ID: <20250930074239.2353-2-guojinhui.liam@bytedance.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_msghandler.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 5b01985aed22..117454a5603b 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -3305,8 +3305,6 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) + intf->channels_ready = true; + wake_up(&intf->waitq); + } else { +- intf->channel_list = intf->wchannels + set; +- intf->channels_ready = true; + rv = send_channel_info_cmd(intf, intf->curr_channel); + } + +-- +2.51.0 + diff --git a/queue-5.10/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch b/queue-5.10/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch new file mode 100644 index 0000000000..1190264aec --- /dev/null +++ b/queue-5.10/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch @@ -0,0 +1,64 @@ +From 40eba4dd31015a3a3abc79271ef29158706b5f94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 11:05:45 +0100 +Subject: nvme-fc: don't hold rport lock when putting ctrl + +From: Daniel Wagner + +[ Upstream commit b71cbcf7d170e51148d5467820ae8a72febcb651 ] + +nvme_fc_ctrl_put can acquire the rport lock when freeing the +ctrl object: + +nvme_fc_ctrl_put + nvme_fc_ctrl_free + spin_lock_irqsave(rport->lock) + +Thus we can't hold the rport lock when calling nvme_fc_ctrl_put. + +Justin suggested use the safe list iterator variant because +nvme_fc_ctrl_put will also modify the rport->list. + +Cc: Justin Tee +Reviewed-by: Christoph Hellwig +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index e37e7207c60c..dbc9173ec0f8 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -1500,14 +1500,14 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport, + { + struct fcnvme_ls_disconnect_assoc_rqst *rqst = + &lsop->rqstbuf->rq_dis_assoc; +- struct nvme_fc_ctrl *ctrl, *ret = NULL; ++ struct nvme_fc_ctrl *ctrl, *tmp, *ret = NULL; + struct nvmefc_ls_rcv_op *oldls = NULL; + u64 association_id = be64_to_cpu(rqst->associd.association_id); + unsigned long flags; + + spin_lock_irqsave(&rport->lock, flags); + +- list_for_each_entry(ctrl, &rport->ctrl_list, ctrl_list) { ++ list_for_each_entry_safe(ctrl, tmp, &rport->ctrl_list, ctrl_list) { + if (!nvme_fc_ctrl_get(ctrl)) + continue; + spin_lock(&ctrl->lock); +@@ -1520,7 +1520,9 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport, + if (ret) + /* leave the ctrl get reference */ + break; ++ spin_unlock_irqrestore(&rport->lock, flags); + nvme_fc_ctrl_put(ctrl); ++ spin_lock_irqsave(&rport->lock, flags); + } + + spin_unlock_irqrestore(&rport->lock, flags); +-- +2.51.0 + diff --git a/queue-5.10/powerpc-addnote-fix-overflow-on-32-bit-builds.patch b/queue-5.10/powerpc-addnote-fix-overflow-on-32-bit-builds.patch new file mode 100644 index 0000000000..d16951aa00 --- /dev/null +++ b/queue-5.10/powerpc-addnote-fix-overflow-on-32-bit-builds.patch @@ -0,0 +1,50 @@ +From 680b3383ad9d5c3b1eece4e0b2f59dfb1db0665a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 22:31:13 -0400 +Subject: powerpc/addnote: Fix overflow on 32-bit builds + +From: Ben Collins + +[ Upstream commit 825ce89a3ef17f84cf2c0eacfa6b8dc9fd11d13f ] + +The PUT_64[LB]E() macros need to cast the value to unsigned long long +like the GET_64[LB]E() macros. Caused lots of warnings when compiled +on 32-bit, and clobbered addresses (36-bit P4080). + +Signed-off-by: Ben Collins +Reviewed-by: Christophe Leroy +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/2025042122-mustard-wrasse-694572@boujee-and-buff +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/addnote.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/boot/addnote.c b/arch/powerpc/boot/addnote.c +index 53b3b2621457..78704927453a 100644 +--- a/arch/powerpc/boot/addnote.c ++++ b/arch/powerpc/boot/addnote.c +@@ -68,8 +68,8 @@ static int e_class = ELFCLASS32; + #define PUT_16BE(off, v)(buf[off] = ((v) >> 8) & 0xff, \ + buf[(off) + 1] = (v) & 0xff) + #define PUT_32BE(off, v)(PUT_16BE((off), (v) >> 16L), PUT_16BE((off) + 2, (v))) +-#define PUT_64BE(off, v)((PUT_32BE((off), (v) >> 32L), \ +- PUT_32BE((off) + 4, (v)))) ++#define PUT_64BE(off, v)((PUT_32BE((off), (unsigned long long)(v) >> 32L), \ ++ PUT_32BE((off) + 4, (unsigned long long)(v)))) + + #define GET_16LE(off) ((buf[off]) + (buf[(off)+1] << 8)) + #define GET_32LE(off) (GET_16LE(off) + (GET_16LE((off)+2U) << 16U)) +@@ -78,7 +78,8 @@ static int e_class = ELFCLASS32; + #define PUT_16LE(off, v) (buf[off] = (v) & 0xff, \ + buf[(off) + 1] = ((v) >> 8) & 0xff) + #define PUT_32LE(off, v) (PUT_16LE((off), (v)), PUT_16LE((off) + 2, (v) >> 16L)) +-#define PUT_64LE(off, v) (PUT_32LE((off), (v)), PUT_32LE((off) + 4, (v) >> 32L)) ++#define PUT_64LE(off, v) (PUT_32LE((off), (unsigned long long)(v)), \ ++ PUT_32LE((off) + 4, (unsigned long long)(v) >> 32L)) + + #define GET_16(off) (e_data == ELFDATA2MSB ? GET_16BE(off) : GET_16LE(off)) + #define GET_32(off) (e_data == ELFDATA2MSB ? GET_32BE(off) : GET_32LE(off)) +-- +2.51.0 + diff --git a/queue-5.10/reset-fix-bit-macro-reference.patch b/queue-5.10/reset-fix-bit-macro-reference.patch new file mode 100644 index 0000000000..e5ecdea2d1 --- /dev/null +++ b/queue-5.10/reset-fix-bit-macro-reference.patch @@ -0,0 +1,40 @@ +From 3a6ea1951fb1117950678a61c103c8867281c31f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 14:10:37 +0800 +Subject: reset: fix BIT macro reference + +From: Encrow Thorne + +[ Upstream commit f3d8b64ee46c9b4b0b82b1a4642027728bac95b8 ] + +RESET_CONTROL_FLAGS_BIT_* macros use BIT(), but reset.h does not +include bits.h. This causes compilation errors when including +reset.h standalone. + +Include bits.h to make reset.h self-contained. + +Suggested-by: Troy Mitchell +Reviewed-by: Troy Mitchell +Reviewed-by: Philipp Zabel +Signed-off-by: Encrow Thorne +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + include/linux/reset.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/reset.h b/include/linux/reset.h +index 05aa9f440f48..f27026f52104 100644 +--- a/include/linux/reset.h ++++ b/include/linux/reset.h +@@ -2,6 +2,7 @@ + #ifndef _LINUX_RESET_H_ + #define _LINUX_RESET_H_ + ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-5.10/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch b/queue-5.10/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch new file mode 100644 index 0000000000..ff3cf4216d --- /dev/null +++ b/queue-5.10/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch @@ -0,0 +1,45 @@ +From c6c25dd608e362022f14b682a6c4bbe5b8e9c726 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:48:45 -0500 +Subject: scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive + +From: Tony Battersby + +[ Upstream commit 8f58fc64d559b5fda1b0a5e2a71422be61e79ab9 ] + +When given the module parameter qlini_mode=exclusive, qla2xxx in +initiator mode is initially unable to successfully send SCSI commands to +devices it finds while scanning, resulting in an escalating series of +resets until an adapter reset clears the issue. Fix by checking the +active mode instead of the module parameter. + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/1715ec14-ba9a-45dc-9cf2-d41aa6b81b5e@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_os.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index a6ecb4bb7456..f35a53cc00dd 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3288,13 +3288,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + base_vha->mgmt_svr_loop_id, host->sg_tablesize); + + if (ha->mqenable) { +- bool startit = false; +- +- if (QLA_TGT_MODE_ENABLED()) +- startit = false; +- +- if (ql2x_ini_mode == QLA2XXX_INI_MODE_ENABLED) +- startit = true; ++ bool startit = !!(host->active_mode & MODE_INITIATOR); + + /* Create start of day qpairs for Block MQ */ + for (i = 0; i < ha->max_qpairs; i++) +-- +2.51.0 + diff --git a/queue-5.10/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch b/queue-5.10/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch new file mode 100644 index 0000000000..906c9d42e2 --- /dev/null +++ b/queue-5.10/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch @@ -0,0 +1,45 @@ +From a95664ce94cfae3fd6f2d645bfe2926da98efbbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:51:28 -0500 +Subject: scsi: qla2xxx: Use reinit_completion on mbx_intr_comp + +From: Tony Battersby + +[ Upstream commit 957aa5974989fba4ae4f807ebcb27f12796edd4d ] + +If a mailbox command completes immediately after +wait_for_completion_timeout() times out, ha->mbx_intr_comp could be left +in an inconsistent state, causing the next mailbox command not to wait +for the hardware. Fix by reinitializing the completion before use. + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/11b6485e-0bfd-4784-8f99-c06a196dad94@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_mbx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 8b7c71e779a7..aa6a68e235c9 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -249,6 +249,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + /* Issue set host interrupt command to send cmd out. */ + ha->flags.mbox_int = 0; + clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags); ++ reinit_completion(&ha->mbx_intr_comp); + + /* Unlock mbx registers and wait for interrupt */ + ql_dbg(ql_dbg_mbx, vha, 0x100f, +@@ -275,6 +276,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + "cmd=%x Timeout.\n", command); + spin_lock_irqsave(&ha->hardware_lock, flags); + clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags); ++ reinit_completion(&ha->mbx_intr_comp); + spin_unlock_irqrestore(&ha->hardware_lock, flags); + + if (chip_reset != ha->chip_reset) { +-- +2.51.0 + diff --git a/queue-5.10/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch b/queue-5.10/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch new file mode 100644 index 0000000000..28411f5618 --- /dev/null +++ b/queue-5.10/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch @@ -0,0 +1,63 @@ +From 415d4443af0ceb8dda536d07e55bf9db71f5d308 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Oct 2025 11:08:40 +0800 +Subject: serial: sprd: Return -EPROBE_DEFER when uart clock is not ready + +From: Wenhua Lin + +[ Upstream commit 29e8a0c587e328ed458380a45d6028adf64d7487 ] + +In sprd_clk_init(), when devm_clk_get() returns -EPROBE_DEFER +for either uart or source clock, we should propagate the +error instead of just warning and continuing with NULL clocks. + +Currently the driver only emits a warning when clock acquisition +fails and proceeds with NULL clock pointers. This can lead to +issues later when the clocks are actually needed. More importantly, +when the clock provider is not ready yet and returns -EPROBE_DEFER, +we should return this error to allow deferred probing. + +This change adds explicit checks for -EPROBE_DEFER after both: +1. devm_clk_get(uport->dev, uart) +2. devm_clk_get(uport->dev, source) + +When -EPROBE_DEFER is encountered, the function now returns +-EPROBE_DEFER to let the driver framework retry probing +later when the clock dependencies are resolved. + +Signed-off-by: Wenhua Lin +Link: https://patch.msgid.link/20251022030840.956589-1-Wenhua.Lin@unisoc.com +Reviewed-by: Cixi Geng +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sprd_serial.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index a1952e4f1fcb..e850959ecf55 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -1137,6 +1137,9 @@ static int sprd_clk_init(struct uart_port *uport) + + clk_uart = devm_clk_get(uport->dev, "uart"); + if (IS_ERR(clk_uart)) { ++ if (PTR_ERR(clk_uart) == -EPROBE_DEFER) ++ return -EPROBE_DEFER; ++ + dev_warn(uport->dev, "uart%d can't get uart clock\n", + uport->line); + clk_uart = NULL; +@@ -1144,6 +1147,9 @@ static int sprd_clk_init(struct uart_port *uport) + + clk_parent = devm_clk_get(uport->dev, "source"); + if (IS_ERR(clk_parent)) { ++ if (PTR_ERR(clk_parent) == -EPROBE_DEFER) ++ return -EPROBE_DEFER; ++ + dev_warn(uport->dev, "uart%d can't get source clock\n", + uport->line); + clk_parent = NULL; +-- +2.51.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 90187caea9..4de544672a 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -197,3 +197,23 @@ input-i8042-add-tuxedo-infinitybook-max-gen10-amd-to-i8042-quirk-table.patch acpi-cppc-fix-missing-pcc-check-for-guaranteed_perf.patch spi-fsl-cpm-check-length-parity-before-switching-to-16-bit-mode.patch net-hsr-fix-null-pointer-dereference-in-prp_get_untagged_frame.patch +alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch +alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch +alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch +ipmi-fix-the-race-between-__scan_channels-and-delive.patch +ipmi-fix-__scan_channels-failing-to-rescan-channels.patch +firmware-imx-scu-irq-init-workqueue-before-request-m.patch +ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch +clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch +powerpc-addnote-fix-overflow-on-32-bit-builds.patch +scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch +scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch +via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch +reset-fix-bit-macro-reference.patch +exfat-fix-remount-failure-in-different-process-envir.patch +usbip-fix-locking-bug-in-rt-enabled-kernels.patch +usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch +usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch +usb-usb-storage-no-additional-quirks-need-to-be-adde.patch +serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch +nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch diff --git a/queue-5.10/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch b/queue-5.10/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch new file mode 100644 index 0000000000..ad1ce7ae77 --- /dev/null +++ b/queue-5.10/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch @@ -0,0 +1,64 @@ +From 4a994b36bd94a2dc12c010a95a552a6892c79d94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 15:11:13 +0200 +Subject: ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx + +From: Matthias Schiffer + +[ Upstream commit 3f61783920504b2cf99330b372d82914bb004d8e ] + +am33xx.dtsi has the same clock setup as am35xx.dtsi, setting +ti,no-reset-on-init and ti,no-idle on timer1_target and timer2_target, +so AM33 needs the same workaround as AM35 to avoid ti-sysc probe +failing on certain target modules. + +Signed-off-by: Matthias Schiffer +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20250825131114.2206804-1-alexander.stein@ew.tq-group.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index ed38c25fb0c5..fe5b0997aee6 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -37,6 +37,7 @@ enum sysc_soc { + SOC_UNKNOWN, + SOC_2420, + SOC_2430, ++ SOC_AM33, + SOC_3430, + SOC_AM35, + SOC_3630, +@@ -2933,6 +2934,7 @@ static void ti_sysc_idle(struct work_struct *work) + static const struct soc_device_attribute sysc_soc_match[] = { + SOC_FLAG("OMAP242*", SOC_2420), + SOC_FLAG("OMAP243*", SOC_2430), ++ SOC_FLAG("AM33*", SOC_AM33), + SOC_FLAG("AM35*", SOC_AM35), + SOC_FLAG("OMAP3[45]*", SOC_3430), + SOC_FLAG("OMAP3[67]*", SOC_3630), +@@ -3121,10 +3123,15 @@ static int sysc_check_active_timer(struct sysc *ddata) + * can be dropped if we stop supporting old beagleboard revisions + * A to B4 at some point. + */ +- if (sysc_soc->soc == SOC_3430 || sysc_soc->soc == SOC_AM35) ++ switch (sysc_soc->soc) { ++ case SOC_AM33: ++ case SOC_3430: ++ case SOC_AM35: + error = -ENXIO; +- else ++ break; ++ default: + error = -EBUSY; ++ } + + if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) && + (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE)) +-- +2.51.0 + diff --git a/queue-5.10/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch b/queue-5.10/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch new file mode 100644 index 0000000000..f3bd468f65 --- /dev/null +++ b/queue-5.10/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch @@ -0,0 +1,49 @@ +From 82054a1f984ced0dd3740ea2704d2be755f5d517 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 14:53:07 -0400 +Subject: usb: typec: ucsi: Handle incorrect num_connectors capability + +From: Mark Pearson + +[ Upstream commit 30cd2cb1abf4c4acdb1ddb468c946f68939819fb ] + +The UCSI spec states that the num_connectors field is 7 bits, and the +8th bit is reserved and should be set to zero. +Some buggy FW has been known to set this bit, and it can lead to a +system not booting. +Flag that the FW is not behaving correctly, and auto-fix the value +so that the system boots correctly. + +Found on Lenovo P1 G8 during Linux enablement program. The FW will +be fixed, but seemed worth addressing in case it hit platforms that +aren't officially Linux supported. + +Signed-off-by: Mark Pearson +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250821185319.2585023-1-mpearson-lenovo@squebb.ca +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index 0851d93d5909..60339c746694 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1220,6 +1220,12 @@ static int ucsi_init(struct ucsi *ucsi) + ret = -ENODEV; + goto err_reset; + } ++ /* Check if reserved bit set. This is out of spec but happens in buggy FW */ ++ if (ucsi->cap.num_connectors & 0x80) { ++ dev_warn(ucsi->dev, "UCSI: Invalid num_connectors %d. Likely buggy FW\n", ++ ucsi->cap.num_connectors); ++ ucsi->cap.num_connectors &= 0x7f; // clear bit and carry on ++ } + + /* Allocate the connectors. Released in ucsi_unregister_ppm() */ + ucsi->connector = kcalloc(ucsi->cap.num_connectors + 1, +-- +2.51.0 + diff --git a/queue-5.10/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch b/queue-5.10/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch new file mode 100644 index 0000000000..b685ef5bb8 --- /dev/null +++ b/queue-5.10/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch @@ -0,0 +1,65 @@ +From f90df9ff69364766e12bc3b5f14a84c27f626929 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 14:40:20 +0800 +Subject: usb: usb-storage: No additional quirks need to be added to the EL-R12 + optical drive. + +From: Chen Changcheng + +[ Upstream commit 955a48a5353f4fe009704a9a4272a3adf627cd35 ] + +The optical drive of EL-R12 has the same vid and pid as INIC-3069, +as follows: +T: Bus=02 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0 +D: Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=13fd ProdID=3940 Rev= 3.10 +S: Manufacturer=HL-DT-ST +S: Product= DVD+-RW GT80N +S: SerialNumber=423349524E4E38303338323439202020 +C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=144mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=02 Prot=50 Driver=usb-storage +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=0a(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +This will result in the optical drive device also adding +the quirks of US_FL_NO_ATA_1X. When performing an erase operation, +it will fail, and the reason for the failure is as follows: +[ 388.967742] sr 5:0:0:0: [sr0] tag#0 Send: scmd 0x00000000d20c33a7 +[ 388.967742] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00 +[ 388.967773] sr 5:0:0:0: [sr0] tag#0 Done: SUCCESS Result: hostbyte=DID_TARGET_FAILURE driverbyte=DRIVER_OK cmd_age=0s +[ 388.967773] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00 +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Sense Key : Illegal Request [current] +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Add. Sense: Invalid field in cdb +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 scsi host busy 1 failed 0 +[ 388.967803] sr 5:0:0:0: Notifying upper driver of completion (result 8100002) +[ 388.967834] sr 5:0:0:0: [sr0] tag#0 0 sectors total, 0 bytes done. + +For the EL-R12 standard optical drive, all operational commands +and usage scenarios were tested without adding the IGNORE_RESIDUE quirks, +and no issues were encountered. It can be reasonably concluded +that removing the IGNORE_RESIDUE quirks has no impact. + +Signed-off-by: Chen Changcheng +Link: https://patch.msgid.link/20251121064020.29332-1-chenchangcheng@kylinos.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/storage/unusual_uas.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index 1477e31d7763..b695f5ba9a40 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -98,7 +98,7 @@ UNUSUAL_DEV(0x125f, 0xa94a, 0x0160, 0x0160, + US_FL_NO_ATA_1X), + + /* Reported-by: Benjamin Tissoires */ +-UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, ++UNUSUAL_DEV(0x13fd, 0x3940, 0x0309, 0x0309, + "Initio Corporation", + "INIC-3069", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, +-- +2.51.0 + diff --git a/queue-5.10/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch b/queue-5.10/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch new file mode 100644 index 0000000000..b532f91942 --- /dev/null +++ b/queue-5.10/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch @@ -0,0 +1,82 @@ +From bcdfe2d480eba9c76f1943c93f9d0c8784bfd121 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 16:23:55 +0200 +Subject: usb: xhci: limit run_graceperiod for only usb 3.0 devices + +From: Hongyu Xie + +[ Upstream commit 8d34983720155b8f05de765f0183d9b0e1345cc0 ] + +run_graceperiod blocks usb 2.0 devices from auto suspending after +xhci_start for 500ms. + +Log shows: +[ 13.387170] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.387177] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.387182] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.387188] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.387191] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.387193] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.387296] hub_event:5779: hub 3-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.393343] handle_port_status:2034: xhci-hcd PNP0D10:02: handle_port_status: starting usb5 port polling. +[ 13.393353] xhci_hub_control:1271: xhci-hcd PNP0D10:02: Get port status 5-1 read: 0x206e1, return 0x10101 +[ 13.400047] hub_suspend:3903: hub 3-0:1.0: hub_suspend +[ 13.403077] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.403080] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.403085] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.403087] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.403090] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.403093] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.403095] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.405002] handle_port_status:1913: xhci-hcd PNP0D10:04: Port change event, 9-1, id 1, portsc: 0x6e1 +[ 13.405016] hub_activate:1169: usb usb5-port1: status 0101 change 0001 +[ 13.405026] xhci_clear_port_change_bit:658: xhci-hcd PNP0D10:02: clear port1 connect change, portsc: 0x6e1 +[ 13.413275] hcd_bus_suspend:2250: usb usb3: bus auto-suspend, wakeup 1 +[ 13.419081] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.419086] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.419095] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.419100] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.419106] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.419110] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.419112] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.420455] handle_port_status:2034: xhci-hcd PNP0D10:04: handle_port_status: starting usb9 port polling. +[ 13.420493] handle_port_status:1913: xhci-hcd PNP0D10:05: Port change event, 10-1, id 1, portsc: 0x6e1 +[ 13.425332] hcd_bus_suspend:2279: usb usb3: suspend raced with wakeup event +[ 13.431931] handle_port_status:2034: xhci-hcd PNP0D10:05: handle_port_status: starting usb10 port polling. +[ 13.435080] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.435084] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.435092] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.435096] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.435102] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.435106] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event + +usb7 and other usb 2.0 root hub were rapidly toggling between suspend +and resume states. More, "suspend raced with wakeup event" confuses people. + +So, limit run_graceperiod for only usb 3.0 devices + +Signed-off-by: Hongyu Xie +Signed-off-by: Mathias Nyman +Link: https://patch.msgid.link/20251119142417.2820519-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-hub.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 05f119e7178c..a7a7f0a8488a 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1564,7 +1564,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf) + * SS devices are only visible to roothub after link training completes. + * Keep polling roothubs for a grace period after xHC start + */ +- if (xhci->run_graceperiod) { ++ if (hcd->speed >= HCD_USB3 && xhci->run_graceperiod) { + if (time_before(jiffies, xhci->run_graceperiod)) + status = 1; + else +-- +2.51.0 + diff --git a/queue-5.10/usbip-fix-locking-bug-in-rt-enabled-kernels.patch b/queue-5.10/usbip-fix-locking-bug-in-rt-enabled-kernels.patch new file mode 100644 index 0000000000..73d0556186 --- /dev/null +++ b/queue-5.10/usbip-fix-locking-bug-in-rt-enabled-kernels.patch @@ -0,0 +1,64 @@ +From ef092ccc1b1ad196c4a78a5cb0e2dd04be5284cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 09:41:43 +0800 +Subject: usbip: Fix locking bug in RT-enabled kernels + +From: Lizhi Xu + +[ Upstream commit 09bf21bf5249880f62fe759b53b14b4b52900c6c ] + +Interrupts are disabled before entering usb_hcd_giveback_urb(). +A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be +acquired with disabled interrupts. + +Save the interrupt status and restore it after usb_hcd_giveback_urb(). + +syz reported: +BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 +Call Trace: + dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 + rt_spin_lock+0xc7/0x2c0 kernel/locking/spinlock_rt.c:57 + spin_lock include/linux/spinlock_rt.h:44 [inline] + mon_bus_complete drivers/usb/mon/mon_main.c:134 [inline] + mon_complete+0x5c/0x200 drivers/usb/mon/mon_main.c:147 + usbmon_urb_complete include/linux/usb/hcd.h:738 [inline] + __usb_hcd_giveback_urb+0x254/0x5e0 drivers/usb/core/hcd.c:1647 + vhci_urb_enqueue+0xb4f/0xe70 drivers/usb/usbip/vhci_hcd.c:818 + +Reported-by: syzbot+205ef33a3b636b4181fb@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=205ef33a3b636b4181fb +Signed-off-by: Lizhi Xu +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20250916014143.1439759-1-lizhi.xu@windriver.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vhci_hcd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index 2d2506c59881..e5660f0e97e8 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -830,15 +830,15 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + no_need_xmit: + usb_hcd_unlink_urb_from_ep(hcd, urb); + no_need_unlink: +- spin_unlock_irqrestore(&vhci->lock, flags); + if (!ret) { + /* usb_hcd_giveback_urb() should be called with + * irqs disabled + */ +- local_irq_disable(); ++ spin_unlock(&vhci->lock); + usb_hcd_giveback_urb(hcd, urb, urb->status); +- local_irq_enable(); ++ spin_lock(&vhci->lock); + } ++ spin_unlock_irqrestore(&vhci->lock, flags); + return ret; + } + +-- +2.51.0 + diff --git a/queue-5.10/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch b/queue-5.10/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch new file mode 100644 index 0000000000..2b1d7abd3b --- /dev/null +++ b/queue-5.10/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch @@ -0,0 +1,43 @@ +From f6ad7a17de26f2d3118ecea739b2bf758c7799d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Sep 2025 16:33:32 +0800 +Subject: via_wdt: fix critical boot hang due to unnamed resource allocation + +From: Li Qiang + +[ Upstream commit 7aa31ee9ec92915926e74731378c009c9cc04928 ] + +The VIA watchdog driver uses allocate_resource() to reserve a MMIO +region for the watchdog control register. However, the allocated +resource was not given a name, which causes the kernel resource tree +to contain an entry marked as "" under /proc/iomem on x86 +platforms. + +During boot, this unnamed resource can lead to a critical hang because +subsequent resource lookups and conflict checks fail to handle the +invalid entry properly. + +Signed-off-by: Li Qiang +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/via_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/via_wdt.c b/drivers/watchdog/via_wdt.c +index eeb39f96e72e..c1ed3ce153cf 100644 +--- a/drivers/watchdog/via_wdt.c ++++ b/drivers/watchdog/via_wdt.c +@@ -165,6 +165,7 @@ static int wdt_probe(struct pci_dev *pdev, + dev_err(&pdev->dev, "cannot enable PCI device\n"); + return -ENODEV; + } ++ wdt_res.name = "via_wdt"; + + /* + * Allocate a MMIO region which contains watchdog control register +-- +2.51.0 + diff --git a/queue-5.15/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch b/queue-5.15/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch new file mode 100644 index 0000000000..d3fd246aa4 --- /dev/null +++ b/queue-5.15/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch @@ -0,0 +1,48 @@ +From 4a8fb9ade8bb27554de443ade56954204aae04b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 17:04:33 +0800 +Subject: ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path + +From: Haotian Zhang + +[ Upstream commit 5032347c04ba7ff9ba878f262e075d745c06a2a8 ] + +When pdacf_config() fails, snd_pdacf_probe() returns the error code +directly without freeing the sound card resources allocated by +snd_card_new(), which leads to a memory leak. + +Add proper error handling to free the sound card and clear the card +list entry when pdacf_config() fails. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Suggested-by: Takashi Iwai +Signed-off-by: Haotian Zhang +Link: https://patch.msgid.link/20251215090433.211-1-vulab@iscas.ac.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c +index 8363ec08df5d..4468d81683ec 100644 +--- a/sound/pcmcia/pdaudiocf/pdaudiocf.c ++++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c +@@ -132,7 +132,13 @@ static int snd_pdacf_probe(struct pcmcia_device *link) + link->config_index = 1; + link->config_regs = PRESENT_OPTION; + +- return pdacf_config(link); ++ err = pdacf_config(link); ++ if (err < 0) { ++ card_list[i] = NULL; ++ snd_card_free(card); ++ return err; ++ } ++ return 0; + } + + +-- +2.51.0 + diff --git a/queue-5.15/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch b/queue-5.15/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch new file mode 100644 index 0000000000..93d82f0c99 --- /dev/null +++ b/queue-5.15/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch @@ -0,0 +1,74 @@ +From 9b715285ab55f12317e6cfac6897c752f2cc0a6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 10:46:30 +0800 +Subject: ALSA: usb-mixer: us16x08: validate meter packet indices + +From: Shipei Qu + +[ Upstream commit 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e ] + +get_meter_levels_from_urb() parses the 64-byte meter packets sent by +the device and fills the per-channel arrays meter_level[], +comp_level[] and master_level[] in struct snd_us16x08_meter_store. + +Currently the function derives the channel index directly from the +meter packet (MUB2(meter_urb, s) - 1) and uses it to index those +arrays without validating the range. If the packet contains a +negative or out-of-range channel number, the driver may write past +the end of these arrays. + +Introduce a local channel variable and validate it before updating the +arrays. We reject negative indices, limit meter_level[] and +comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[] +updates with ARRAY_SIZE(master_level). + +Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk") +Reported-by: DARKNAVY (@DarkNavyOrg) +Closes: https://lore.kernel.org/tencent_21C112743C44C1A2517FF219@qq.com +Signed-off-by: Shipei Qu +Link: https://patch.msgid.link/20251217024630.59576-1-qu@darknavy.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_us16x08.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c +index 2f6fa722442f..c13bc858e282 100644 +--- a/sound/usb/mixer_us16x08.c ++++ b/sound/usb/mixer_us16x08.c +@@ -656,17 +656,25 @@ static void get_meter_levels_from_urb(int s, + u8 *meter_urb) + { + int val = MUC2(meter_urb, s) + (MUC3(meter_urb, s) << 8); ++ int ch = MUB2(meter_urb, s) - 1; ++ ++ if (ch < 0) ++ return; + + if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 && + MUA2(meter_urb, s) == 0x04 && MUB0(meter_urb, s) == 0x62) { +- if (MUC0(meter_urb, s) == 0x72) +- store->meter_level[MUB2(meter_urb, s) - 1] = val; +- if (MUC0(meter_urb, s) == 0xb2) +- store->comp_level[MUB2(meter_urb, s) - 1] = val; ++ if (ch < SND_US16X08_MAX_CHANNELS) { ++ if (MUC0(meter_urb, s) == 0x72) ++ store->meter_level[ch] = val; ++ if (MUC0(meter_urb, s) == 0xb2) ++ store->comp_level[ch] = val; ++ } + } + if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 && +- MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) +- store->master_level[MUB2(meter_urb, s) - 1] = val; ++ MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) { ++ if (ch < ARRAY_SIZE(store->master_level)) ++ store->master_level[ch] = val; ++ } + } + + /* Function to retrieve current meter values from the device. +-- +2.51.0 + diff --git a/queue-5.15/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch b/queue-5.15/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch new file mode 100644 index 0000000000..fa17fc8ced --- /dev/null +++ b/queue-5.15/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch @@ -0,0 +1,47 @@ +From 272fb07533788c9403e8ddf476dc61c29b02fc7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 12:26:52 +0800 +Subject: ALSA: vxpocket: Fix resource leak in vxpocket_probe error path + +From: Haotian Zhang + +[ Upstream commit 2a03b40deacbd293ac9aed0f9b11197dad54fe5f ] + +When vxpocket_config() fails, vxpocket_probe() returns the error code +directly without freeing the sound card resources allocated by +snd_card_new(), which leads to a memory leak. + +Add proper error handling to free the sound card and clear the +allocation bit when vxpocket_config() fails. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Haotian Zhang +Link: https://patch.msgid.link/20251215042652.695-1-vulab@iscas.ac.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pcmcia/vx/vxpocket.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c +index 7a0f0e73ceb2..867a477d53ae 100644 +--- a/sound/pcmcia/vx/vxpocket.c ++++ b/sound/pcmcia/vx/vxpocket.c +@@ -295,7 +295,13 @@ static int vxpocket_probe(struct pcmcia_device *p_dev) + + vxp->p_dev = p_dev; + +- return vxpocket_config(p_dev); ++ err = vxpocket_config(p_dev); ++ if (err < 0) { ++ card_alloc &= ~(1 << i); ++ snd_card_free(card); ++ return err; ++ } ++ return 0; + } + + static void vxpocket_detach(struct pcmcia_device *link) +-- +2.51.0 + diff --git a/queue-5.15/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch b/queue-5.15/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch new file mode 100644 index 0000000000..199c6d04d7 --- /dev/null +++ b/queue-5.15/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch @@ -0,0 +1,79 @@ +From 3f7eb90f0ab2d212cefc9d55c066322a83d1b401 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 16:16:26 +0100 +Subject: clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & + pcie_x4 + +From: Josua Mayer + +[ Upstream commit f0e6bc0c3ef4b4afb299bd6912586cafd5d864e9 ] + +CP110 based platforms rely on the bootloader for pci port +initialization. +TF-A actively prevents non-uboot re-configuration of pci lanes, and many +boards do not have software control over the pci card reset. + +If a pci port had link at boot-time and the clock is stopped at a later +point, the link fails and can not be recovered. + +PCI controller driver probe - and by extension ownership of a driver for +the pci clocks - may be delayed especially on large modular kernels, +causing the clock core to start disabling unused clocks. + +Add the CLK_IGNORE_UNUSED flag to the three pci port's clocks to ensure +they are not stopped before the pci controller driver has taken +ownership and tested for an existing link. + +This fixes failed pci link detection when controller driver probes late, +e.g. with arm64 defconfig and CONFIG_PHY_MVEBU_CP110_COMPHY=m. + +Closes: https://lore.kernel.org/r/b71596c7-461b-44b6-89ab-3cfbd492639f@solid-run.com +Signed-off-by: Josua Mayer +Reviewed-by: Andrew Lunn +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/cp110-system-controller.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c +index 84c8900542e4..b477396917ad 100644 +--- a/drivers/clk/mvebu/cp110-system-controller.c ++++ b/drivers/clk/mvebu/cp110-system-controller.c +@@ -110,6 +110,25 @@ static const char * const gate_base_names[] = { + [CP110_GATE_EIP197] = "eip197" + }; + ++static unsigned long gate_flags(const u8 bit_idx) ++{ ++ switch (bit_idx) { ++ case CP110_GATE_PCIE_X1_0: ++ case CP110_GATE_PCIE_X1_1: ++ case CP110_GATE_PCIE_X4: ++ /* ++ * If a port had an active link at boot time, stopping ++ * the clock creates a failed state from which controller ++ * driver can not recover. ++ * Prevent stopping this clock till after a driver has taken ++ * ownership. ++ */ ++ return CLK_IGNORE_UNUSED; ++ default: ++ return 0; ++ } ++}; ++ + struct cp110_gate_clk { + struct clk_hw hw; + struct regmap *regmap; +@@ -171,6 +190,7 @@ static struct clk_hw *cp110_register_gate(const char *name, + init.ops = &cp110_gate_ops; + init.parent_names = &parent_name; + init.num_parents = 1; ++ init.flags = gate_flags(bit_idx); + + gate->regmap = regmap; + gate->bit_idx = bit_idx; +-- +2.51.0 + diff --git a/queue-5.15/exfat-fix-remount-failure-in-different-process-envir.patch b/queue-5.15/exfat-fix-remount-failure-in-different-process-envir.patch new file mode 100644 index 0000000000..90e5cd664d --- /dev/null +++ b/queue-5.15/exfat-fix-remount-failure-in-different-process-envir.patch @@ -0,0 +1,60 @@ +From e3ed690259226de56ff2947b7d734747a16548dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 17:51:10 +0800 +Subject: exfat: fix remount failure in different process environments + +From: Yuezhang Mo + +[ Upstream commit 51fc7b4ce10ccab8ea5e4876bcdc42cf5202a0ef ] + +The kernel test robot reported that the exFAT remount operation +failed. The reason for the failure was that the process's umask +is different between mount and remount, causing fs_fmask and +fs_dmask are changed. + +Potentially, both gid and uid may also be changed. Therefore, when +initializing fs_context for remount, inherit these mount options +from the options used during mount. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-lkp/202511251637.81670f5c-lkp@intel.com +Signed-off-by: Yuezhang Mo +Signed-off-by: Namjae Jeon +Signed-off-by: Sasha Levin +--- + fs/exfat/super.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/fs/exfat/super.c b/fs/exfat/super.c +index 816ba7e1607f..39e999c0de75 100644 +--- a/fs/exfat/super.c ++++ b/fs/exfat/super.c +@@ -758,10 +758,21 @@ static int exfat_init_fs_context(struct fs_context *fc) + ratelimit_state_init(&sbi->ratelimit, DEFAULT_RATELIMIT_INTERVAL, + DEFAULT_RATELIMIT_BURST); + +- sbi->options.fs_uid = current_uid(); +- sbi->options.fs_gid = current_gid(); +- sbi->options.fs_fmask = current->fs->umask; +- sbi->options.fs_dmask = current->fs->umask; ++ if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE && fc->root) { ++ struct super_block *sb = fc->root->d_sb; ++ struct exfat_mount_options *cur_opts = &EXFAT_SB(sb)->options; ++ ++ sbi->options.fs_uid = cur_opts->fs_uid; ++ sbi->options.fs_gid = cur_opts->fs_gid; ++ sbi->options.fs_fmask = cur_opts->fs_fmask; ++ sbi->options.fs_dmask = cur_opts->fs_dmask; ++ } else { ++ sbi->options.fs_uid = current_uid(); ++ sbi->options.fs_gid = current_gid(); ++ sbi->options.fs_fmask = current->fs->umask; ++ sbi->options.fs_dmask = current->fs->umask; ++ } ++ + sbi->options.allow_utime = -1; + sbi->options.iocharset = exfat_default_iocharset; + sbi->options.errors = EXFAT_ERRORS_RO; +-- +2.51.0 + diff --git a/queue-5.15/firmware-imx-scu-irq-init-workqueue-before-request-m.patch b/queue-5.15/firmware-imx-scu-irq-init-workqueue-before-request-m.patch new file mode 100644 index 0000000000..3e1ab12a4b --- /dev/null +++ b/queue-5.15/firmware-imx-scu-irq-init-workqueue-before-request-m.patch @@ -0,0 +1,46 @@ +From ef101f5b6c29e0551b2e15ab7bc00c7d38919457 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Oct 2025 09:56:26 +0800 +Subject: firmware: imx: scu-irq: Init workqueue before request mbox channel + +From: Peng Fan + +[ Upstream commit 81fb53feb66a3aefbf6fcab73bb8d06f5b0c54ad ] + +With mailbox channel requested, there is possibility that interrupts may +come in, so need to make sure the workqueue is initialized before +the queue is scheduled by mailbox rx callback. + +Reviewed-by: Frank Li +Signed-off-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/firmware/imx/imx-scu-irq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/imx/imx-scu-irq.c b/drivers/firmware/imx/imx-scu-irq.c +index 32b1ca4e1050..06c49a61a079 100644 +--- a/drivers/firmware/imx/imx-scu-irq.c ++++ b/drivers/firmware/imx/imx-scu-irq.c +@@ -148,6 +148,8 @@ int imx_scu_enable_general_irq_channel(struct device *dev) + cl->dev = dev; + cl->rx_callback = imx_scu_irq_callback; + ++ INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler); ++ + /* SCU general IRQ uses general interrupt channel 3 */ + ch = mbox_request_channel_byname(cl, "gip3"); + if (IS_ERR(ch)) { +@@ -157,8 +159,6 @@ int imx_scu_enable_general_irq_channel(struct device *dev) + return ret; + } + +- INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler); +- + if (!of_parse_phandle_with_args(dev->of_node, "mboxes", + "#mbox-cells", 0, &spec)) { + i = of_alias_get_id(spec.np, "mu"); +-- +2.51.0 + diff --git a/queue-5.15/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch b/queue-5.15/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch new file mode 100644 index 0000000000..c0b6a707f1 --- /dev/null +++ b/queue-5.15/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch @@ -0,0 +1,85 @@ +From 88f57de680a44aff6ecf518592d17e4c1bfe2815 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:42:38 +0800 +Subject: ipmi: Fix __scan_channels() failing to rescan channels + +From: Jinhui Guo + +[ Upstream commit 6bd30d8fc523fb880b4be548e8501bc0fe8f42d4 ] + +channel_handler() sets intf->channels_ready to true but never +clears it, so __scan_channels() skips any rescan. When the BMC +firmware changes a rescan is required. Allow it by clearing +the flag before starting a new scan. + +Signed-off-by: Jinhui Guo +Message-ID: <20250930074239.2353-3-guojinhui.liam@bytedance.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_msghandler.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 98ccba19292a..d680e4d46992 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -593,7 +593,8 @@ static void __ipmi_bmc_unregister(struct ipmi_smi *intf); + static int __ipmi_bmc_register(struct ipmi_smi *intf, + struct ipmi_device_id *id, + bool guid_set, guid_t *guid, int intf_num); +-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id); ++static int __scan_channels(struct ipmi_smi *intf, ++ struct ipmi_device_id *id, bool rescan); + + + /** +@@ -2543,7 +2544,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, + if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num)) + need_waiter(intf); /* Retry later on an error. */ + else +- __scan_channels(intf, &id); ++ __scan_channels(intf, &id, false); + + + if (!intf_set) { +@@ -2563,7 +2564,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, + goto out_noprocessing; + } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id))) + /* Version info changes, scan the channels again. */ +- __scan_channels(intf, &bmc->fetch_id); ++ __scan_channels(intf, &bmc->fetch_id, true); + + bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; + +@@ -3313,10 +3314,17 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) + /* + * Must be holding intf->bmc_reg_mutex to call this. + */ +-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id) ++static int __scan_channels(struct ipmi_smi *intf, ++ struct ipmi_device_id *id, ++ bool rescan) + { + int rv; + ++ if (rescan) { ++ /* Clear channels_ready to force channels rescan. */ ++ intf->channels_ready = false; ++ } ++ + if (ipmi_version_major(id) > 1 + || (ipmi_version_major(id) == 1 + && ipmi_version_minor(id) >= 5)) { +@@ -3488,7 +3496,7 @@ int ipmi_add_smi(struct module *owner, + } + + mutex_lock(&intf->bmc_reg_mutex); +- rv = __scan_channels(intf, &id); ++ rv = __scan_channels(intf, &id, false); + mutex_unlock(&intf->bmc_reg_mutex); + if (rv) + goto out_err_bmc_reg; +-- +2.51.0 + diff --git a/queue-5.15/ipmi-fix-the-race-between-__scan_channels-and-delive.patch b/queue-5.15/ipmi-fix-the-race-between-__scan_channels-and-delive.patch new file mode 100644 index 0000000000..7c97980c90 --- /dev/null +++ b/queue-5.15/ipmi-fix-the-race-between-__scan_channels-and-delive.patch @@ -0,0 +1,90 @@ +From 6c3f850656c17abf9794a752130145704edb6b96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:42:37 +0800 +Subject: ipmi: Fix the race between __scan_channels() and deliver_response() + +From: Jinhui Guo + +[ Upstream commit 936750fdba4c45e13bbd17f261bb140dd55f5e93 ] + +The race window between __scan_channels() and deliver_response() causes +the parameters of some channels to be set to 0. + +1.[CPUA] __scan_channels() issues an IPMI request and waits with + wait_event() until all channels have been scanned. + wait_event() internally calls might_sleep(), which might + yield the CPU. (Moreover, an interrupt can preempt + wait_event() and force the task to yield the CPU.) +2.[CPUB] deliver_response() is invoked when the CPU receives the + IPMI response. After processing a IPMI response, + deliver_response() directly assigns intf->wchannels to + intf->channel_list and sets intf->channels_ready to true. + However, not all channels are actually ready for use. +3.[CPUA] Since intf->channels_ready is already true, wait_event() + never enters __wait_event(). __scan_channels() immediately + clears intf->null_user_handler and exits. +4.[CPUB] Once intf->null_user_handler is set to NULL, deliver_response() + ignores further IPMI responses, leaving the remaining + channels zero-initialized and unusable. + +CPUA CPUB +------------------------------- ----------------------------- +__scan_channels() + intf->null_user_handler + = channel_handler; + send_channel_info_cmd(intf, + 0); + wait_event(intf->waitq, + intf->channels_ready); + do { + might_sleep(); + deliver_response() + channel_handler() + intf->channel_list = + intf->wchannels + set; + intf->channels_ready = true; + send_channel_info_cmd(intf, + intf->curr_channel); + if (condition) + break; + __wait_event(wq_head, + condition); + } while(0) + intf->null_user_handler + = NULL; + deliver_response() + if (!msg->user) + if (intf->null_user_handler) + rv = -EINVAL; + return rv; +------------------------------- ----------------------------- + +Fix the race between __scan_channels() and deliver_response() by +deferring both the assignment intf->channel_list = intf->wchannels +and the flag intf->channels_ready = true until all channels have +been successfully scanned or until the IPMI request has failed. + +Signed-off-by: Jinhui Guo +Message-ID: <20250930074239.2353-2-guojinhui.liam@bytedance.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_msghandler.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index af563ee827aa..98ccba19292a 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -3292,8 +3292,6 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) + intf->channels_ready = true; + wake_up(&intf->waitq); + } else { +- intf->channel_list = intf->wchannels + set; +- intf->channels_ready = true; + rv = send_channel_info_cmd(intf, intf->curr_channel); + } + +-- +2.51.0 + diff --git a/queue-5.15/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch b/queue-5.15/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch new file mode 100644 index 0000000000..be2daed495 --- /dev/null +++ b/queue-5.15/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch @@ -0,0 +1,64 @@ +From 1c8e1406360e0e9dc9ca7fa1b2c77898a2fcd0c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 11:05:45 +0100 +Subject: nvme-fc: don't hold rport lock when putting ctrl + +From: Daniel Wagner + +[ Upstream commit b71cbcf7d170e51148d5467820ae8a72febcb651 ] + +nvme_fc_ctrl_put can acquire the rport lock when freeing the +ctrl object: + +nvme_fc_ctrl_put + nvme_fc_ctrl_free + spin_lock_irqsave(rport->lock) + +Thus we can't hold the rport lock when calling nvme_fc_ctrl_put. + +Justin suggested use the safe list iterator variant because +nvme_fc_ctrl_put will also modify the rport->list. + +Cc: Justin Tee +Reviewed-by: Christoph Hellwig +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 3fe4db3c9c34..0bbc226ea4f4 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -1500,14 +1500,14 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport, + { + struct fcnvme_ls_disconnect_assoc_rqst *rqst = + &lsop->rqstbuf->rq_dis_assoc; +- struct nvme_fc_ctrl *ctrl, *ret = NULL; ++ struct nvme_fc_ctrl *ctrl, *tmp, *ret = NULL; + struct nvmefc_ls_rcv_op *oldls = NULL; + u64 association_id = be64_to_cpu(rqst->associd.association_id); + unsigned long flags; + + spin_lock_irqsave(&rport->lock, flags); + +- list_for_each_entry(ctrl, &rport->ctrl_list, ctrl_list) { ++ list_for_each_entry_safe(ctrl, tmp, &rport->ctrl_list, ctrl_list) { + if (!nvme_fc_ctrl_get(ctrl)) + continue; + spin_lock(&ctrl->lock); +@@ -1520,7 +1520,9 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport, + if (ret) + /* leave the ctrl get reference */ + break; ++ spin_unlock_irqrestore(&rport->lock, flags); + nvme_fc_ctrl_put(ctrl); ++ spin_lock_irqsave(&rport->lock, flags); + } + + spin_unlock_irqrestore(&rport->lock, flags); +-- +2.51.0 + diff --git a/queue-5.15/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch b/queue-5.15/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch new file mode 100644 index 0000000000..a8bf29adac --- /dev/null +++ b/queue-5.15/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch @@ -0,0 +1,56 @@ +From 965f49332de6788ad36162ab3e3dc6109b747e7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 15:04:07 +0800 +Subject: platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI + quirks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chia-Lin Kao (AceLan) + +[ Upstream commit b169e1733cadb614e87f69d7a5ae1b186c50d313 ] + +Dell Pro Rugged 10/12 tablets has a reliable VGBS method. +If VGBS is not called on boot, the on-screen keyboard won't appear if the +device is booted without a keyboard. + +Call VGBS on boot on thess devices to get the initial state of +SW_TABLET_MODE in a reliable way. + +Signed-off-by: Chia-Lin Kao (AceLan) +Reviewed-by: Hans de Goede +Link: https://patch.msgid.link/20251127070407.656463-1-acelan.kao@canonical.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/hid.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c +index f59a3cc9767b..4d488e985dc5 100644 +--- a/drivers/platform/x86/intel/hid.c ++++ b/drivers/platform/x86/intel/hid.c +@@ -144,6 +144,18 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite Dragonfly G2 Notebook PC"), + }, + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 10 Tablet RA00260"), ++ }, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 12 Tablet RA02260"), ++ }, ++ }, + { } + }; + +-- +2.51.0 + diff --git a/queue-5.15/powerpc-addnote-fix-overflow-on-32-bit-builds.patch b/queue-5.15/powerpc-addnote-fix-overflow-on-32-bit-builds.patch new file mode 100644 index 0000000000..f646dc2725 --- /dev/null +++ b/queue-5.15/powerpc-addnote-fix-overflow-on-32-bit-builds.patch @@ -0,0 +1,50 @@ +From 3879210dbcbf3a5f6aa07f0f87fc21594ed77600 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 22:31:13 -0400 +Subject: powerpc/addnote: Fix overflow on 32-bit builds + +From: Ben Collins + +[ Upstream commit 825ce89a3ef17f84cf2c0eacfa6b8dc9fd11d13f ] + +The PUT_64[LB]E() macros need to cast the value to unsigned long long +like the GET_64[LB]E() macros. Caused lots of warnings when compiled +on 32-bit, and clobbered addresses (36-bit P4080). + +Signed-off-by: Ben Collins +Reviewed-by: Christophe Leroy +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/2025042122-mustard-wrasse-694572@boujee-and-buff +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/addnote.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/boot/addnote.c b/arch/powerpc/boot/addnote.c +index 53b3b2621457..78704927453a 100644 +--- a/arch/powerpc/boot/addnote.c ++++ b/arch/powerpc/boot/addnote.c +@@ -68,8 +68,8 @@ static int e_class = ELFCLASS32; + #define PUT_16BE(off, v)(buf[off] = ((v) >> 8) & 0xff, \ + buf[(off) + 1] = (v) & 0xff) + #define PUT_32BE(off, v)(PUT_16BE((off), (v) >> 16L), PUT_16BE((off) + 2, (v))) +-#define PUT_64BE(off, v)((PUT_32BE((off), (v) >> 32L), \ +- PUT_32BE((off) + 4, (v)))) ++#define PUT_64BE(off, v)((PUT_32BE((off), (unsigned long long)(v) >> 32L), \ ++ PUT_32BE((off) + 4, (unsigned long long)(v)))) + + #define GET_16LE(off) ((buf[off]) + (buf[(off)+1] << 8)) + #define GET_32LE(off) (GET_16LE(off) + (GET_16LE((off)+2U) << 16U)) +@@ -78,7 +78,8 @@ static int e_class = ELFCLASS32; + #define PUT_16LE(off, v) (buf[off] = (v) & 0xff, \ + buf[(off) + 1] = ((v) >> 8) & 0xff) + #define PUT_32LE(off, v) (PUT_16LE((off), (v)), PUT_16LE((off) + 2, (v) >> 16L)) +-#define PUT_64LE(off, v) (PUT_32LE((off), (v)), PUT_32LE((off) + 4, (v) >> 32L)) ++#define PUT_64LE(off, v) (PUT_32LE((off), (unsigned long long)(v)), \ ++ PUT_32LE((off) + 4, (unsigned long long)(v) >> 32L)) + + #define GET_16(off) (e_data == ELFDATA2MSB ? GET_16BE(off) : GET_16LE(off)) + #define GET_32(off) (e_data == ELFDATA2MSB ? GET_32BE(off) : GET_32LE(off)) +-- +2.51.0 + diff --git a/queue-5.15/reset-fix-bit-macro-reference.patch b/queue-5.15/reset-fix-bit-macro-reference.patch new file mode 100644 index 0000000000..b8dd745cd3 --- /dev/null +++ b/queue-5.15/reset-fix-bit-macro-reference.patch @@ -0,0 +1,40 @@ +From 01a30ff6a74d145704cf532d1450febb2febc167 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 14:10:37 +0800 +Subject: reset: fix BIT macro reference + +From: Encrow Thorne + +[ Upstream commit f3d8b64ee46c9b4b0b82b1a4642027728bac95b8 ] + +RESET_CONTROL_FLAGS_BIT_* macros use BIT(), but reset.h does not +include bits.h. This causes compilation errors when including +reset.h standalone. + +Include bits.h to make reset.h self-contained. + +Suggested-by: Troy Mitchell +Reviewed-by: Troy Mitchell +Reviewed-by: Philipp Zabel +Signed-off-by: Encrow Thorne +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + include/linux/reset.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/reset.h b/include/linux/reset.h +index 7bb583737528..23abb90398ad 100644 +--- a/include/linux/reset.h ++++ b/include/linux/reset.h +@@ -2,6 +2,7 @@ + #ifndef _LINUX_RESET_H_ + #define _LINUX_RESET_H_ + ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-5.15/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch b/queue-5.15/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch new file mode 100644 index 0000000000..4fa96a964b --- /dev/null +++ b/queue-5.15/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch @@ -0,0 +1,45 @@ +From ce63a60c547e7a7137372586568cc9dbe6f5877d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:48:45 -0500 +Subject: scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive + +From: Tony Battersby + +[ Upstream commit 8f58fc64d559b5fda1b0a5e2a71422be61e79ab9 ] + +When given the module parameter qlini_mode=exclusive, qla2xxx in +initiator mode is initially unable to successfully send SCSI commands to +devices it finds while scanning, resulting in an escalating series of +resets until an adapter reset clears the issue. Fix by checking the +active mode instead of the module parameter. + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/1715ec14-ba9a-45dc-9cf2-d41aa6b81b5e@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_os.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 9267e7e73478..97a1aeb07947 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3425,13 +3425,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + base_vha->mgmt_svr_loop_id, host->sg_tablesize); + + if (ha->mqenable) { +- bool startit = false; +- +- if (QLA_TGT_MODE_ENABLED()) +- startit = false; +- +- if (ql2x_ini_mode == QLA2XXX_INI_MODE_ENABLED) +- startit = true; ++ bool startit = !!(host->active_mode & MODE_INITIATOR); + + /* Create start of day qpairs for Block MQ */ + for (i = 0; i < ha->max_qpairs; i++) +-- +2.51.0 + diff --git a/queue-5.15/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch b/queue-5.15/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch new file mode 100644 index 0000000000..e421333340 --- /dev/null +++ b/queue-5.15/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch @@ -0,0 +1,193 @@ +From 3eb6f19c84c95eb16dc7ac8f8d3725af583f8b60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:50:05 -0500 +Subject: scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled + +From: Tony Battersby + +[ Upstream commit 4f6aaade2a22ac428fa99ed716cf2b87e79c9837 ] + +When qla2xxx is loaded with qlini_mode=disabled, +ha->flags.disable_msix_handshake is used before it is set, resulting in +the wrong interrupt handler being used on certain HBAs +(qla2xxx_msix_rsp_q_hs() is used when qla2xxx_msix_rsp_q() should be +used). The only difference between these two interrupt handlers is that +the _hs() version writes to a register to clear the "RISC" interrupt, +whereas the other version does not. So this bug results in the RISC +interrupt being cleared when it should not be. This occasionally causes +a different interrupt handler qla24xx_msix_default() for a different +vector to see ((stat & HSRX_RISC_INT) == 0) and ignore its interrupt, +which then causes problems like: + +qla2xxx [0000:02:00.0]-d04c:6: MBX Command timeout for cmd 20, + iocontrol=8 jiffies=1090c0300 mb[0-3]=[0x4000 0x0 0x40 0xda] mb7 0x500 + host_status 0x40000010 hccr 0x3f00 +qla2xxx [0000:02:00.0]-101e:6: Mailbox cmd timeout occurred, cmd=0x20, + mb[0]=0x20. Scheduling ISP abort +(the cmd varies; sometimes it is 0x20, 0x22, 0x54, 0x5a, 0x5d, or 0x6a) + +This problem can be reproduced with a 16 or 32 Gbps HBA by loading +qla2xxx with qlini_mode=disabled and running a high IOPS test while +triggering frequent RSCN database change events. + +While analyzing the problem I discovered that even with +disable_msix_handshake forced to 0, it is not necessary to clear the +RISC interrupt from qla2xxx_msix_rsp_q_hs() (more below). So just +completely remove qla2xxx_msix_rsp_q_hs() and the logic for selecting +it, which also fixes the bug with qlini_mode=disabled. + +The test below describes the justification for not needing +qla2xxx_msix_rsp_q_hs(): + +Force disable_msix_handshake to 0: +qla24xx_config_rings(): +if (0 && (ha->fw_attributes & BIT_6) && (IS_MSIX_NACK_CAPABLE(ha)) && + (ha->flags.msix_enabled)) { + +In qla24xx_msix_rsp_q() and qla2xxx_msix_rsp_q_hs(), check: + (rd_reg_dword(®->host_status) & HSRX_RISC_INT) + +Count the number of calls to each function with HSRX_RISC_INT set and +the number with HSRX_RISC_INT not set while performing some I/O. + +If qla2xxx_msix_rsp_q_hs() clears the RISC interrupt (original code): +qla24xx_msix_rsp_q: 50% of calls have HSRX_RISC_INT set +qla2xxx_msix_rsp_q_hs: 5% of calls have HSRX_RISC_INT set +(# of qla2xxx_msix_rsp_q_hs interrupts) = + (# of qla24xx_msix_rsp_q interrupts) * 3 + +If qla2xxx_msix_rsp_q_hs() does not clear the RISC interrupt (patched +code): +qla24xx_msix_rsp_q: 100% of calls have HSRX_RISC_INT set +qla2xxx_msix_rsp_q_hs: 9% of calls have HSRX_RISC_INT set +(# of qla2xxx_msix_rsp_q_hs interrupts) = + (# of qla24xx_msix_rsp_q interrupts) * 3 + +In the case of the original code, qla24xx_msix_rsp_q() was seeing +HSRX_RISC_INT set only 50% of the time because qla2xxx_msix_rsp_q_hs() +was clearing it when it shouldn't have been. In the patched code, +qla24xx_msix_rsp_q() sees HSRX_RISC_INT set 100% of the time, which +makes sense if that interrupt handler needs to clear the RISC interrupt +(which it does). qla2xxx_msix_rsp_q_hs() sees HSRX_RISC_INT only 9% of +the time, which is just overlap from the other interrupt during the +high IOPS test. + +Tested with SCST on: +QLE2742 FW:v9.08.02 (32 Gbps 2-port) +QLE2694L FW:v9.10.11 (16 Gbps 4-port) +QLE2694L FW:v9.08.02 (16 Gbps 4-port) +QLE2672 FW:v8.07.12 (16 Gbps 2-port) +both initiator and target mode + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/56d378eb-14ad-49c7-bae9-c649b6c7691e@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_def.h | 1 - + drivers/scsi/qla2xxx/qla_gbl.h | 2 +- + drivers/scsi/qla2xxx/qla_isr.c | 32 +++----------------------------- + drivers/scsi/qla2xxx/qla_mid.c | 4 +--- + 4 files changed, 5 insertions(+), 34 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index a6ea7c775092..02a2fd1b150a 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -3447,7 +3447,6 @@ struct isp_operations { + #define QLA_MSIX_RSP_Q 0x01 + #define QLA_ATIO_VECTOR 0x02 + #define QLA_MSIX_QPAIR_MULTIQ_RSP_Q 0x03 +-#define QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS 0x04 + + #define QLA_MIDX_DEFAULT 0 + #define QLA_MIDX_RSP_Q 1 +diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h +index d1c290f3f56a..e8c66cc4b71b 100644 +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -769,7 +769,7 @@ extern int qla2x00_dfs_remove(scsi_qla_host_t *); + + /* Globa function prototypes for multi-q */ + extern int qla25xx_request_irq(struct qla_hw_data *, struct qla_qpair *, +- struct qla_msix_entry *, int); ++ struct qla_msix_entry *); + extern int qla25xx_init_req_que(struct scsi_qla_host *, struct req_que *); + extern int qla25xx_init_rsp_que(struct scsi_qla_host *, struct rsp_que *); + extern int qla25xx_create_req_que(struct qla_hw_data *, uint16_t, uint8_t, +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 51e906fa8694..1459ae380389 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -4284,32 +4284,6 @@ qla2xxx_msix_rsp_q(int irq, void *dev_id) + return IRQ_HANDLED; + } + +-irqreturn_t +-qla2xxx_msix_rsp_q_hs(int irq, void *dev_id) +-{ +- struct qla_hw_data *ha; +- struct qla_qpair *qpair; +- struct device_reg_24xx __iomem *reg; +- unsigned long flags; +- +- qpair = dev_id; +- if (!qpair) { +- ql_log(ql_log_info, NULL, 0x505b, +- "%s: NULL response queue pointer.\n", __func__); +- return IRQ_NONE; +- } +- ha = qpair->hw; +- +- reg = &ha->iobase->isp24; +- spin_lock_irqsave(&ha->hardware_lock, flags); +- wrt_reg_dword(®->hccr, HCCRX_CLR_RISC_INT); +- spin_unlock_irqrestore(&ha->hardware_lock, flags); +- +- queue_work(ha->wq, &qpair->q_work); +- +- return IRQ_HANDLED; +-} +- + /* Interrupt handling helpers. */ + + struct qla_init_msix_entry { +@@ -4322,7 +4296,6 @@ static const struct qla_init_msix_entry msix_entries[] = { + { "rsp_q", qla24xx_msix_rsp_q }, + { "atio_q", qla83xx_msix_atio_q }, + { "qpair_multiq", qla2xxx_msix_rsp_q }, +- { "qpair_multiq_hs", qla2xxx_msix_rsp_q_hs }, + }; + + static const struct qla_init_msix_entry qla82xx_msix_entries[] = { +@@ -4609,9 +4582,10 @@ qla2x00_free_irqs(scsi_qla_host_t *vha) + } + + int qla25xx_request_irq(struct qla_hw_data *ha, struct qla_qpair *qpair, +- struct qla_msix_entry *msix, int vector_type) ++ struct qla_msix_entry *msix) + { +- const struct qla_init_msix_entry *intr = &msix_entries[vector_type]; ++ const struct qla_init_msix_entry *intr = ++ &msix_entries[QLA_MSIX_QPAIR_MULTIQ_RSP_Q]; + scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev); + int ret; + +diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c +index cb52841c5105..7e1956d0435d 100644 +--- a/drivers/scsi/qla2xxx/qla_mid.c ++++ b/drivers/scsi/qla2xxx/qla_mid.c +@@ -910,9 +910,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options, + rsp->options, rsp->id, rsp->rsp_q_in, + rsp->rsp_q_out); + +- ret = qla25xx_request_irq(ha, qpair, qpair->msix, +- ha->flags.disable_msix_handshake ? +- QLA_MSIX_QPAIR_MULTIQ_RSP_Q : QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS); ++ ret = qla25xx_request_irq(ha, qpair, qpair->msix); + if (ret) + goto que_failed; + +-- +2.51.0 + diff --git a/queue-5.15/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch b/queue-5.15/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch new file mode 100644 index 0000000000..ce74f6d083 --- /dev/null +++ b/queue-5.15/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch @@ -0,0 +1,45 @@ +From 6bc6ab97180e5b99dca7a3d39adfb4f040174e37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:51:28 -0500 +Subject: scsi: qla2xxx: Use reinit_completion on mbx_intr_comp + +From: Tony Battersby + +[ Upstream commit 957aa5974989fba4ae4f807ebcb27f12796edd4d ] + +If a mailbox command completes immediately after +wait_for_completion_timeout() times out, ha->mbx_intr_comp could be left +in an inconsistent state, causing the next mailbox command not to wait +for the hardware. Fix by reinitializing the completion before use. + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/11b6485e-0bfd-4784-8f99-c06a196dad94@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_mbx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 7a28582b1f73..771b323a5194 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -253,6 +253,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + /* Issue set host interrupt command to send cmd out. */ + ha->flags.mbox_int = 0; + clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags); ++ reinit_completion(&ha->mbx_intr_comp); + + /* Unlock mbx registers and wait for interrupt */ + ql_dbg(ql_dbg_mbx, vha, 0x100f, +@@ -279,6 +280,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + "cmd=%x Timeout.\n", command); + spin_lock_irqsave(&ha->hardware_lock, flags); + clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags); ++ reinit_completion(&ha->mbx_intr_comp); + spin_unlock_irqrestore(&ha->hardware_lock, flags); + + if (chip_reset != ha->chip_reset) { +-- +2.51.0 + diff --git a/queue-5.15/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch b/queue-5.15/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch new file mode 100644 index 0000000000..1b771b22cb --- /dev/null +++ b/queue-5.15/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch @@ -0,0 +1,63 @@ +From 1d28338b3bffc27c86b1ab631e3e26e1ff45d7ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Oct 2025 11:08:40 +0800 +Subject: serial: sprd: Return -EPROBE_DEFER when uart clock is not ready + +From: Wenhua Lin + +[ Upstream commit 29e8a0c587e328ed458380a45d6028adf64d7487 ] + +In sprd_clk_init(), when devm_clk_get() returns -EPROBE_DEFER +for either uart or source clock, we should propagate the +error instead of just warning and continuing with NULL clocks. + +Currently the driver only emits a warning when clock acquisition +fails and proceeds with NULL clock pointers. This can lead to +issues later when the clocks are actually needed. More importantly, +when the clock provider is not ready yet and returns -EPROBE_DEFER, +we should return this error to allow deferred probing. + +This change adds explicit checks for -EPROBE_DEFER after both: +1. devm_clk_get(uport->dev, uart) +2. devm_clk_get(uport->dev, source) + +When -EPROBE_DEFER is encountered, the function now returns +-EPROBE_DEFER to let the driver framework retry probing +later when the clock dependencies are resolved. + +Signed-off-by: Wenhua Lin +Link: https://patch.msgid.link/20251022030840.956589-1-Wenhua.Lin@unisoc.com +Reviewed-by: Cixi Geng +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sprd_serial.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index a1952e4f1fcb..e850959ecf55 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -1137,6 +1137,9 @@ static int sprd_clk_init(struct uart_port *uport) + + clk_uart = devm_clk_get(uport->dev, "uart"); + if (IS_ERR(clk_uart)) { ++ if (PTR_ERR(clk_uart) == -EPROBE_DEFER) ++ return -EPROBE_DEFER; ++ + dev_warn(uport->dev, "uart%d can't get uart clock\n", + uport->line); + clk_uart = NULL; +@@ -1144,6 +1147,9 @@ static int sprd_clk_init(struct uart_port *uport) + + clk_parent = devm_clk_get(uport->dev, "source"); + if (IS_ERR(clk_parent)) { ++ if (PTR_ERR(clk_parent) == -EPROBE_DEFER) ++ return -EPROBE_DEFER; ++ + dev_warn(uport->dev, "uart%d can't get source clock\n", + uport->line); + clk_parent = NULL; +-- +2.51.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 4f820a10d5..15508bac67 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -250,3 +250,25 @@ acpi-cppc-fix-missing-pcc-check-for-guaranteed_perf.patch spi-fsl-cpm-check-length-parity-before-switching-to-16-bit-mode.patch mmc-sdhci-esdhc-imx-add-alternate-arch_s32-dependency-to-kconfig.patch net-hsr-fix-null-pointer-dereference-in-prp_get_untagged_frame.patch +alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch +alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch +alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch +ipmi-fix-the-race-between-__scan_channels-and-delive.patch +ipmi-fix-__scan_channels-failing-to-rescan-channels.patch +firmware-imx-scu-irq-init-workqueue-before-request-m.patch +ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch +clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch +powerpc-addnote-fix-overflow-on-32-bit-builds.patch +scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch +scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch +scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch +via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch +reset-fix-bit-macro-reference.patch +exfat-fix-remount-failure-in-different-process-envir.patch +usbip-fix-locking-bug-in-rt-enabled-kernels.patch +usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch +usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch +usb-usb-storage-no-additional-quirks-need-to-be-adde.patch +serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch +nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch +platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch diff --git a/queue-5.15/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch b/queue-5.15/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch new file mode 100644 index 0000000000..ff0dbd8ade --- /dev/null +++ b/queue-5.15/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch @@ -0,0 +1,64 @@ +From 3cc58f948432d5a1d70587f57282139dd8b4dada Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 15:11:13 +0200 +Subject: ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx + +From: Matthias Schiffer + +[ Upstream commit 3f61783920504b2cf99330b372d82914bb004d8e ] + +am33xx.dtsi has the same clock setup as am35xx.dtsi, setting +ti,no-reset-on-init and ti,no-idle on timer1_target and timer2_target, +so AM33 needs the same workaround as AM35 to avoid ti-sysc probe +failing on certain target modules. + +Signed-off-by: Matthias Schiffer +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20250825131114.2206804-1-alexander.stein@ew.tq-group.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 20e090723485..12ab9bf160c9 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -37,6 +37,7 @@ enum sysc_soc { + SOC_UNKNOWN, + SOC_2420, + SOC_2430, ++ SOC_AM33, + SOC_3430, + SOC_AM35, + SOC_3630, +@@ -2946,6 +2947,7 @@ static void ti_sysc_idle(struct work_struct *work) + static const struct soc_device_attribute sysc_soc_match[] = { + SOC_FLAG("OMAP242*", SOC_2420), + SOC_FLAG("OMAP243*", SOC_2430), ++ SOC_FLAG("AM33*", SOC_AM33), + SOC_FLAG("AM35*", SOC_AM35), + SOC_FLAG("OMAP3[45]*", SOC_3430), + SOC_FLAG("OMAP3[67]*", SOC_3630), +@@ -3153,10 +3155,15 @@ static int sysc_check_active_timer(struct sysc *ddata) + * can be dropped if we stop supporting old beagleboard revisions + * A to B4 at some point. + */ +- if (sysc_soc->soc == SOC_3430 || sysc_soc->soc == SOC_AM35) ++ switch (sysc_soc->soc) { ++ case SOC_AM33: ++ case SOC_3430: ++ case SOC_AM35: + error = -ENXIO; +- else ++ break; ++ default: + error = -EBUSY; ++ } + + if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) && + (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE)) +-- +2.51.0 + diff --git a/queue-5.15/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch b/queue-5.15/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch new file mode 100644 index 0000000000..7681acf3f8 --- /dev/null +++ b/queue-5.15/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch @@ -0,0 +1,49 @@ +From 4f620a2a6006882b1fc5e185c1709eaa5f4928cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 14:53:07 -0400 +Subject: usb: typec: ucsi: Handle incorrect num_connectors capability + +From: Mark Pearson + +[ Upstream commit 30cd2cb1abf4c4acdb1ddb468c946f68939819fb ] + +The UCSI spec states that the num_connectors field is 7 bits, and the +8th bit is reserved and should be set to zero. +Some buggy FW has been known to set this bit, and it can lead to a +system not booting. +Flag that the FW is not behaving correctly, and auto-fix the value +so that the system boots correctly. + +Found on Lenovo P1 G8 during Linux enablement program. The FW will +be fixed, but seemed worth addressing in case it hit platforms that +aren't officially Linux supported. + +Signed-off-by: Mark Pearson +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250821185319.2585023-1-mpearson-lenovo@squebb.ca +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index 62124882b21a..05a2909e84fd 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1270,6 +1270,12 @@ static int ucsi_init(struct ucsi *ucsi) + ret = -ENODEV; + goto err_reset; + } ++ /* Check if reserved bit set. This is out of spec but happens in buggy FW */ ++ if (ucsi->cap.num_connectors & 0x80) { ++ dev_warn(ucsi->dev, "UCSI: Invalid num_connectors %d. Likely buggy FW\n", ++ ucsi->cap.num_connectors); ++ ucsi->cap.num_connectors &= 0x7f; // clear bit and carry on ++ } + + /* Allocate the connectors. Released in ucsi_unregister() */ + ucsi->connector = kcalloc(ucsi->cap.num_connectors + 1, +-- +2.51.0 + diff --git a/queue-5.15/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch b/queue-5.15/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch new file mode 100644 index 0000000000..a33a98a405 --- /dev/null +++ b/queue-5.15/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch @@ -0,0 +1,65 @@ +From 111c265db2dd32128376d8abd24c81f09edf5315 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 14:40:20 +0800 +Subject: usb: usb-storage: No additional quirks need to be added to the EL-R12 + optical drive. + +From: Chen Changcheng + +[ Upstream commit 955a48a5353f4fe009704a9a4272a3adf627cd35 ] + +The optical drive of EL-R12 has the same vid and pid as INIC-3069, +as follows: +T: Bus=02 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0 +D: Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=13fd ProdID=3940 Rev= 3.10 +S: Manufacturer=HL-DT-ST +S: Product= DVD+-RW GT80N +S: SerialNumber=423349524E4E38303338323439202020 +C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=144mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=02 Prot=50 Driver=usb-storage +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=0a(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +This will result in the optical drive device also adding +the quirks of US_FL_NO_ATA_1X. When performing an erase operation, +it will fail, and the reason for the failure is as follows: +[ 388.967742] sr 5:0:0:0: [sr0] tag#0 Send: scmd 0x00000000d20c33a7 +[ 388.967742] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00 +[ 388.967773] sr 5:0:0:0: [sr0] tag#0 Done: SUCCESS Result: hostbyte=DID_TARGET_FAILURE driverbyte=DRIVER_OK cmd_age=0s +[ 388.967773] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00 +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Sense Key : Illegal Request [current] +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Add. Sense: Invalid field in cdb +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 scsi host busy 1 failed 0 +[ 388.967803] sr 5:0:0:0: Notifying upper driver of completion (result 8100002) +[ 388.967834] sr 5:0:0:0: [sr0] tag#0 0 sectors total, 0 bytes done. + +For the EL-R12 standard optical drive, all operational commands +and usage scenarios were tested without adding the IGNORE_RESIDUE quirks, +and no issues were encountered. It can be reasonably concluded +that removing the IGNORE_RESIDUE quirks has no impact. + +Signed-off-by: Chen Changcheng +Link: https://patch.msgid.link/20251121064020.29332-1-chenchangcheng@kylinos.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/storage/unusual_uas.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index 1477e31d7763..b695f5ba9a40 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -98,7 +98,7 @@ UNUSUAL_DEV(0x125f, 0xa94a, 0x0160, 0x0160, + US_FL_NO_ATA_1X), + + /* Reported-by: Benjamin Tissoires */ +-UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, ++UNUSUAL_DEV(0x13fd, 0x3940, 0x0309, 0x0309, + "Initio Corporation", + "INIC-3069", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, +-- +2.51.0 + diff --git a/queue-5.15/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch b/queue-5.15/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch new file mode 100644 index 0000000000..a6bce6f5c2 --- /dev/null +++ b/queue-5.15/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch @@ -0,0 +1,82 @@ +From 69e5f9d6e6e4fe62243fa09cc1f38ce71872464c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 16:23:55 +0200 +Subject: usb: xhci: limit run_graceperiod for only usb 3.0 devices + +From: Hongyu Xie + +[ Upstream commit 8d34983720155b8f05de765f0183d9b0e1345cc0 ] + +run_graceperiod blocks usb 2.0 devices from auto suspending after +xhci_start for 500ms. + +Log shows: +[ 13.387170] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.387177] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.387182] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.387188] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.387191] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.387193] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.387296] hub_event:5779: hub 3-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.393343] handle_port_status:2034: xhci-hcd PNP0D10:02: handle_port_status: starting usb5 port polling. +[ 13.393353] xhci_hub_control:1271: xhci-hcd PNP0D10:02: Get port status 5-1 read: 0x206e1, return 0x10101 +[ 13.400047] hub_suspend:3903: hub 3-0:1.0: hub_suspend +[ 13.403077] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.403080] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.403085] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.403087] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.403090] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.403093] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.403095] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.405002] handle_port_status:1913: xhci-hcd PNP0D10:04: Port change event, 9-1, id 1, portsc: 0x6e1 +[ 13.405016] hub_activate:1169: usb usb5-port1: status 0101 change 0001 +[ 13.405026] xhci_clear_port_change_bit:658: xhci-hcd PNP0D10:02: clear port1 connect change, portsc: 0x6e1 +[ 13.413275] hcd_bus_suspend:2250: usb usb3: bus auto-suspend, wakeup 1 +[ 13.419081] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.419086] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.419095] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.419100] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.419106] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.419110] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.419112] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.420455] handle_port_status:2034: xhci-hcd PNP0D10:04: handle_port_status: starting usb9 port polling. +[ 13.420493] handle_port_status:1913: xhci-hcd PNP0D10:05: Port change event, 10-1, id 1, portsc: 0x6e1 +[ 13.425332] hcd_bus_suspend:2279: usb usb3: suspend raced with wakeup event +[ 13.431931] handle_port_status:2034: xhci-hcd PNP0D10:05: handle_port_status: starting usb10 port polling. +[ 13.435080] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.435084] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.435092] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.435096] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.435102] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.435106] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event + +usb7 and other usb 2.0 root hub were rapidly toggling between suspend +and resume states. More, "suspend raced with wakeup event" confuses people. + +So, limit run_graceperiod for only usb 3.0 devices + +Signed-off-by: Hongyu Xie +Signed-off-by: Mathias Nyman +Link: https://patch.msgid.link/20251119142417.2820519-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-hub.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index b226b5487694..f10ab11616ac 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1650,7 +1650,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf) + * SS devices are only visible to roothub after link training completes. + * Keep polling roothubs for a grace period after xHC start + */ +- if (xhci->run_graceperiod) { ++ if (hcd->speed >= HCD_USB3 && xhci->run_graceperiod) { + if (time_before(jiffies, xhci->run_graceperiod)) + status = 1; + else +-- +2.51.0 + diff --git a/queue-5.15/usbip-fix-locking-bug-in-rt-enabled-kernels.patch b/queue-5.15/usbip-fix-locking-bug-in-rt-enabled-kernels.patch new file mode 100644 index 0000000000..3431e8b2c5 --- /dev/null +++ b/queue-5.15/usbip-fix-locking-bug-in-rt-enabled-kernels.patch @@ -0,0 +1,64 @@ +From bc8196ecc88503f4c67807778c97a60eddae66ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 09:41:43 +0800 +Subject: usbip: Fix locking bug in RT-enabled kernels + +From: Lizhi Xu + +[ Upstream commit 09bf21bf5249880f62fe759b53b14b4b52900c6c ] + +Interrupts are disabled before entering usb_hcd_giveback_urb(). +A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be +acquired with disabled interrupts. + +Save the interrupt status and restore it after usb_hcd_giveback_urb(). + +syz reported: +BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 +Call Trace: + dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 + rt_spin_lock+0xc7/0x2c0 kernel/locking/spinlock_rt.c:57 + spin_lock include/linux/spinlock_rt.h:44 [inline] + mon_bus_complete drivers/usb/mon/mon_main.c:134 [inline] + mon_complete+0x5c/0x200 drivers/usb/mon/mon_main.c:147 + usbmon_urb_complete include/linux/usb/hcd.h:738 [inline] + __usb_hcd_giveback_urb+0x254/0x5e0 drivers/usb/core/hcd.c:1647 + vhci_urb_enqueue+0xb4f/0xe70 drivers/usb/usbip/vhci_hcd.c:818 + +Reported-by: syzbot+205ef33a3b636b4181fb@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=205ef33a3b636b4181fb +Signed-off-by: Lizhi Xu +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20250916014143.1439759-1-lizhi.xu@windriver.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vhci_hcd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index e3c8483d7ba4..cfe51672ca41 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -830,15 +830,15 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + no_need_xmit: + usb_hcd_unlink_urb_from_ep(hcd, urb); + no_need_unlink: +- spin_unlock_irqrestore(&vhci->lock, flags); + if (!ret) { + /* usb_hcd_giveback_urb() should be called with + * irqs disabled + */ +- local_irq_disable(); ++ spin_unlock(&vhci->lock); + usb_hcd_giveback_urb(hcd, urb, urb->status); +- local_irq_enable(); ++ spin_lock(&vhci->lock); + } ++ spin_unlock_irqrestore(&vhci->lock, flags); + return ret; + } + +-- +2.51.0 + diff --git a/queue-5.15/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch b/queue-5.15/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch new file mode 100644 index 0000000000..8a74b20094 --- /dev/null +++ b/queue-5.15/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch @@ -0,0 +1,43 @@ +From 03355f95e160a728e6cc0e791080e3aa38f72124 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Sep 2025 16:33:32 +0800 +Subject: via_wdt: fix critical boot hang due to unnamed resource allocation + +From: Li Qiang + +[ Upstream commit 7aa31ee9ec92915926e74731378c009c9cc04928 ] + +The VIA watchdog driver uses allocate_resource() to reserve a MMIO +region for the watchdog control register. However, the allocated +resource was not given a name, which causes the kernel resource tree +to contain an entry marked as "" under /proc/iomem on x86 +platforms. + +During boot, this unnamed resource can lead to a critical hang because +subsequent resource lookups and conflict checks fail to handle the +invalid entry properly. + +Signed-off-by: Li Qiang +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/via_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/via_wdt.c b/drivers/watchdog/via_wdt.c +index eeb39f96e72e..c1ed3ce153cf 100644 +--- a/drivers/watchdog/via_wdt.c ++++ b/drivers/watchdog/via_wdt.c +@@ -165,6 +165,7 @@ static int wdt_probe(struct pci_dev *pdev, + dev_err(&pdev->dev, "cannot enable PCI device\n"); + return -ENODEV; + } ++ wdt_res.name = "via_wdt"; + + /* + * Allocate a MMIO region which contains watchdog control register +-- +2.51.0 + diff --git a/queue-6.1/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch b/queue-6.1/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch new file mode 100644 index 0000000000..1150f58048 --- /dev/null +++ b/queue-6.1/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch @@ -0,0 +1,48 @@ +From 4a4d63c359f25af46135bf94df78675ca01d7145 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 17:04:33 +0800 +Subject: ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path + +From: Haotian Zhang + +[ Upstream commit 5032347c04ba7ff9ba878f262e075d745c06a2a8 ] + +When pdacf_config() fails, snd_pdacf_probe() returns the error code +directly without freeing the sound card resources allocated by +snd_card_new(), which leads to a memory leak. + +Add proper error handling to free the sound card and clear the card +list entry when pdacf_config() fails. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Suggested-by: Takashi Iwai +Signed-off-by: Haotian Zhang +Link: https://patch.msgid.link/20251215090433.211-1-vulab@iscas.ac.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c +index 8363ec08df5d..4468d81683ec 100644 +--- a/sound/pcmcia/pdaudiocf/pdaudiocf.c ++++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c +@@ -132,7 +132,13 @@ static int snd_pdacf_probe(struct pcmcia_device *link) + link->config_index = 1; + link->config_regs = PRESENT_OPTION; + +- return pdacf_config(link); ++ err = pdacf_config(link); ++ if (err < 0) { ++ card_list[i] = NULL; ++ snd_card_free(card); ++ return err; ++ } ++ return 0; + } + + +-- +2.51.0 + diff --git a/queue-6.1/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch b/queue-6.1/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch new file mode 100644 index 0000000000..165118673a --- /dev/null +++ b/queue-6.1/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch @@ -0,0 +1,74 @@ +From 5216cb6a1f8e1c9b13d574f14c091f49ad7cacce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 10:46:30 +0800 +Subject: ALSA: usb-mixer: us16x08: validate meter packet indices + +From: Shipei Qu + +[ Upstream commit 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e ] + +get_meter_levels_from_urb() parses the 64-byte meter packets sent by +the device and fills the per-channel arrays meter_level[], +comp_level[] and master_level[] in struct snd_us16x08_meter_store. + +Currently the function derives the channel index directly from the +meter packet (MUB2(meter_urb, s) - 1) and uses it to index those +arrays without validating the range. If the packet contains a +negative or out-of-range channel number, the driver may write past +the end of these arrays. + +Introduce a local channel variable and validate it before updating the +arrays. We reject negative indices, limit meter_level[] and +comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[] +updates with ARRAY_SIZE(master_level). + +Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk") +Reported-by: DARKNAVY (@DarkNavyOrg) +Closes: https://lore.kernel.org/tencent_21C112743C44C1A2517FF219@qq.com +Signed-off-by: Shipei Qu +Link: https://patch.msgid.link/20251217024630.59576-1-qu@darknavy.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_us16x08.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c +index 20ac32635f1f..d05cb54de788 100644 +--- a/sound/usb/mixer_us16x08.c ++++ b/sound/usb/mixer_us16x08.c +@@ -656,17 +656,25 @@ static void get_meter_levels_from_urb(int s, + u8 *meter_urb) + { + int val = MUC2(meter_urb, s) + (MUC3(meter_urb, s) << 8); ++ int ch = MUB2(meter_urb, s) - 1; ++ ++ if (ch < 0) ++ return; + + if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 && + MUA2(meter_urb, s) == 0x04 && MUB0(meter_urb, s) == 0x62) { +- if (MUC0(meter_urb, s) == 0x72) +- store->meter_level[MUB2(meter_urb, s) - 1] = val; +- if (MUC0(meter_urb, s) == 0xb2) +- store->comp_level[MUB2(meter_urb, s) - 1] = val; ++ if (ch < SND_US16X08_MAX_CHANNELS) { ++ if (MUC0(meter_urb, s) == 0x72) ++ store->meter_level[ch] = val; ++ if (MUC0(meter_urb, s) == 0xb2) ++ store->comp_level[ch] = val; ++ } + } + if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 && +- MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) +- store->master_level[MUB2(meter_urb, s) - 1] = val; ++ MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) { ++ if (ch < ARRAY_SIZE(store->master_level)) ++ store->master_level[ch] = val; ++ } + } + + /* Function to retrieve current meter values from the device. +-- +2.51.0 + diff --git a/queue-6.1/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch b/queue-6.1/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch new file mode 100644 index 0000000000..b7a5ba4fd2 --- /dev/null +++ b/queue-6.1/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch @@ -0,0 +1,47 @@ +From 2a8c901b8bb40572b31b565b9e559d88ba737d06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 12:26:52 +0800 +Subject: ALSA: vxpocket: Fix resource leak in vxpocket_probe error path + +From: Haotian Zhang + +[ Upstream commit 2a03b40deacbd293ac9aed0f9b11197dad54fe5f ] + +When vxpocket_config() fails, vxpocket_probe() returns the error code +directly without freeing the sound card resources allocated by +snd_card_new(), which leads to a memory leak. + +Add proper error handling to free the sound card and clear the +allocation bit when vxpocket_config() fails. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Haotian Zhang +Link: https://patch.msgid.link/20251215042652.695-1-vulab@iscas.ac.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pcmcia/vx/vxpocket.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c +index 7a0f0e73ceb2..867a477d53ae 100644 +--- a/sound/pcmcia/vx/vxpocket.c ++++ b/sound/pcmcia/vx/vxpocket.c +@@ -295,7 +295,13 @@ static int vxpocket_probe(struct pcmcia_device *p_dev) + + vxp->p_dev = p_dev; + +- return vxpocket_config(p_dev); ++ err = vxpocket_config(p_dev); ++ if (err < 0) { ++ card_alloc &= ~(1 << i); ++ snd_card_free(card); ++ return err; ++ } ++ return 0; + } + + static void vxpocket_detach(struct pcmcia_device *link) +-- +2.51.0 + diff --git a/queue-6.1/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch b/queue-6.1/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch new file mode 100644 index 0000000000..945ca2d57c --- /dev/null +++ b/queue-6.1/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch @@ -0,0 +1,79 @@ +From c31f24ca5d5bd655d40ab15e9ab1298eb6c3dddf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 16:16:26 +0100 +Subject: clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & + pcie_x4 + +From: Josua Mayer + +[ Upstream commit f0e6bc0c3ef4b4afb299bd6912586cafd5d864e9 ] + +CP110 based platforms rely on the bootloader for pci port +initialization. +TF-A actively prevents non-uboot re-configuration of pci lanes, and many +boards do not have software control over the pci card reset. + +If a pci port had link at boot-time and the clock is stopped at a later +point, the link fails and can not be recovered. + +PCI controller driver probe - and by extension ownership of a driver for +the pci clocks - may be delayed especially on large modular kernels, +causing the clock core to start disabling unused clocks. + +Add the CLK_IGNORE_UNUSED flag to the three pci port's clocks to ensure +they are not stopped before the pci controller driver has taken +ownership and tested for an existing link. + +This fixes failed pci link detection when controller driver probes late, +e.g. with arm64 defconfig and CONFIG_PHY_MVEBU_CP110_COMPHY=m. + +Closes: https://lore.kernel.org/r/b71596c7-461b-44b6-89ab-3cfbd492639f@solid-run.com +Signed-off-by: Josua Mayer +Reviewed-by: Andrew Lunn +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/cp110-system-controller.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c +index 84c8900542e4..b477396917ad 100644 +--- a/drivers/clk/mvebu/cp110-system-controller.c ++++ b/drivers/clk/mvebu/cp110-system-controller.c +@@ -110,6 +110,25 @@ static const char * const gate_base_names[] = { + [CP110_GATE_EIP197] = "eip197" + }; + ++static unsigned long gate_flags(const u8 bit_idx) ++{ ++ switch (bit_idx) { ++ case CP110_GATE_PCIE_X1_0: ++ case CP110_GATE_PCIE_X1_1: ++ case CP110_GATE_PCIE_X4: ++ /* ++ * If a port had an active link at boot time, stopping ++ * the clock creates a failed state from which controller ++ * driver can not recover. ++ * Prevent stopping this clock till after a driver has taken ++ * ownership. ++ */ ++ return CLK_IGNORE_UNUSED; ++ default: ++ return 0; ++ } ++}; ++ + struct cp110_gate_clk { + struct clk_hw hw; + struct regmap *regmap; +@@ -171,6 +190,7 @@ static struct clk_hw *cp110_register_gate(const char *name, + init.ops = &cp110_gate_ops; + init.parent_names = &parent_name; + init.num_parents = 1; ++ init.flags = gate_flags(bit_idx); + + gate->regmap = regmap; + gate->bit_idx = bit_idx; +-- +2.51.0 + diff --git a/queue-6.1/exfat-fix-remount-failure-in-different-process-envir.patch b/queue-6.1/exfat-fix-remount-failure-in-different-process-envir.patch new file mode 100644 index 0000000000..94d87a93d4 --- /dev/null +++ b/queue-6.1/exfat-fix-remount-failure-in-different-process-envir.patch @@ -0,0 +1,60 @@ +From 278cfee2cbe33a93de5bd1f1a1887b33d737fdb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 17:51:10 +0800 +Subject: exfat: fix remount failure in different process environments + +From: Yuezhang Mo + +[ Upstream commit 51fc7b4ce10ccab8ea5e4876bcdc42cf5202a0ef ] + +The kernel test robot reported that the exFAT remount operation +failed. The reason for the failure was that the process's umask +is different between mount and remount, causing fs_fmask and +fs_dmask are changed. + +Potentially, both gid and uid may also be changed. Therefore, when +initializing fs_context for remount, inherit these mount options +from the options used during mount. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-lkp/202511251637.81670f5c-lkp@intel.com +Signed-off-by: Yuezhang Mo +Signed-off-by: Namjae Jeon +Signed-off-by: Sasha Levin +--- + fs/exfat/super.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/fs/exfat/super.c b/fs/exfat/super.c +index 6cb7a11a3f62..52b852a4121b 100644 +--- a/fs/exfat/super.c ++++ b/fs/exfat/super.c +@@ -763,10 +763,21 @@ static int exfat_init_fs_context(struct fs_context *fc) + ratelimit_state_init(&sbi->ratelimit, DEFAULT_RATELIMIT_INTERVAL, + DEFAULT_RATELIMIT_BURST); + +- sbi->options.fs_uid = current_uid(); +- sbi->options.fs_gid = current_gid(); +- sbi->options.fs_fmask = current->fs->umask; +- sbi->options.fs_dmask = current->fs->umask; ++ if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE && fc->root) { ++ struct super_block *sb = fc->root->d_sb; ++ struct exfat_mount_options *cur_opts = &EXFAT_SB(sb)->options; ++ ++ sbi->options.fs_uid = cur_opts->fs_uid; ++ sbi->options.fs_gid = cur_opts->fs_gid; ++ sbi->options.fs_fmask = cur_opts->fs_fmask; ++ sbi->options.fs_dmask = cur_opts->fs_dmask; ++ } else { ++ sbi->options.fs_uid = current_uid(); ++ sbi->options.fs_gid = current_gid(); ++ sbi->options.fs_fmask = current->fs->umask; ++ sbi->options.fs_dmask = current->fs->umask; ++ } ++ + sbi->options.allow_utime = -1; + sbi->options.iocharset = exfat_default_iocharset; + sbi->options.errors = EXFAT_ERRORS_RO; +-- +2.51.0 + diff --git a/queue-6.1/firmware-imx-scu-irq-init-workqueue-before-request-m.patch b/queue-6.1/firmware-imx-scu-irq-init-workqueue-before-request-m.patch new file mode 100644 index 0000000000..addd68609d --- /dev/null +++ b/queue-6.1/firmware-imx-scu-irq-init-workqueue-before-request-m.patch @@ -0,0 +1,46 @@ +From 794c5376098b61f1bd1eefdab7d5b5dbd3984900 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Oct 2025 09:56:26 +0800 +Subject: firmware: imx: scu-irq: Init workqueue before request mbox channel + +From: Peng Fan + +[ Upstream commit 81fb53feb66a3aefbf6fcab73bb8d06f5b0c54ad ] + +With mailbox channel requested, there is possibility that interrupts may +come in, so need to make sure the workqueue is initialized before +the queue is scheduled by mailbox rx callback. + +Reviewed-by: Frank Li +Signed-off-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/firmware/imx/imx-scu-irq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/imx/imx-scu-irq.c b/drivers/firmware/imx/imx-scu-irq.c +index 32b1ca4e1050..06c49a61a079 100644 +--- a/drivers/firmware/imx/imx-scu-irq.c ++++ b/drivers/firmware/imx/imx-scu-irq.c +@@ -148,6 +148,8 @@ int imx_scu_enable_general_irq_channel(struct device *dev) + cl->dev = dev; + cl->rx_callback = imx_scu_irq_callback; + ++ INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler); ++ + /* SCU general IRQ uses general interrupt channel 3 */ + ch = mbox_request_channel_byname(cl, "gip3"); + if (IS_ERR(ch)) { +@@ -157,8 +159,6 @@ int imx_scu_enable_general_irq_channel(struct device *dev) + return ret; + } + +- INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler); +- + if (!of_parse_phandle_with_args(dev->of_node, "mboxes", + "#mbox-cells", 0, &spec)) { + i = of_alias_get_id(spec.np, "mu"); +-- +2.51.0 + diff --git a/queue-6.1/iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch b/queue-6.1/iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch new file mode 100644 index 0000000000..1e17a224ae --- /dev/null +++ b/queue-6.1/iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch @@ -0,0 +1,49 @@ +From bf2670b3cbc266b80ba1a604180f7b3b0338b3a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 17:12:50 +0800 +Subject: iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc + complains + +From: Pei Xiao + +[ Upstream commit c9fb952360d0c78bbe98239bd6b702f05c2dbb31 ] + +FIELD_PREP() checks that a value fits into the available bitfield, add a +check for step_avg to fix gcc complains. + +which gcc complains about: + drivers/iio/adc/ti_am335x_adc.c: In function 'tiadc_step_config': + include/linux/compiler_types.h:572:38: error: call to +'__compiletime_assert_491' declared with attribute error: FIELD_PREP: value +too large for the field include/linux/mfd/ti_am335x_tscadc.h:58:29: note: +in expansion of macro 'FIELD_PREP' + #define STEPCONFIG_AVG(val) FIELD_PREP(GENMASK(4, 2), (val)) + ^~~~~~~~~~ +drivers/iio/adc/ti_am335x_adc.c:127:17: note: in expansion of macro 'STEPCONFIG_AVG' + stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1) + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202510102117.Jqxrw1vF-lkp@intel.com/ +Signed-off-by: Pei Xiao +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ti_am335x_adc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c +index 3ac253a27dd9..109adff1370e 100644 +--- a/drivers/iio/adc/ti_am335x_adc.c ++++ b/drivers/iio/adc/ti_am335x_adc.c +@@ -124,7 +124,7 @@ static void tiadc_step_config(struct iio_dev *indio_dev) + + chan = adc_dev->channel_line[i]; + +- if (adc_dev->step_avg[i]) ++ if (adc_dev->step_avg[i] && adc_dev->step_avg[i] <= STEPCONFIG_AVG_16) + stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1) | + STEPCONFIG_FIFO1; + else +-- +2.51.0 + diff --git a/queue-6.1/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch b/queue-6.1/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch new file mode 100644 index 0000000000..60761d26fc --- /dev/null +++ b/queue-6.1/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch @@ -0,0 +1,85 @@ +From 61116a7db9c7065ed4f517ee16cec08d7ac67fb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:42:38 +0800 +Subject: ipmi: Fix __scan_channels() failing to rescan channels + +From: Jinhui Guo + +[ Upstream commit 6bd30d8fc523fb880b4be548e8501bc0fe8f42d4 ] + +channel_handler() sets intf->channels_ready to true but never +clears it, so __scan_channels() skips any rescan. When the BMC +firmware changes a rescan is required. Allow it by clearing +the flag before starting a new scan. + +Signed-off-by: Jinhui Guo +Message-ID: <20250930074239.2353-3-guojinhui.liam@bytedance.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_msghandler.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index b7f6cec0383f..8bc8da7f70bb 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -613,7 +613,8 @@ static void __ipmi_bmc_unregister(struct ipmi_smi *intf); + static int __ipmi_bmc_register(struct ipmi_smi *intf, + struct ipmi_device_id *id, + bool guid_set, guid_t *guid, int intf_num); +-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id); ++static int __scan_channels(struct ipmi_smi *intf, ++ struct ipmi_device_id *id, bool rescan); + + + /** +@@ -2665,7 +2666,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, + if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num)) + need_waiter(intf); /* Retry later on an error. */ + else +- __scan_channels(intf, &id); ++ __scan_channels(intf, &id, false); + + + if (!intf_set) { +@@ -2685,7 +2686,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, + goto out_noprocessing; + } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id))) + /* Version info changes, scan the channels again. */ +- __scan_channels(intf, &bmc->fetch_id); ++ __scan_channels(intf, &bmc->fetch_id, true); + + bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; + +@@ -3435,10 +3436,17 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) + /* + * Must be holding intf->bmc_reg_mutex to call this. + */ +-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id) ++static int __scan_channels(struct ipmi_smi *intf, ++ struct ipmi_device_id *id, ++ bool rescan) + { + int rv; + ++ if (rescan) { ++ /* Clear channels_ready to force channels rescan. */ ++ intf->channels_ready = false; ++ } ++ + if (ipmi_version_major(id) > 1 + || (ipmi_version_major(id) == 1 + && ipmi_version_minor(id) >= 5)) { +@@ -3641,7 +3649,7 @@ int ipmi_add_smi(struct module *owner, + } + + mutex_lock(&intf->bmc_reg_mutex); +- rv = __scan_channels(intf, &id); ++ rv = __scan_channels(intf, &id, false); + mutex_unlock(&intf->bmc_reg_mutex); + if (rv) + goto out_err_bmc_reg; +-- +2.51.0 + diff --git a/queue-6.1/ipmi-fix-the-race-between-__scan_channels-and-delive.patch b/queue-6.1/ipmi-fix-the-race-between-__scan_channels-and-delive.patch new file mode 100644 index 0000000000..19999aa443 --- /dev/null +++ b/queue-6.1/ipmi-fix-the-race-between-__scan_channels-and-delive.patch @@ -0,0 +1,90 @@ +From 2d9fd35e8c946945103163d571a835870ee3fefb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:42:37 +0800 +Subject: ipmi: Fix the race between __scan_channels() and deliver_response() + +From: Jinhui Guo + +[ Upstream commit 936750fdba4c45e13bbd17f261bb140dd55f5e93 ] + +The race window between __scan_channels() and deliver_response() causes +the parameters of some channels to be set to 0. + +1.[CPUA] __scan_channels() issues an IPMI request and waits with + wait_event() until all channels have been scanned. + wait_event() internally calls might_sleep(), which might + yield the CPU. (Moreover, an interrupt can preempt + wait_event() and force the task to yield the CPU.) +2.[CPUB] deliver_response() is invoked when the CPU receives the + IPMI response. After processing a IPMI response, + deliver_response() directly assigns intf->wchannels to + intf->channel_list and sets intf->channels_ready to true. + However, not all channels are actually ready for use. +3.[CPUA] Since intf->channels_ready is already true, wait_event() + never enters __wait_event(). __scan_channels() immediately + clears intf->null_user_handler and exits. +4.[CPUB] Once intf->null_user_handler is set to NULL, deliver_response() + ignores further IPMI responses, leaving the remaining + channels zero-initialized and unusable. + +CPUA CPUB +------------------------------- ----------------------------- +__scan_channels() + intf->null_user_handler + = channel_handler; + send_channel_info_cmd(intf, + 0); + wait_event(intf->waitq, + intf->channels_ready); + do { + might_sleep(); + deliver_response() + channel_handler() + intf->channel_list = + intf->wchannels + set; + intf->channels_ready = true; + send_channel_info_cmd(intf, + intf->curr_channel); + if (condition) + break; + __wait_event(wq_head, + condition); + } while(0) + intf->null_user_handler + = NULL; + deliver_response() + if (!msg->user) + if (intf->null_user_handler) + rv = -EINVAL; + return rv; +------------------------------- ----------------------------- + +Fix the race between __scan_channels() and deliver_response() by +deferring both the assignment intf->channel_list = intf->wchannels +and the flag intf->channels_ready = true until all channels have +been successfully scanned or until the IPMI request has failed. + +Signed-off-by: Jinhui Guo +Message-ID: <20250930074239.2353-2-guojinhui.liam@bytedance.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_msghandler.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index a475d0bd2685..b7f6cec0383f 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -3414,8 +3414,6 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) + intf->channels_ready = true; + wake_up(&intf->waitq); + } else { +- intf->channel_list = intf->wchannels + set; +- intf->channels_ready = true; + rv = send_channel_info_cmd(intf, intf->curr_channel); + } + +-- +2.51.0 + diff --git a/queue-6.1/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch b/queue-6.1/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch new file mode 100644 index 0000000000..d29aba7ef1 --- /dev/null +++ b/queue-6.1/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch @@ -0,0 +1,64 @@ +From 5fb14aff931ef32f9ee8f27a6ed284cac678d2ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 11:05:45 +0100 +Subject: nvme-fc: don't hold rport lock when putting ctrl + +From: Daniel Wagner + +[ Upstream commit b71cbcf7d170e51148d5467820ae8a72febcb651 ] + +nvme_fc_ctrl_put can acquire the rport lock when freeing the +ctrl object: + +nvme_fc_ctrl_put + nvme_fc_ctrl_free + spin_lock_irqsave(rport->lock) + +Thus we can't hold the rport lock when calling nvme_fc_ctrl_put. + +Justin suggested use the safe list iterator variant because +nvme_fc_ctrl_put will also modify the rport->list. + +Cc: Justin Tee +Reviewed-by: Christoph Hellwig +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index f5b1378839a7..87a9801ac9f2 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -1501,14 +1501,14 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport, + { + struct fcnvme_ls_disconnect_assoc_rqst *rqst = + &lsop->rqstbuf->rq_dis_assoc; +- struct nvme_fc_ctrl *ctrl, *ret = NULL; ++ struct nvme_fc_ctrl *ctrl, *tmp, *ret = NULL; + struct nvmefc_ls_rcv_op *oldls = NULL; + u64 association_id = be64_to_cpu(rqst->associd.association_id); + unsigned long flags; + + spin_lock_irqsave(&rport->lock, flags); + +- list_for_each_entry(ctrl, &rport->ctrl_list, ctrl_list) { ++ list_for_each_entry_safe(ctrl, tmp, &rport->ctrl_list, ctrl_list) { + if (!nvme_fc_ctrl_get(ctrl)) + continue; + spin_lock(&ctrl->lock); +@@ -1521,7 +1521,9 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport, + if (ret) + /* leave the ctrl get reference */ + break; ++ spin_unlock_irqrestore(&rport->lock, flags); + nvme_fc_ctrl_put(ctrl); ++ spin_lock_irqsave(&rport->lock, flags); + } + + spin_unlock_irqrestore(&rport->lock, flags); +-- +2.51.0 + diff --git a/queue-6.1/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch b/queue-6.1/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch new file mode 100644 index 0000000000..3bacadddb8 --- /dev/null +++ b/queue-6.1/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch @@ -0,0 +1,56 @@ +From 70b46e94a4700d957b9280973601b9dee2f2d381 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 15:04:07 +0800 +Subject: platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI + quirks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chia-Lin Kao (AceLan) + +[ Upstream commit b169e1733cadb614e87f69d7a5ae1b186c50d313 ] + +Dell Pro Rugged 10/12 tablets has a reliable VGBS method. +If VGBS is not called on boot, the on-screen keyboard won't appear if the +device is booted without a keyboard. + +Call VGBS on boot on thess devices to get the initial state of +SW_TABLET_MODE in a reliable way. + +Signed-off-by: Chia-Lin Kao (AceLan) +Reviewed-by: Hans de Goede +Link: https://patch.msgid.link/20251127070407.656463-1-acelan.kao@canonical.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/hid.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c +index c13837401c26..051f2bb786e9 100644 +--- a/drivers/platform/x86/intel/hid.c ++++ b/drivers/platform/x86/intel/hid.c +@@ -144,6 +144,18 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite Dragonfly G2 Notebook PC"), + }, + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 10 Tablet RA00260"), ++ }, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 12 Tablet RA02260"), ++ }, ++ }, + { } + }; + +-- +2.51.0 + diff --git a/queue-6.1/powerpc-addnote-fix-overflow-on-32-bit-builds.patch b/queue-6.1/powerpc-addnote-fix-overflow-on-32-bit-builds.patch new file mode 100644 index 0000000000..f0bf4daff5 --- /dev/null +++ b/queue-6.1/powerpc-addnote-fix-overflow-on-32-bit-builds.patch @@ -0,0 +1,50 @@ +From 7c4a9f5b36aa6e926f12a659d17eb61a04e901a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 22:31:13 -0400 +Subject: powerpc/addnote: Fix overflow on 32-bit builds + +From: Ben Collins + +[ Upstream commit 825ce89a3ef17f84cf2c0eacfa6b8dc9fd11d13f ] + +The PUT_64[LB]E() macros need to cast the value to unsigned long long +like the GET_64[LB]E() macros. Caused lots of warnings when compiled +on 32-bit, and clobbered addresses (36-bit P4080). + +Signed-off-by: Ben Collins +Reviewed-by: Christophe Leroy +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/2025042122-mustard-wrasse-694572@boujee-and-buff +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/addnote.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/boot/addnote.c b/arch/powerpc/boot/addnote.c +index 53b3b2621457..78704927453a 100644 +--- a/arch/powerpc/boot/addnote.c ++++ b/arch/powerpc/boot/addnote.c +@@ -68,8 +68,8 @@ static int e_class = ELFCLASS32; + #define PUT_16BE(off, v)(buf[off] = ((v) >> 8) & 0xff, \ + buf[(off) + 1] = (v) & 0xff) + #define PUT_32BE(off, v)(PUT_16BE((off), (v) >> 16L), PUT_16BE((off) + 2, (v))) +-#define PUT_64BE(off, v)((PUT_32BE((off), (v) >> 32L), \ +- PUT_32BE((off) + 4, (v)))) ++#define PUT_64BE(off, v)((PUT_32BE((off), (unsigned long long)(v) >> 32L), \ ++ PUT_32BE((off) + 4, (unsigned long long)(v)))) + + #define GET_16LE(off) ((buf[off]) + (buf[(off)+1] << 8)) + #define GET_32LE(off) (GET_16LE(off) + (GET_16LE((off)+2U) << 16U)) +@@ -78,7 +78,8 @@ static int e_class = ELFCLASS32; + #define PUT_16LE(off, v) (buf[off] = (v) & 0xff, \ + buf[(off) + 1] = ((v) >> 8) & 0xff) + #define PUT_32LE(off, v) (PUT_16LE((off), (v)), PUT_16LE((off) + 2, (v) >> 16L)) +-#define PUT_64LE(off, v) (PUT_32LE((off), (v)), PUT_32LE((off) + 4, (v) >> 32L)) ++#define PUT_64LE(off, v) (PUT_32LE((off), (unsigned long long)(v)), \ ++ PUT_32LE((off) + 4, (unsigned long long)(v) >> 32L)) + + #define GET_16(off) (e_data == ELFDATA2MSB ? GET_16BE(off) : GET_16LE(off)) + #define GET_32(off) (e_data == ELFDATA2MSB ? GET_32BE(off) : GET_32LE(off)) +-- +2.51.0 + diff --git a/queue-6.1/reset-fix-bit-macro-reference.patch b/queue-6.1/reset-fix-bit-macro-reference.patch new file mode 100644 index 0000000000..44664ca856 --- /dev/null +++ b/queue-6.1/reset-fix-bit-macro-reference.patch @@ -0,0 +1,40 @@ +From 9a14328156df86903d97ab0ef983633f1d112830 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 14:10:37 +0800 +Subject: reset: fix BIT macro reference + +From: Encrow Thorne + +[ Upstream commit f3d8b64ee46c9b4b0b82b1a4642027728bac95b8 ] + +RESET_CONTROL_FLAGS_BIT_* macros use BIT(), but reset.h does not +include bits.h. This causes compilation errors when including +reset.h standalone. + +Include bits.h to make reset.h self-contained. + +Suggested-by: Troy Mitchell +Reviewed-by: Troy Mitchell +Reviewed-by: Philipp Zabel +Signed-off-by: Encrow Thorne +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + include/linux/reset.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/reset.h b/include/linux/reset.h +index 514ddf003efc..4b31d683776e 100644 +--- a/include/linux/reset.h ++++ b/include/linux/reset.h +@@ -2,6 +2,7 @@ + #ifndef _LINUX_RESET_H_ + #define _LINUX_RESET_H_ + ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.1/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch b/queue-6.1/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch new file mode 100644 index 0000000000..cd56c42b55 --- /dev/null +++ b/queue-6.1/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch @@ -0,0 +1,45 @@ +From 0b19cf5215a02428e73bc2272b69d69f2c2c0f6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:48:45 -0500 +Subject: scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive + +From: Tony Battersby + +[ Upstream commit 8f58fc64d559b5fda1b0a5e2a71422be61e79ab9 ] + +When given the module parameter qlini_mode=exclusive, qla2xxx in +initiator mode is initially unable to successfully send SCSI commands to +devices it finds while scanning, resulting in an escalating series of +resets until an adapter reset clears the issue. Fix by checking the +active mode instead of the module parameter. + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/1715ec14-ba9a-45dc-9cf2-d41aa6b81b5e@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_os.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 513a9749ea3d..372562d35c9b 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3458,13 +3458,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + ha->mqenable = 0; + + if (ha->mqenable) { +- bool startit = false; +- +- if (QLA_TGT_MODE_ENABLED()) +- startit = false; +- +- if (ql2x_ini_mode == QLA2XXX_INI_MODE_ENABLED) +- startit = true; ++ bool startit = !!(host->active_mode & MODE_INITIATOR); + + /* Create start of day qpairs for Block MQ */ + for (i = 0; i < ha->max_qpairs; i++) +-- +2.51.0 + diff --git a/queue-6.1/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch b/queue-6.1/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch new file mode 100644 index 0000000000..fd81f5bf2a --- /dev/null +++ b/queue-6.1/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch @@ -0,0 +1,193 @@ +From 90cb3482705a6fb11e2365b300496843f51c9e49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:50:05 -0500 +Subject: scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled + +From: Tony Battersby + +[ Upstream commit 4f6aaade2a22ac428fa99ed716cf2b87e79c9837 ] + +When qla2xxx is loaded with qlini_mode=disabled, +ha->flags.disable_msix_handshake is used before it is set, resulting in +the wrong interrupt handler being used on certain HBAs +(qla2xxx_msix_rsp_q_hs() is used when qla2xxx_msix_rsp_q() should be +used). The only difference between these two interrupt handlers is that +the _hs() version writes to a register to clear the "RISC" interrupt, +whereas the other version does not. So this bug results in the RISC +interrupt being cleared when it should not be. This occasionally causes +a different interrupt handler qla24xx_msix_default() for a different +vector to see ((stat & HSRX_RISC_INT) == 0) and ignore its interrupt, +which then causes problems like: + +qla2xxx [0000:02:00.0]-d04c:6: MBX Command timeout for cmd 20, + iocontrol=8 jiffies=1090c0300 mb[0-3]=[0x4000 0x0 0x40 0xda] mb7 0x500 + host_status 0x40000010 hccr 0x3f00 +qla2xxx [0000:02:00.0]-101e:6: Mailbox cmd timeout occurred, cmd=0x20, + mb[0]=0x20. Scheduling ISP abort +(the cmd varies; sometimes it is 0x20, 0x22, 0x54, 0x5a, 0x5d, or 0x6a) + +This problem can be reproduced with a 16 or 32 Gbps HBA by loading +qla2xxx with qlini_mode=disabled and running a high IOPS test while +triggering frequent RSCN database change events. + +While analyzing the problem I discovered that even with +disable_msix_handshake forced to 0, it is not necessary to clear the +RISC interrupt from qla2xxx_msix_rsp_q_hs() (more below). So just +completely remove qla2xxx_msix_rsp_q_hs() and the logic for selecting +it, which also fixes the bug with qlini_mode=disabled. + +The test below describes the justification for not needing +qla2xxx_msix_rsp_q_hs(): + +Force disable_msix_handshake to 0: +qla24xx_config_rings(): +if (0 && (ha->fw_attributes & BIT_6) && (IS_MSIX_NACK_CAPABLE(ha)) && + (ha->flags.msix_enabled)) { + +In qla24xx_msix_rsp_q() and qla2xxx_msix_rsp_q_hs(), check: + (rd_reg_dword(®->host_status) & HSRX_RISC_INT) + +Count the number of calls to each function with HSRX_RISC_INT set and +the number with HSRX_RISC_INT not set while performing some I/O. + +If qla2xxx_msix_rsp_q_hs() clears the RISC interrupt (original code): +qla24xx_msix_rsp_q: 50% of calls have HSRX_RISC_INT set +qla2xxx_msix_rsp_q_hs: 5% of calls have HSRX_RISC_INT set +(# of qla2xxx_msix_rsp_q_hs interrupts) = + (# of qla24xx_msix_rsp_q interrupts) * 3 + +If qla2xxx_msix_rsp_q_hs() does not clear the RISC interrupt (patched +code): +qla24xx_msix_rsp_q: 100% of calls have HSRX_RISC_INT set +qla2xxx_msix_rsp_q_hs: 9% of calls have HSRX_RISC_INT set +(# of qla2xxx_msix_rsp_q_hs interrupts) = + (# of qla24xx_msix_rsp_q interrupts) * 3 + +In the case of the original code, qla24xx_msix_rsp_q() was seeing +HSRX_RISC_INT set only 50% of the time because qla2xxx_msix_rsp_q_hs() +was clearing it when it shouldn't have been. In the patched code, +qla24xx_msix_rsp_q() sees HSRX_RISC_INT set 100% of the time, which +makes sense if that interrupt handler needs to clear the RISC interrupt +(which it does). qla2xxx_msix_rsp_q_hs() sees HSRX_RISC_INT only 9% of +the time, which is just overlap from the other interrupt during the +high IOPS test. + +Tested with SCST on: +QLE2742 FW:v9.08.02 (32 Gbps 2-port) +QLE2694L FW:v9.10.11 (16 Gbps 4-port) +QLE2694L FW:v9.08.02 (16 Gbps 4-port) +QLE2672 FW:v8.07.12 (16 Gbps 2-port) +both initiator and target mode + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/56d378eb-14ad-49c7-bae9-c649b6c7691e@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_def.h | 1 - + drivers/scsi/qla2xxx/qla_gbl.h | 2 +- + drivers/scsi/qla2xxx/qla_isr.c | 32 +++----------------------------- + drivers/scsi/qla2xxx/qla_mid.c | 4 +--- + 4 files changed, 5 insertions(+), 34 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index f8b949eaffcf..c0d8714d6f76 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -3461,7 +3461,6 @@ struct isp_operations { + #define QLA_MSIX_RSP_Q 0x01 + #define QLA_ATIO_VECTOR 0x02 + #define QLA_MSIX_QPAIR_MULTIQ_RSP_Q 0x03 +-#define QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS 0x04 + + #define QLA_MIDX_DEFAULT 0 + #define QLA_MIDX_RSP_Q 1 +diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h +index f991fb81c72b..f654877ed083 100644 +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -776,7 +776,7 @@ extern int qla2x00_dfs_remove(scsi_qla_host_t *); + + /* Globa function prototypes for multi-q */ + extern int qla25xx_request_irq(struct qla_hw_data *, struct qla_qpair *, +- struct qla_msix_entry *, int); ++ struct qla_msix_entry *); + extern int qla25xx_init_req_que(struct scsi_qla_host *, struct req_que *); + extern int qla25xx_init_rsp_que(struct scsi_qla_host *, struct rsp_que *); + extern int qla25xx_create_req_que(struct qla_hw_data *, uint16_t, uint8_t, +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index db65dbab3a9f..b5421614c857 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -4313,32 +4313,6 @@ qla2xxx_msix_rsp_q(int irq, void *dev_id) + return IRQ_HANDLED; + } + +-irqreturn_t +-qla2xxx_msix_rsp_q_hs(int irq, void *dev_id) +-{ +- struct qla_hw_data *ha; +- struct qla_qpair *qpair; +- struct device_reg_24xx __iomem *reg; +- unsigned long flags; +- +- qpair = dev_id; +- if (!qpair) { +- ql_log(ql_log_info, NULL, 0x505b, +- "%s: NULL response queue pointer.\n", __func__); +- return IRQ_NONE; +- } +- ha = qpair->hw; +- +- reg = &ha->iobase->isp24; +- spin_lock_irqsave(&ha->hardware_lock, flags); +- wrt_reg_dword(®->hccr, HCCRX_CLR_RISC_INT); +- spin_unlock_irqrestore(&ha->hardware_lock, flags); +- +- queue_work(ha->wq, &qpair->q_work); +- +- return IRQ_HANDLED; +-} +- + /* Interrupt handling helpers. */ + + struct qla_init_msix_entry { +@@ -4351,7 +4325,6 @@ static const struct qla_init_msix_entry msix_entries[] = { + { "rsp_q", qla24xx_msix_rsp_q }, + { "atio_q", qla83xx_msix_atio_q }, + { "qpair_multiq", qla2xxx_msix_rsp_q }, +- { "qpair_multiq_hs", qla2xxx_msix_rsp_q_hs }, + }; + + static const struct qla_init_msix_entry qla82xx_msix_entries[] = { +@@ -4638,9 +4611,10 @@ qla2x00_free_irqs(scsi_qla_host_t *vha) + } + + int qla25xx_request_irq(struct qla_hw_data *ha, struct qla_qpair *qpair, +- struct qla_msix_entry *msix, int vector_type) ++ struct qla_msix_entry *msix) + { +- const struct qla_init_msix_entry *intr = &msix_entries[vector_type]; ++ const struct qla_init_msix_entry *intr = ++ &msix_entries[QLA_MSIX_QPAIR_MULTIQ_RSP_Q]; + scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev); + int ret; + +diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c +index 8e582fbb3403..79e4319bbbd2 100644 +--- a/drivers/scsi/qla2xxx/qla_mid.c ++++ b/drivers/scsi/qla2xxx/qla_mid.c +@@ -908,9 +908,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options, + rsp->options, rsp->id, rsp->rsp_q_in, + rsp->rsp_q_out); + +- ret = qla25xx_request_irq(ha, qpair, qpair->msix, +- ha->flags.disable_msix_handshake ? +- QLA_MSIX_QPAIR_MULTIQ_RSP_Q : QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS); ++ ret = qla25xx_request_irq(ha, qpair, qpair->msix); + if (ret) + goto que_failed; + +-- +2.51.0 + diff --git a/queue-6.1/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch b/queue-6.1/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch new file mode 100644 index 0000000000..0d9c0cccce --- /dev/null +++ b/queue-6.1/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch @@ -0,0 +1,45 @@ +From afc28371f2446accfc86aad09f99552e4164d6ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:51:28 -0500 +Subject: scsi: qla2xxx: Use reinit_completion on mbx_intr_comp + +From: Tony Battersby + +[ Upstream commit 957aa5974989fba4ae4f807ebcb27f12796edd4d ] + +If a mailbox command completes immediately after +wait_for_completion_timeout() times out, ha->mbx_intr_comp could be left +in an inconsistent state, causing the next mailbox command not to wait +for the hardware. Fix by reinitializing the completion before use. + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/11b6485e-0bfd-4784-8f99-c06a196dad94@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_mbx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 77b23d9dcb3c..33a499dea7ad 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -253,6 +253,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + /* Issue set host interrupt command to send cmd out. */ + ha->flags.mbox_int = 0; + clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags); ++ reinit_completion(&ha->mbx_intr_comp); + + /* Unlock mbx registers and wait for interrupt */ + ql_dbg(ql_dbg_mbx, vha, 0x100f, +@@ -279,6 +280,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + "cmd=%x Timeout.\n", command); + spin_lock_irqsave(&ha->hardware_lock, flags); + clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags); ++ reinit_completion(&ha->mbx_intr_comp); + spin_unlock_irqrestore(&ha->hardware_lock, flags); + + if (chip_reset != ha->chip_reset) { +-- +2.51.0 + diff --git a/queue-6.1/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch b/queue-6.1/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch new file mode 100644 index 0000000000..0a246dffb3 --- /dev/null +++ b/queue-6.1/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch @@ -0,0 +1,63 @@ +From 351ac9685d601d62612495a35a86cb68d8dbcfce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Oct 2025 11:08:40 +0800 +Subject: serial: sprd: Return -EPROBE_DEFER when uart clock is not ready + +From: Wenhua Lin + +[ Upstream commit 29e8a0c587e328ed458380a45d6028adf64d7487 ] + +In sprd_clk_init(), when devm_clk_get() returns -EPROBE_DEFER +for either uart or source clock, we should propagate the +error instead of just warning and continuing with NULL clocks. + +Currently the driver only emits a warning when clock acquisition +fails and proceeds with NULL clock pointers. This can lead to +issues later when the clocks are actually needed. More importantly, +when the clock provider is not ready yet and returns -EPROBE_DEFER, +we should return this error to allow deferred probing. + +This change adds explicit checks for -EPROBE_DEFER after both: +1. devm_clk_get(uport->dev, uart) +2. devm_clk_get(uport->dev, source) + +When -EPROBE_DEFER is encountered, the function now returns +-EPROBE_DEFER to let the driver framework retry probing +later when the clock dependencies are resolved. + +Signed-off-by: Wenhua Lin +Link: https://patch.msgid.link/20251022030840.956589-1-Wenhua.Lin@unisoc.com +Reviewed-by: Cixi Geng +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sprd_serial.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index 9c7f71993e94..33cc3773cf56 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -1136,6 +1136,9 @@ static int sprd_clk_init(struct uart_port *uport) + + clk_uart = devm_clk_get(uport->dev, "uart"); + if (IS_ERR(clk_uart)) { ++ if (PTR_ERR(clk_uart) == -EPROBE_DEFER) ++ return -EPROBE_DEFER; ++ + dev_warn(uport->dev, "uart%d can't get uart clock\n", + uport->line); + clk_uart = NULL; +@@ -1143,6 +1146,9 @@ static int sprd_clk_init(struct uart_port *uport) + + clk_parent = devm_clk_get(uport->dev, "source"); + if (IS_ERR(clk_parent)) { ++ if (PTR_ERR(clk_parent) == -EPROBE_DEFER) ++ return -EPROBE_DEFER; ++ + dev_warn(uport->dev, "uart%d can't get source clock\n", + uport->line); + clk_parent = NULL; +-- +2.51.0 + diff --git a/queue-6.1/series b/queue-6.1/series index b18c911e3c..7b01663997 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -290,3 +290,26 @@ acpi-cppc-fix-missing-pcc-check-for-guaranteed_perf.patch spi-fsl-cpm-check-length-parity-before-switching-to-16-bit-mode.patch mmc-sdhci-esdhc-imx-add-alternate-arch_s32-dependency-to-kconfig.patch net-hsr-fix-null-pointer-dereference-in-prp_get_untagged_frame.patch +alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch +alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch +alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch +ipmi-fix-the-race-between-__scan_channels-and-delive.patch +ipmi-fix-__scan_channels-failing-to-rescan-channels.patch +firmware-imx-scu-irq-init-workqueue-before-request-m.patch +ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch +clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch +powerpc-addnote-fix-overflow-on-32-bit-builds.patch +scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch +scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch +scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch +via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch +reset-fix-bit-macro-reference.patch +exfat-fix-remount-failure-in-different-process-envir.patch +usbip-fix-locking-bug-in-rt-enabled-kernels.patch +usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch +iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch +usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch +usb-usb-storage-no-additional-quirks-need-to-be-adde.patch +serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch +nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch +platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch diff --git a/queue-6.1/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch b/queue-6.1/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch new file mode 100644 index 0000000000..7e19ed8ef4 --- /dev/null +++ b/queue-6.1/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch @@ -0,0 +1,64 @@ +From 45e2a4922e88411f6aaf1e8584ccd8a656e3677c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 15:11:13 +0200 +Subject: ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx + +From: Matthias Schiffer + +[ Upstream commit 3f61783920504b2cf99330b372d82914bb004d8e ] + +am33xx.dtsi has the same clock setup as am35xx.dtsi, setting +ti,no-reset-on-init and ti,no-idle on timer1_target and timer2_target, +so AM33 needs the same workaround as AM35 to avoid ti-sysc probe +failing on certain target modules. + +Signed-off-by: Matthias Schiffer +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20250825131114.2206804-1-alexander.stein@ew.tq-group.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 172b17fe87c4..42037b15594a 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -37,6 +37,7 @@ enum sysc_soc { + SOC_UNKNOWN, + SOC_2420, + SOC_2430, ++ SOC_AM33, + SOC_3430, + SOC_AM35, + SOC_3630, +@@ -3016,6 +3017,7 @@ static void ti_sysc_idle(struct work_struct *work) + static const struct soc_device_attribute sysc_soc_match[] = { + SOC_FLAG("OMAP242*", SOC_2420), + SOC_FLAG("OMAP243*", SOC_2430), ++ SOC_FLAG("AM33*", SOC_AM33), + SOC_FLAG("AM35*", SOC_AM35), + SOC_FLAG("OMAP3[45]*", SOC_3430), + SOC_FLAG("OMAP3[67]*", SOC_3630), +@@ -3223,10 +3225,15 @@ static int sysc_check_active_timer(struct sysc *ddata) + * can be dropped if we stop supporting old beagleboard revisions + * A to B4 at some point. + */ +- if (sysc_soc->soc == SOC_3430 || sysc_soc->soc == SOC_AM35) ++ switch (sysc_soc->soc) { ++ case SOC_AM33: ++ case SOC_3430: ++ case SOC_AM35: + error = -ENXIO; +- else ++ break; ++ default: + error = -EBUSY; ++ } + + if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) && + (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE)) +-- +2.51.0 + diff --git a/queue-6.1/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch b/queue-6.1/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch new file mode 100644 index 0000000000..3c178c02ff --- /dev/null +++ b/queue-6.1/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch @@ -0,0 +1,49 @@ +From 33dbd0437df324151972ce09a06a26a627e9a45e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 14:53:07 -0400 +Subject: usb: typec: ucsi: Handle incorrect num_connectors capability + +From: Mark Pearson + +[ Upstream commit 30cd2cb1abf4c4acdb1ddb468c946f68939819fb ] + +The UCSI spec states that the num_connectors field is 7 bits, and the +8th bit is reserved and should be set to zero. +Some buggy FW has been known to set this bit, and it can lead to a +system not booting. +Flag that the FW is not behaving correctly, and auto-fix the value +so that the system boots correctly. + +Found on Lenovo P1 G8 during Linux enablement program. The FW will +be fixed, but seemed worth addressing in case it hit platforms that +aren't officially Linux supported. + +Signed-off-by: Mark Pearson +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250821185319.2585023-1-mpearson-lenovo@squebb.ca +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index c26b5aae11fb..5baa48213f1e 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1276,6 +1276,12 @@ static int ucsi_init(struct ucsi *ucsi) + ret = -ENODEV; + goto err_reset; + } ++ /* Check if reserved bit set. This is out of spec but happens in buggy FW */ ++ if (ucsi->cap.num_connectors & 0x80) { ++ dev_warn(ucsi->dev, "UCSI: Invalid num_connectors %d. Likely buggy FW\n", ++ ucsi->cap.num_connectors); ++ ucsi->cap.num_connectors &= 0x7f; // clear bit and carry on ++ } + + /* Allocate the connectors. Released in ucsi_unregister() */ + connector = kcalloc(ucsi->cap.num_connectors + 1, sizeof(*connector), GFP_KERNEL); +-- +2.51.0 + diff --git a/queue-6.1/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch b/queue-6.1/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch new file mode 100644 index 0000000000..2d41108679 --- /dev/null +++ b/queue-6.1/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch @@ -0,0 +1,65 @@ +From 87b05223cc81fb3321cf5e65c24cb7dfb2236b10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 14:40:20 +0800 +Subject: usb: usb-storage: No additional quirks need to be added to the EL-R12 + optical drive. + +From: Chen Changcheng + +[ Upstream commit 955a48a5353f4fe009704a9a4272a3adf627cd35 ] + +The optical drive of EL-R12 has the same vid and pid as INIC-3069, +as follows: +T: Bus=02 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0 +D: Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=13fd ProdID=3940 Rev= 3.10 +S: Manufacturer=HL-DT-ST +S: Product= DVD+-RW GT80N +S: SerialNumber=423349524E4E38303338323439202020 +C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=144mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=02 Prot=50 Driver=usb-storage +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=0a(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +This will result in the optical drive device also adding +the quirks of US_FL_NO_ATA_1X. When performing an erase operation, +it will fail, and the reason for the failure is as follows: +[ 388.967742] sr 5:0:0:0: [sr0] tag#0 Send: scmd 0x00000000d20c33a7 +[ 388.967742] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00 +[ 388.967773] sr 5:0:0:0: [sr0] tag#0 Done: SUCCESS Result: hostbyte=DID_TARGET_FAILURE driverbyte=DRIVER_OK cmd_age=0s +[ 388.967773] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00 +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Sense Key : Illegal Request [current] +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Add. Sense: Invalid field in cdb +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 scsi host busy 1 failed 0 +[ 388.967803] sr 5:0:0:0: Notifying upper driver of completion (result 8100002) +[ 388.967834] sr 5:0:0:0: [sr0] tag#0 0 sectors total, 0 bytes done. + +For the EL-R12 standard optical drive, all operational commands +and usage scenarios were tested without adding the IGNORE_RESIDUE quirks, +and no issues were encountered. It can be reasonably concluded +that removing the IGNORE_RESIDUE quirks has no impact. + +Signed-off-by: Chen Changcheng +Link: https://patch.msgid.link/20251121064020.29332-1-chenchangcheng@kylinos.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/storage/unusual_uas.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index 1477e31d7763..b695f5ba9a40 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -98,7 +98,7 @@ UNUSUAL_DEV(0x125f, 0xa94a, 0x0160, 0x0160, + US_FL_NO_ATA_1X), + + /* Reported-by: Benjamin Tissoires */ +-UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, ++UNUSUAL_DEV(0x13fd, 0x3940, 0x0309, 0x0309, + "Initio Corporation", + "INIC-3069", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, +-- +2.51.0 + diff --git a/queue-6.1/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch b/queue-6.1/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch new file mode 100644 index 0000000000..53e182e13a --- /dev/null +++ b/queue-6.1/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch @@ -0,0 +1,82 @@ +From b61d66a47615257eefa1b3878dae5f3cf191b5b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 16:23:55 +0200 +Subject: usb: xhci: limit run_graceperiod for only usb 3.0 devices + +From: Hongyu Xie + +[ Upstream commit 8d34983720155b8f05de765f0183d9b0e1345cc0 ] + +run_graceperiod blocks usb 2.0 devices from auto suspending after +xhci_start for 500ms. + +Log shows: +[ 13.387170] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.387177] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.387182] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.387188] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.387191] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.387193] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.387296] hub_event:5779: hub 3-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.393343] handle_port_status:2034: xhci-hcd PNP0D10:02: handle_port_status: starting usb5 port polling. +[ 13.393353] xhci_hub_control:1271: xhci-hcd PNP0D10:02: Get port status 5-1 read: 0x206e1, return 0x10101 +[ 13.400047] hub_suspend:3903: hub 3-0:1.0: hub_suspend +[ 13.403077] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.403080] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.403085] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.403087] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.403090] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.403093] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.403095] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.405002] handle_port_status:1913: xhci-hcd PNP0D10:04: Port change event, 9-1, id 1, portsc: 0x6e1 +[ 13.405016] hub_activate:1169: usb usb5-port1: status 0101 change 0001 +[ 13.405026] xhci_clear_port_change_bit:658: xhci-hcd PNP0D10:02: clear port1 connect change, portsc: 0x6e1 +[ 13.413275] hcd_bus_suspend:2250: usb usb3: bus auto-suspend, wakeup 1 +[ 13.419081] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.419086] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.419095] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.419100] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.419106] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.419110] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.419112] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.420455] handle_port_status:2034: xhci-hcd PNP0D10:04: handle_port_status: starting usb9 port polling. +[ 13.420493] handle_port_status:1913: xhci-hcd PNP0D10:05: Port change event, 10-1, id 1, portsc: 0x6e1 +[ 13.425332] hcd_bus_suspend:2279: usb usb3: suspend raced with wakeup event +[ 13.431931] handle_port_status:2034: xhci-hcd PNP0D10:05: handle_port_status: starting usb10 port polling. +[ 13.435080] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.435084] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.435092] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.435096] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.435102] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.435106] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event + +usb7 and other usb 2.0 root hub were rapidly toggling between suspend +and resume states. More, "suspend raced with wakeup event" confuses people. + +So, limit run_graceperiod for only usb 3.0 devices + +Signed-off-by: Hongyu Xie +Signed-off-by: Mathias Nyman +Link: https://patch.msgid.link/20251119142417.2820519-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-hub.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 4619d5e89d5b..6a7f3047ead3 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1652,7 +1652,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf) + * SS devices are only visible to roothub after link training completes. + * Keep polling roothubs for a grace period after xHC start + */ +- if (xhci->run_graceperiod) { ++ if (hcd->speed >= HCD_USB3 && xhci->run_graceperiod) { + if (time_before(jiffies, xhci->run_graceperiod)) + status = 1; + else +-- +2.51.0 + diff --git a/queue-6.1/usbip-fix-locking-bug-in-rt-enabled-kernels.patch b/queue-6.1/usbip-fix-locking-bug-in-rt-enabled-kernels.patch new file mode 100644 index 0000000000..38998bb74c --- /dev/null +++ b/queue-6.1/usbip-fix-locking-bug-in-rt-enabled-kernels.patch @@ -0,0 +1,64 @@ +From 2a2d1d454b4669d48455d8e25f9b4642b657292a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 09:41:43 +0800 +Subject: usbip: Fix locking bug in RT-enabled kernels + +From: Lizhi Xu + +[ Upstream commit 09bf21bf5249880f62fe759b53b14b4b52900c6c ] + +Interrupts are disabled before entering usb_hcd_giveback_urb(). +A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be +acquired with disabled interrupts. + +Save the interrupt status and restore it after usb_hcd_giveback_urb(). + +syz reported: +BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 +Call Trace: + dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 + rt_spin_lock+0xc7/0x2c0 kernel/locking/spinlock_rt.c:57 + spin_lock include/linux/spinlock_rt.h:44 [inline] + mon_bus_complete drivers/usb/mon/mon_main.c:134 [inline] + mon_complete+0x5c/0x200 drivers/usb/mon/mon_main.c:147 + usbmon_urb_complete include/linux/usb/hcd.h:738 [inline] + __usb_hcd_giveback_urb+0x254/0x5e0 drivers/usb/core/hcd.c:1647 + vhci_urb_enqueue+0xb4f/0xe70 drivers/usb/usbip/vhci_hcd.c:818 + +Reported-by: syzbot+205ef33a3b636b4181fb@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=205ef33a3b636b4181fb +Signed-off-by: Lizhi Xu +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20250916014143.1439759-1-lizhi.xu@windriver.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vhci_hcd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index e3c8483d7ba4..cfe51672ca41 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -830,15 +830,15 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + no_need_xmit: + usb_hcd_unlink_urb_from_ep(hcd, urb); + no_need_unlink: +- spin_unlock_irqrestore(&vhci->lock, flags); + if (!ret) { + /* usb_hcd_giveback_urb() should be called with + * irqs disabled + */ +- local_irq_disable(); ++ spin_unlock(&vhci->lock); + usb_hcd_giveback_urb(hcd, urb, urb->status); +- local_irq_enable(); ++ spin_lock(&vhci->lock); + } ++ spin_unlock_irqrestore(&vhci->lock, flags); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.1/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch b/queue-6.1/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch new file mode 100644 index 0000000000..a64e2a1275 --- /dev/null +++ b/queue-6.1/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch @@ -0,0 +1,43 @@ +From 0fa6ae62668990c50fe04f59b8c37e4f5571bf5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Sep 2025 16:33:32 +0800 +Subject: via_wdt: fix critical boot hang due to unnamed resource allocation + +From: Li Qiang + +[ Upstream commit 7aa31ee9ec92915926e74731378c009c9cc04928 ] + +The VIA watchdog driver uses allocate_resource() to reserve a MMIO +region for the watchdog control register. However, the allocated +resource was not given a name, which causes the kernel resource tree +to contain an entry marked as "" under /proc/iomem on x86 +platforms. + +During boot, this unnamed resource can lead to a critical hang because +subsequent resource lookups and conflict checks fail to handle the +invalid entry properly. + +Signed-off-by: Li Qiang +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/via_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/via_wdt.c b/drivers/watchdog/via_wdt.c +index eeb39f96e72e..c1ed3ce153cf 100644 +--- a/drivers/watchdog/via_wdt.c ++++ b/drivers/watchdog/via_wdt.c +@@ -165,6 +165,7 @@ static int wdt_probe(struct pci_dev *pdev, + dev_err(&pdev->dev, "cannot enable PCI device\n"); + return -ENODEV; + } ++ wdt_res.name = "via_wdt"; + + /* + * Allocate a MMIO region which contains watchdog control register +-- +2.51.0 + diff --git a/queue-6.12/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch b/queue-6.12/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch new file mode 100644 index 0000000000..bf4590ba37 --- /dev/null +++ b/queue-6.12/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch @@ -0,0 +1,48 @@ +From 9d8c4f018e476188fb67ad7862dec719fd9b9489 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 17:04:33 +0800 +Subject: ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path + +From: Haotian Zhang + +[ Upstream commit 5032347c04ba7ff9ba878f262e075d745c06a2a8 ] + +When pdacf_config() fails, snd_pdacf_probe() returns the error code +directly without freeing the sound card resources allocated by +snd_card_new(), which leads to a memory leak. + +Add proper error handling to free the sound card and clear the card +list entry when pdacf_config() fails. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Suggested-by: Takashi Iwai +Signed-off-by: Haotian Zhang +Link: https://patch.msgid.link/20251215090433.211-1-vulab@iscas.ac.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c +index 494460746614..7531e89e35da 100644 +--- a/sound/pcmcia/pdaudiocf/pdaudiocf.c ++++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c +@@ -131,7 +131,13 @@ static int snd_pdacf_probe(struct pcmcia_device *link) + link->config_index = 1; + link->config_regs = PRESENT_OPTION; + +- return pdacf_config(link); ++ err = pdacf_config(link); ++ if (err < 0) { ++ card_list[i] = NULL; ++ snd_card_free(card); ++ return err; ++ } ++ return 0; + } + + +-- +2.51.0 + diff --git a/queue-6.12/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch b/queue-6.12/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch new file mode 100644 index 0000000000..983ab50880 --- /dev/null +++ b/queue-6.12/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch @@ -0,0 +1,74 @@ +From d1de75c367a84e141441ee8b2cfc923b0baff4c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 10:46:30 +0800 +Subject: ALSA: usb-mixer: us16x08: validate meter packet indices + +From: Shipei Qu + +[ Upstream commit 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e ] + +get_meter_levels_from_urb() parses the 64-byte meter packets sent by +the device and fills the per-channel arrays meter_level[], +comp_level[] and master_level[] in struct snd_us16x08_meter_store. + +Currently the function derives the channel index directly from the +meter packet (MUB2(meter_urb, s) - 1) and uses it to index those +arrays without validating the range. If the packet contains a +negative or out-of-range channel number, the driver may write past +the end of these arrays. + +Introduce a local channel variable and validate it before updating the +arrays. We reject negative indices, limit meter_level[] and +comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[] +updates with ARRAY_SIZE(master_level). + +Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk") +Reported-by: DARKNAVY (@DarkNavyOrg) +Closes: https://lore.kernel.org/tencent_21C112743C44C1A2517FF219@qq.com +Signed-off-by: Shipei Qu +Link: https://patch.msgid.link/20251217024630.59576-1-qu@darknavy.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_us16x08.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c +index 20ac32635f1f..d05cb54de788 100644 +--- a/sound/usb/mixer_us16x08.c ++++ b/sound/usb/mixer_us16x08.c +@@ -656,17 +656,25 @@ static void get_meter_levels_from_urb(int s, + u8 *meter_urb) + { + int val = MUC2(meter_urb, s) + (MUC3(meter_urb, s) << 8); ++ int ch = MUB2(meter_urb, s) - 1; ++ ++ if (ch < 0) ++ return; + + if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 && + MUA2(meter_urb, s) == 0x04 && MUB0(meter_urb, s) == 0x62) { +- if (MUC0(meter_urb, s) == 0x72) +- store->meter_level[MUB2(meter_urb, s) - 1] = val; +- if (MUC0(meter_urb, s) == 0xb2) +- store->comp_level[MUB2(meter_urb, s) - 1] = val; ++ if (ch < SND_US16X08_MAX_CHANNELS) { ++ if (MUC0(meter_urb, s) == 0x72) ++ store->meter_level[ch] = val; ++ if (MUC0(meter_urb, s) == 0xb2) ++ store->comp_level[ch] = val; ++ } + } + if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 && +- MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) +- store->master_level[MUB2(meter_urb, s) - 1] = val; ++ MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) { ++ if (ch < ARRAY_SIZE(store->master_level)) ++ store->master_level[ch] = val; ++ } + } + + /* Function to retrieve current meter values from the device. +-- +2.51.0 + diff --git a/queue-6.12/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch b/queue-6.12/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch new file mode 100644 index 0000000000..3888891ba0 --- /dev/null +++ b/queue-6.12/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch @@ -0,0 +1,47 @@ +From 26a3189b37ae837c64ad1d2cd08ae53918d93367 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 12:26:52 +0800 +Subject: ALSA: vxpocket: Fix resource leak in vxpocket_probe error path + +From: Haotian Zhang + +[ Upstream commit 2a03b40deacbd293ac9aed0f9b11197dad54fe5f ] + +When vxpocket_config() fails, vxpocket_probe() returns the error code +directly without freeing the sound card resources allocated by +snd_card_new(), which leads to a memory leak. + +Add proper error handling to free the sound card and clear the +allocation bit when vxpocket_config() fails. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Haotian Zhang +Link: https://patch.msgid.link/20251215042652.695-1-vulab@iscas.ac.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pcmcia/vx/vxpocket.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c +index d2d5f64d63b4..e1f5b8cfeef0 100644 +--- a/sound/pcmcia/vx/vxpocket.c ++++ b/sound/pcmcia/vx/vxpocket.c +@@ -284,7 +284,13 @@ static int vxpocket_probe(struct pcmcia_device *p_dev) + + vxp->p_dev = p_dev; + +- return vxpocket_config(p_dev); ++ err = vxpocket_config(p_dev); ++ if (err < 0) { ++ card_alloc &= ~(1 << i); ++ snd_card_free(card); ++ return err; ++ } ++ return 0; + } + + static void vxpocket_detach(struct pcmcia_device *link) +-- +2.51.0 + diff --git a/queue-6.12/asoc-ak4458-remove-the-reset-operation-in-probe-and-.patch b/queue-6.12/asoc-ak4458-remove-the-reset-operation-in-probe-and-.patch new file mode 100644 index 0000000000..c487bc4ce4 --- /dev/null +++ b/queue-6.12/asoc-ak4458-remove-the-reset-operation-in-probe-and-.patch @@ -0,0 +1,50 @@ +From d21ea27bca81e1ff0a04f4c133971c352d500f74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 15:02:01 +0800 +Subject: ASoC: ak4458: remove the reset operation in probe and remove + +From: Shengjiu Wang + +[ Upstream commit 00b960a83c764208b0623089eb70af3685e3906f ] + +The reset_control handler has the reference count for usage, as there is +reset operation in runtime suspend and resume, then reset operation in +probe() would cause the reference count of reset not balanced. + +Previously add reset operation in probe and remove is to fix the compile +issue with !CONFIG_PM, as the driver has been update to use +RUNTIME_PM_OPS(), so that change can be reverted. + +Fixes: 1e0dff741b0a ("ASoC: ak4458: remove "reset-gpios" property handler") +Signed-off-by: Shengjiu Wang +Link: https://patch.msgid.link/20251216070201.358477-1-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/ak4458.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/sound/soc/codecs/ak4458.c b/sound/soc/codecs/ak4458.c +index fb1ab335a4c1..e2e12dbc8cf2 100644 +--- a/sound/soc/codecs/ak4458.c ++++ b/sound/soc/codecs/ak4458.c +@@ -790,16 +790,12 @@ static int ak4458_i2c_probe(struct i2c_client *i2c) + + pm_runtime_enable(&i2c->dev); + regcache_cache_only(ak4458->regmap, true); +- ak4458_reset(ak4458, false); + + return 0; + } + + static void ak4458_i2c_remove(struct i2c_client *i2c) + { +- struct ak4458_priv *ak4458 = i2c_get_clientdata(i2c); +- +- ak4458_reset(ak4458, true); + pm_runtime_disable(&i2c->dev); + } + +-- +2.51.0 + diff --git a/queue-6.12/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch b/queue-6.12/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch new file mode 100644 index 0000000000..0322a5f743 --- /dev/null +++ b/queue-6.12/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch @@ -0,0 +1,79 @@ +From bc1fceaf8c912827ce31126887a33d9769001177 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 16:16:26 +0100 +Subject: clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & + pcie_x4 + +From: Josua Mayer + +[ Upstream commit f0e6bc0c3ef4b4afb299bd6912586cafd5d864e9 ] + +CP110 based platforms rely on the bootloader for pci port +initialization. +TF-A actively prevents non-uboot re-configuration of pci lanes, and many +boards do not have software control over the pci card reset. + +If a pci port had link at boot-time and the clock is stopped at a later +point, the link fails and can not be recovered. + +PCI controller driver probe - and by extension ownership of a driver for +the pci clocks - may be delayed especially on large modular kernels, +causing the clock core to start disabling unused clocks. + +Add the CLK_IGNORE_UNUSED flag to the three pci port's clocks to ensure +they are not stopped before the pci controller driver has taken +ownership and tested for an existing link. + +This fixes failed pci link detection when controller driver probes late, +e.g. with arm64 defconfig and CONFIG_PHY_MVEBU_CP110_COMPHY=m. + +Closes: https://lore.kernel.org/r/b71596c7-461b-44b6-89ab-3cfbd492639f@solid-run.com +Signed-off-by: Josua Mayer +Reviewed-by: Andrew Lunn +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/cp110-system-controller.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c +index 03c59bf22106..b47c86906046 100644 +--- a/drivers/clk/mvebu/cp110-system-controller.c ++++ b/drivers/clk/mvebu/cp110-system-controller.c +@@ -110,6 +110,25 @@ static const char * const gate_base_names[] = { + [CP110_GATE_EIP197] = "eip197" + }; + ++static unsigned long gate_flags(const u8 bit_idx) ++{ ++ switch (bit_idx) { ++ case CP110_GATE_PCIE_X1_0: ++ case CP110_GATE_PCIE_X1_1: ++ case CP110_GATE_PCIE_X4: ++ /* ++ * If a port had an active link at boot time, stopping ++ * the clock creates a failed state from which controller ++ * driver can not recover. ++ * Prevent stopping this clock till after a driver has taken ++ * ownership. ++ */ ++ return CLK_IGNORE_UNUSED; ++ default: ++ return 0; ++ } ++}; ++ + struct cp110_gate_clk { + struct clk_hw hw; + struct regmap *regmap; +@@ -171,6 +190,7 @@ static struct clk_hw *cp110_register_gate(const char *name, + init.ops = &cp110_gate_ops; + init.parent_names = &parent_name; + init.num_parents = 1; ++ init.flags = gate_flags(bit_idx); + + gate->regmap = regmap; + gate->bit_idx = bit_idx; +-- +2.51.0 + diff --git a/queue-6.12/clk-qcom-dispcc-sm7150-fix-dispcc_mdss_pclk0_clk_src.patch b/queue-6.12/clk-qcom-dispcc-sm7150-fix-dispcc_mdss_pclk0_clk_src.patch new file mode 100644 index 0000000000..84a85d387c --- /dev/null +++ b/queue-6.12/clk-qcom-dispcc-sm7150-fix-dispcc_mdss_pclk0_clk_src.patch @@ -0,0 +1,38 @@ +From 5b81477732f777ef503a2a8436e5f35700bd75fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 14:34:32 +0200 +Subject: clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src + +From: Jens Reidel + +[ Upstream commit e3c13e0caa8ceb7dec1a7c4fcfd9dbef56a69fbe ] + +Set CLK_OPS_PARENT_ENABLE to ensure the parent gets prepared and enabled +when switching to it, fixing an "rcg didn't update its configuration" +warning. + +Signed-off-by: Jens Reidel +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250919-sm7150-dispcc-fixes-v1-3-308ad47c5fce@mainlining.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-sm7150.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/dispcc-sm7150.c b/drivers/clk/qcom/dispcc-sm7150.c +index d32bd7df1433..1e2a98a63511 100644 +--- a/drivers/clk/qcom/dispcc-sm7150.c ++++ b/drivers/clk/qcom/dispcc-sm7150.c +@@ -357,7 +357,7 @@ static struct clk_rcg2 dispcc_mdss_pclk0_clk_src = { + .name = "dispcc_mdss_pclk0_clk_src", + .parent_data = dispcc_parent_data_4, + .num_parents = ARRAY_SIZE(dispcc_parent_data_4), +- .flags = CLK_SET_RATE_PARENT, ++ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, + .ops = &clk_pixel_ops, + }, + }; +-- +2.51.0 + diff --git a/queue-6.12/exfat-fix-remount-failure-in-different-process-envir.patch b/queue-6.12/exfat-fix-remount-failure-in-different-process-envir.patch new file mode 100644 index 0000000000..c7511d07cb --- /dev/null +++ b/queue-6.12/exfat-fix-remount-failure-in-different-process-envir.patch @@ -0,0 +1,60 @@ +From 2595a36943c2a23b74577332b3856c9d4fb7d05b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 17:51:10 +0800 +Subject: exfat: fix remount failure in different process environments + +From: Yuezhang Mo + +[ Upstream commit 51fc7b4ce10ccab8ea5e4876bcdc42cf5202a0ef ] + +The kernel test robot reported that the exFAT remount operation +failed. The reason for the failure was that the process's umask +is different between mount and remount, causing fs_fmask and +fs_dmask are changed. + +Potentially, both gid and uid may also be changed. Therefore, when +initializing fs_context for remount, inherit these mount options +from the options used during mount. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-lkp/202511251637.81670f5c-lkp@intel.com +Signed-off-by: Yuezhang Mo +Signed-off-by: Namjae Jeon +Signed-off-by: Sasha Levin +--- + fs/exfat/super.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/fs/exfat/super.c b/fs/exfat/super.c +index 82acff400f4c..75c6d5046e31 100644 +--- a/fs/exfat/super.c ++++ b/fs/exfat/super.c +@@ -801,10 +801,21 @@ static int exfat_init_fs_context(struct fs_context *fc) + ratelimit_state_init(&sbi->ratelimit, DEFAULT_RATELIMIT_INTERVAL, + DEFAULT_RATELIMIT_BURST); + +- sbi->options.fs_uid = current_uid(); +- sbi->options.fs_gid = current_gid(); +- sbi->options.fs_fmask = current->fs->umask; +- sbi->options.fs_dmask = current->fs->umask; ++ if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE && fc->root) { ++ struct super_block *sb = fc->root->d_sb; ++ struct exfat_mount_options *cur_opts = &EXFAT_SB(sb)->options; ++ ++ sbi->options.fs_uid = cur_opts->fs_uid; ++ sbi->options.fs_gid = cur_opts->fs_gid; ++ sbi->options.fs_fmask = cur_opts->fs_fmask; ++ sbi->options.fs_dmask = cur_opts->fs_dmask; ++ } else { ++ sbi->options.fs_uid = current_uid(); ++ sbi->options.fs_gid = current_gid(); ++ sbi->options.fs_fmask = current->fs->umask; ++ sbi->options.fs_dmask = current->fs->umask; ++ } ++ + sbi->options.allow_utime = -1; + sbi->options.iocharset = exfat_default_iocharset; + sbi->options.errors = EXFAT_ERRORS_RO; +-- +2.51.0 + diff --git a/queue-6.12/exfat-zero-out-post-eof-page-cache-on-file-extension.patch b/queue-6.12/exfat-zero-out-post-eof-page-cache-on-file-extension.patch new file mode 100644 index 0000000000..42e289e7f7 --- /dev/null +++ b/queue-6.12/exfat-zero-out-post-eof-page-cache-on-file-extension.patch @@ -0,0 +1,63 @@ +From 604de3d0f79d148c2f216059f2d4022e09024aca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Oct 2025 17:03:41 +0800 +Subject: exfat: zero out post-EOF page cache on file extension + +From: Yuezhang Mo + +[ Upstream commit 4e163c39dd4e70fcdce948b8774d96e0482b4a11 ] + +xfstests generic/363 was failing due to unzeroed post-EOF page +cache that allowed mmap writes beyond EOF to become visible +after file extension. + +For example, in following xfs_io sequence, 0x22 should not be +written to the file but would become visible after the extension: + + xfs_io -f -t -c "pwrite -S 0x11 0 8" \ + -c "mmap 0 4096" \ + -c "mwrite -S 0x22 32 32" \ + -c "munmap" \ + -c "pwrite -S 0x33 512 32" \ + $testfile + +This violates the expected behavior where writes beyond EOF via +mmap should not persist after the file is extended. Instead, the +extended region should contain zeros. + +Fix this by using truncate_pagecache() to truncate the page cache +after the current EOF when extending the file. + +Signed-off-by: Yuezhang Mo +Signed-off-by: Namjae Jeon +Signed-off-by: Sasha Levin +--- + fs/exfat/file.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/exfat/file.c b/fs/exfat/file.c +index 7ac5126aa4f1..033852efe5dc 100644 +--- a/fs/exfat/file.c ++++ b/fs/exfat/file.c +@@ -25,6 +25,8 @@ static int exfat_cont_expand(struct inode *inode, loff_t size) + struct exfat_sb_info *sbi = EXFAT_SB(sb); + struct exfat_chain clu; + ++ truncate_pagecache(inode, i_size_read(inode)); ++ + ret = inode_newsize_ok(inode, size); + if (ret) + return ret; +@@ -587,6 +589,9 @@ static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter) + + inode_lock(inode); + ++ if (pos > i_size_read(inode)) ++ truncate_pagecache(inode, i_size_read(inode)); ++ + valid_size = ei->valid_size; + + ret = generic_write_checks(iocb, iter); +-- +2.51.0 + diff --git a/queue-6.12/firmware-imx-scu-irq-init-workqueue-before-request-m.patch b/queue-6.12/firmware-imx-scu-irq-init-workqueue-before-request-m.patch new file mode 100644 index 0000000000..c0e13b7c8d --- /dev/null +++ b/queue-6.12/firmware-imx-scu-irq-init-workqueue-before-request-m.patch @@ -0,0 +1,46 @@ +From f644f2a81bd920876c36075f18cafb659bd82b07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Oct 2025 09:56:26 +0800 +Subject: firmware: imx: scu-irq: Init workqueue before request mbox channel + +From: Peng Fan + +[ Upstream commit 81fb53feb66a3aefbf6fcab73bb8d06f5b0c54ad ] + +With mailbox channel requested, there is possibility that interrupts may +come in, so need to make sure the workqueue is initialized before +the queue is scheduled by mailbox rx callback. + +Reviewed-by: Frank Li +Signed-off-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/firmware/imx/imx-scu-irq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/imx/imx-scu-irq.c b/drivers/firmware/imx/imx-scu-irq.c +index f2b902e95b73..b9f6128d56f7 100644 +--- a/drivers/firmware/imx/imx-scu-irq.c ++++ b/drivers/firmware/imx/imx-scu-irq.c +@@ -214,6 +214,8 @@ int imx_scu_enable_general_irq_channel(struct device *dev) + cl->dev = dev; + cl->rx_callback = imx_scu_irq_callback; + ++ INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler); ++ + /* SCU general IRQ uses general interrupt channel 3 */ + ch = mbox_request_channel_byname(cl, "gip3"); + if (IS_ERR(ch)) { +@@ -223,8 +225,6 @@ int imx_scu_enable_general_irq_channel(struct device *dev) + return ret; + } + +- INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler); +- + if (!of_parse_phandle_with_args(dev->of_node, "mboxes", + "#mbox-cells", 0, &spec)) { + i = of_alias_get_id(spec.np, "mu"); +-- +2.51.0 + diff --git a/queue-6.12/fuse-always-flush-the-page-cache-before-fopen_direct.patch b/queue-6.12/fuse-always-flush-the-page-cache-before-fopen_direct.patch new file mode 100644 index 0000000000..9136779726 --- /dev/null +++ b/queue-6.12/fuse-always-flush-the-page-cache-before-fopen_direct.patch @@ -0,0 +1,36 @@ +From b6a23d526c91e657619171486556355431047014 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 00:21:18 +0200 +Subject: fuse: Always flush the page cache before FOPEN_DIRECT_IO write + +From: Bernd Schubert + +[ Upstream commit 1ce120dcefc056ce8af2486cebbb77a458aad4c3 ] + +This was done as condition on direct_io_allow_mmap, but I believe +this is not right, as a file might be open two times - once with +write-back enabled another time with FOPEN_DIRECT_IO. + +Signed-off-by: Bernd Schubert +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index a8218a3bc0b4..ec1b235df91d 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -1582,7 +1582,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, + if (!ia) + return -ENOMEM; + +- if (fopen_direct_io && fc->direct_io_allow_mmap) { ++ if (fopen_direct_io) { + res = filemap_write_and_wait_range(mapping, pos, pos + count - 1); + if (res) { + fuse_io_free(ia); +-- +2.51.0 + diff --git a/queue-6.12/fuse-invalidate-the-page-cache-after-fopen_direct_io.patch b/queue-6.12/fuse-invalidate-the-page-cache-after-fopen_direct_io.patch new file mode 100644 index 0000000000..0769584da3 --- /dev/null +++ b/queue-6.12/fuse-invalidate-the-page-cache-after-fopen_direct_io.patch @@ -0,0 +1,45 @@ +From 8b3241a6614108e8f08be5311bb11e8ca6f8c943 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 00:21:17 +0200 +Subject: fuse: Invalidate the page cache after FOPEN_DIRECT_IO write + +From: Bernd Schubert + +[ Upstream commit b359af8275a982a458e8df6c6beab1415be1f795 ] + +generic_file_direct_write() also does this and has a large +comment about. + +Reproducer here is xfstest's generic/209, which is exactly to +have competing DIO write and cached IO read. + +Signed-off-by: Bernd Schubert +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/file.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index ec1b235df91d..4c5cf2d116d2 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -1656,6 +1656,15 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, + if (res > 0) + *ppos = pos; + ++ if (res > 0 && write && fopen_direct_io) { ++ /* ++ * As in generic_file_direct_write(), invalidate after the ++ * write, to invalidate read-ahead cache that may have competed ++ * with the write. ++ */ ++ invalidate_inode_pages2_range(mapping, idx_from, idx_to); ++ } ++ + return res > 0 ? res : err; + } + EXPORT_SYMBOL_GPL(fuse_direct_io); +-- +2.51.0 + diff --git a/queue-6.12/i2c-designware-disable-smbus-interrupts-to-prevent-s.patch b/queue-6.12/i2c-designware-disable-smbus-interrupts-to-prevent-s.patch new file mode 100644 index 0000000000..efdf42f34f --- /dev/null +++ b/queue-6.12/i2c-designware-disable-smbus-interrupts-to-prevent-s.patch @@ -0,0 +1,60 @@ +From 851837c3e96759183e872e224080a6d1eca833b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Oct 2025 15:57:14 +0800 +Subject: i2c: designware: Disable SMBus interrupts to prevent storms from + mis-configured firmware + +From: Jinhui Guo + +[ Upstream commit d3429178ee51dd7155445d15a5ab87a45fae3c73 ] + +When probing the I2C master, disable SMBus interrupts to prevent +storms caused by broken firmware mis-configuring IC_SMBUS=1; the +handler never services them and a mis-configured SMBUS Master +extend-clock timeout or SMBUS Slave extend-clock timeout can +flood the CPU. + +Signed-off-by: Jinhui Guo +Reviewed-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20251021075714.3712-2-guojinhui.liam@bytedance.com +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-core.h | 1 + + drivers/i2c/busses/i2c-designware-master.c | 7 +++++++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h +index 2d32896d0673..e3d76e423842 100644 +--- a/drivers/i2c/busses/i2c-designware-core.h ++++ b/drivers/i2c/busses/i2c-designware-core.h +@@ -78,6 +78,7 @@ + #define DW_IC_TX_ABRT_SOURCE 0x80 + #define DW_IC_ENABLE_STATUS 0x9c + #define DW_IC_CLR_RESTART_DET 0xa8 ++#define DW_IC_SMBUS_INTR_MASK 0xcc + #define DW_IC_COMP_PARAM_1 0xf4 + #define DW_IC_COMP_VERSION 0xf8 + #define DW_IC_SDA_HOLD_MIN_VERS 0x3131312A /* "111*" == v1.11* */ +diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c +index 52dc666c3ef4..196bb073c6bc 100644 +--- a/drivers/i2c/busses/i2c-designware-master.c ++++ b/drivers/i2c/busses/i2c-designware-master.c +@@ -203,6 +203,13 @@ static int i2c_dw_init_master(struct dw_i2c_dev *dev) + /* Disable the adapter */ + __i2c_dw_disable(dev); + ++ /* ++ * Mask SMBus interrupts to block storms from broken ++ * firmware that leaves IC_SMBUS=1; the handler never ++ * services them. ++ */ ++ regmap_write(dev->map, DW_IC_SMBUS_INTR_MASK, 0); ++ + /* Write standard speed timing parameters */ + regmap_write(dev->map, DW_IC_SS_SCL_HCNT, dev->ss_hcnt); + regmap_write(dev->map, DW_IC_SS_SCL_LCNT, dev->ss_lcnt); +-- +2.51.0 + diff --git a/queue-6.12/iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch b/queue-6.12/iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch new file mode 100644 index 0000000000..51a1e10592 --- /dev/null +++ b/queue-6.12/iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch @@ -0,0 +1,49 @@ +From 4d85d2ad3751729814a68ab9b39d14f4c84ccf6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 17:12:50 +0800 +Subject: iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc + complains + +From: Pei Xiao + +[ Upstream commit c9fb952360d0c78bbe98239bd6b702f05c2dbb31 ] + +FIELD_PREP() checks that a value fits into the available bitfield, add a +check for step_avg to fix gcc complains. + +which gcc complains about: + drivers/iio/adc/ti_am335x_adc.c: In function 'tiadc_step_config': + include/linux/compiler_types.h:572:38: error: call to +'__compiletime_assert_491' declared with attribute error: FIELD_PREP: value +too large for the field include/linux/mfd/ti_am335x_tscadc.h:58:29: note: +in expansion of macro 'FIELD_PREP' + #define STEPCONFIG_AVG(val) FIELD_PREP(GENMASK(4, 2), (val)) + ^~~~~~~~~~ +drivers/iio/adc/ti_am335x_adc.c:127:17: note: in expansion of macro 'STEPCONFIG_AVG' + stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1) + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202510102117.Jqxrw1vF-lkp@intel.com/ +Signed-off-by: Pei Xiao +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ti_am335x_adc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c +index 426e3c9f88a1..205d1f103b3c 100644 +--- a/drivers/iio/adc/ti_am335x_adc.c ++++ b/drivers/iio/adc/ti_am335x_adc.c +@@ -123,7 +123,7 @@ static void tiadc_step_config(struct iio_dev *indio_dev) + + chan = adc_dev->channel_line[i]; + +- if (adc_dev->step_avg[i]) ++ if (adc_dev->step_avg[i] && adc_dev->step_avg[i] <= STEPCONFIG_AVG_16) + stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1) | + STEPCONFIG_FIFO1; + else +-- +2.51.0 + diff --git a/queue-6.12/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch b/queue-6.12/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch new file mode 100644 index 0000000000..454154a300 --- /dev/null +++ b/queue-6.12/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch @@ -0,0 +1,85 @@ +From 2e59e8a2f574287cf126a1c5519204847f07adbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:42:38 +0800 +Subject: ipmi: Fix __scan_channels() failing to rescan channels + +From: Jinhui Guo + +[ Upstream commit 6bd30d8fc523fb880b4be548e8501bc0fe8f42d4 ] + +channel_handler() sets intf->channels_ready to true but never +clears it, so __scan_channels() skips any rescan. When the BMC +firmware changes a rescan is required. Allow it by clearing +the flag before starting a new scan. + +Signed-off-by: Jinhui Guo +Message-ID: <20250930074239.2353-3-guojinhui.liam@bytedance.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_msghandler.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 29106325aba7..188722ec0337 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -613,7 +613,8 @@ static void __ipmi_bmc_unregister(struct ipmi_smi *intf); + static int __ipmi_bmc_register(struct ipmi_smi *intf, + struct ipmi_device_id *id, + bool guid_set, guid_t *guid, int intf_num); +-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id); ++static int __scan_channels(struct ipmi_smi *intf, ++ struct ipmi_device_id *id, bool rescan); + + + /* +@@ -2665,7 +2666,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, + if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num)) + need_waiter(intf); /* Retry later on an error. */ + else +- __scan_channels(intf, &id); ++ __scan_channels(intf, &id, false); + + + if (!intf_set) { +@@ -2685,7 +2686,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, + goto out_noprocessing; + } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id))) + /* Version info changes, scan the channels again. */ +- __scan_channels(intf, &bmc->fetch_id); ++ __scan_channels(intf, &bmc->fetch_id, true); + + bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; + +@@ -3435,10 +3436,17 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) + /* + * Must be holding intf->bmc_reg_mutex to call this. + */ +-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id) ++static int __scan_channels(struct ipmi_smi *intf, ++ struct ipmi_device_id *id, ++ bool rescan) + { + int rv; + ++ if (rescan) { ++ /* Clear channels_ready to force channels rescan. */ ++ intf->channels_ready = false; ++ } ++ + if (ipmi_version_major(id) > 1 + || (ipmi_version_major(id) == 1 + && ipmi_version_minor(id) >= 5)) { +@@ -3640,7 +3648,7 @@ int ipmi_add_smi(struct module *owner, + } + + mutex_lock(&intf->bmc_reg_mutex); +- rv = __scan_channels(intf, &id); ++ rv = __scan_channels(intf, &id, false); + mutex_unlock(&intf->bmc_reg_mutex); + if (rv) + goto out_err_bmc_reg; +-- +2.51.0 + diff --git a/queue-6.12/ipmi-fix-the-race-between-__scan_channels-and-delive.patch b/queue-6.12/ipmi-fix-the-race-between-__scan_channels-and-delive.patch new file mode 100644 index 0000000000..b80022532d --- /dev/null +++ b/queue-6.12/ipmi-fix-the-race-between-__scan_channels-and-delive.patch @@ -0,0 +1,90 @@ +From 5dc16937175c98bb2d793717a5429a82b379d606 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:42:37 +0800 +Subject: ipmi: Fix the race between __scan_channels() and deliver_response() + +From: Jinhui Guo + +[ Upstream commit 936750fdba4c45e13bbd17f261bb140dd55f5e93 ] + +The race window between __scan_channels() and deliver_response() causes +the parameters of some channels to be set to 0. + +1.[CPUA] __scan_channels() issues an IPMI request and waits with + wait_event() until all channels have been scanned. + wait_event() internally calls might_sleep(), which might + yield the CPU. (Moreover, an interrupt can preempt + wait_event() and force the task to yield the CPU.) +2.[CPUB] deliver_response() is invoked when the CPU receives the + IPMI response. After processing a IPMI response, + deliver_response() directly assigns intf->wchannels to + intf->channel_list and sets intf->channels_ready to true. + However, not all channels are actually ready for use. +3.[CPUA] Since intf->channels_ready is already true, wait_event() + never enters __wait_event(). __scan_channels() immediately + clears intf->null_user_handler and exits. +4.[CPUB] Once intf->null_user_handler is set to NULL, deliver_response() + ignores further IPMI responses, leaving the remaining + channels zero-initialized and unusable. + +CPUA CPUB +------------------------------- ----------------------------- +__scan_channels() + intf->null_user_handler + = channel_handler; + send_channel_info_cmd(intf, + 0); + wait_event(intf->waitq, + intf->channels_ready); + do { + might_sleep(); + deliver_response() + channel_handler() + intf->channel_list = + intf->wchannels + set; + intf->channels_ready = true; + send_channel_info_cmd(intf, + intf->curr_channel); + if (condition) + break; + __wait_event(wq_head, + condition); + } while(0) + intf->null_user_handler + = NULL; + deliver_response() + if (!msg->user) + if (intf->null_user_handler) + rv = -EINVAL; + return rv; +------------------------------- ----------------------------- + +Fix the race between __scan_channels() and deliver_response() by +deferring both the assignment intf->channel_list = intf->wchannels +and the flag intf->channels_ready = true until all channels have +been successfully scanned or until the IPMI request has failed. + +Signed-off-by: Jinhui Guo +Message-ID: <20250930074239.2353-2-guojinhui.liam@bytedance.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_msghandler.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 99fe01321971..29106325aba7 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -3414,8 +3414,6 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) + intf->channels_ready = true; + wake_up(&intf->waitq); + } else { +- intf->channel_list = intf->wchannels + set; +- intf->channels_ready = true; + rv = send_channel_info_cmd(intf, intf->curr_channel); + } + +-- +2.51.0 + diff --git a/queue-6.12/libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch b/queue-6.12/libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch new file mode 100644 index 0000000000..3a89122175 --- /dev/null +++ b/queue-6.12/libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch @@ -0,0 +1,47 @@ +From 93f7dae4e2d27f6bc82580d96ea52693a881d28a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 13:47:01 -0800 +Subject: libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map + +From: Ian Rogers + +[ Upstream commit a0a4173631bfcfd3520192c0a61cf911d6a52c3a ] + +Passing an empty map to perf_cpu_map__max triggered a SEGV. Explicitly +test for the empty map. + +Reported-by: Ingo Molnar +Closes: https://lore.kernel.org/linux-perf-users/aSwt7yzFjVJCEmVp@gmail.com/ +Tested-by: Ingo Molnar +Signed-off-by: Ian Rogers +Tested-by: Thomas Richter +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/lib/perf/cpumap.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/perf/cpumap.c b/tools/lib/perf/cpumap.c +index cae799ad44e1..e5938b91199f 100644 +--- a/tools/lib/perf/cpumap.c ++++ b/tools/lib/perf/cpumap.c +@@ -409,10 +409,12 @@ struct perf_cpu perf_cpu_map__max(const struct perf_cpu_map *map) + .cpu = -1 + }; + +- // cpu_map__trim_new() qsort()s it, cpu_map__default_new() sorts it as well. +- return __perf_cpu_map__nr(map) > 0 +- ? __perf_cpu_map__cpu(map, __perf_cpu_map__nr(map) - 1) +- : result; ++ if (!map) ++ return result; ++ ++ // The CPUs are always sorted and nr is always > 0 as 0 length map is ++ // encoded as NULL. ++ return __perf_cpu_map__cpu(map, __perf_cpu_map__nr(map) - 1); + } + + /** Is 'b' a subset of 'a'. */ +-- +2.51.0 + diff --git a/queue-6.12/mips-ftrace-fix-memory-corruption-when-kernel-is-loc.patch b/queue-6.12/mips-ftrace-fix-memory-corruption-when-kernel-is-loc.patch new file mode 100644 index 0000000000..cb7402b113 --- /dev/null +++ b/queue-6.12/mips-ftrace-fix-memory-corruption-when-kernel-is-loc.patch @@ -0,0 +1,83 @@ +From e24ad0f0c0054440b4c54dc95896343955c2fcff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 09:30:06 +0100 +Subject: MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 + bits + +From: Gregory CLEMENT + +[ Upstream commit 36dac9a3dda1f2bae343191bc16b910c603cac25 ] + +Since commit e424054000878 ("MIPS: Tracing: Reduce the overhead of +dynamic Function Tracer"), the macro UASM_i_LA_mostly has been used, +and this macro can generate more than 2 instructions. At the same +time, the code in ftrace assumes that no more than 2 instructions can +be generated, which is why it stores them in an int[2] array. However, +as previously noted, the macro UASM_i_LA_mostly (and now UASM_i_LA) +causes a buffer overflow when _mcount is beyond 32 bits. This leads to +corruption of the variables located in the __read_mostly section. + +This corruption was observed because the variable +__cpu_primary_thread_mask was corrupted, causing a hang very early +during boot. + +This fix prevents the corruption by avoiding the generation of +instructions if they could exceed 2 instructions in +length. Fortunately, insn_la_mcount is only used if the instrumented +code is located outside the kernel code section, so dynamic ftrace can +still be used, albeit in a more limited scope. This is still +preferable to corrupting memory and/or crashing the kernel. + +Signed-off-by: Gregory CLEMENT +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/ftrace.c | 25 +++++++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) + +diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c +index f39e85fd58fa..b15615b28569 100644 +--- a/arch/mips/kernel/ftrace.c ++++ b/arch/mips/kernel/ftrace.c +@@ -54,10 +54,20 @@ static inline void ftrace_dyn_arch_init_insns(void) + u32 *buf; + unsigned int v1; + +- /* la v1, _mcount */ +- v1 = 3; +- buf = (u32 *)&insn_la_mcount[0]; +- UASM_i_LA(&buf, v1, MCOUNT_ADDR); ++ /* If we are not in compat space, the number of generated ++ * instructions will exceed the maximum expected limit of 2. ++ * To prevent buffer overflow, we avoid generating them. ++ * insn_la_mcount will not be used later in ftrace_make_call. ++ */ ++ if (uasm_in_compat_space_p(MCOUNT_ADDR)) { ++ /* la v1, _mcount */ ++ v1 = 3; ++ buf = (u32 *)&insn_la_mcount[0]; ++ UASM_i_LA(&buf, v1, MCOUNT_ADDR); ++ } else { ++ pr_warn("ftrace: mcount address beyond 32 bits is not supported (%lX)\n", ++ MCOUNT_ADDR); ++ } + + /* jal (ftrace_caller + 8), jump over the first two instruction */ + buf = (u32 *)&insn_jal_ftrace_caller; +@@ -189,6 +199,13 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) + unsigned int new; + unsigned long ip = rec->ip; + ++ /* When the code to patch does not belong to the kernel code ++ * space, we must use insn_la_mcount. However, if MCOUNT_ADDR ++ * is not in compat space, insn_la_mcount is not usable. ++ */ ++ if (!core_kernel_text(ip) && !uasm_in_compat_space_p(MCOUNT_ADDR)) ++ return -EFAULT; ++ + new = core_kernel_text(ip) ? insn_jal_ftrace_caller : insn_la_mcount[0]; + + #ifdef CONFIG_64BIT +-- +2.51.0 + diff --git a/queue-6.12/nfsd-fix-memory-leak-in-nfsd_create_serv-error-paths.patch b/queue-6.12/nfsd-fix-memory-leak-in-nfsd_create_serv-error-paths.patch new file mode 100644 index 0000000000..d4806b4cf2 --- /dev/null +++ b/queue-6.12/nfsd-fix-memory-leak-in-nfsd_create_serv-error-paths.patch @@ -0,0 +1,64 @@ +From 1209a3dd1c94e6f55df34fdcda276f5d1622803d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 17:41:21 +0530 +Subject: nfsd: fix memory leak in nfsd_create_serv error paths + +From: Shardul Bankar + +[ Upstream commit df8d829bba3adcf3cc744c01d933b6fd7cf06e91 ] + +When nfsd_create_serv() calls percpu_ref_init() to initialize +nn->nfsd_net_ref, it allocates both a percpu reference counter +and a percpu_ref_data structure (64 bytes). However, if the +function fails later due to svc_create_pooled() returning NULL +or svc_bind() returning an error, these allocations are not +cleaned up, resulting in a memory leak. + +The leak manifests as: +- Unreferenced percpu allocation (8 bytes per CPU) +- Unreferenced percpu_ref_data structure (64 bytes) + +Fix this by adding percpu_ref_exit() calls in both error paths +to properly clean up the percpu_ref_init() allocations. + +This patch fixes the percpu_ref leak in nfsd_create_serv() seen +as an auxiliary leak in syzbot report 099461f8558eb0a1f4f3; the +prepare_creds() and vsock-related leaks in the same report +remain to be addressed separately. + +Reported-by: syzbot+099461f8558eb0a1f4f3@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=099461f8558eb0a1f4f3 +Fixes: 47e988147f40 ("nfsd: add nfsd_serv_try_get and nfsd_serv_put") +Signed-off-by: Shardul Bankar +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfssvc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c +index 571a6ae90833..cc185c00e309 100644 +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -667,13 +667,16 @@ int nfsd_create_serv(struct net *net) + serv = svc_create_pooled(nfsd_programs, ARRAY_SIZE(nfsd_programs), + &nn->nfsd_svcstats, + nfsd_max_blksize, nfsd); +- if (serv == NULL) ++ if (serv == NULL) { ++ percpu_ref_exit(&nn->nfsd_net_ref); + return -ENOMEM; ++ } + + serv->sv_maxconn = nn->max_connections; + error = svc_bind(serv, net); + if (error < 0) { + svc_destroy(&serv); ++ percpu_ref_exit(&nn->nfsd_net_ref); + return error; + } + spin_lock(&nfsd_notifier_lock); +-- +2.51.0 + diff --git a/queue-6.12/nfsd-rename-nfsd_serv_-prefixed-methods-and-variable.patch b/queue-6.12/nfsd-rename-nfsd_serv_-prefixed-methods-and-variable.patch new file mode 100644 index 0000000000..52e5c5e183 --- /dev/null +++ b/queue-6.12/nfsd-rename-nfsd_serv_-prefixed-methods-and-variable.patch @@ -0,0 +1,358 @@ +From dcdf956b530de8f7ee73d9e06218996ac58b0cf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2024 20:40:59 -0500 +Subject: nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_ + +From: Mike Snitzer + +[ Upstream commit b33f7dec3a67216123312c7bb752b8f6faa1c465 ] + +Also update Documentation/filesystems/nfs/localio.rst accordingly +and reduce the technical documentation debt that was previously +captured in that document. + +Signed-off-by: Mike Snitzer +Reviewed-by: Jeff Layton +Acked-by: Chuck Lever +Signed-off-by: Anna Schumaker +Stable-dep-of: df8d829bba3a ("nfsd: fix memory leak in nfsd_create_serv error paths") +Signed-off-by: Sasha Levin +--- + Documentation/filesystems/nfs/localio.rst | 85 +++++++---------------- + fs/nfs_common/nfslocalio.c | 10 ++- + fs/nfsd/filecache.c | 2 +- + fs/nfsd/localio.c | 4 +- + fs/nfsd/netns.h | 11 +-- + fs/nfsd/nfssvc.c | 34 ++++----- + include/linux/nfslocalio.h | 12 ++-- + 7 files changed, 66 insertions(+), 92 deletions(-) + +diff --git a/Documentation/filesystems/nfs/localio.rst b/Documentation/filesystems/nfs/localio.rst +index 20fc901a08f4..7d2dbf75e96d 100644 +--- a/Documentation/filesystems/nfs/localio.rst ++++ b/Documentation/filesystems/nfs/localio.rst +@@ -218,64 +218,30 @@ NFS Client and Server Interlock + =============================== + + LOCALIO provides the nfs_uuid_t object and associated interfaces to +-allow proper network namespace (net-ns) and NFSD object refcounting: +- +- We don't want to keep a long-term counted reference on each NFSD's +- net-ns in the client because that prevents a server container from +- completely shutting down. +- +- So we avoid taking a reference at all and rely on the per-cpu +- reference to the server (detailed below) being sufficient to keep +- the net-ns active. This involves allowing the NFSD's net-ns exit +- code to iterate all active clients and clear their ->net pointers +- (which are needed to find the per-cpu-refcount for the nfsd_serv). +- +- Details: +- +- - Embed nfs_uuid_t in nfs_client. nfs_uuid_t provides a list_head +- that can be used to find the client. It does add the 16-byte +- uuid_t to nfs_client so it is bigger than needed (given that +- uuid_t is only used during the initial NFS client and server +- LOCALIO handshake to determine if they are local to each other). +- If that is really a problem we can find a fix. +- +- - When the nfs server confirms that the uuid_t is local, it moves +- the nfs_uuid_t onto a per-net-ns list in NFSD's nfsd_net. +- +- - When each server's net-ns is shutting down - in a "pre_exit" +- handler, all these nfs_uuid_t have their ->net cleared. There is +- an rcu_synchronize() call between pre_exit() handlers and exit() +- handlers so any caller that sees nfs_uuid_t ->net as not NULL can +- safely manage the per-cpu-refcount for nfsd_serv. +- +- - The client's nfs_uuid_t is passed to nfsd_open_local_fh() so it +- can safely dereference ->net in a private rcu_read_lock() section +- to allow safe access to the associated nfsd_net and nfsd_serv. +- +-So LOCALIO required the introduction and use of NFSD's percpu_ref to +-interlock nfsd_destroy_serv() and nfsd_open_local_fh(), to ensure each +-nn->nfsd_serv is not destroyed while in use by nfsd_open_local_fh(), and ++allow proper network namespace (net-ns) and NFSD object refcounting. ++ ++LOCALIO required the introduction and use of NFSD's percpu nfsd_net_ref ++to interlock nfsd_shutdown_net() and nfsd_open_local_fh(), to ensure ++each net-ns is not destroyed while in use by nfsd_open_local_fh(), and + warrants a more detailed explanation: + +- nfsd_open_local_fh() uses nfsd_serv_try_get() before opening its ++ nfsd_open_local_fh() uses nfsd_net_try_get() before opening its + nfsd_file handle and then the caller (NFS client) must drop the +- reference for the nfsd_file and associated nn->nfsd_serv using +- nfs_file_put_local() once it has completed its IO. ++ reference for the nfsd_file and associated net-ns using ++ nfsd_file_put_local() once it has completed its IO. + + This interlock working relies heavily on nfsd_open_local_fh() being + afforded the ability to safely deal with the possibility that the + NFSD's net-ns (and nfsd_net by association) may have been destroyed +- by nfsd_destroy_serv() via nfsd_shutdown_net() -- which is only +- possible given the nfs_uuid_t ->net pointer managemenet detailed +- above. +- +-All told, this elaborate interlock of the NFS client and server has been +-verified to fix an easy to hit crash that would occur if an NFSD +-instance running in a container, with a LOCALIO client mounted, is +-shutdown. Upon restart of the container and associated NFSD the client +-would go on to crash due to NULL pointer dereference that occurred due +-to the LOCALIO client's attempting to nfsd_open_local_fh(), using +-nn->nfsd_serv, without having a proper reference on nn->nfsd_serv. ++ by nfsd_destroy_serv() via nfsd_shutdown_net(). ++ ++This interlock of the NFS client and server has been verified to fix an ++easy to hit crash that would occur if an NFSD instance running in a ++container, with a LOCALIO client mounted, is shutdown. Upon restart of ++the container and associated NFSD, the client would go on to crash due ++to NULL pointer dereference that occurred due to the LOCALIO client's ++attempting to nfsd_open_local_fh() without having a proper reference on ++NFSD's net-ns. + + NFS Client issues IO instead of Server + ====================================== +@@ -308,16 +274,19 @@ fs/nfs/localio.c:nfs_local_commit(). + + With normal NFS that makes use of RPC to issue IO to the server, if an + application uses O_DIRECT the NFS client will bypass the pagecache but +-the NFS server will not. Because the NFS server's use of buffered IO +-affords applications to be less precise with their alignment when +-issuing IO to the NFS client. LOCALIO can be configured to use O_DIRECT +-semantics by setting the 'localio_O_DIRECT_semantics' nfs module ++the NFS server will not. The NFS server's use of buffered IO affords ++applications to be less precise with their alignment when issuing IO to ++the NFS client. But if all applications properly align their IO, LOCALIO ++can be configured to use end-to-end O_DIRECT semantics from the NFS ++client to the underlying local filesystem, that it is sharing with ++the NFS server, by setting the 'localio_O_DIRECT_semantics' nfs module + parameter to Y, e.g.: + +- echo Y > /sys/module/nfs/parameters/localio_O_DIRECT_semantics ++ echo Y > /sys/module/nfs/parameters/localio_O_DIRECT_semantics + +-Once enabled, it will cause LOCALIO to use O_DIRECT semantics (this may +-cause IO to fail if applications do not properly align their IO). ++Once enabled, it will cause LOCALIO to use end-to-end O_DIRECT semantics ++(but again, this may cause IO to fail if applications do not properly ++align their IO). + + Security + ======== +diff --git a/fs/nfs_common/nfslocalio.c b/fs/nfs_common/nfslocalio.c +index a74ec08f6c96..e6fbc45ec4f1 100644 +--- a/fs/nfs_common/nfslocalio.c ++++ b/fs/nfs_common/nfslocalio.c +@@ -128,6 +128,10 @@ void nfs_uuid_invalidate_one_client(nfs_uuid_t *nfs_uuid) + } + EXPORT_SYMBOL_GPL(nfs_uuid_invalidate_one_client); + ++/* ++ * Caller is responsible for calling nfsd_net_put and ++ * nfsd_file_put (via nfs_to_nfsd_file_put_local). ++ */ + struct nfsd_file *nfs_open_local_fh(nfs_uuid_t *uuid, + struct rpc_clnt *rpc_clnt, const struct cred *cred, + const struct nfs_fh *nfs_fh, const fmode_t fmode) +@@ -139,7 +143,7 @@ struct nfsd_file *nfs_open_local_fh(nfs_uuid_t *uuid, + * Not running in nfsd context, so must safely get reference on nfsd_serv. + * But the server may already be shutting down, if so disallow new localio. + * uuid->net is NOT a counted reference, but rcu_read_lock() ensures that +- * if uuid->net is not NULL, then calling nfsd_serv_try_get() is safe ++ * if uuid->net is not NULL, then calling nfsd_net_try_get() is safe + * and if it succeeds we will have an implied reference to the net. + * + * Otherwise NFS may not have ref on NFSD and therefore cannot safely +@@ -147,12 +151,12 @@ struct nfsd_file *nfs_open_local_fh(nfs_uuid_t *uuid, + */ + rcu_read_lock(); + net = rcu_dereference(uuid->net); +- if (!net || !nfs_to->nfsd_serv_try_get(net)) { ++ if (!net || !nfs_to->nfsd_net_try_get(net)) { + rcu_read_unlock(); + return ERR_PTR(-ENXIO); + } + rcu_read_unlock(); +- /* We have an implied reference to net thanks to nfsd_serv_try_get */ ++ /* We have an implied reference to net thanks to nfsd_net_try_get */ + localio = nfs_to->nfsd_open_local_fh(net, uuid->dom, rpc_clnt, + cred, nfs_fh, fmode); + if (IS_ERR(localio)) +diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c +index d19968881855..05f0a4867673 100644 +--- a/fs/nfsd/filecache.c ++++ b/fs/nfsd/filecache.c +@@ -391,7 +391,7 @@ nfsd_file_put(struct nfsd_file *nf) + } + + /** +- * nfsd_file_put_local - put nfsd_file reference and arm nfsd_serv_put in caller ++ * nfsd_file_put_local - put nfsd_file reference and arm nfsd_net_put in caller + * @nf: nfsd_file of which to put the reference + * + * First save the associated net to return to caller, then put +diff --git a/fs/nfsd/localio.c b/fs/nfsd/localio.c +index f441cb9f74d5..ce6d408598c7 100644 +--- a/fs/nfsd/localio.c ++++ b/fs/nfsd/localio.c +@@ -25,8 +25,8 @@ + #include "cache.h" + + static const struct nfsd_localio_operations nfsd_localio_ops = { +- .nfsd_serv_try_get = nfsd_serv_try_get, +- .nfsd_serv_put = nfsd_serv_put, ++ .nfsd_net_try_get = nfsd_net_try_get, ++ .nfsd_net_put = nfsd_net_put, + .nfsd_open_local_fh = nfsd_open_local_fh, + .nfsd_file_put_local = nfsd_file_put_local, + .nfsd_file_file = nfsd_file_file, +diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h +index a05a45bb1978..ceab4a3e503f 100644 +--- a/fs/nfsd/netns.h ++++ b/fs/nfsd/netns.h +@@ -140,9 +140,10 @@ struct nfsd_net { + + struct svc_info nfsd_info; + #define nfsd_serv nfsd_info.serv +- struct percpu_ref nfsd_serv_ref; +- struct completion nfsd_serv_confirm_done; +- struct completion nfsd_serv_free_done; ++ ++ struct percpu_ref nfsd_net_ref; ++ struct completion nfsd_net_confirm_done; ++ struct completion nfsd_net_free_done; + + /* + * clientid and stateid data for construction of net unique COPY +@@ -229,8 +230,8 @@ struct nfsd_net { + extern bool nfsd_support_version(int vers); + extern unsigned int nfsd_net_id; + +-bool nfsd_serv_try_get(struct net *net); +-void nfsd_serv_put(struct net *net); ++bool nfsd_net_try_get(struct net *net); ++void nfsd_net_put(struct net *net); + + void nfsd_copy_write_verifier(__be32 verf[2], struct nfsd_net *nn); + void nfsd_reset_write_verifier(struct nfsd_net *nn); +diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c +index f9bb408478dc..571a6ae90833 100644 +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -214,32 +214,32 @@ int nfsd_minorversion(struct nfsd_net *nn, u32 minorversion, enum vers_op change + return 0; + } + +-bool nfsd_serv_try_get(struct net *net) __must_hold(rcu) ++bool nfsd_net_try_get(struct net *net) __must_hold(rcu) + { + struct nfsd_net *nn = net_generic(net, nfsd_net_id); + +- return (nn && percpu_ref_tryget_live(&nn->nfsd_serv_ref)); ++ return (nn && percpu_ref_tryget_live(&nn->nfsd_net_ref)); + } + +-void nfsd_serv_put(struct net *net) __must_hold(rcu) ++void nfsd_net_put(struct net *net) __must_hold(rcu) + { + struct nfsd_net *nn = net_generic(net, nfsd_net_id); + +- percpu_ref_put(&nn->nfsd_serv_ref); ++ percpu_ref_put(&nn->nfsd_net_ref); + } + +-static void nfsd_serv_done(struct percpu_ref *ref) ++static void nfsd_net_done(struct percpu_ref *ref) + { +- struct nfsd_net *nn = container_of(ref, struct nfsd_net, nfsd_serv_ref); ++ struct nfsd_net *nn = container_of(ref, struct nfsd_net, nfsd_net_ref); + +- complete(&nn->nfsd_serv_confirm_done); ++ complete(&nn->nfsd_net_confirm_done); + } + +-static void nfsd_serv_free(struct percpu_ref *ref) ++static void nfsd_net_free(struct percpu_ref *ref) + { +- struct nfsd_net *nn = container_of(ref, struct nfsd_net, nfsd_serv_ref); ++ struct nfsd_net *nn = container_of(ref, struct nfsd_net, nfsd_net_ref); + +- complete(&nn->nfsd_serv_free_done); ++ complete(&nn->nfsd_net_free_done); + } + + /* +@@ -437,8 +437,8 @@ static void nfsd_shutdown_net(struct net *net) + if (!nn->nfsd_net_up) + return; + +- percpu_ref_kill_and_confirm(&nn->nfsd_serv_ref, nfsd_serv_done); +- wait_for_completion(&nn->nfsd_serv_confirm_done); ++ percpu_ref_kill_and_confirm(&nn->nfsd_net_ref, nfsd_net_done); ++ wait_for_completion(&nn->nfsd_net_confirm_done); + + nfsd_export_flush(net); + nfs4_state_shutdown_net(net); +@@ -449,8 +449,8 @@ static void nfsd_shutdown_net(struct net *net) + nn->lockd_up = false; + } + +- wait_for_completion(&nn->nfsd_serv_free_done); +- percpu_ref_exit(&nn->nfsd_serv_ref); ++ wait_for_completion(&nn->nfsd_net_free_done); ++ percpu_ref_exit(&nn->nfsd_net_ref); + + nn->nfsd_net_up = false; + nfsd_shutdown_generic(); +@@ -654,12 +654,12 @@ int nfsd_create_serv(struct net *net) + if (nn->nfsd_serv) + return 0; + +- error = percpu_ref_init(&nn->nfsd_serv_ref, nfsd_serv_free, ++ error = percpu_ref_init(&nn->nfsd_net_ref, nfsd_net_free, + 0, GFP_KERNEL); + if (error) + return error; +- init_completion(&nn->nfsd_serv_free_done); +- init_completion(&nn->nfsd_serv_confirm_done); ++ init_completion(&nn->nfsd_net_free_done); ++ init_completion(&nn->nfsd_net_confirm_done); + + if (nfsd_max_blksize == 0) + nfsd_max_blksize = nfsd_get_default_max_blksize(); +diff --git a/include/linux/nfslocalio.h b/include/linux/nfslocalio.h +index 9202f4b24343..e1b8018ba639 100644 +--- a/include/linux/nfslocalio.h ++++ b/include/linux/nfslocalio.h +@@ -47,8 +47,8 @@ nfsd_open_local_fh(struct net *, struct auth_domain *, struct rpc_clnt *, + const fmode_t) __must_hold(rcu); + + struct nfsd_localio_operations { +- bool (*nfsd_serv_try_get)(struct net *); +- void (*nfsd_serv_put)(struct net *); ++ bool (*nfsd_net_try_get)(struct net *); ++ void (*nfsd_net_put)(struct net *); + struct nfsd_file *(*nfsd_open_local_fh)(struct net *, + struct auth_domain *, + struct rpc_clnt *, +@@ -69,12 +69,12 @@ struct nfsd_file *nfs_open_local_fh(nfs_uuid_t *, + static inline void nfs_to_nfsd_net_put(struct net *net) + { + /* +- * Once reference to nfsd_serv is dropped, NFSD could be +- * unloaded, so ensure safe return from nfsd_file_put_local() +- * by always taking RCU. ++ * Once reference to net (and associated nfsd_serv) is dropped, NFSD ++ * could be unloaded, so ensure safe return from nfsd_net_put() by ++ * always taking RCU. + */ + rcu_read_lock(); +- nfs_to->nfsd_serv_put(net); ++ nfs_to->nfsd_net_put(net); + rcu_read_unlock(); + } + +-- +2.51.0 + diff --git a/queue-6.12/nfsd-update-percpu_ref-to-manage-references-on-nfsd_.patch b/queue-6.12/nfsd-update-percpu_ref-to-manage-references-on-nfsd_.patch new file mode 100644 index 0000000000..706c4e44ab --- /dev/null +++ b/queue-6.12/nfsd-update-percpu_ref-to-manage-references-on-nfsd_.patch @@ -0,0 +1,69 @@ +From 5074ab86f3edcc55cb6b7a574f9042a1516d2969 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2024 20:40:58 -0500 +Subject: nfsd: update percpu_ref to manage references on nfsd_net + +From: Mike Snitzer + +[ Upstream commit 39972494e318a21b3059287909fc090186dbe60a ] + +Holding a reference on nfsd_net is what is required, it was never +actually about ensuring nn->nfsd_serv available. + +Move waiting for outstanding percpu references from +nfsd_destroy_serv() to nfsd_shutdown_net(). + +By moving it later it will be possible to invalidate localio clients +during nfsd_file_cache_shutdown_net() via __nfsd_file_cache_purge(). + +Signed-off-by: Mike Snitzer +Reviewed-by: Jeff Layton +Acked-by: Chuck Lever +Signed-off-by: Anna Schumaker +Stable-dep-of: df8d829bba3a ("nfsd: fix memory leak in nfsd_create_serv error paths") +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfssvc.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c +index 45f1bb2c6f13..f9bb408478dc 100644 +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -436,6 +436,10 @@ static void nfsd_shutdown_net(struct net *net) + + if (!nn->nfsd_net_up) + return; ++ ++ percpu_ref_kill_and_confirm(&nn->nfsd_serv_ref, nfsd_serv_done); ++ wait_for_completion(&nn->nfsd_serv_confirm_done); ++ + nfsd_export_flush(net); + nfs4_state_shutdown_net(net); + nfsd_reply_cache_shutdown(nn); +@@ -444,7 +448,10 @@ static void nfsd_shutdown_net(struct net *net) + lockd_down(net); + nn->lockd_up = false; + } ++ ++ wait_for_completion(&nn->nfsd_serv_free_done); + percpu_ref_exit(&nn->nfsd_serv_ref); ++ + nn->nfsd_net_up = false; + nfsd_shutdown_generic(); + } +@@ -526,11 +533,6 @@ void nfsd_destroy_serv(struct net *net) + + lockdep_assert_held(&nfsd_mutex); + +- percpu_ref_kill_and_confirm(&nn->nfsd_serv_ref, nfsd_serv_done); +- wait_for_completion(&nn->nfsd_serv_confirm_done); +- wait_for_completion(&nn->nfsd_serv_free_done); +- /* percpu_ref_exit is called in nfsd_shutdown_net */ +- + spin_lock(&nfsd_notifier_lock); + nn->nfsd_serv = NULL; + spin_unlock(&nfsd_notifier_lock); +-- +2.51.0 + diff --git a/queue-6.12/nvme-fabrics-add-enokey-to-no-retry-criteria-for-aut.patch b/queue-6.12/nvme-fabrics-add-enokey-to-no-retry-criteria-for-aut.patch new file mode 100644 index 0000000000..a70a5fda33 --- /dev/null +++ b/queue-6.12/nvme-fabrics-add-enokey-to-no-retry-criteria-for-aut.patch @@ -0,0 +1,43 @@ +From e03d7ce9bfac2a872a4c791331a862e65fe5d751 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 10:43:43 -0800 +Subject: nvme-fabrics: add ENOKEY to no retry criteria for authentication + failures + +From: Justin Tee + +[ Upstream commit 13989207ee29c40501e719512e8dc90768325895 ] + +With authentication, in addition to EKEYREJECTED there is also no point in +retrying reconnects when status is ENOKEY. Thus, add -ENOKEY as another +criteria to determine when to stop retries. + +Cc: Daniel Wagner +Cc: Hannes Reinecke +Closes: https://lore.kernel.org/linux-nvme/20250829-nvme-fc-sync-v3-0-d69c87e63aee@kernel.org/ +Signed-off-by: Justin Tee +Tested-by: Daniel Wagner +Reviewed-by: Daniel Wagner +Reviewed-by: Hannes Reinecke +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fabrics.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c +index 432efcbf9e2f..2e47c56b2d4b 100644 +--- a/drivers/nvme/host/fabrics.c ++++ b/drivers/nvme/host/fabrics.c +@@ -591,7 +591,7 @@ bool nvmf_should_reconnect(struct nvme_ctrl *ctrl, int status) + if (status > 0 && (status & NVME_STATUS_DNR)) + return false; + +- if (status == -EKEYREJECTED) ++ if (status == -EKEYREJECTED || status == -ENOKEY) + return false; + + if (ctrl->opts->max_reconnects == -1 || +-- +2.51.0 + diff --git a/queue-6.12/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch b/queue-6.12/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch new file mode 100644 index 0000000000..68c3ae8df7 --- /dev/null +++ b/queue-6.12/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch @@ -0,0 +1,64 @@ +From 4bcf19f1ebd641c4729453d734cd0812264213c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 11:05:45 +0100 +Subject: nvme-fc: don't hold rport lock when putting ctrl + +From: Daniel Wagner + +[ Upstream commit b71cbcf7d170e51148d5467820ae8a72febcb651 ] + +nvme_fc_ctrl_put can acquire the rport lock when freeing the +ctrl object: + +nvme_fc_ctrl_put + nvme_fc_ctrl_free + spin_lock_irqsave(rport->lock) + +Thus we can't hold the rport lock when calling nvme_fc_ctrl_put. + +Justin suggested use the safe list iterator variant because +nvme_fc_ctrl_put will also modify the rport->list. + +Cc: Justin Tee +Reviewed-by: Christoph Hellwig +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index d01bd3c300fa..3d90ace0b537 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -1462,14 +1462,14 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport, + { + struct fcnvme_ls_disconnect_assoc_rqst *rqst = + &lsop->rqstbuf->rq_dis_assoc; +- struct nvme_fc_ctrl *ctrl, *ret = NULL; ++ struct nvme_fc_ctrl *ctrl, *tmp, *ret = NULL; + struct nvmefc_ls_rcv_op *oldls = NULL; + u64 association_id = be64_to_cpu(rqst->associd.association_id); + unsigned long flags; + + spin_lock_irqsave(&rport->lock, flags); + +- list_for_each_entry(ctrl, &rport->ctrl_list, ctrl_list) { ++ list_for_each_entry_safe(ctrl, tmp, &rport->ctrl_list, ctrl_list) { + if (!nvme_fc_ctrl_get(ctrl)) + continue; + spin_lock(&ctrl->lock); +@@ -1482,7 +1482,9 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport, + if (ret) + /* leave the ctrl get reference */ + break; ++ spin_unlock_irqrestore(&rport->lock, flags); + nvme_fc_ctrl_put(ctrl); ++ spin_lock_irqsave(&rport->lock, flags); + } + + spin_unlock_irqrestore(&rport->lock, flags); +-- +2.51.0 + diff --git a/queue-6.12/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch b/queue-6.12/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch new file mode 100644 index 0000000000..d653b8c7dc --- /dev/null +++ b/queue-6.12/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch @@ -0,0 +1,56 @@ +From 6dd01971aa603b8686df38d9fb701bb1d20da573 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 15:04:07 +0800 +Subject: platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI + quirks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chia-Lin Kao (AceLan) + +[ Upstream commit b169e1733cadb614e87f69d7a5ae1b186c50d313 ] + +Dell Pro Rugged 10/12 tablets has a reliable VGBS method. +If VGBS is not called on boot, the on-screen keyboard won't appear if the +device is booted without a keyboard. + +Call VGBS on boot on thess devices to get the initial state of +SW_TABLET_MODE in a reliable way. + +Signed-off-by: Chia-Lin Kao (AceLan) +Reviewed-by: Hans de Goede +Link: https://patch.msgid.link/20251127070407.656463-1-acelan.kao@canonical.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/hid.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c +index 59392f1a0d8a..04056fbd9219 100644 +--- a/drivers/platform/x86/intel/hid.c ++++ b/drivers/platform/x86/intel/hid.c +@@ -168,6 +168,18 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite Dragonfly G2 Notebook PC"), + }, + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 10 Tablet RA00260"), ++ }, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 12 Tablet RA02260"), ++ }, ++ }, + { } + }; + +-- +2.51.0 + diff --git a/queue-6.12/powerpc-addnote-fix-overflow-on-32-bit-builds.patch b/queue-6.12/powerpc-addnote-fix-overflow-on-32-bit-builds.patch new file mode 100644 index 0000000000..148d76174b --- /dev/null +++ b/queue-6.12/powerpc-addnote-fix-overflow-on-32-bit-builds.patch @@ -0,0 +1,50 @@ +From 34aed5e4db5932f9b78832549e794d3e06d702c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 22:31:13 -0400 +Subject: powerpc/addnote: Fix overflow on 32-bit builds + +From: Ben Collins + +[ Upstream commit 825ce89a3ef17f84cf2c0eacfa6b8dc9fd11d13f ] + +The PUT_64[LB]E() macros need to cast the value to unsigned long long +like the GET_64[LB]E() macros. Caused lots of warnings when compiled +on 32-bit, and clobbered addresses (36-bit P4080). + +Signed-off-by: Ben Collins +Reviewed-by: Christophe Leroy +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/2025042122-mustard-wrasse-694572@boujee-and-buff +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/addnote.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/boot/addnote.c b/arch/powerpc/boot/addnote.c +index 53b3b2621457..78704927453a 100644 +--- a/arch/powerpc/boot/addnote.c ++++ b/arch/powerpc/boot/addnote.c +@@ -68,8 +68,8 @@ static int e_class = ELFCLASS32; + #define PUT_16BE(off, v)(buf[off] = ((v) >> 8) & 0xff, \ + buf[(off) + 1] = (v) & 0xff) + #define PUT_32BE(off, v)(PUT_16BE((off), (v) >> 16L), PUT_16BE((off) + 2, (v))) +-#define PUT_64BE(off, v)((PUT_32BE((off), (v) >> 32L), \ +- PUT_32BE((off) + 4, (v)))) ++#define PUT_64BE(off, v)((PUT_32BE((off), (unsigned long long)(v) >> 32L), \ ++ PUT_32BE((off) + 4, (unsigned long long)(v)))) + + #define GET_16LE(off) ((buf[off]) + (buf[(off)+1] << 8)) + #define GET_32LE(off) (GET_16LE(off) + (GET_16LE((off)+2U) << 16U)) +@@ -78,7 +78,8 @@ static int e_class = ELFCLASS32; + #define PUT_16LE(off, v) (buf[off] = (v) & 0xff, \ + buf[(off) + 1] = ((v) >> 8) & 0xff) + #define PUT_32LE(off, v) (PUT_16LE((off), (v)), PUT_16LE((off) + 2, (v) >> 16L)) +-#define PUT_64LE(off, v) (PUT_32LE((off), (v)), PUT_32LE((off) + 4, (v) >> 32L)) ++#define PUT_64LE(off, v) (PUT_32LE((off), (unsigned long long)(v)), \ ++ PUT_32LE((off) + 4, (unsigned long long)(v) >> 32L)) + + #define GET_16(off) (e_data == ELFDATA2MSB ? GET_16BE(off) : GET_16LE(off)) + #define GET_32(off) (e_data == ELFDATA2MSB ? GET_32BE(off) : GET_32LE(off)) +-- +2.51.0 + diff --git a/queue-6.12/reset-fix-bit-macro-reference.patch b/queue-6.12/reset-fix-bit-macro-reference.patch new file mode 100644 index 0000000000..6d68bee93b --- /dev/null +++ b/queue-6.12/reset-fix-bit-macro-reference.patch @@ -0,0 +1,40 @@ +From 54d365941f0576bedd4d910233463746a2d89ebc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 14:10:37 +0800 +Subject: reset: fix BIT macro reference + +From: Encrow Thorne + +[ Upstream commit f3d8b64ee46c9b4b0b82b1a4642027728bac95b8 ] + +RESET_CONTROL_FLAGS_BIT_* macros use BIT(), but reset.h does not +include bits.h. This causes compilation errors when including +reset.h standalone. + +Include bits.h to make reset.h self-contained. + +Suggested-by: Troy Mitchell +Reviewed-by: Troy Mitchell +Reviewed-by: Philipp Zabel +Signed-off-by: Encrow Thorne +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + include/linux/reset.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/reset.h b/include/linux/reset.h +index 514ddf003efc..4b31d683776e 100644 +--- a/include/linux/reset.h ++++ b/include/linux/reset.h +@@ -2,6 +2,7 @@ + #ifndef _LINUX_RESET_H_ + #define _LINUX_RESET_H_ + ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.12/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch b/queue-6.12/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch new file mode 100644 index 0000000000..ee1e83f28f --- /dev/null +++ b/queue-6.12/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch @@ -0,0 +1,45 @@ +From 69cff80a2a9da6b8fce01299d0cd581141052433 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:48:45 -0500 +Subject: scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive + +From: Tony Battersby + +[ Upstream commit 8f58fc64d559b5fda1b0a5e2a71422be61e79ab9 ] + +When given the module parameter qlini_mode=exclusive, qla2xxx in +initiator mode is initially unable to successfully send SCSI commands to +devices it finds while scanning, resulting in an escalating series of +resets until an adapter reset clears the issue. Fix by checking the +active mode instead of the module parameter. + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/1715ec14-ba9a-45dc-9cf2-d41aa6b81b5e@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_os.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 81c76678f25a..9f35c42102be 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3456,13 +3456,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + ha->mqenable = 0; + + if (ha->mqenable) { +- bool startit = false; +- +- if (QLA_TGT_MODE_ENABLED()) +- startit = false; +- +- if (ql2x_ini_mode == QLA2XXX_INI_MODE_ENABLED) +- startit = true; ++ bool startit = !!(host->active_mode & MODE_INITIATOR); + + /* Create start of day qpairs for Block MQ */ + for (i = 0; i < ha->max_qpairs; i++) +-- +2.51.0 + diff --git a/queue-6.12/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch b/queue-6.12/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch new file mode 100644 index 0000000000..4cf223ee6d --- /dev/null +++ b/queue-6.12/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch @@ -0,0 +1,193 @@ +From aec241eecfe4f669a6c7c53b965ec5d8fec93cb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:50:05 -0500 +Subject: scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled + +From: Tony Battersby + +[ Upstream commit 4f6aaade2a22ac428fa99ed716cf2b87e79c9837 ] + +When qla2xxx is loaded with qlini_mode=disabled, +ha->flags.disable_msix_handshake is used before it is set, resulting in +the wrong interrupt handler being used on certain HBAs +(qla2xxx_msix_rsp_q_hs() is used when qla2xxx_msix_rsp_q() should be +used). The only difference between these two interrupt handlers is that +the _hs() version writes to a register to clear the "RISC" interrupt, +whereas the other version does not. So this bug results in the RISC +interrupt being cleared when it should not be. This occasionally causes +a different interrupt handler qla24xx_msix_default() for a different +vector to see ((stat & HSRX_RISC_INT) == 0) and ignore its interrupt, +which then causes problems like: + +qla2xxx [0000:02:00.0]-d04c:6: MBX Command timeout for cmd 20, + iocontrol=8 jiffies=1090c0300 mb[0-3]=[0x4000 0x0 0x40 0xda] mb7 0x500 + host_status 0x40000010 hccr 0x3f00 +qla2xxx [0000:02:00.0]-101e:6: Mailbox cmd timeout occurred, cmd=0x20, + mb[0]=0x20. Scheduling ISP abort +(the cmd varies; sometimes it is 0x20, 0x22, 0x54, 0x5a, 0x5d, or 0x6a) + +This problem can be reproduced with a 16 or 32 Gbps HBA by loading +qla2xxx with qlini_mode=disabled and running a high IOPS test while +triggering frequent RSCN database change events. + +While analyzing the problem I discovered that even with +disable_msix_handshake forced to 0, it is not necessary to clear the +RISC interrupt from qla2xxx_msix_rsp_q_hs() (more below). So just +completely remove qla2xxx_msix_rsp_q_hs() and the logic for selecting +it, which also fixes the bug with qlini_mode=disabled. + +The test below describes the justification for not needing +qla2xxx_msix_rsp_q_hs(): + +Force disable_msix_handshake to 0: +qla24xx_config_rings(): +if (0 && (ha->fw_attributes & BIT_6) && (IS_MSIX_NACK_CAPABLE(ha)) && + (ha->flags.msix_enabled)) { + +In qla24xx_msix_rsp_q() and qla2xxx_msix_rsp_q_hs(), check: + (rd_reg_dword(®->host_status) & HSRX_RISC_INT) + +Count the number of calls to each function with HSRX_RISC_INT set and +the number with HSRX_RISC_INT not set while performing some I/O. + +If qla2xxx_msix_rsp_q_hs() clears the RISC interrupt (original code): +qla24xx_msix_rsp_q: 50% of calls have HSRX_RISC_INT set +qla2xxx_msix_rsp_q_hs: 5% of calls have HSRX_RISC_INT set +(# of qla2xxx_msix_rsp_q_hs interrupts) = + (# of qla24xx_msix_rsp_q interrupts) * 3 + +If qla2xxx_msix_rsp_q_hs() does not clear the RISC interrupt (patched +code): +qla24xx_msix_rsp_q: 100% of calls have HSRX_RISC_INT set +qla2xxx_msix_rsp_q_hs: 9% of calls have HSRX_RISC_INT set +(# of qla2xxx_msix_rsp_q_hs interrupts) = + (# of qla24xx_msix_rsp_q interrupts) * 3 + +In the case of the original code, qla24xx_msix_rsp_q() was seeing +HSRX_RISC_INT set only 50% of the time because qla2xxx_msix_rsp_q_hs() +was clearing it when it shouldn't have been. In the patched code, +qla24xx_msix_rsp_q() sees HSRX_RISC_INT set 100% of the time, which +makes sense if that interrupt handler needs to clear the RISC interrupt +(which it does). qla2xxx_msix_rsp_q_hs() sees HSRX_RISC_INT only 9% of +the time, which is just overlap from the other interrupt during the +high IOPS test. + +Tested with SCST on: +QLE2742 FW:v9.08.02 (32 Gbps 2-port) +QLE2694L FW:v9.10.11 (16 Gbps 4-port) +QLE2694L FW:v9.08.02 (16 Gbps 4-port) +QLE2672 FW:v8.07.12 (16 Gbps 2-port) +both initiator and target mode + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/56d378eb-14ad-49c7-bae9-c649b6c7691e@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_def.h | 1 - + drivers/scsi/qla2xxx/qla_gbl.h | 2 +- + drivers/scsi/qla2xxx/qla_isr.c | 32 +++----------------------------- + drivers/scsi/qla2xxx/qla_mid.c | 4 +--- + 4 files changed, 5 insertions(+), 34 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index cb95b7b12051..b3265952c4be 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -3503,7 +3503,6 @@ struct isp_operations { + #define QLA_MSIX_RSP_Q 0x01 + #define QLA_ATIO_VECTOR 0x02 + #define QLA_MSIX_QPAIR_MULTIQ_RSP_Q 0x03 +-#define QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS 0x04 + + #define QLA_MIDX_DEFAULT 0 + #define QLA_MIDX_RSP_Q 1 +diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h +index e556f57c91af..59f448e2e319 100644 +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -768,7 +768,7 @@ extern int qla2x00_dfs_remove(scsi_qla_host_t *); + + /* Globa function prototypes for multi-q */ + extern int qla25xx_request_irq(struct qla_hw_data *, struct qla_qpair *, +- struct qla_msix_entry *, int); ++ struct qla_msix_entry *); + extern int qla25xx_init_req_que(struct scsi_qla_host *, struct req_que *); + extern int qla25xx_init_rsp_que(struct scsi_qla_host *, struct rsp_que *); + extern int qla25xx_create_req_que(struct qla_hw_data *, uint16_t, uint8_t, +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index fe98c76e9be3..77c779cca97f 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -4467,32 +4467,6 @@ qla2xxx_msix_rsp_q(int irq, void *dev_id) + return IRQ_HANDLED; + } + +-irqreturn_t +-qla2xxx_msix_rsp_q_hs(int irq, void *dev_id) +-{ +- struct qla_hw_data *ha; +- struct qla_qpair *qpair; +- struct device_reg_24xx __iomem *reg; +- unsigned long flags; +- +- qpair = dev_id; +- if (!qpair) { +- ql_log(ql_log_info, NULL, 0x505b, +- "%s: NULL response queue pointer.\n", __func__); +- return IRQ_NONE; +- } +- ha = qpair->hw; +- +- reg = &ha->iobase->isp24; +- spin_lock_irqsave(&ha->hardware_lock, flags); +- wrt_reg_dword(®->hccr, HCCRX_CLR_RISC_INT); +- spin_unlock_irqrestore(&ha->hardware_lock, flags); +- +- queue_work(ha->wq, &qpair->q_work); +- +- return IRQ_HANDLED; +-} +- + /* Interrupt handling helpers. */ + + struct qla_init_msix_entry { +@@ -4505,7 +4479,6 @@ static const struct qla_init_msix_entry msix_entries[] = { + { "rsp_q", qla24xx_msix_rsp_q }, + { "atio_q", qla83xx_msix_atio_q }, + { "qpair_multiq", qla2xxx_msix_rsp_q }, +- { "qpair_multiq_hs", qla2xxx_msix_rsp_q_hs }, + }; + + static const struct qla_init_msix_entry qla82xx_msix_entries[] = { +@@ -4792,9 +4765,10 @@ qla2x00_free_irqs(scsi_qla_host_t *vha) + } + + int qla25xx_request_irq(struct qla_hw_data *ha, struct qla_qpair *qpair, +- struct qla_msix_entry *msix, int vector_type) ++ struct qla_msix_entry *msix) + { +- const struct qla_init_msix_entry *intr = &msix_entries[vector_type]; ++ const struct qla_init_msix_entry *intr = ++ &msix_entries[QLA_MSIX_QPAIR_MULTIQ_RSP_Q]; + scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev); + int ret; + +diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c +index 79879c4743e6..9946899dd83b 100644 +--- a/drivers/scsi/qla2xxx/qla_mid.c ++++ b/drivers/scsi/qla2xxx/qla_mid.c +@@ -899,9 +899,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options, + rsp->options, rsp->id, rsp->rsp_q_in, + rsp->rsp_q_out); + +- ret = qla25xx_request_irq(ha, qpair, qpair->msix, +- ha->flags.disable_msix_handshake ? +- QLA_MSIX_QPAIR_MULTIQ_RSP_Q : QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS); ++ ret = qla25xx_request_irq(ha, qpair, qpair->msix); + if (ret) + goto que_failed; + +-- +2.51.0 + diff --git a/queue-6.12/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch b/queue-6.12/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch new file mode 100644 index 0000000000..79c10228fc --- /dev/null +++ b/queue-6.12/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch @@ -0,0 +1,45 @@ +From 6f6c1ee3030abbb7ff5d0d087da7dd8495542cf0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:51:28 -0500 +Subject: scsi: qla2xxx: Use reinit_completion on mbx_intr_comp + +From: Tony Battersby + +[ Upstream commit 957aa5974989fba4ae4f807ebcb27f12796edd4d ] + +If a mailbox command completes immediately after +wait_for_completion_timeout() times out, ha->mbx_intr_comp could be left +in an inconsistent state, causing the next mailbox command not to wait +for the hardware. Fix by reinitializing the completion before use. + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/11b6485e-0bfd-4784-8f99-c06a196dad94@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_mbx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 13b6cb1b93ac..41435e98092a 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -253,6 +253,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + /* Issue set host interrupt command to send cmd out. */ + ha->flags.mbox_int = 0; + clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags); ++ reinit_completion(&ha->mbx_intr_comp); + + /* Unlock mbx registers and wait for interrupt */ + ql_dbg(ql_dbg_mbx, vha, 0x100f, +@@ -279,6 +280,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + "cmd=%x Timeout.\n", command); + spin_lock_irqsave(&ha->hardware_lock, flags); + clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags); ++ reinit_completion(&ha->mbx_intr_comp); + spin_unlock_irqrestore(&ha->hardware_lock, flags); + + if (chip_reset != ha->chip_reset) { +-- +2.51.0 + diff --git a/queue-6.12/scsi-smartpqi-add-support-for-hurray-data-new-contro.patch b/queue-6.12/scsi-smartpqi-add-support-for-hurray-data-new-contro.patch new file mode 100644 index 0000000000..8584492e4f --- /dev/null +++ b/queue-6.12/scsi-smartpqi-add-support-for-hurray-data-new-contro.patch @@ -0,0 +1,48 @@ +From 5f79852ca80fa2a55e0fcaf33c30b52f7c9df97f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 10:38:21 -0600 +Subject: scsi: smartpqi: Add support for Hurray Data new controller PCI device + +From: David Strahan + +[ Upstream commit 48e6b7e708029cea451e53a8c16fc8c16039ecdc ] + +Add support for new Hurray Data controller. + +All entries are in HEX. + +Add PCI IDs for Hurray Data controllers: + VID / DID / SVID / SDID + ---- ---- ---- ---- + 9005 028f 207d 4840 + +Reviewed-by: Scott Benesh +Reviewed-by: Scott Teel +Reviewed-by: Mike McGowen +Signed-off-by: David Strahan +Signed-off-by: Don Brace +Link: https://patch.msgid.link/20251106163823.786828-4-don.brace@microchip.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi_init.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index 018f5428a07d..f0fb22e4117e 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -10091,6 +10091,10 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x207d, 0x4240) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x207d, 0x4840) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_VENDOR_ID_ADVANTECH, 0x8312) +-- +2.51.0 + diff --git a/queue-6.12/scsi-ufs-host-mediatek-fix-shutdown-suspend-race-con.patch b/queue-6.12/scsi-ufs-host-mediatek-fix-shutdown-suspend-race-con.patch new file mode 100644 index 0000000000..7a5e80ead0 --- /dev/null +++ b/queue-6.12/scsi-ufs-host-mediatek-fix-shutdown-suspend-race-con.patch @@ -0,0 +1,41 @@ +From 6f05c0c8eebe81b81f2f275bf3b54a9a4c4b70fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 17:43:27 +0800 +Subject: scsi: ufs: host: mediatek: Fix shutdown/suspend race condition + +From: Peter Wang + +[ Upstream commit 014de20bb36ba03e0e0b0a7e0a1406ab900c9fda ] + +Address a race condition between shutdown and suspend operations in the +UFS Mediatek driver. Before entering suspend, check if a shutdown is in +progress to prevent conflicts and ensure system stability. + +Signed-off-by: Peter Wang +Acked-by: Chun-Hung Wu +Link: https://patch.msgid.link/20250924094527.2992256-6-peter.wang@mediatek.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/host/ufs-mediatek.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c +index 00ecfe14c1fd..1fb98af4ac56 100644 +--- a/drivers/ufs/host/ufs-mediatek.c ++++ b/drivers/ufs/host/ufs-mediatek.c +@@ -1994,6 +1994,11 @@ static int ufs_mtk_system_suspend(struct device *dev) + struct arm_smccc_res res; + int ret; + ++ if (hba->shutting_down) { ++ ret = -EBUSY; ++ goto out; ++ } ++ + ret = ufshcd_system_suspend(dev); + if (ret) + goto out; +-- +2.51.0 + diff --git a/queue-6.12/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch b/queue-6.12/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch new file mode 100644 index 0000000000..a8250f6b93 --- /dev/null +++ b/queue-6.12/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch @@ -0,0 +1,63 @@ +From 09181ceced300c988eba7942e770166c4bea9559 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Oct 2025 11:08:40 +0800 +Subject: serial: sprd: Return -EPROBE_DEFER when uart clock is not ready + +From: Wenhua Lin + +[ Upstream commit 29e8a0c587e328ed458380a45d6028adf64d7487 ] + +In sprd_clk_init(), when devm_clk_get() returns -EPROBE_DEFER +for either uart or source clock, we should propagate the +error instead of just warning and continuing with NULL clocks. + +Currently the driver only emits a warning when clock acquisition +fails and proceeds with NULL clock pointers. This can lead to +issues later when the clocks are actually needed. More importantly, +when the clock provider is not ready yet and returns -EPROBE_DEFER, +we should return this error to allow deferred probing. + +This change adds explicit checks for -EPROBE_DEFER after both: +1. devm_clk_get(uport->dev, uart) +2. devm_clk_get(uport->dev, source) + +When -EPROBE_DEFER is encountered, the function now returns +-EPROBE_DEFER to let the driver framework retry probing +later when the clock dependencies are resolved. + +Signed-off-by: Wenhua Lin +Link: https://patch.msgid.link/20251022030840.956589-1-Wenhua.Lin@unisoc.com +Reviewed-by: Cixi Geng +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sprd_serial.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index 3fc54cc02a1f..c575c38b513d 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -1109,6 +1109,9 @@ static int sprd_clk_init(struct uart_port *uport) + + clk_uart = devm_clk_get(uport->dev, "uart"); + if (IS_ERR(clk_uart)) { ++ if (PTR_ERR(clk_uart) == -EPROBE_DEFER) ++ return -EPROBE_DEFER; ++ + dev_warn(uport->dev, "uart%d can't get uart clock\n", + uport->line); + clk_uart = NULL; +@@ -1116,6 +1119,9 @@ static int sprd_clk_init(struct uart_port *uport) + + clk_parent = devm_clk_get(uport->dev, "source"); + if (IS_ERR(clk_parent)) { ++ if (PTR_ERR(clk_parent) == -EPROBE_DEFER) ++ return -EPROBE_DEFER; ++ + dev_warn(uport->dev, "uart%d can't get source clock\n", + uport->line); + clk_parent = NULL; +-- +2.51.0 + diff --git a/queue-6.12/series b/queue-6.12/series index 51c84319b7..bc3566ad59 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -108,3 +108,41 @@ mmc-sdhci-esdhc-imx-add-alternate-arch_s32-dependency-to-kconfig.patch mmc-sdhci-of-arasan-increase-cd-stable-timeout-to-2-seconds.patch dt-bindings-mmc-sdhci-of-aspeed-switch-ref-to-sdhci-common.yaml.patch net-hsr-fix-null-pointer-dereference-in-prp_get_untagged_frame.patch +x86-fpu-fix-fpu-state-core-dump-truncation-on-cpus-w.patch +alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch +alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch +alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch +asoc-ak4458-remove-the-reset-operation-in-probe-and-.patch +nfsd-update-percpu_ref-to-manage-references-on-nfsd_.patch +nfsd-rename-nfsd_serv_-prefixed-methods-and-variable.patch +nfsd-fix-memory-leak-in-nfsd_create_serv-error-paths.patch +ipmi-fix-the-race-between-__scan_channels-and-delive.patch +ipmi-fix-__scan_channels-failing-to-rescan-channels.patch +scsi-ufs-host-mediatek-fix-shutdown-suspend-race-con.patch +firmware-imx-scu-irq-init-workqueue-before-request-m.patch +ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch +scsi-smartpqi-add-support-for-hurray-data-new-contro.patch +clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch +powerpc-addnote-fix-overflow-on-32-bit-builds.patch +scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch +scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch +scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch +fuse-always-flush-the-page-cache-before-fopen_direct.patch +fuse-invalidate-the-page-cache-after-fopen_direct_io.patch +via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch +reset-fix-bit-macro-reference.patch +exfat-fix-remount-failure-in-different-process-envir.patch +exfat-zero-out-post-eof-page-cache-on-file-extension.patch +usbip-fix-locking-bug-in-rt-enabled-kernels.patch +usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch +iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch +usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch +usb-usb-storage-no-additional-quirks-need-to-be-adde.patch +serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch +libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch +clk-qcom-dispcc-sm7150-fix-dispcc_mdss_pclk0_clk_src.patch +i2c-designware-disable-smbus-interrupts-to-prevent-s.patch +nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch +nvme-fabrics-add-enokey-to-no-retry-criteria-for-aut.patch +platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch +mips-ftrace-fix-memory-corruption-when-kernel-is-loc.patch diff --git a/queue-6.12/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch b/queue-6.12/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch new file mode 100644 index 0000000000..0a1c7d98c7 --- /dev/null +++ b/queue-6.12/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch @@ -0,0 +1,64 @@ +From 856c2c0de0c7bb5026229eadfa097a7694e016ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 15:11:13 +0200 +Subject: ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx + +From: Matthias Schiffer + +[ Upstream commit 3f61783920504b2cf99330b372d82914bb004d8e ] + +am33xx.dtsi has the same clock setup as am35xx.dtsi, setting +ti,no-reset-on-init and ti,no-idle on timer1_target and timer2_target, +so AM33 needs the same workaround as AM35 to avoid ti-sysc probe +failing on certain target modules. + +Signed-off-by: Matthias Schiffer +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20250825131114.2206804-1-alexander.stein@ew.tq-group.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index f715c8d28129..27149eb29afb 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -48,6 +48,7 @@ enum sysc_soc { + SOC_UNKNOWN, + SOC_2420, + SOC_2430, ++ SOC_AM33, + SOC_3430, + SOC_AM35, + SOC_3630, +@@ -2896,6 +2897,7 @@ static void ti_sysc_idle(struct work_struct *work) + static const struct soc_device_attribute sysc_soc_match[] = { + SOC_FLAG("OMAP242*", SOC_2420), + SOC_FLAG("OMAP243*", SOC_2430), ++ SOC_FLAG("AM33*", SOC_AM33), + SOC_FLAG("AM35*", SOC_AM35), + SOC_FLAG("OMAP3[45]*", SOC_3430), + SOC_FLAG("OMAP3[67]*", SOC_3630), +@@ -3101,10 +3103,15 @@ static int sysc_check_active_timer(struct sysc *ddata) + * can be dropped if we stop supporting old beagleboard revisions + * A to B4 at some point. + */ +- if (sysc_soc->soc == SOC_3430 || sysc_soc->soc == SOC_AM35) ++ switch (sysc_soc->soc) { ++ case SOC_AM33: ++ case SOC_3430: ++ case SOC_AM35: + error = -ENXIO; +- else ++ break; ++ default: + error = -EBUSY; ++ } + + if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) && + (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE)) +-- +2.51.0 + diff --git a/queue-6.12/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch b/queue-6.12/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch new file mode 100644 index 0000000000..42c1ea76d8 --- /dev/null +++ b/queue-6.12/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch @@ -0,0 +1,49 @@ +From ab8c19545f24332b4a071cad9d247618fbca9b13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 14:53:07 -0400 +Subject: usb: typec: ucsi: Handle incorrect num_connectors capability + +From: Mark Pearson + +[ Upstream commit 30cd2cb1abf4c4acdb1ddb468c946f68939819fb ] + +The UCSI spec states that the num_connectors field is 7 bits, and the +8th bit is reserved and should be set to zero. +Some buggy FW has been known to set this bit, and it can lead to a +system not booting. +Flag that the FW is not behaving correctly, and auto-fix the value +so that the system boots correctly. + +Found on Lenovo P1 G8 during Linux enablement program. The FW will +be fixed, but seemed worth addressing in case it hit platforms that +aren't officially Linux supported. + +Signed-off-by: Mark Pearson +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250821185319.2585023-1-mpearson-lenovo@squebb.ca +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index 896e6bc1b5e2..9a0fb6a79b21 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1772,6 +1772,12 @@ static int ucsi_init(struct ucsi *ucsi) + ret = -ENODEV; + goto err_reset; + } ++ /* Check if reserved bit set. This is out of spec but happens in buggy FW */ ++ if (ucsi->cap.num_connectors & 0x80) { ++ dev_warn(ucsi->dev, "UCSI: Invalid num_connectors %d. Likely buggy FW\n", ++ ucsi->cap.num_connectors); ++ ucsi->cap.num_connectors &= 0x7f; // clear bit and carry on ++ } + + /* Allocate the connectors. Released in ucsi_unregister() */ + connector = kcalloc(ucsi->cap.num_connectors + 1, sizeof(*connector), GFP_KERNEL); +-- +2.51.0 + diff --git a/queue-6.12/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch b/queue-6.12/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch new file mode 100644 index 0000000000..3c6cdebd36 --- /dev/null +++ b/queue-6.12/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch @@ -0,0 +1,65 @@ +From ee8f8f89c95ed161edcd84d81db71d01286fa238 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 14:40:20 +0800 +Subject: usb: usb-storage: No additional quirks need to be added to the EL-R12 + optical drive. + +From: Chen Changcheng + +[ Upstream commit 955a48a5353f4fe009704a9a4272a3adf627cd35 ] + +The optical drive of EL-R12 has the same vid and pid as INIC-3069, +as follows: +T: Bus=02 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0 +D: Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=13fd ProdID=3940 Rev= 3.10 +S: Manufacturer=HL-DT-ST +S: Product= DVD+-RW GT80N +S: SerialNumber=423349524E4E38303338323439202020 +C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=144mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=02 Prot=50 Driver=usb-storage +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=0a(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +This will result in the optical drive device also adding +the quirks of US_FL_NO_ATA_1X. When performing an erase operation, +it will fail, and the reason for the failure is as follows: +[ 388.967742] sr 5:0:0:0: [sr0] tag#0 Send: scmd 0x00000000d20c33a7 +[ 388.967742] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00 +[ 388.967773] sr 5:0:0:0: [sr0] tag#0 Done: SUCCESS Result: hostbyte=DID_TARGET_FAILURE driverbyte=DRIVER_OK cmd_age=0s +[ 388.967773] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00 +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Sense Key : Illegal Request [current] +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Add. Sense: Invalid field in cdb +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 scsi host busy 1 failed 0 +[ 388.967803] sr 5:0:0:0: Notifying upper driver of completion (result 8100002) +[ 388.967834] sr 5:0:0:0: [sr0] tag#0 0 sectors total, 0 bytes done. + +For the EL-R12 standard optical drive, all operational commands +and usage scenarios were tested without adding the IGNORE_RESIDUE quirks, +and no issues were encountered. It can be reasonably concluded +that removing the IGNORE_RESIDUE quirks has no impact. + +Signed-off-by: Chen Changcheng +Link: https://patch.msgid.link/20251121064020.29332-1-chenchangcheng@kylinos.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/storage/unusual_uas.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index 1477e31d7763..b695f5ba9a40 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -98,7 +98,7 @@ UNUSUAL_DEV(0x125f, 0xa94a, 0x0160, 0x0160, + US_FL_NO_ATA_1X), + + /* Reported-by: Benjamin Tissoires */ +-UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, ++UNUSUAL_DEV(0x13fd, 0x3940, 0x0309, 0x0309, + "Initio Corporation", + "INIC-3069", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, +-- +2.51.0 + diff --git a/queue-6.12/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch b/queue-6.12/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch new file mode 100644 index 0000000000..98728c2232 --- /dev/null +++ b/queue-6.12/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch @@ -0,0 +1,82 @@ +From 87ce67ca4fb2a0d6d6abca90a8936ea6d879b608 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 16:23:55 +0200 +Subject: usb: xhci: limit run_graceperiod for only usb 3.0 devices + +From: Hongyu Xie + +[ Upstream commit 8d34983720155b8f05de765f0183d9b0e1345cc0 ] + +run_graceperiod blocks usb 2.0 devices from auto suspending after +xhci_start for 500ms. + +Log shows: +[ 13.387170] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.387177] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.387182] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.387188] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.387191] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.387193] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.387296] hub_event:5779: hub 3-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.393343] handle_port_status:2034: xhci-hcd PNP0D10:02: handle_port_status: starting usb5 port polling. +[ 13.393353] xhci_hub_control:1271: xhci-hcd PNP0D10:02: Get port status 5-1 read: 0x206e1, return 0x10101 +[ 13.400047] hub_suspend:3903: hub 3-0:1.0: hub_suspend +[ 13.403077] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.403080] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.403085] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.403087] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.403090] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.403093] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.403095] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.405002] handle_port_status:1913: xhci-hcd PNP0D10:04: Port change event, 9-1, id 1, portsc: 0x6e1 +[ 13.405016] hub_activate:1169: usb usb5-port1: status 0101 change 0001 +[ 13.405026] xhci_clear_port_change_bit:658: xhci-hcd PNP0D10:02: clear port1 connect change, portsc: 0x6e1 +[ 13.413275] hcd_bus_suspend:2250: usb usb3: bus auto-suspend, wakeup 1 +[ 13.419081] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.419086] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.419095] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.419100] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.419106] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.419110] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.419112] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.420455] handle_port_status:2034: xhci-hcd PNP0D10:04: handle_port_status: starting usb9 port polling. +[ 13.420493] handle_port_status:1913: xhci-hcd PNP0D10:05: Port change event, 10-1, id 1, portsc: 0x6e1 +[ 13.425332] hcd_bus_suspend:2279: usb usb3: suspend raced with wakeup event +[ 13.431931] handle_port_status:2034: xhci-hcd PNP0D10:05: handle_port_status: starting usb10 port polling. +[ 13.435080] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.435084] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.435092] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.435096] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.435102] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.435106] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event + +usb7 and other usb 2.0 root hub were rapidly toggling between suspend +and resume states. More, "suspend raced with wakeup event" confuses people. + +So, limit run_graceperiod for only usb 3.0 devices + +Signed-off-by: Hongyu Xie +Signed-off-by: Mathias Nyman +Link: https://patch.msgid.link/20251119142417.2820519-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-hub.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 69aedce9d67b..49cba1cdd91b 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1671,7 +1671,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf) + * SS devices are only visible to roothub after link training completes. + * Keep polling roothubs for a grace period after xHC start + */ +- if (xhci->run_graceperiod) { ++ if (hcd->speed >= HCD_USB3 && xhci->run_graceperiod) { + if (time_before(jiffies, xhci->run_graceperiod)) + status = 1; + else +-- +2.51.0 + diff --git a/queue-6.12/usbip-fix-locking-bug-in-rt-enabled-kernels.patch b/queue-6.12/usbip-fix-locking-bug-in-rt-enabled-kernels.patch new file mode 100644 index 0000000000..5bba425559 --- /dev/null +++ b/queue-6.12/usbip-fix-locking-bug-in-rt-enabled-kernels.patch @@ -0,0 +1,64 @@ +From 6c7f345971e7097ba694751dc853c5c1f4e46de2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 09:41:43 +0800 +Subject: usbip: Fix locking bug in RT-enabled kernels + +From: Lizhi Xu + +[ Upstream commit 09bf21bf5249880f62fe759b53b14b4b52900c6c ] + +Interrupts are disabled before entering usb_hcd_giveback_urb(). +A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be +acquired with disabled interrupts. + +Save the interrupt status and restore it after usb_hcd_giveback_urb(). + +syz reported: +BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 +Call Trace: + dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 + rt_spin_lock+0xc7/0x2c0 kernel/locking/spinlock_rt.c:57 + spin_lock include/linux/spinlock_rt.h:44 [inline] + mon_bus_complete drivers/usb/mon/mon_main.c:134 [inline] + mon_complete+0x5c/0x200 drivers/usb/mon/mon_main.c:147 + usbmon_urb_complete include/linux/usb/hcd.h:738 [inline] + __usb_hcd_giveback_urb+0x254/0x5e0 drivers/usb/core/hcd.c:1647 + vhci_urb_enqueue+0xb4f/0xe70 drivers/usb/usbip/vhci_hcd.c:818 + +Reported-by: syzbot+205ef33a3b636b4181fb@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=205ef33a3b636b4181fb +Signed-off-by: Lizhi Xu +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20250916014143.1439759-1-lizhi.xu@windriver.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vhci_hcd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index a793e30d46b7..f67b4d33a0ab 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -830,15 +830,15 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + no_need_xmit: + usb_hcd_unlink_urb_from_ep(hcd, urb); + no_need_unlink: +- spin_unlock_irqrestore(&vhci->lock, flags); + if (!ret) { + /* usb_hcd_giveback_urb() should be called with + * irqs disabled + */ +- local_irq_disable(); ++ spin_unlock(&vhci->lock); + usb_hcd_giveback_urb(hcd, urb, urb->status); +- local_irq_enable(); ++ spin_lock(&vhci->lock); + } ++ spin_unlock_irqrestore(&vhci->lock, flags); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.12/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch b/queue-6.12/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch new file mode 100644 index 0000000000..18d04fc684 --- /dev/null +++ b/queue-6.12/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch @@ -0,0 +1,43 @@ +From 8f2cabc6242ca1414347f7585fef0e640c1ae665 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Sep 2025 16:33:32 +0800 +Subject: via_wdt: fix critical boot hang due to unnamed resource allocation + +From: Li Qiang + +[ Upstream commit 7aa31ee9ec92915926e74731378c009c9cc04928 ] + +The VIA watchdog driver uses allocate_resource() to reserve a MMIO +region for the watchdog control register. However, the allocated +resource was not given a name, which causes the kernel resource tree +to contain an entry marked as "" under /proc/iomem on x86 +platforms. + +During boot, this unnamed resource can lead to a critical hang because +subsequent resource lookups and conflict checks fail to handle the +invalid entry properly. + +Signed-off-by: Li Qiang +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/via_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/via_wdt.c b/drivers/watchdog/via_wdt.c +index eeb39f96e72e..c1ed3ce153cf 100644 +--- a/drivers/watchdog/via_wdt.c ++++ b/drivers/watchdog/via_wdt.c +@@ -165,6 +165,7 @@ static int wdt_probe(struct pci_dev *pdev, + dev_err(&pdev->dev, "cannot enable PCI device\n"); + return -ENODEV; + } ++ wdt_res.name = "via_wdt"; + + /* + * Allocate a MMIO region which contains watchdog control register +-- +2.51.0 + diff --git a/queue-6.12/x86-fpu-fix-fpu-state-core-dump-truncation-on-cpus-w.patch b/queue-6.12/x86-fpu-fix-fpu-state-core-dump-truncation-on-cpus-w.patch new file mode 100644 index 0000000000..0c7d1113f7 --- /dev/null +++ b/queue-6.12/x86-fpu-fix-fpu-state-core-dump-truncation-on-cpus-w.patch @@ -0,0 +1,54 @@ +From c8b030f6fdc3e50c93209199e5f23c0a960cbd79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 08:02:20 +0800 +Subject: x86/fpu: Fix FPU state core dump truncation on CPUs with no extended + xfeatures + +From: Yongxin Liu + +[ Upstream commit c8161e5304abb26e6c0bec6efc947992500fa6c5 ] + +Zero can be a valid value of num_records. For example, on Intel Atom x6425RE, +only x87 and SSE are supported (features 0, 1), and fpu_user_cfg.max_features +is 3. The for_each_extended_xfeature() loop only iterates feature 2, which is +not enabled, so num_records = 0. This is valid and should not cause core dump +failure. + +The issue is that dump_xsave_layout_desc() returns 0 for both genuine errors +(dump_emit() failure) and valid cases (no extended features). Use negative +return values for errors and only abort on genuine failures. + +Fixes: ba386777a30b ("x86/elf: Add a new FPU buffer layout info to x86 core files") +Signed-off-by: Yongxin Liu +Signed-off-by: Ingo Molnar +Link: https://patch.msgid.link/20251210000219.4094353-2-yongxin.liu@windriver.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/fpu/xstate.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c +index 22abb5ee0cf2..aacb59c4a35c 100644 +--- a/arch/x86/kernel/fpu/xstate.c ++++ b/arch/x86/kernel/fpu/xstate.c +@@ -1879,7 +1879,7 @@ static int dump_xsave_layout_desc(struct coredump_params *cprm) + }; + + if (!dump_emit(cprm, &xc, sizeof(xc))) +- return 0; ++ return -1; + + num_records++; + } +@@ -1917,7 +1917,7 @@ int elf_coredump_extra_notes_write(struct coredump_params *cprm) + return 1; + + num_records = dump_xsave_layout_desc(cprm); +- if (!num_records) ++ if (num_records < 0) + return 1; + + /* Total size should be equal to the number of records */ +-- +2.51.0 + diff --git a/queue-6.18/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch b/queue-6.18/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch new file mode 100644 index 0000000000..65342126fe --- /dev/null +++ b/queue-6.18/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch @@ -0,0 +1,48 @@ +From c3fdb025dbec65c7516f52bc61d8fb4ec6a6691b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 17:04:33 +0800 +Subject: ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path + +From: Haotian Zhang + +[ Upstream commit 5032347c04ba7ff9ba878f262e075d745c06a2a8 ] + +When pdacf_config() fails, snd_pdacf_probe() returns the error code +directly without freeing the sound card resources allocated by +snd_card_new(), which leads to a memory leak. + +Add proper error handling to free the sound card and clear the card +list entry when pdacf_config() fails. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Suggested-by: Takashi Iwai +Signed-off-by: Haotian Zhang +Link: https://patch.msgid.link/20251215090433.211-1-vulab@iscas.ac.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c +index 13419837dfb7..a3291e626440 100644 +--- a/sound/pcmcia/pdaudiocf/pdaudiocf.c ++++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c +@@ -131,7 +131,13 @@ static int snd_pdacf_probe(struct pcmcia_device *link) + link->config_index = 1; + link->config_regs = PRESENT_OPTION; + +- return pdacf_config(link); ++ err = pdacf_config(link); ++ if (err < 0) { ++ card_list[i] = NULL; ++ snd_card_free(card); ++ return err; ++ } ++ return 0; + } + + +-- +2.51.0 + diff --git a/queue-6.18/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch b/queue-6.18/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch new file mode 100644 index 0000000000..b4a19b310a --- /dev/null +++ b/queue-6.18/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch @@ -0,0 +1,74 @@ +From 42edac347ca65be744a4b9b489b640cebaf446ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 10:46:30 +0800 +Subject: ALSA: usb-mixer: us16x08: validate meter packet indices + +From: Shipei Qu + +[ Upstream commit 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e ] + +get_meter_levels_from_urb() parses the 64-byte meter packets sent by +the device and fills the per-channel arrays meter_level[], +comp_level[] and master_level[] in struct snd_us16x08_meter_store. + +Currently the function derives the channel index directly from the +meter packet (MUB2(meter_urb, s) - 1) and uses it to index those +arrays without validating the range. If the packet contains a +negative or out-of-range channel number, the driver may write past +the end of these arrays. + +Introduce a local channel variable and validate it before updating the +arrays. We reject negative indices, limit meter_level[] and +comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[] +updates with ARRAY_SIZE(master_level). + +Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk") +Reported-by: DARKNAVY (@DarkNavyOrg) +Closes: https://lore.kernel.org/tencent_21C112743C44C1A2517FF219@qq.com +Signed-off-by: Shipei Qu +Link: https://patch.msgid.link/20251217024630.59576-1-qu@darknavy.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_us16x08.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c +index 1c5712c31f5e..f9df40730eff 100644 +--- a/sound/usb/mixer_us16x08.c ++++ b/sound/usb/mixer_us16x08.c +@@ -655,17 +655,25 @@ static void get_meter_levels_from_urb(int s, + u8 *meter_urb) + { + int val = MUC2(meter_urb, s) + (MUC3(meter_urb, s) << 8); ++ int ch = MUB2(meter_urb, s) - 1; ++ ++ if (ch < 0) ++ return; + + if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 && + MUA2(meter_urb, s) == 0x04 && MUB0(meter_urb, s) == 0x62) { +- if (MUC0(meter_urb, s) == 0x72) +- store->meter_level[MUB2(meter_urb, s) - 1] = val; +- if (MUC0(meter_urb, s) == 0xb2) +- store->comp_level[MUB2(meter_urb, s) - 1] = val; ++ if (ch < SND_US16X08_MAX_CHANNELS) { ++ if (MUC0(meter_urb, s) == 0x72) ++ store->meter_level[ch] = val; ++ if (MUC0(meter_urb, s) == 0xb2) ++ store->comp_level[ch] = val; ++ } + } + if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 && +- MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) +- store->master_level[MUB2(meter_urb, s) - 1] = val; ++ MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) { ++ if (ch < ARRAY_SIZE(store->master_level)) ++ store->master_level[ch] = val; ++ } + } + + /* Function to retrieve current meter values from the device. +-- +2.51.0 + diff --git a/queue-6.18/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch b/queue-6.18/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch new file mode 100644 index 0000000000..064ead113b --- /dev/null +++ b/queue-6.18/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch @@ -0,0 +1,47 @@ +From e8c7452384ab27cd70a9b18089cbc98ff91517d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 12:26:52 +0800 +Subject: ALSA: vxpocket: Fix resource leak in vxpocket_probe error path + +From: Haotian Zhang + +[ Upstream commit 2a03b40deacbd293ac9aed0f9b11197dad54fe5f ] + +When vxpocket_config() fails, vxpocket_probe() returns the error code +directly without freeing the sound card resources allocated by +snd_card_new(), which leads to a memory leak. + +Add proper error handling to free the sound card and clear the +allocation bit when vxpocket_config() fails. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Haotian Zhang +Link: https://patch.msgid.link/20251215042652.695-1-vulab@iscas.ac.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pcmcia/vx/vxpocket.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c +index 2e09f2a513a6..9a5c9aa8eec4 100644 +--- a/sound/pcmcia/vx/vxpocket.c ++++ b/sound/pcmcia/vx/vxpocket.c +@@ -284,7 +284,13 @@ static int vxpocket_probe(struct pcmcia_device *p_dev) + + vxp->p_dev = p_dev; + +- return vxpocket_config(p_dev); ++ err = vxpocket_config(p_dev); ++ if (err < 0) { ++ card_alloc &= ~(1 << i); ++ snd_card_free(card); ++ return err; ++ } ++ return 0; + } + + static void vxpocket_detach(struct pcmcia_device *link) +-- +2.51.0 + diff --git a/queue-6.18/asoc-ak4458-remove-the-reset-operation-in-probe-and-.patch b/queue-6.18/asoc-ak4458-remove-the-reset-operation-in-probe-and-.patch new file mode 100644 index 0000000000..b5c92b2f49 --- /dev/null +++ b/queue-6.18/asoc-ak4458-remove-the-reset-operation-in-probe-and-.patch @@ -0,0 +1,50 @@ +From 3e07d91f74426033504afacdd76db9cd6ffbc5b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 15:02:01 +0800 +Subject: ASoC: ak4458: remove the reset operation in probe and remove + +From: Shengjiu Wang + +[ Upstream commit 00b960a83c764208b0623089eb70af3685e3906f ] + +The reset_control handler has the reference count for usage, as there is +reset operation in runtime suspend and resume, then reset operation in +probe() would cause the reference count of reset not balanced. + +Previously add reset operation in probe and remove is to fix the compile +issue with !CONFIG_PM, as the driver has been update to use +RUNTIME_PM_OPS(), so that change can be reverted. + +Fixes: 1e0dff741b0a ("ASoC: ak4458: remove "reset-gpios" property handler") +Signed-off-by: Shengjiu Wang +Link: https://patch.msgid.link/20251216070201.358477-1-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/ak4458.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/sound/soc/codecs/ak4458.c b/sound/soc/codecs/ak4458.c +index a6c04dd3de3e..abe742edb10f 100644 +--- a/sound/soc/codecs/ak4458.c ++++ b/sound/soc/codecs/ak4458.c +@@ -783,16 +783,12 @@ static int ak4458_i2c_probe(struct i2c_client *i2c) + + pm_runtime_enable(&i2c->dev); + regcache_cache_only(ak4458->regmap, true); +- ak4458_reset(ak4458, false); + + return 0; + } + + static void ak4458_i2c_remove(struct i2c_client *i2c) + { +- struct ak4458_priv *ak4458 = i2c_get_clientdata(i2c); +- +- ak4458_reset(ak4458, true); + pm_runtime_disable(&i2c->dev); + } + +-- +2.51.0 + diff --git a/queue-6.18/asoc-fsl_sai-constrain-sample-rates-from-audio-plls-.patch b/queue-6.18/asoc-fsl_sai-constrain-sample-rates-from-audio-plls-.patch new file mode 100644 index 0000000000..1b37460757 --- /dev/null +++ b/queue-6.18/asoc-fsl_sai-constrain-sample-rates-from-audio-plls-.patch @@ -0,0 +1,48 @@ +From fad6db078815dbe7aea942ff6a0af5e5306fba88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 15:21:09 +0900 +Subject: ASoC: fsl_sai: Constrain sample rates from audio PLLs only in master + mode + +From: Chancel Liu + +[ Upstream commit 9f4d0899efd9892fc7514c9488270e1bb7dedd2b ] + +If SAI works in master mode it will generate clocks for external codec +from audio PLLs. Thus sample rates should be constrained according to +audio PLL clocks. While SAI works in slave mode which means clocks are +generated externally then constraints are independent of audio PLLs. + +Fixes: 4edc98598be4 ("ASoC: fsl_sai: Add sample rate constraint") +Signed-off-by: Chancel Liu +Link: https://patch.msgid.link/20251210062109.2577735-1-chancel.liu@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_sai.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c +index 72bfc91e21b9..86730c214914 100644 +--- a/sound/soc/fsl/fsl_sai.c ++++ b/sound/soc/fsl/fsl_sai.c +@@ -917,8 +917,14 @@ static int fsl_sai_startup(struct snd_pcm_substream *substream, + tx ? sai->dma_params_tx.maxburst : + sai->dma_params_rx.maxburst); + +- ret = snd_pcm_hw_constraint_list(substream->runtime, 0, +- SNDRV_PCM_HW_PARAM_RATE, &sai->constraint_rates); ++ if (sai->is_consumer_mode[tx]) ++ ret = snd_pcm_hw_constraint_list(substream->runtime, 0, ++ SNDRV_PCM_HW_PARAM_RATE, ++ &fsl_sai_rate_constraints); ++ else ++ ret = snd_pcm_hw_constraint_list(substream->runtime, 0, ++ SNDRV_PCM_HW_PARAM_RATE, ++ &sai->constraint_rates); + + return ret; + } +-- +2.51.0 + diff --git a/queue-6.18/asoc-ops-fix-snd_soc_get_volsw-for-sx-controls.patch b/queue-6.18/asoc-ops-fix-snd_soc_get_volsw-for-sx-controls.patch new file mode 100644 index 0000000000..191072b104 --- /dev/null +++ b/queue-6.18/asoc-ops-fix-snd_soc_get_volsw-for-sx-controls.patch @@ -0,0 +1,132 @@ +From e4ab11bff0d6f855a6fbc0908a31a5db75e86100 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Dec 2025 13:49:20 +0000 +Subject: ASoC: ops: fix snd_soc_get_volsw for sx controls + +From: Stefan Binding + +[ Upstream commit 095d621141826a2841dae85b52c784c147ea99d3 ] + +SX controls are currently broken, since the clamp introduced in +commit a0ce874cfaaa ("ASoC: ops: improve snd_soc_get_volsw") does not +handle SX controls, for example where the min value in the clamp is +greater than the max value in the clamp. + +Add clamp parameter to prevent clamping in SX controls. +The nature of SX controls mean that it wraps around 0, with a variable +number of bits, therefore clamping the value becomes complicated and +prone to error. + +Fixes 35 kunit tests for soc_ops_test_access. + +Fixes: a0ce874cfaaa ("ASoC: ops: improve snd_soc_get_volsw") + +Co-developed-by: Charles Keepax +Signed-off-by: Stefan Binding +Tested-by: Peter Ujfalusi +Link: https://patch.msgid.link/20251216134938.788625-1-sbinding@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-ops.c | 32 ++++++++++++++++++++------------ + 1 file changed, 20 insertions(+), 12 deletions(-) + +diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c +index ce86978c158d..624e9269fc25 100644 +--- a/sound/soc/soc-ops.c ++++ b/sound/soc/soc-ops.c +@@ -111,7 +111,8 @@ int snd_soc_put_enum_double(struct snd_kcontrol *kcontrol, + EXPORT_SYMBOL_GPL(snd_soc_put_enum_double); + + static int sdca_soc_q78_reg_to_ctl(struct soc_mixer_control *mc, unsigned int reg_val, +- unsigned int mask, unsigned int shift, int max) ++ unsigned int mask, unsigned int shift, int max, ++ bool sx) + { + int val = reg_val; + +@@ -141,20 +142,26 @@ static unsigned int sdca_soc_q78_ctl_to_reg(struct soc_mixer_control *mc, int va + } + + static int soc_mixer_reg_to_ctl(struct soc_mixer_control *mc, unsigned int reg_val, +- unsigned int mask, unsigned int shift, int max) ++ unsigned int mask, unsigned int shift, int max, ++ bool sx) + { + int val = (reg_val >> shift) & mask; + + if (mc->sign_bit) + val = sign_extend32(val, mc->sign_bit); + +- val = clamp(val, mc->min, mc->max); +- val -= mc->min; ++ if (sx) { ++ val -= mc->min; // SX controls intentionally can overflow here ++ val = min_t(unsigned int, val & mask, max); ++ } else { ++ val = clamp(val, mc->min, mc->max); ++ val -= mc->min; ++ } + + if (mc->invert) + val = max - val; + +- return val & mask; ++ return val; + } + + static unsigned int soc_mixer_ctl_to_reg(struct soc_mixer_control *mc, int val, +@@ -280,9 +287,10 @@ static int soc_put_volsw(struct snd_kcontrol *kcontrol, + + static int soc_get_volsw(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_value *ucontrol, +- struct soc_mixer_control *mc, int mask, int max) ++ struct soc_mixer_control *mc, int mask, int max, bool sx) + { +- int (*reg_to_ctl)(struct soc_mixer_control *, unsigned int, unsigned int, unsigned int, int); ++ int (*reg_to_ctl)(struct soc_mixer_control *, unsigned int, unsigned int, ++ unsigned int, int, bool); + struct snd_soc_component *component = snd_kcontrol_chip(kcontrol); + unsigned int reg_val; + int val; +@@ -293,16 +301,16 @@ static int soc_get_volsw(struct snd_kcontrol *kcontrol, + reg_to_ctl = soc_mixer_reg_to_ctl; + + reg_val = snd_soc_component_read(component, mc->reg); +- val = reg_to_ctl(mc, reg_val, mask, mc->shift, max); ++ val = reg_to_ctl(mc, reg_val, mask, mc->shift, max, sx); + + ucontrol->value.integer.value[0] = val; + + if (snd_soc_volsw_is_stereo(mc)) { + if (mc->reg == mc->rreg) { +- val = reg_to_ctl(mc, reg_val, mask, mc->rshift, max); ++ val = reg_to_ctl(mc, reg_val, mask, mc->rshift, max, sx); + } else { + reg_val = snd_soc_component_read(component, mc->rreg); +- val = reg_to_ctl(mc, reg_val, mask, mc->shift, max); ++ val = reg_to_ctl(mc, reg_val, mask, mc->shift, max, sx); + } + + ucontrol->value.integer.value[1] = val; +@@ -371,7 +379,7 @@ int snd_soc_get_volsw(struct snd_kcontrol *kcontrol, + (struct soc_mixer_control *)kcontrol->private_value; + unsigned int mask = soc_mixer_mask(mc); + +- return soc_get_volsw(kcontrol, ucontrol, mc, mask, mc->max - mc->min); ++ return soc_get_volsw(kcontrol, ucontrol, mc, mask, mc->max - mc->min, false); + } + EXPORT_SYMBOL_GPL(snd_soc_get_volsw); + +@@ -413,7 +421,7 @@ int snd_soc_get_volsw_sx(struct snd_kcontrol *kcontrol, + (struct soc_mixer_control *)kcontrol->private_value; + unsigned int mask = soc_mixer_sx_mask(mc); + +- return soc_get_volsw(kcontrol, ucontrol, mc, mask, mc->max); ++ return soc_get_volsw(kcontrol, ucontrol, mc, mask, mc->max, true); + } + EXPORT_SYMBOL_GPL(snd_soc_get_volsw_sx); + +-- +2.51.0 + diff --git a/queue-6.18/asoc-sdca-support-q7.8-volume-format.patch b/queue-6.18/asoc-sdca-support-q7.8-volume-format.patch new file mode 100644 index 0000000000..009eed8425 --- /dev/null +++ b/queue-6.18/asoc-sdca-support-q7.8-volume-format.patch @@ -0,0 +1,218 @@ +From 192149320c2ef63d0ecffd51618d4c558ef25ee7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 17:33:35 +0800 +Subject: ASoC: SDCA: support Q7.8 volume format + +From: Shuming Fan + +[ Upstream commit 1b0f3f9ee41ee2bdd206667f85ea2aa36dfe6e69 ] + +The SDCA specification uses Q7.8 volume format. +This patch adds a field to indicate whether it is SDCA volume control +and supports the volume settings. + +Signed-off-by: Shuming Fan +Reviewed-by: Charles Keepax +Link: https://patch.msgid.link/20251106093335.1363237-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Stable-dep-of: 095d62114182 ("ASoC: ops: fix snd_soc_get_volsw for sx controls") +Signed-off-by: Sasha Levin +--- + include/sound/soc.h | 1 + + sound/soc/sdca/sdca_asoc.c | 34 ++++++--------------- + sound/soc/soc-ops.c | 62 +++++++++++++++++++++++++++++++------- + 3 files changed, 61 insertions(+), 36 deletions(-) + +diff --git a/include/sound/soc.h b/include/sound/soc.h +index ddc508ff7b9b..a9c058b06ab4 100644 +--- a/include/sound/soc.h ++++ b/include/sound/soc.h +@@ -1225,6 +1225,7 @@ struct soc_mixer_control { + unsigned int sign_bit; + unsigned int invert:1; + unsigned int autodisable:1; ++ unsigned int sdca_q78:1; + #ifdef CONFIG_SND_SOC_TOPOLOGY + struct snd_soc_dobj dobj; + #endif +diff --git a/sound/soc/sdca/sdca_asoc.c b/sound/soc/sdca/sdca_asoc.c +index c493ec530cc5..892b7c028fae 100644 +--- a/sound/soc/sdca/sdca_asoc.c ++++ b/sound/soc/sdca/sdca_asoc.c +@@ -795,7 +795,6 @@ static int control_limit_kctl(struct device *dev, + struct sdca_control_range *range; + int min, max, step; + unsigned int *tlv; +- int shift; + + if (control->type != SDCA_CTL_DATATYPE_Q7P8DB) + return 0; +@@ -814,37 +813,22 @@ static int control_limit_kctl(struct device *dev, + min = sign_extend32(min, control->nbits - 1); + max = sign_extend32(max, control->nbits - 1); + +- /* +- * FIXME: Only support power of 2 step sizes as this can be supported +- * by a simple shift. +- */ +- if (hweight32(step) != 1) { +- dev_err(dev, "%s: %s: currently unsupported step size\n", +- entity->label, control->label); +- return -EINVAL; +- } +- +- /* +- * The SDCA volumes are in steps of 1/256th of a dB, a step down of +- * 64 (shift of 6) gives 1/4dB. 1/4dB is the smallest unit that is also +- * representable in the ALSA TLVs which are in 1/100ths of a dB. +- */ +- shift = max(ffs(step) - 1, 6); +- + tlv = devm_kcalloc(dev, 4, sizeof(*tlv), GFP_KERNEL); + if (!tlv) + return -ENOMEM; + +- tlv[0] = SNDRV_CTL_TLVT_DB_SCALE; ++ tlv[0] = SNDRV_CTL_TLVT_DB_MINMAX; + tlv[1] = 2 * sizeof(*tlv); + tlv[2] = (min * 100) >> 8; +- tlv[3] = ((1 << shift) * 100) >> 8; ++ tlv[3] = (max * 100) >> 8; ++ ++ step = (step * 100) >> 8; + +- mc->min = min >> shift; +- mc->max = max >> shift; +- mc->shift = shift; +- mc->rshift = shift; +- mc->sign_bit = 15 - shift; ++ mc->min = ((int)tlv[2] / step); ++ mc->max = ((int)tlv[3] / step); ++ mc->shift = step; ++ mc->sign_bit = 15; ++ mc->sdca_q78 = 1; + + kctl->tlv.p = tlv; + kctl->access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ; +diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c +index d2b6fb8e0b6c..ce86978c158d 100644 +--- a/sound/soc/soc-ops.c ++++ b/sound/soc/soc-ops.c +@@ -110,6 +110,36 @@ int snd_soc_put_enum_double(struct snd_kcontrol *kcontrol, + } + EXPORT_SYMBOL_GPL(snd_soc_put_enum_double); + ++static int sdca_soc_q78_reg_to_ctl(struct soc_mixer_control *mc, unsigned int reg_val, ++ unsigned int mask, unsigned int shift, int max) ++{ ++ int val = reg_val; ++ ++ if (WARN_ON(!mc->shift)) ++ return -EINVAL; ++ ++ val = sign_extend32(val, mc->sign_bit); ++ val = (((val * 100) >> 8) / (int)mc->shift); ++ val -= mc->min; ++ ++ return val & mask; ++} ++ ++static unsigned int sdca_soc_q78_ctl_to_reg(struct soc_mixer_control *mc, int val, ++ unsigned int mask, unsigned int shift, int max) ++{ ++ unsigned int ret_val; ++ int reg_val; ++ ++ if (WARN_ON(!mc->shift)) ++ return -EINVAL; ++ ++ reg_val = val + mc->min; ++ ret_val = (int)((reg_val * mc->shift) << 8) / 100; ++ ++ return ret_val & mask; ++} ++ + static int soc_mixer_reg_to_ctl(struct soc_mixer_control *mc, unsigned int reg_val, + unsigned int mask, unsigned int shift, int max) + { +@@ -197,19 +227,27 @@ static int soc_put_volsw(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_value *ucontrol, + struct soc_mixer_control *mc, int mask, int max) + { ++ unsigned int (*ctl_to_reg)(struct soc_mixer_control *, int, unsigned int, unsigned int, int); + struct snd_soc_component *component = snd_kcontrol_chip(kcontrol); + unsigned int val1, val_mask; + unsigned int val2 = 0; + bool double_r = false; + int ret; + ++ if (mc->sdca_q78) { ++ ctl_to_reg = sdca_soc_q78_ctl_to_reg; ++ val_mask = mask; ++ } else { ++ ctl_to_reg = soc_mixer_ctl_to_reg; ++ val_mask = mask << mc->shift; ++ } ++ + ret = soc_mixer_valid_ctl(mc, ucontrol->value.integer.value[0], max); + if (ret) + return ret; + +- val1 = soc_mixer_ctl_to_reg(mc, ucontrol->value.integer.value[0], ++ val1 = ctl_to_reg(mc, ucontrol->value.integer.value[0], + mask, mc->shift, max); +- val_mask = mask << mc->shift; + + if (snd_soc_volsw_is_stereo(mc)) { + ret = soc_mixer_valid_ctl(mc, ucontrol->value.integer.value[1], max); +@@ -217,14 +255,10 @@ static int soc_put_volsw(struct snd_kcontrol *kcontrol, + return ret; + + if (mc->reg == mc->rreg) { +- val1 |= soc_mixer_ctl_to_reg(mc, +- ucontrol->value.integer.value[1], +- mask, mc->rshift, max); ++ val1 |= ctl_to_reg(mc, ucontrol->value.integer.value[1], mask, mc->rshift, max); + val_mask |= mask << mc->rshift; + } else { +- val2 = soc_mixer_ctl_to_reg(mc, +- ucontrol->value.integer.value[1], +- mask, mc->shift, max); ++ val2 = ctl_to_reg(mc, ucontrol->value.integer.value[1], mask, mc->shift, max); + double_r = true; + } + } +@@ -248,21 +282,27 @@ static int soc_get_volsw(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_value *ucontrol, + struct soc_mixer_control *mc, int mask, int max) + { ++ int (*reg_to_ctl)(struct soc_mixer_control *, unsigned int, unsigned int, unsigned int, int); + struct snd_soc_component *component = snd_kcontrol_chip(kcontrol); + unsigned int reg_val; + int val; + ++ if (mc->sdca_q78) ++ reg_to_ctl = sdca_soc_q78_reg_to_ctl; ++ else ++ reg_to_ctl = soc_mixer_reg_to_ctl; ++ + reg_val = snd_soc_component_read(component, mc->reg); +- val = soc_mixer_reg_to_ctl(mc, reg_val, mask, mc->shift, max); ++ val = reg_to_ctl(mc, reg_val, mask, mc->shift, max); + + ucontrol->value.integer.value[0] = val; + + if (snd_soc_volsw_is_stereo(mc)) { + if (mc->reg == mc->rreg) { +- val = soc_mixer_reg_to_ctl(mc, reg_val, mask, mc->rshift, max); ++ val = reg_to_ctl(mc, reg_val, mask, mc->rshift, max); + } else { + reg_val = snd_soc_component_read(component, mc->rreg); +- val = soc_mixer_reg_to_ctl(mc, reg_val, mask, mc->shift, max); ++ val = reg_to_ctl(mc, reg_val, mask, mc->shift, max); + } + + ucontrol->value.integer.value[1] = val; +-- +2.51.0 + diff --git a/queue-6.18/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch b/queue-6.18/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch new file mode 100644 index 0000000000..58e3ba78fe --- /dev/null +++ b/queue-6.18/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch @@ -0,0 +1,79 @@ +From 77101cf3d34dc7cfa2317cf88c48cd65e48b2b2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 16:16:26 +0100 +Subject: clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & + pcie_x4 + +From: Josua Mayer + +[ Upstream commit f0e6bc0c3ef4b4afb299bd6912586cafd5d864e9 ] + +CP110 based platforms rely on the bootloader for pci port +initialization. +TF-A actively prevents non-uboot re-configuration of pci lanes, and many +boards do not have software control over the pci card reset. + +If a pci port had link at boot-time and the clock is stopped at a later +point, the link fails and can not be recovered. + +PCI controller driver probe - and by extension ownership of a driver for +the pci clocks - may be delayed especially on large modular kernels, +causing the clock core to start disabling unused clocks. + +Add the CLK_IGNORE_UNUSED flag to the three pci port's clocks to ensure +they are not stopped before the pci controller driver has taken +ownership and tested for an existing link. + +This fixes failed pci link detection when controller driver probes late, +e.g. with arm64 defconfig and CONFIG_PHY_MVEBU_CP110_COMPHY=m. + +Closes: https://lore.kernel.org/r/b71596c7-461b-44b6-89ab-3cfbd492639f@solid-run.com +Signed-off-by: Josua Mayer +Reviewed-by: Andrew Lunn +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/cp110-system-controller.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c +index 03c59bf22106..b47c86906046 100644 +--- a/drivers/clk/mvebu/cp110-system-controller.c ++++ b/drivers/clk/mvebu/cp110-system-controller.c +@@ -110,6 +110,25 @@ static const char * const gate_base_names[] = { + [CP110_GATE_EIP197] = "eip197" + }; + ++static unsigned long gate_flags(const u8 bit_idx) ++{ ++ switch (bit_idx) { ++ case CP110_GATE_PCIE_X1_0: ++ case CP110_GATE_PCIE_X1_1: ++ case CP110_GATE_PCIE_X4: ++ /* ++ * If a port had an active link at boot time, stopping ++ * the clock creates a failed state from which controller ++ * driver can not recover. ++ * Prevent stopping this clock till after a driver has taken ++ * ownership. ++ */ ++ return CLK_IGNORE_UNUSED; ++ default: ++ return 0; ++ } ++}; ++ + struct cp110_gate_clk { + struct clk_hw hw; + struct regmap *regmap; +@@ -171,6 +190,7 @@ static struct clk_hw *cp110_register_gate(const char *name, + init.ops = &cp110_gate_ops; + init.parent_names = &parent_name; + init.num_parents = 1; ++ init.flags = gate_flags(bit_idx); + + gate->regmap = regmap; + gate->bit_idx = bit_idx; +-- +2.51.0 + diff --git a/queue-6.18/clk-qcom-dispcc-sm7150-fix-dispcc_mdss_pclk0_clk_src.patch b/queue-6.18/clk-qcom-dispcc-sm7150-fix-dispcc_mdss_pclk0_clk_src.patch new file mode 100644 index 0000000000..32bd61ab17 --- /dev/null +++ b/queue-6.18/clk-qcom-dispcc-sm7150-fix-dispcc_mdss_pclk0_clk_src.patch @@ -0,0 +1,38 @@ +From a7105597e0bdb68e2af07f36627502b964fec45e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Sep 2025 14:34:32 +0200 +Subject: clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src + +From: Jens Reidel + +[ Upstream commit e3c13e0caa8ceb7dec1a7c4fcfd9dbef56a69fbe ] + +Set CLK_OPS_PARENT_ENABLE to ensure the parent gets prepared and enabled +when switching to it, fixing an "rcg didn't update its configuration" +warning. + +Signed-off-by: Jens Reidel +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250919-sm7150-dispcc-fixes-v1-3-308ad47c5fce@mainlining.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-sm7150.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/dispcc-sm7150.c b/drivers/clk/qcom/dispcc-sm7150.c +index bdfff246ed3f..ddc7230b8aea 100644 +--- a/drivers/clk/qcom/dispcc-sm7150.c ++++ b/drivers/clk/qcom/dispcc-sm7150.c +@@ -356,7 +356,7 @@ static struct clk_rcg2 dispcc_mdss_pclk0_clk_src = { + .name = "dispcc_mdss_pclk0_clk_src", + .parent_data = dispcc_parent_data_4, + .num_parents = ARRAY_SIZE(dispcc_parent_data_4), +- .flags = CLK_SET_RATE_PARENT, ++ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, + .ops = &clk_pixel_ops, + }, + }; +-- +2.51.0 + diff --git a/queue-6.18/exfat-fix-remount-failure-in-different-process-envir.patch b/queue-6.18/exfat-fix-remount-failure-in-different-process-envir.patch new file mode 100644 index 0000000000..5c1ea2aee5 --- /dev/null +++ b/queue-6.18/exfat-fix-remount-failure-in-different-process-envir.patch @@ -0,0 +1,60 @@ +From 1aa377ec85460a454f58b44984d1487e25fbb0c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 17:51:10 +0800 +Subject: exfat: fix remount failure in different process environments + +From: Yuezhang Mo + +[ Upstream commit 51fc7b4ce10ccab8ea5e4876bcdc42cf5202a0ef ] + +The kernel test robot reported that the exFAT remount operation +failed. The reason for the failure was that the process's umask +is different between mount and remount, causing fs_fmask and +fs_dmask are changed. + +Potentially, both gid and uid may also be changed. Therefore, when +initializing fs_context for remount, inherit these mount options +from the options used during mount. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-lkp/202511251637.81670f5c-lkp@intel.com +Signed-off-by: Yuezhang Mo +Signed-off-by: Namjae Jeon +Signed-off-by: Sasha Levin +--- + fs/exfat/super.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/fs/exfat/super.c b/fs/exfat/super.c +index 74d451f732c7..581754001128 100644 +--- a/fs/exfat/super.c ++++ b/fs/exfat/super.c +@@ -813,10 +813,21 @@ static int exfat_init_fs_context(struct fs_context *fc) + ratelimit_state_init(&sbi->ratelimit, DEFAULT_RATELIMIT_INTERVAL, + DEFAULT_RATELIMIT_BURST); + +- sbi->options.fs_uid = current_uid(); +- sbi->options.fs_gid = current_gid(); +- sbi->options.fs_fmask = current->fs->umask; +- sbi->options.fs_dmask = current->fs->umask; ++ if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE && fc->root) { ++ struct super_block *sb = fc->root->d_sb; ++ struct exfat_mount_options *cur_opts = &EXFAT_SB(sb)->options; ++ ++ sbi->options.fs_uid = cur_opts->fs_uid; ++ sbi->options.fs_gid = cur_opts->fs_gid; ++ sbi->options.fs_fmask = cur_opts->fs_fmask; ++ sbi->options.fs_dmask = cur_opts->fs_dmask; ++ } else { ++ sbi->options.fs_uid = current_uid(); ++ sbi->options.fs_gid = current_gid(); ++ sbi->options.fs_fmask = current->fs->umask; ++ sbi->options.fs_dmask = current->fs->umask; ++ } ++ + sbi->options.allow_utime = -1; + sbi->options.errors = EXFAT_ERRORS_RO; + exfat_set_iocharset(&sbi->options, exfat_default_iocharset); +-- +2.51.0 + diff --git a/queue-6.18/exfat-zero-out-post-eof-page-cache-on-file-extension.patch b/queue-6.18/exfat-zero-out-post-eof-page-cache-on-file-extension.patch new file mode 100644 index 0000000000..585c7e08f6 --- /dev/null +++ b/queue-6.18/exfat-zero-out-post-eof-page-cache-on-file-extension.patch @@ -0,0 +1,63 @@ +From f15f34ce4687cd02668b26102b15a44a763011ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Oct 2025 17:03:41 +0800 +Subject: exfat: zero out post-EOF page cache on file extension + +From: Yuezhang Mo + +[ Upstream commit 4e163c39dd4e70fcdce948b8774d96e0482b4a11 ] + +xfstests generic/363 was failing due to unzeroed post-EOF page +cache that allowed mmap writes beyond EOF to become visible +after file extension. + +For example, in following xfs_io sequence, 0x22 should not be +written to the file but would become visible after the extension: + + xfs_io -f -t -c "pwrite -S 0x11 0 8" \ + -c "mmap 0 4096" \ + -c "mwrite -S 0x22 32 32" \ + -c "munmap" \ + -c "pwrite -S 0x33 512 32" \ + $testfile + +This violates the expected behavior where writes beyond EOF via +mmap should not persist after the file is extended. Instead, the +extended region should contain zeros. + +Fix this by using truncate_pagecache() to truncate the page cache +after the current EOF when extending the file. + +Signed-off-by: Yuezhang Mo +Signed-off-by: Namjae Jeon +Signed-off-by: Sasha Levin +--- + fs/exfat/file.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/exfat/file.c b/fs/exfat/file.c +index adc37b4d7fc2..536c8078f0c1 100644 +--- a/fs/exfat/file.c ++++ b/fs/exfat/file.c +@@ -25,6 +25,8 @@ static int exfat_cont_expand(struct inode *inode, loff_t size) + struct exfat_sb_info *sbi = EXFAT_SB(sb); + struct exfat_chain clu; + ++ truncate_pagecache(inode, i_size_read(inode)); ++ + ret = inode_newsize_ok(inode, size); + if (ret) + return ret; +@@ -639,6 +641,9 @@ static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter) + + inode_lock(inode); + ++ if (pos > i_size_read(inode)) ++ truncate_pagecache(inode, i_size_read(inode)); ++ + valid_size = ei->valid_size; + + ret = generic_write_checks(iocb, iter); +-- +2.51.0 + diff --git a/queue-6.18/firmware-imx-scu-irq-init-workqueue-before-request-m.patch b/queue-6.18/firmware-imx-scu-irq-init-workqueue-before-request-m.patch new file mode 100644 index 0000000000..3c4bb9946d --- /dev/null +++ b/queue-6.18/firmware-imx-scu-irq-init-workqueue-before-request-m.patch @@ -0,0 +1,46 @@ +From fb3f685982a800468d43edabb4486bef35d6e6cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Oct 2025 09:56:26 +0800 +Subject: firmware: imx: scu-irq: Init workqueue before request mbox channel + +From: Peng Fan + +[ Upstream commit 81fb53feb66a3aefbf6fcab73bb8d06f5b0c54ad ] + +With mailbox channel requested, there is possibility that interrupts may +come in, so need to make sure the workqueue is initialized before +the queue is scheduled by mailbox rx callback. + +Reviewed-by: Frank Li +Signed-off-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/firmware/imx/imx-scu-irq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/imx/imx-scu-irq.c b/drivers/firmware/imx/imx-scu-irq.c +index f2b902e95b73..b9f6128d56f7 100644 +--- a/drivers/firmware/imx/imx-scu-irq.c ++++ b/drivers/firmware/imx/imx-scu-irq.c +@@ -214,6 +214,8 @@ int imx_scu_enable_general_irq_channel(struct device *dev) + cl->dev = dev; + cl->rx_callback = imx_scu_irq_callback; + ++ INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler); ++ + /* SCU general IRQ uses general interrupt channel 3 */ + ch = mbox_request_channel_byname(cl, "gip3"); + if (IS_ERR(ch)) { +@@ -223,8 +225,6 @@ int imx_scu_enable_general_irq_channel(struct device *dev) + return ret; + } + +- INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler); +- + if (!of_parse_phandle_with_args(dev->of_node, "mboxes", + "#mbox-cells", 0, &spec)) { + i = of_alias_get_id(spec.np, "mu"); +-- +2.51.0 + diff --git a/queue-6.18/functionfs-fix-the-open-removal-races.patch b/queue-6.18/functionfs-fix-the-open-removal-races.patch new file mode 100644 index 0000000000..27e797d7bc --- /dev/null +++ b/queue-6.18/functionfs-fix-the-open-removal-races.patch @@ -0,0 +1,141 @@ +From b6daec599af2fccb451702345162ebb2033eb5b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Nov 2025 02:18:22 -0500 +Subject: functionfs: fix the open/removal races + +From: Al Viro + +[ Upstream commit e5bf5ee266633cb18fff6f98f0b7d59a62819eee ] + +ffs_epfile_open() can race with removal, ending up with file->private_data +pointing to freed object. + +There is a total count of opened files on functionfs (both ep0 and +dynamic ones) and when it hits zero, dynamic files get removed. +Unfortunately, that removal can happen while another thread is +in ffs_epfile_open(), but has not incremented the count yet. +In that case open will succeed, leaving us with UAF on any subsequent +read() or write(). + +The root cause is that ffs->opened is misused; atomic_dec_and_test() vs. +atomic_add_return() is not a good idea, when object remains visible all +along. + +To untangle that + * serialize openers on ffs->mutex (both for ep0 and for dynamic files) + * have dynamic ones use atomic_inc_not_zero() and fail if we had +zero ->opened; in that case the file we are opening is doomed. + * have the inodes of dynamic files marked on removal (from the +callback of simple_recursive_removal()) - clear ->i_private there. + * have open of dynamic ones verify they hadn't been already removed, +along with checking that state is FFS_ACTIVE. + +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_fs.c | 53 ++++++++++++++++++++++++------ + 1 file changed, 43 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 47cfbe41fdff..69f6e3c0f7e0 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -640,13 +640,22 @@ static ssize_t ffs_ep0_read(struct file *file, char __user *buf, + + static int ffs_ep0_open(struct inode *inode, struct file *file) + { +- struct ffs_data *ffs = inode->i_private; ++ struct ffs_data *ffs = inode->i_sb->s_fs_info; ++ int ret; + +- if (ffs->state == FFS_CLOSING) +- return -EBUSY; ++ /* Acquire mutex */ ++ ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK); ++ if (ret < 0) ++ return ret; + +- file->private_data = ffs; + ffs_data_opened(ffs); ++ if (ffs->state == FFS_CLOSING) { ++ ffs_data_closed(ffs); ++ mutex_unlock(&ffs->mutex); ++ return -EBUSY; ++ } ++ mutex_unlock(&ffs->mutex); ++ file->private_data = ffs; + + return stream_open(inode, file); + } +@@ -1193,14 +1202,33 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) + static int + ffs_epfile_open(struct inode *inode, struct file *file) + { +- struct ffs_epfile *epfile = inode->i_private; ++ struct ffs_data *ffs = inode->i_sb->s_fs_info; ++ struct ffs_epfile *epfile; ++ int ret; + +- if (WARN_ON(epfile->ffs->state != FFS_ACTIVE)) ++ /* Acquire mutex */ ++ ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK); ++ if (ret < 0) ++ return ret; ++ ++ if (!atomic_inc_not_zero(&ffs->opened)) { ++ mutex_unlock(&ffs->mutex); ++ return -ENODEV; ++ } ++ /* ++ * we want the state to be FFS_ACTIVE; FFS_ACTIVE alone is ++ * not enough, though - we might have been through FFS_CLOSING ++ * and back to FFS_ACTIVE, with our file already removed. ++ */ ++ epfile = smp_load_acquire(&inode->i_private); ++ if (unlikely(ffs->state != FFS_ACTIVE || !epfile)) { ++ mutex_unlock(&ffs->mutex); ++ ffs_data_closed(ffs); + return -ENODEV; ++ } ++ mutex_unlock(&ffs->mutex); + + file->private_data = epfile; +- ffs_data_opened(epfile->ffs); +- + return stream_open(inode, file); + } + +@@ -1332,7 +1360,7 @@ static void ffs_dmabuf_put(struct dma_buf_attachment *attach) + static int + ffs_epfile_release(struct inode *inode, struct file *file) + { +- struct ffs_epfile *epfile = inode->i_private; ++ struct ffs_epfile *epfile = file->private_data; + struct ffs_dmabuf_priv *priv, *tmp; + struct ffs_data *ffs = epfile->ffs; + +@@ -2352,6 +2380,11 @@ static int ffs_epfiles_create(struct ffs_data *ffs) + return 0; + } + ++static void clear_one(struct dentry *dentry) ++{ ++ smp_store_release(&dentry->d_inode->i_private, NULL); ++} ++ + static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count) + { + struct ffs_epfile *epfile = epfiles; +@@ -2359,7 +2392,7 @@ static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count) + for (; count; --count, ++epfile) { + BUG_ON(mutex_is_locked(&epfile->mutex)); + if (epfile->dentry) { +- simple_recursive_removal(epfile->dentry, NULL); ++ simple_recursive_removal(epfile->dentry, clear_one); + epfile->dentry = NULL; + } + } +-- +2.51.0 + diff --git a/queue-6.18/fuse-always-flush-the-page-cache-before-fopen_direct.patch b/queue-6.18/fuse-always-flush-the-page-cache-before-fopen_direct.patch new file mode 100644 index 0000000000..42c6a91913 --- /dev/null +++ b/queue-6.18/fuse-always-flush-the-page-cache-before-fopen_direct.patch @@ -0,0 +1,36 @@ +From f5e92a2cb7b894d86921049eaa3d8fe4c375fb9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 00:21:18 +0200 +Subject: fuse: Always flush the page cache before FOPEN_DIRECT_IO write + +From: Bernd Schubert + +[ Upstream commit 1ce120dcefc056ce8af2486cebbb77a458aad4c3 ] + +This was done as condition on direct_io_allow_mmap, but I believe +this is not right, as a file might be open two times - once with +write-back enabled another time with FOPEN_DIRECT_IO. + +Signed-off-by: Bernd Schubert +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index f1ef77a0be05..c5c82b380791 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -1607,7 +1607,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, + if (!ia) + return -ENOMEM; + +- if (fopen_direct_io && fc->direct_io_allow_mmap) { ++ if (fopen_direct_io) { + res = filemap_write_and_wait_range(mapping, pos, pos + count - 1); + if (res) { + fuse_io_free(ia); +-- +2.51.0 + diff --git a/queue-6.18/fuse-invalidate-the-page-cache-after-fopen_direct_io.patch b/queue-6.18/fuse-invalidate-the-page-cache-after-fopen_direct_io.patch new file mode 100644 index 0000000000..80481a1d9c --- /dev/null +++ b/queue-6.18/fuse-invalidate-the-page-cache-after-fopen_direct_io.patch @@ -0,0 +1,45 @@ +From 40270b9231a715f9d5a0fd2a9931ec43ee5c6534 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 00:21:17 +0200 +Subject: fuse: Invalidate the page cache after FOPEN_DIRECT_IO write + +From: Bernd Schubert + +[ Upstream commit b359af8275a982a458e8df6c6beab1415be1f795 ] + +generic_file_direct_write() also does this and has a large +comment about. + +Reproducer here is xfstest's generic/209, which is exactly to +have competing DIO write and cached IO read. + +Signed-off-by: Bernd Schubert +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/file.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index c5c82b380791..bb4ecfd469a5 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -1681,6 +1681,15 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, + if (res > 0) + *ppos = pos; + ++ if (res > 0 && write && fopen_direct_io) { ++ /* ++ * As in generic_file_direct_write(), invalidate after the ++ * write, to invalidate read-ahead cache that may have competed ++ * with the write. ++ */ ++ invalidate_inode_pages2_range(mapping, idx_from, idx_to); ++ } ++ + return res > 0 ? res : err; + } + EXPORT_SYMBOL_GPL(fuse_direct_io); +-- +2.51.0 + diff --git a/queue-6.18/hwmon-emc2305-fix-device-node-refcount-leak-in-error.patch b/queue-6.18/hwmon-emc2305-fix-device-node-refcount-leak-in-error.patch new file mode 100644 index 0000000000..bc9dc66f79 --- /dev/null +++ b/queue-6.18/hwmon-emc2305-fix-device-node-refcount-leak-in-error.patch @@ -0,0 +1,46 @@ +From 5e180a8f19c94e5750e1b8145b6d0a4712cfdf11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 11:15:13 +0800 +Subject: hwmon: (emc2305) fix device node refcount leak in error path + +From: Pei Xiao + +[ Upstream commit 4910da6b36b122db50a27fabf6ab7f8611b60bf8 ] + +The for_each_child_of_node() macro automatically manages device node +reference counts during normal iteration. However, when breaking out +of the loop early with return, the current iteration's node is not +automatically released, leading to a reference count leak. + +Fix this by adding of_node_put(child) before returning from the loop +when emc2305_set_single_tz() fails. + +This issue could lead to memory leaks over multiple probe cycles. + +Signed-off-by: Pei Xiao +Link: https://lore.kernel.org/r/tencent_5CDC08544C901D5ECA270573D5AEE3117108@qq.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/emc2305.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwmon/emc2305.c b/drivers/hwmon/emc2305.c +index 60809289f816..84cb9b72cb6c 100644 +--- a/drivers/hwmon/emc2305.c ++++ b/drivers/hwmon/emc2305.c +@@ -685,8 +685,10 @@ static int emc2305_probe(struct i2c_client *client) + i = 0; + for_each_child_of_node(dev->of_node, child) { + ret = emc2305_set_single_tz(dev, child, i); +- if (ret != 0) ++ if (ret != 0) { ++ of_node_put(child); + return ret; ++ } + i++; + } + } else { +-- +2.51.0 + diff --git a/queue-6.18/hwmon-emc2305-fix-double-put-in-emc2305_probe_childs.patch b/queue-6.18/hwmon-emc2305-fix-double-put-in-emc2305_probe_childs.patch new file mode 100644 index 0000000000..6d8f9ddf41 --- /dev/null +++ b/queue-6.18/hwmon-emc2305-fix-double-put-in-emc2305_probe_childs.patch @@ -0,0 +1,41 @@ +From dbeb9d4698fe445f4039354040915ae7ef127c63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Dec 2025 10:02:41 +0800 +Subject: hwmon: (emc2305) fix double put in emc2305_probe_childs_from_dt + +From: Pei Xiao + +[ Upstream commit 541dfb49dcb80c2509e030842de77adfb77820f5 ] + +./drivers/hwmon/emc2305.c:597:4-15: ERROR: probable double put + +Device node iterators put the previous value of the index variable, so an +explicit put causes a double put. + +Signed-off-by: Pei Xiao +Link: https://lore.kernel.org/r/tencent_CD373F952BE48697C949E39CB5EB77841D06@qq.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/emc2305.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/hwmon/emc2305.c b/drivers/hwmon/emc2305.c +index 84cb9b72cb6c..ceae96c07ac4 100644 +--- a/drivers/hwmon/emc2305.c ++++ b/drivers/hwmon/emc2305.c +@@ -593,10 +593,8 @@ static int emc2305_probe_childs_from_dt(struct device *dev) + for_each_child_of_node(dev->of_node, child) { + if (of_property_present(child, "reg")) { + ret = emc2305_of_parse_pwm_child(dev, child, data); +- if (ret) { +- of_node_put(child); ++ if (ret) + continue; +- } + count++; + } + } +-- +2.51.0 + diff --git a/queue-6.18/i2c-designware-disable-smbus-interrupts-to-prevent-s.patch b/queue-6.18/i2c-designware-disable-smbus-interrupts-to-prevent-s.patch new file mode 100644 index 0000000000..8623e2c188 --- /dev/null +++ b/queue-6.18/i2c-designware-disable-smbus-interrupts-to-prevent-s.patch @@ -0,0 +1,60 @@ +From 4c51fe21250e0b50ff4ee0c2f4ce92629c462175 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Oct 2025 15:57:14 +0800 +Subject: i2c: designware: Disable SMBus interrupts to prevent storms from + mis-configured firmware + +From: Jinhui Guo + +[ Upstream commit d3429178ee51dd7155445d15a5ab87a45fae3c73 ] + +When probing the I2C master, disable SMBus interrupts to prevent +storms caused by broken firmware mis-configuring IC_SMBUS=1; the +handler never services them and a mis-configured SMBUS Master +extend-clock timeout or SMBUS Slave extend-clock timeout can +flood the CPU. + +Signed-off-by: Jinhui Guo +Reviewed-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20251021075714.3712-2-guojinhui.liam@bytedance.com +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-core.h | 1 + + drivers/i2c/busses/i2c-designware-master.c | 7 +++++++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h +index 347843b4f5dd..436555543c79 100644 +--- a/drivers/i2c/busses/i2c-designware-core.h ++++ b/drivers/i2c/busses/i2c-designware-core.h +@@ -78,6 +78,7 @@ + #define DW_IC_TX_ABRT_SOURCE 0x80 + #define DW_IC_ENABLE_STATUS 0x9c + #define DW_IC_CLR_RESTART_DET 0xa8 ++#define DW_IC_SMBUS_INTR_MASK 0xcc + #define DW_IC_COMP_PARAM_1 0xf4 + #define DW_IC_COMP_VERSION 0xf8 + #define DW_IC_SDA_HOLD_MIN_VERS 0x3131312A /* "111*" == v1.11* */ +diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c +index 41e9b5ecad20..45bfca05bb30 100644 +--- a/drivers/i2c/busses/i2c-designware-master.c ++++ b/drivers/i2c/busses/i2c-designware-master.c +@@ -220,6 +220,13 @@ static int i2c_dw_init_master(struct dw_i2c_dev *dev) + /* Disable the adapter */ + __i2c_dw_disable(dev); + ++ /* ++ * Mask SMBus interrupts to block storms from broken ++ * firmware that leaves IC_SMBUS=1; the handler never ++ * services them. ++ */ ++ regmap_write(dev->map, DW_IC_SMBUS_INTR_MASK, 0); ++ + /* Write standard speed timing parameters */ + regmap_write(dev->map, DW_IC_SS_SCL_HCNT, dev->ss_hcnt); + regmap_write(dev->map, DW_IC_SS_SCL_LCNT, dev->ss_lcnt); +-- +2.51.0 + diff --git a/queue-6.18/iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch b/queue-6.18/iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch new file mode 100644 index 0000000000..34673b57ec --- /dev/null +++ b/queue-6.18/iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch @@ -0,0 +1,49 @@ +From 22cbbf8d8ef3e1c08e93cc985b62b277e00b2618 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 17:12:50 +0800 +Subject: iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc + complains + +From: Pei Xiao + +[ Upstream commit c9fb952360d0c78bbe98239bd6b702f05c2dbb31 ] + +FIELD_PREP() checks that a value fits into the available bitfield, add a +check for step_avg to fix gcc complains. + +which gcc complains about: + drivers/iio/adc/ti_am335x_adc.c: In function 'tiadc_step_config': + include/linux/compiler_types.h:572:38: error: call to +'__compiletime_assert_491' declared with attribute error: FIELD_PREP: value +too large for the field include/linux/mfd/ti_am335x_tscadc.h:58:29: note: +in expansion of macro 'FIELD_PREP' + #define STEPCONFIG_AVG(val) FIELD_PREP(GENMASK(4, 2), (val)) + ^~~~~~~~~~ +drivers/iio/adc/ti_am335x_adc.c:127:17: note: in expansion of macro 'STEPCONFIG_AVG' + stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1) + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202510102117.Jqxrw1vF-lkp@intel.com/ +Signed-off-by: Pei Xiao +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ti_am335x_adc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c +index 99f274adc870..a1a28584de93 100644 +--- a/drivers/iio/adc/ti_am335x_adc.c ++++ b/drivers/iio/adc/ti_am335x_adc.c +@@ -123,7 +123,7 @@ static void tiadc_step_config(struct iio_dev *indio_dev) + + chan = adc_dev->channel_line[i]; + +- if (adc_dev->step_avg[i]) ++ if (adc_dev->step_avg[i] && adc_dev->step_avg[i] <= STEPCONFIG_AVG_16) + stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1) | + STEPCONFIG_FIFO1; + else +-- +2.51.0 + diff --git a/queue-6.18/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch b/queue-6.18/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch new file mode 100644 index 0000000000..401f27c8ff --- /dev/null +++ b/queue-6.18/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch @@ -0,0 +1,85 @@ +From 3074718f41bce2743710b41f7c0068d175c7c1d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:42:38 +0800 +Subject: ipmi: Fix __scan_channels() failing to rescan channels + +From: Jinhui Guo + +[ Upstream commit 6bd30d8fc523fb880b4be548e8501bc0fe8f42d4 ] + +channel_handler() sets intf->channels_ready to true but never +clears it, so __scan_channels() skips any rescan. When the BMC +firmware changes a rescan is required. Allow it by clearing +the flag before starting a new scan. + +Signed-off-by: Jinhui Guo +Message-ID: <20250930074239.2353-3-guojinhui.liam@bytedance.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_msghandler.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index d3f84deee451..0a886399f9da 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -599,7 +599,8 @@ static void __ipmi_bmc_unregister(struct ipmi_smi *intf); + static int __ipmi_bmc_register(struct ipmi_smi *intf, + struct ipmi_device_id *id, + bool guid_set, guid_t *guid, int intf_num); +-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id); ++static int __scan_channels(struct ipmi_smi *intf, ++ struct ipmi_device_id *id, bool rescan); + + static void free_ipmi_user(struct kref *ref) + { +@@ -2668,7 +2669,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, + if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num)) + need_waiter(intf); /* Retry later on an error. */ + else +- __scan_channels(intf, &id); ++ __scan_channels(intf, &id, false); + + + if (!intf_set) { +@@ -2688,7 +2689,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, + goto out_noprocessing; + } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id))) + /* Version info changes, scan the channels again. */ +- __scan_channels(intf, &bmc->fetch_id); ++ __scan_channels(intf, &bmc->fetch_id, true); + + bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; + +@@ -3438,10 +3439,17 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) + /* + * Must be holding intf->bmc_reg_mutex to call this. + */ +-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id) ++static int __scan_channels(struct ipmi_smi *intf, ++ struct ipmi_device_id *id, ++ bool rescan) + { + int rv; + ++ if (rescan) { ++ /* Clear channels_ready to force channels rescan. */ ++ intf->channels_ready = false; ++ } ++ + if (ipmi_version_major(id) > 1 + || (ipmi_version_major(id) == 1 + && ipmi_version_minor(id) >= 5)) { +@@ -3656,7 +3664,7 @@ int ipmi_add_smi(struct module *owner, + } + + mutex_lock(&intf->bmc_reg_mutex); +- rv = __scan_channels(intf, &id); ++ rv = __scan_channels(intf, &id, false); + mutex_unlock(&intf->bmc_reg_mutex); + if (rv) + goto out_err_bmc_reg; +-- +2.51.0 + diff --git a/queue-6.18/ipmi-fix-the-race-between-__scan_channels-and-delive.patch b/queue-6.18/ipmi-fix-the-race-between-__scan_channels-and-delive.patch new file mode 100644 index 0000000000..c9af137cdc --- /dev/null +++ b/queue-6.18/ipmi-fix-the-race-between-__scan_channels-and-delive.patch @@ -0,0 +1,90 @@ +From 9b8413d41077b4b752c6633d628eb8955846cc39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:42:37 +0800 +Subject: ipmi: Fix the race between __scan_channels() and deliver_response() + +From: Jinhui Guo + +[ Upstream commit 936750fdba4c45e13bbd17f261bb140dd55f5e93 ] + +The race window between __scan_channels() and deliver_response() causes +the parameters of some channels to be set to 0. + +1.[CPUA] __scan_channels() issues an IPMI request and waits with + wait_event() until all channels have been scanned. + wait_event() internally calls might_sleep(), which might + yield the CPU. (Moreover, an interrupt can preempt + wait_event() and force the task to yield the CPU.) +2.[CPUB] deliver_response() is invoked when the CPU receives the + IPMI response. After processing a IPMI response, + deliver_response() directly assigns intf->wchannels to + intf->channel_list and sets intf->channels_ready to true. + However, not all channels are actually ready for use. +3.[CPUA] Since intf->channels_ready is already true, wait_event() + never enters __wait_event(). __scan_channels() immediately + clears intf->null_user_handler and exits. +4.[CPUB] Once intf->null_user_handler is set to NULL, deliver_response() + ignores further IPMI responses, leaving the remaining + channels zero-initialized and unusable. + +CPUA CPUB +------------------------------- ----------------------------- +__scan_channels() + intf->null_user_handler + = channel_handler; + send_channel_info_cmd(intf, + 0); + wait_event(intf->waitq, + intf->channels_ready); + do { + might_sleep(); + deliver_response() + channel_handler() + intf->channel_list = + intf->wchannels + set; + intf->channels_ready = true; + send_channel_info_cmd(intf, + intf->curr_channel); + if (condition) + break; + __wait_event(wq_head, + condition); + } while(0) + intf->null_user_handler + = NULL; + deliver_response() + if (!msg->user) + if (intf->null_user_handler) + rv = -EINVAL; + return rv; +------------------------------- ----------------------------- + +Fix the race between __scan_channels() and deliver_response() by +deferring both the assignment intf->channel_list = intf->wchannels +and the flag intf->channels_ready = true until all channels have +been successfully scanned or until the IPMI request has failed. + +Signed-off-by: Jinhui Guo +Message-ID: <20250930074239.2353-2-guojinhui.liam@bytedance.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_msghandler.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 3700ab4eba3e..d3f84deee451 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -3417,8 +3417,6 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) + intf->channels_ready = true; + wake_up(&intf->waitq); + } else { +- intf->channel_list = intf->wchannels + set; +- intf->channels_ready = true; + rv = send_channel_info_cmd(intf, intf->curr_channel); + } + +-- +2.51.0 + diff --git a/queue-6.18/libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch b/queue-6.18/libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch new file mode 100644 index 0000000000..235060a8b5 --- /dev/null +++ b/queue-6.18/libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch @@ -0,0 +1,47 @@ +From c6d02c36ff2db753b30fba7d31fa4ef1257e71e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 13:47:01 -0800 +Subject: libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map + +From: Ian Rogers + +[ Upstream commit a0a4173631bfcfd3520192c0a61cf911d6a52c3a ] + +Passing an empty map to perf_cpu_map__max triggered a SEGV. Explicitly +test for the empty map. + +Reported-by: Ingo Molnar +Closes: https://lore.kernel.org/linux-perf-users/aSwt7yzFjVJCEmVp@gmail.com/ +Tested-by: Ingo Molnar +Signed-off-by: Ian Rogers +Tested-by: Thomas Richter +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/lib/perf/cpumap.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/perf/cpumap.c b/tools/lib/perf/cpumap.c +index b20a5280f2b3..2bbbe1c782b8 100644 +--- a/tools/lib/perf/cpumap.c ++++ b/tools/lib/perf/cpumap.c +@@ -368,10 +368,12 @@ struct perf_cpu perf_cpu_map__max(const struct perf_cpu_map *map) + .cpu = -1 + }; + +- // cpu_map__trim_new() qsort()s it, cpu_map__default_new() sorts it as well. +- return __perf_cpu_map__nr(map) > 0 +- ? __perf_cpu_map__cpu(map, __perf_cpu_map__nr(map) - 1) +- : result; ++ if (!map) ++ return result; ++ ++ // The CPUs are always sorted and nr is always > 0 as 0 length map is ++ // encoded as NULL. ++ return __perf_cpu_map__cpu(map, __perf_cpu_map__nr(map) - 1); + } + + /** Is 'b' a subset of 'a'. */ +-- +2.51.0 + diff --git a/queue-6.18/mips-ftrace-fix-memory-corruption-when-kernel-is-loc.patch b/queue-6.18/mips-ftrace-fix-memory-corruption-when-kernel-is-loc.patch new file mode 100644 index 0000000000..601fb8c582 --- /dev/null +++ b/queue-6.18/mips-ftrace-fix-memory-corruption-when-kernel-is-loc.patch @@ -0,0 +1,83 @@ +From e479f09f217e3219a0662b05d6324b2d15addcee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 09:30:06 +0100 +Subject: MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 + bits + +From: Gregory CLEMENT + +[ Upstream commit 36dac9a3dda1f2bae343191bc16b910c603cac25 ] + +Since commit e424054000878 ("MIPS: Tracing: Reduce the overhead of +dynamic Function Tracer"), the macro UASM_i_LA_mostly has been used, +and this macro can generate more than 2 instructions. At the same +time, the code in ftrace assumes that no more than 2 instructions can +be generated, which is why it stores them in an int[2] array. However, +as previously noted, the macro UASM_i_LA_mostly (and now UASM_i_LA) +causes a buffer overflow when _mcount is beyond 32 bits. This leads to +corruption of the variables located in the __read_mostly section. + +This corruption was observed because the variable +__cpu_primary_thread_mask was corrupted, causing a hang very early +during boot. + +This fix prevents the corruption by avoiding the generation of +instructions if they could exceed 2 instructions in +length. Fortunately, insn_la_mcount is only used if the instrumented +code is located outside the kernel code section, so dynamic ftrace can +still be used, albeit in a more limited scope. This is still +preferable to corrupting memory and/or crashing the kernel. + +Signed-off-by: Gregory CLEMENT +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/ftrace.c | 25 +++++++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) + +diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c +index f39e85fd58fa..b15615b28569 100644 +--- a/arch/mips/kernel/ftrace.c ++++ b/arch/mips/kernel/ftrace.c +@@ -54,10 +54,20 @@ static inline void ftrace_dyn_arch_init_insns(void) + u32 *buf; + unsigned int v1; + +- /* la v1, _mcount */ +- v1 = 3; +- buf = (u32 *)&insn_la_mcount[0]; +- UASM_i_LA(&buf, v1, MCOUNT_ADDR); ++ /* If we are not in compat space, the number of generated ++ * instructions will exceed the maximum expected limit of 2. ++ * To prevent buffer overflow, we avoid generating them. ++ * insn_la_mcount will not be used later in ftrace_make_call. ++ */ ++ if (uasm_in_compat_space_p(MCOUNT_ADDR)) { ++ /* la v1, _mcount */ ++ v1 = 3; ++ buf = (u32 *)&insn_la_mcount[0]; ++ UASM_i_LA(&buf, v1, MCOUNT_ADDR); ++ } else { ++ pr_warn("ftrace: mcount address beyond 32 bits is not supported (%lX)\n", ++ MCOUNT_ADDR); ++ } + + /* jal (ftrace_caller + 8), jump over the first two instruction */ + buf = (u32 *)&insn_jal_ftrace_caller; +@@ -189,6 +199,13 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) + unsigned int new; + unsigned long ip = rec->ip; + ++ /* When the code to patch does not belong to the kernel code ++ * space, we must use insn_la_mcount. However, if MCOUNT_ADDR ++ * is not in compat space, insn_la_mcount is not usable. ++ */ ++ if (!core_kernel_text(ip) && !uasm_in_compat_space_p(MCOUNT_ADDR)) ++ return -EFAULT; ++ + new = core_kernel_text(ip) ? insn_jal_ftrace_caller : insn_la_mcount[0]; + + #ifdef CONFIG_64BIT +-- +2.51.0 + diff --git a/queue-6.18/nfsd-fix-memory-leak-in-nfsd_create_serv-error-paths.patch b/queue-6.18/nfsd-fix-memory-leak-in-nfsd_create_serv-error-paths.patch new file mode 100644 index 0000000000..d90e8f4441 --- /dev/null +++ b/queue-6.18/nfsd-fix-memory-leak-in-nfsd_create_serv-error-paths.patch @@ -0,0 +1,63 @@ +From 75b879c3aeafd55bbcc1ca6c1f9024ea80e01bb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 17:41:21 +0530 +Subject: nfsd: fix memory leak in nfsd_create_serv error paths + +From: Shardul Bankar + +[ Upstream commit df8d829bba3adcf3cc744c01d933b6fd7cf06e91 ] + +When nfsd_create_serv() calls percpu_ref_init() to initialize +nn->nfsd_net_ref, it allocates both a percpu reference counter +and a percpu_ref_data structure (64 bytes). However, if the +function fails later due to svc_create_pooled() returning NULL +or svc_bind() returning an error, these allocations are not +cleaned up, resulting in a memory leak. + +The leak manifests as: +- Unreferenced percpu allocation (8 bytes per CPU) +- Unreferenced percpu_ref_data structure (64 bytes) + +Fix this by adding percpu_ref_exit() calls in both error paths +to properly clean up the percpu_ref_init() allocations. + +This patch fixes the percpu_ref leak in nfsd_create_serv() seen +as an auxiliary leak in syzbot report 099461f8558eb0a1f4f3; the +prepare_creds() and vsock-related leaks in the same report +remain to be addressed separately. + +Reported-by: syzbot+099461f8558eb0a1f4f3@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=099461f8558eb0a1f4f3 +Fixes: 47e988147f40 ("nfsd: add nfsd_serv_try_get and nfsd_serv_put") +Signed-off-by: Shardul Bankar +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfssvc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c +index 7057ddd7a0a8..32cc03a7e7be 100644 +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -633,12 +633,15 @@ int nfsd_create_serv(struct net *net) + serv = svc_create_pooled(nfsd_programs, ARRAY_SIZE(nfsd_programs), + &nn->nfsd_svcstats, + nfsd_max_blksize, nfsd); +- if (serv == NULL) ++ if (serv == NULL) { ++ percpu_ref_exit(&nn->nfsd_net_ref); + return -ENOMEM; ++ } + + error = svc_bind(serv, net); + if (error < 0) { + svc_destroy(&serv); ++ percpu_ref_exit(&nn->nfsd_net_ref); + return error; + } + spin_lock(&nfsd_notifier_lock); +-- +2.51.0 + diff --git a/queue-6.18/nvme-fabrics-add-enokey-to-no-retry-criteria-for-aut.patch b/queue-6.18/nvme-fabrics-add-enokey-to-no-retry-criteria-for-aut.patch new file mode 100644 index 0000000000..47cf721c06 --- /dev/null +++ b/queue-6.18/nvme-fabrics-add-enokey-to-no-retry-criteria-for-aut.patch @@ -0,0 +1,43 @@ +From 8dc813082f682be81d46190282ccd58f430b1129 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Nov 2025 10:43:43 -0800 +Subject: nvme-fabrics: add ENOKEY to no retry criteria for authentication + failures + +From: Justin Tee + +[ Upstream commit 13989207ee29c40501e719512e8dc90768325895 ] + +With authentication, in addition to EKEYREJECTED there is also no point in +retrying reconnects when status is ENOKEY. Thus, add -ENOKEY as another +criteria to determine when to stop retries. + +Cc: Daniel Wagner +Cc: Hannes Reinecke +Closes: https://lore.kernel.org/linux-nvme/20250829-nvme-fc-sync-v3-0-d69c87e63aee@kernel.org/ +Signed-off-by: Justin Tee +Tested-by: Daniel Wagner +Reviewed-by: Daniel Wagner +Reviewed-by: Hannes Reinecke +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fabrics.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c +index 2e58a7ce1090..55a8afd2efd5 100644 +--- a/drivers/nvme/host/fabrics.c ++++ b/drivers/nvme/host/fabrics.c +@@ -592,7 +592,7 @@ bool nvmf_should_reconnect(struct nvme_ctrl *ctrl, int status) + if (status > 0 && (status & NVME_STATUS_DNR)) + return false; + +- if (status == -EKEYREJECTED) ++ if (status == -EKEYREJECTED || status == -ENOKEY) + return false; + + if (ctrl->opts->max_reconnects == -1 || +-- +2.51.0 + diff --git a/queue-6.18/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch b/queue-6.18/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch new file mode 100644 index 0000000000..78036b4ffe --- /dev/null +++ b/queue-6.18/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch @@ -0,0 +1,64 @@ +From 0f72775e3f54420e392e50a97e2ea250a60feb56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 11:05:45 +0100 +Subject: nvme-fc: don't hold rport lock when putting ctrl + +From: Daniel Wagner + +[ Upstream commit b71cbcf7d170e51148d5467820ae8a72febcb651 ] + +nvme_fc_ctrl_put can acquire the rport lock when freeing the +ctrl object: + +nvme_fc_ctrl_put + nvme_fc_ctrl_free + spin_lock_irqsave(rport->lock) + +Thus we can't hold the rport lock when calling nvme_fc_ctrl_put. + +Justin suggested use the safe list iterator variant because +nvme_fc_ctrl_put will also modify the rport->list. + +Cc: Justin Tee +Reviewed-by: Christoph Hellwig +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 2c903729b0b9..8324230c5371 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -1468,14 +1468,14 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport, + { + struct fcnvme_ls_disconnect_assoc_rqst *rqst = + &lsop->rqstbuf->rq_dis_assoc; +- struct nvme_fc_ctrl *ctrl, *ret = NULL; ++ struct nvme_fc_ctrl *ctrl, *tmp, *ret = NULL; + struct nvmefc_ls_rcv_op *oldls = NULL; + u64 association_id = be64_to_cpu(rqst->associd.association_id); + unsigned long flags; + + spin_lock_irqsave(&rport->lock, flags); + +- list_for_each_entry(ctrl, &rport->ctrl_list, ctrl_list) { ++ list_for_each_entry_safe(ctrl, tmp, &rport->ctrl_list, ctrl_list) { + if (!nvme_fc_ctrl_get(ctrl)) + continue; + spin_lock(&ctrl->lock); +@@ -1488,7 +1488,9 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport, + if (ret) + /* leave the ctrl get reference */ + break; ++ spin_unlock_irqrestore(&rport->lock, flags); + nvme_fc_ctrl_put(ctrl); ++ spin_lock_irqsave(&rport->lock, flags); + } + + spin_unlock_irqrestore(&rport->lock, flags); +-- +2.51.0 + diff --git a/queue-6.18/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch b/queue-6.18/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch new file mode 100644 index 0000000000..e8a3f90b83 --- /dev/null +++ b/queue-6.18/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch @@ -0,0 +1,56 @@ +From c1ba8feee3265d4fbc38dae347c6d954fb1d030a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 15:04:07 +0800 +Subject: platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI + quirks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chia-Lin Kao (AceLan) + +[ Upstream commit b169e1733cadb614e87f69d7a5ae1b186c50d313 ] + +Dell Pro Rugged 10/12 tablets has a reliable VGBS method. +If VGBS is not called on boot, the on-screen keyboard won't appear if the +device is booted without a keyboard. + +Call VGBS on boot on thess devices to get the initial state of +SW_TABLET_MODE in a reliable way. + +Signed-off-by: Chia-Lin Kao (AceLan) +Reviewed-by: Hans de Goede +Link: https://patch.msgid.link/20251127070407.656463-1-acelan.kao@canonical.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/hid.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c +index 9c07a7faf18f..560cc063198e 100644 +--- a/drivers/platform/x86/intel/hid.c ++++ b/drivers/platform/x86/intel/hid.c +@@ -177,6 +177,18 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite Dragonfly G2 Notebook PC"), + }, + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 10 Tablet RA00260"), ++ }, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 12 Tablet RA02260"), ++ }, ++ }, + { } + }; + +-- +2.51.0 + diff --git a/queue-6.18/platform-x86-wmi-gamezone-add-legion-go-2-quirks.patch b/queue-6.18/platform-x86-wmi-gamezone-add-legion-go-2-quirks.patch new file mode 100644 index 0000000000..286c5b1379 --- /dev/null +++ b/queue-6.18/platform-x86-wmi-gamezone-add-legion-go-2-quirks.patch @@ -0,0 +1,57 @@ +From 4361d09df411f487a06ffa48308ddba3c49eba57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 07:16:05 -0800 +Subject: platform/x86: wmi-gamezone: Add Legion Go 2 Quirks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Derek J. Clark + +[ Upstream commit 55715d7ad5e772d621c3201da3895f250591bce8 ] + +Add Legion Go 2 SKU's to the Extreme Mode quirks table. + +Signed-off-by: Derek J. Clark +Reviewed-by: Armin Wolf +Reviewed-by: Mark Pearson +Link: https://patch.msgid.link/20251127151605.1018026-4-derekjohn.clark@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/lenovo/wmi-gamezone.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/lenovo/wmi-gamezone.c b/drivers/platform/x86/lenovo/wmi-gamezone.c +index 0eb7fe8222f4..b26806b37d96 100644 +--- a/drivers/platform/x86/lenovo/wmi-gamezone.c ++++ b/drivers/platform/x86/lenovo/wmi-gamezone.c +@@ -274,8 +274,23 @@ static const struct dmi_system_id fwbug_list[] = { + }, + .driver_data = &quirk_no_extreme_bug, + }, ++ { ++ .ident = "Legion Go 8ASP2", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Legion Go 8ASP2"), ++ }, ++ .driver_data = &quirk_no_extreme_bug, ++ }, ++ { ++ .ident = "Legion Go 8AHP2", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Legion Go 8AHP2"), ++ }, ++ .driver_data = &quirk_no_extreme_bug, ++ }, + {}, +- + }; + + /** +-- +2.51.0 + diff --git a/queue-6.18/powerpc-addnote-fix-overflow-on-32-bit-builds.patch b/queue-6.18/powerpc-addnote-fix-overflow-on-32-bit-builds.patch new file mode 100644 index 0000000000..f03d00c7de --- /dev/null +++ b/queue-6.18/powerpc-addnote-fix-overflow-on-32-bit-builds.patch @@ -0,0 +1,50 @@ +From 9ce7f4ec91455dc1284f9ad7c1de9f9a7a28335d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 22:31:13 -0400 +Subject: powerpc/addnote: Fix overflow on 32-bit builds + +From: Ben Collins + +[ Upstream commit 825ce89a3ef17f84cf2c0eacfa6b8dc9fd11d13f ] + +The PUT_64[LB]E() macros need to cast the value to unsigned long long +like the GET_64[LB]E() macros. Caused lots of warnings when compiled +on 32-bit, and clobbered addresses (36-bit P4080). + +Signed-off-by: Ben Collins +Reviewed-by: Christophe Leroy +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/2025042122-mustard-wrasse-694572@boujee-and-buff +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/addnote.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/boot/addnote.c b/arch/powerpc/boot/addnote.c +index 53b3b2621457..78704927453a 100644 +--- a/arch/powerpc/boot/addnote.c ++++ b/arch/powerpc/boot/addnote.c +@@ -68,8 +68,8 @@ static int e_class = ELFCLASS32; + #define PUT_16BE(off, v)(buf[off] = ((v) >> 8) & 0xff, \ + buf[(off) + 1] = (v) & 0xff) + #define PUT_32BE(off, v)(PUT_16BE((off), (v) >> 16L), PUT_16BE((off) + 2, (v))) +-#define PUT_64BE(off, v)((PUT_32BE((off), (v) >> 32L), \ +- PUT_32BE((off) + 4, (v)))) ++#define PUT_64BE(off, v)((PUT_32BE((off), (unsigned long long)(v) >> 32L), \ ++ PUT_32BE((off) + 4, (unsigned long long)(v)))) + + #define GET_16LE(off) ((buf[off]) + (buf[(off)+1] << 8)) + #define GET_32LE(off) (GET_16LE(off) + (GET_16LE((off)+2U) << 16U)) +@@ -78,7 +78,8 @@ static int e_class = ELFCLASS32; + #define PUT_16LE(off, v) (buf[off] = (v) & 0xff, \ + buf[(off) + 1] = ((v) >> 8) & 0xff) + #define PUT_32LE(off, v) (PUT_16LE((off), (v)), PUT_16LE((off) + 2, (v) >> 16L)) +-#define PUT_64LE(off, v) (PUT_32LE((off), (v)), PUT_32LE((off) + 4, (v) >> 32L)) ++#define PUT_64LE(off, v) (PUT_32LE((off), (unsigned long long)(v)), \ ++ PUT_32LE((off) + 4, (unsigned long long)(v) >> 32L)) + + #define GET_16(off) (e_data == ELFDATA2MSB ? GET_16BE(off) : GET_16LE(off)) + #define GET_32(off) (e_data == ELFDATA2MSB ? GET_32BE(off) : GET_32LE(off)) +-- +2.51.0 + diff --git a/queue-6.18/reset-fix-bit-macro-reference.patch b/queue-6.18/reset-fix-bit-macro-reference.patch new file mode 100644 index 0000000000..352243c7c1 --- /dev/null +++ b/queue-6.18/reset-fix-bit-macro-reference.patch @@ -0,0 +1,40 @@ +From c89eceec495afc78a08f794bc9fcc0b85a062580 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 14:10:37 +0800 +Subject: reset: fix BIT macro reference + +From: Encrow Thorne + +[ Upstream commit f3d8b64ee46c9b4b0b82b1a4642027728bac95b8 ] + +RESET_CONTROL_FLAGS_BIT_* macros use BIT(), but reset.h does not +include bits.h. This causes compilation errors when including +reset.h standalone. + +Include bits.h to make reset.h self-contained. + +Suggested-by: Troy Mitchell +Reviewed-by: Troy Mitchell +Reviewed-by: Philipp Zabel +Signed-off-by: Encrow Thorne +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + include/linux/reset.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/reset.h b/include/linux/reset.h +index 840d75d172f6..44f9e3415f92 100644 +--- a/include/linux/reset.h ++++ b/include/linux/reset.h +@@ -2,6 +2,7 @@ + #ifndef _LINUX_RESET_H_ + #define _LINUX_RESET_H_ + ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.18/scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp_dro.patch b/queue-6.18/scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp_dro.patch new file mode 100644 index 0000000000..7411876ae2 --- /dev/null +++ b/queue-6.18/scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp_dro.patch @@ -0,0 +1,125 @@ +From 225db0c387df79255948f442b77f2329cdab2e2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 14:46:36 -0800 +Subject: scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during + FLOGI + +From: Justin Tee + +[ Upstream commit 07caedc6a3887938813727beafea40f07c497705 ] + +It's possible for an unstable link to repeatedly bounce allowing a FLOGI +retry, but then bounce again forcing an abort of the FLOGI. Ensure that +the initial reference count on the FLOGI ndlp is restored in this faulty +link scenario. + +Signed-off-by: Justin Tee +Link: https://patch.msgid.link/20251106224639.139176-8-justintee8345@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_els.c | 36 +++++++++++++++++++++++++------- + drivers/scsi/lpfc/lpfc_hbadisc.c | 4 +++- + 2 files changed, 32 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index b71db7d7d747..c08237f04bce 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -934,10 +934,15 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + /* Check to see if link went down during discovery */ + if (lpfc_els_chk_latt(vport)) { + /* One additional decrement on node reference count to +- * trigger the release of the node ++ * trigger the release of the node. Make sure the ndlp ++ * is marked NLP_DROPPED. + */ +- if (!(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) ++ if (!test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag) && ++ !test_bit(NLP_DROPPED, &ndlp->nlp_flag) && ++ !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) { ++ set_bit(NLP_DROPPED, &ndlp->nlp_flag); + lpfc_nlp_put(ndlp); ++ } + goto out; + } + +@@ -995,9 +1000,10 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + IOERR_LOOP_OPEN_FAILURE))) + lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS, + "2858 FLOGI Status:x%x/x%x TMO" +- ":x%x Data x%lx x%x\n", ++ ":x%x Data x%lx x%x x%lx x%x\n", + ulp_status, ulp_word4, tmo, +- phba->hba_flag, phba->fcf.fcf_flag); ++ phba->hba_flag, phba->fcf.fcf_flag, ++ ndlp->nlp_flag, ndlp->fc4_xpt_flags); + + /* Check for retry */ + if (lpfc_els_retry(phba, cmdiocb, rspiocb)) { +@@ -1015,14 +1021,17 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + * reference to trigger node release. + */ + if (!test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag) && +- !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) ++ !test_bit(NLP_DROPPED, &ndlp->nlp_flag) && ++ !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) { ++ set_bit(NLP_DROPPED, &ndlp->nlp_flag); + lpfc_nlp_put(ndlp); ++ } + + lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS, + "0150 FLOGI Status:x%x/x%x " +- "xri x%x TMO:x%x refcnt %d\n", ++ "xri x%x iotag x%x TMO:x%x refcnt %d\n", + ulp_status, ulp_word4, cmdiocb->sli4_xritag, +- tmo, kref_read(&ndlp->kref)); ++ cmdiocb->iotag, tmo, kref_read(&ndlp->kref)); + + /* If this is not a loop open failure, bail out */ + if (!(ulp_status == IOSTAT_LOCAL_REJECT && +@@ -1279,6 +1288,19 @@ lpfc_issue_els_flogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + uint32_t tmo, did; + int rc; + ++ /* It's possible for lpfc to reissue a FLOGI on an ndlp that is marked ++ * NLP_DROPPED. This happens when the FLOGI completed with the XB bit ++ * set causing lpfc to reference the ndlp until the XRI_ABORTED CQE is ++ * issued. The time window for the XRI_ABORTED CQE can be as much as ++ * 2*2*RA_TOV allowing for ndlp reuse of this type when the link is ++ * cycling quickly. When true, restore the initial reference and remove ++ * the NLP_DROPPED flag as lpfc is retrying. ++ */ ++ if (test_and_clear_bit(NLP_DROPPED, &ndlp->nlp_flag)) { ++ if (!lpfc_nlp_get(ndlp)) ++ return 1; ++ } ++ + cmdsize = (sizeof(uint32_t) + sizeof(struct serv_parm)); + elsiocb = lpfc_prep_els_iocb(vport, 1, cmdsize, retry, ndlp, + ndlp->nlp_DID, ELS_CMD_FLOGI); +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c +index 43d246c5c049..717ae56c8e4b 100644 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -424,6 +424,7 @@ lpfc_check_nlp_post_devloss(struct lpfc_vport *vport, + struct lpfc_nodelist *ndlp) + { + if (test_and_clear_bit(NLP_IN_RECOV_POST_DEV_LOSS, &ndlp->save_flags)) { ++ clear_bit(NLP_DROPPED, &ndlp->nlp_flag); + lpfc_nlp_get(ndlp); + lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY | LOG_NODE, + "8438 Devloss timeout reversed on DID x%x " +@@ -566,7 +567,8 @@ lpfc_dev_loss_tmo_handler(struct lpfc_nodelist *ndlp) + return fcf_inuse; + } + +- lpfc_nlp_put(ndlp); ++ if (!test_and_set_bit(NLP_DROPPED, &ndlp->nlp_flag)) ++ lpfc_nlp_put(ndlp); + return fcf_inuse; + } + +-- +2.51.0 + diff --git a/queue-6.18/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch b/queue-6.18/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch new file mode 100644 index 0000000000..4008f06db8 --- /dev/null +++ b/queue-6.18/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch @@ -0,0 +1,45 @@ +From ede7fa5b45120364d6a71ea886778bc3eb2f6035 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:48:45 -0500 +Subject: scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive + +From: Tony Battersby + +[ Upstream commit 8f58fc64d559b5fda1b0a5e2a71422be61e79ab9 ] + +When given the module parameter qlini_mode=exclusive, qla2xxx in +initiator mode is initially unable to successfully send SCSI commands to +devices it finds while scanning, resulting in an escalating series of +resets until an adapter reset clears the issue. Fix by checking the +active mode instead of the module parameter. + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/1715ec14-ba9a-45dc-9cf2-d41aa6b81b5e@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_os.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 70a579cf9c3f..6b0f616b1ca0 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3460,13 +3460,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + ha->mqenable = 0; + + if (ha->mqenable) { +- bool startit = false; +- +- if (QLA_TGT_MODE_ENABLED()) +- startit = false; +- +- if (ql2x_ini_mode == QLA2XXX_INI_MODE_ENABLED) +- startit = true; ++ bool startit = !!(host->active_mode & MODE_INITIATOR); + + /* Create start of day qpairs for Block MQ */ + for (i = 0; i < ha->max_qpairs; i++) +-- +2.51.0 + diff --git a/queue-6.18/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch b/queue-6.18/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch new file mode 100644 index 0000000000..f6c638688b --- /dev/null +++ b/queue-6.18/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch @@ -0,0 +1,193 @@ +From dc5cf5fb755ca552126de94eeb05d0b8d4868e62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:50:05 -0500 +Subject: scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled + +From: Tony Battersby + +[ Upstream commit 4f6aaade2a22ac428fa99ed716cf2b87e79c9837 ] + +When qla2xxx is loaded with qlini_mode=disabled, +ha->flags.disable_msix_handshake is used before it is set, resulting in +the wrong interrupt handler being used on certain HBAs +(qla2xxx_msix_rsp_q_hs() is used when qla2xxx_msix_rsp_q() should be +used). The only difference between these two interrupt handlers is that +the _hs() version writes to a register to clear the "RISC" interrupt, +whereas the other version does not. So this bug results in the RISC +interrupt being cleared when it should not be. This occasionally causes +a different interrupt handler qla24xx_msix_default() for a different +vector to see ((stat & HSRX_RISC_INT) == 0) and ignore its interrupt, +which then causes problems like: + +qla2xxx [0000:02:00.0]-d04c:6: MBX Command timeout for cmd 20, + iocontrol=8 jiffies=1090c0300 mb[0-3]=[0x4000 0x0 0x40 0xda] mb7 0x500 + host_status 0x40000010 hccr 0x3f00 +qla2xxx [0000:02:00.0]-101e:6: Mailbox cmd timeout occurred, cmd=0x20, + mb[0]=0x20. Scheduling ISP abort +(the cmd varies; sometimes it is 0x20, 0x22, 0x54, 0x5a, 0x5d, or 0x6a) + +This problem can be reproduced with a 16 or 32 Gbps HBA by loading +qla2xxx with qlini_mode=disabled and running a high IOPS test while +triggering frequent RSCN database change events. + +While analyzing the problem I discovered that even with +disable_msix_handshake forced to 0, it is not necessary to clear the +RISC interrupt from qla2xxx_msix_rsp_q_hs() (more below). So just +completely remove qla2xxx_msix_rsp_q_hs() and the logic for selecting +it, which also fixes the bug with qlini_mode=disabled. + +The test below describes the justification for not needing +qla2xxx_msix_rsp_q_hs(): + +Force disable_msix_handshake to 0: +qla24xx_config_rings(): +if (0 && (ha->fw_attributes & BIT_6) && (IS_MSIX_NACK_CAPABLE(ha)) && + (ha->flags.msix_enabled)) { + +In qla24xx_msix_rsp_q() and qla2xxx_msix_rsp_q_hs(), check: + (rd_reg_dword(®->host_status) & HSRX_RISC_INT) + +Count the number of calls to each function with HSRX_RISC_INT set and +the number with HSRX_RISC_INT not set while performing some I/O. + +If qla2xxx_msix_rsp_q_hs() clears the RISC interrupt (original code): +qla24xx_msix_rsp_q: 50% of calls have HSRX_RISC_INT set +qla2xxx_msix_rsp_q_hs: 5% of calls have HSRX_RISC_INT set +(# of qla2xxx_msix_rsp_q_hs interrupts) = + (# of qla24xx_msix_rsp_q interrupts) * 3 + +If qla2xxx_msix_rsp_q_hs() does not clear the RISC interrupt (patched +code): +qla24xx_msix_rsp_q: 100% of calls have HSRX_RISC_INT set +qla2xxx_msix_rsp_q_hs: 9% of calls have HSRX_RISC_INT set +(# of qla2xxx_msix_rsp_q_hs interrupts) = + (# of qla24xx_msix_rsp_q interrupts) * 3 + +In the case of the original code, qla24xx_msix_rsp_q() was seeing +HSRX_RISC_INT set only 50% of the time because qla2xxx_msix_rsp_q_hs() +was clearing it when it shouldn't have been. In the patched code, +qla24xx_msix_rsp_q() sees HSRX_RISC_INT set 100% of the time, which +makes sense if that interrupt handler needs to clear the RISC interrupt +(which it does). qla2xxx_msix_rsp_q_hs() sees HSRX_RISC_INT only 9% of +the time, which is just overlap from the other interrupt during the +high IOPS test. + +Tested with SCST on: +QLE2742 FW:v9.08.02 (32 Gbps 2-port) +QLE2694L FW:v9.10.11 (16 Gbps 4-port) +QLE2694L FW:v9.08.02 (16 Gbps 4-port) +QLE2672 FW:v8.07.12 (16 Gbps 2-port) +both initiator and target mode + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/56d378eb-14ad-49c7-bae9-c649b6c7691e@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_def.h | 1 - + drivers/scsi/qla2xxx/qla_gbl.h | 2 +- + drivers/scsi/qla2xxx/qla_isr.c | 32 +++----------------------------- + drivers/scsi/qla2xxx/qla_mid.c | 4 +--- + 4 files changed, 5 insertions(+), 34 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index cb95b7b12051..b3265952c4be 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -3503,7 +3503,6 @@ struct isp_operations { + #define QLA_MSIX_RSP_Q 0x01 + #define QLA_ATIO_VECTOR 0x02 + #define QLA_MSIX_QPAIR_MULTIQ_RSP_Q 0x03 +-#define QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS 0x04 + + #define QLA_MIDX_DEFAULT 0 + #define QLA_MIDX_RSP_Q 1 +diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h +index 145defc420f2..55d531c19e6b 100644 +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -766,7 +766,7 @@ extern int qla2x00_dfs_remove(scsi_qla_host_t *); + + /* Globa function prototypes for multi-q */ + extern int qla25xx_request_irq(struct qla_hw_data *, struct qla_qpair *, +- struct qla_msix_entry *, int); ++ struct qla_msix_entry *); + extern int qla25xx_init_req_que(struct scsi_qla_host *, struct req_que *); + extern int qla25xx_init_rsp_que(struct scsi_qla_host *, struct rsp_que *); + extern int qla25xx_create_req_que(struct qla_hw_data *, uint16_t, uint8_t, +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index c4c6b5c6658c..a3971afc2dd1 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -4467,32 +4467,6 @@ qla2xxx_msix_rsp_q(int irq, void *dev_id) + return IRQ_HANDLED; + } + +-irqreturn_t +-qla2xxx_msix_rsp_q_hs(int irq, void *dev_id) +-{ +- struct qla_hw_data *ha; +- struct qla_qpair *qpair; +- struct device_reg_24xx __iomem *reg; +- unsigned long flags; +- +- qpair = dev_id; +- if (!qpair) { +- ql_log(ql_log_info, NULL, 0x505b, +- "%s: NULL response queue pointer.\n", __func__); +- return IRQ_NONE; +- } +- ha = qpair->hw; +- +- reg = &ha->iobase->isp24; +- spin_lock_irqsave(&ha->hardware_lock, flags); +- wrt_reg_dword(®->hccr, HCCRX_CLR_RISC_INT); +- spin_unlock_irqrestore(&ha->hardware_lock, flags); +- +- queue_work(ha->wq, &qpair->q_work); +- +- return IRQ_HANDLED; +-} +- + /* Interrupt handling helpers. */ + + struct qla_init_msix_entry { +@@ -4505,7 +4479,6 @@ static const struct qla_init_msix_entry msix_entries[] = { + { "rsp_q", qla24xx_msix_rsp_q }, + { "atio_q", qla83xx_msix_atio_q }, + { "qpair_multiq", qla2xxx_msix_rsp_q }, +- { "qpair_multiq_hs", qla2xxx_msix_rsp_q_hs }, + }; + + static const struct qla_init_msix_entry qla82xx_msix_entries[] = { +@@ -4792,9 +4765,10 @@ qla2x00_free_irqs(scsi_qla_host_t *vha) + } + + int qla25xx_request_irq(struct qla_hw_data *ha, struct qla_qpair *qpair, +- struct qla_msix_entry *msix, int vector_type) ++ struct qla_msix_entry *msix) + { +- const struct qla_init_msix_entry *intr = &msix_entries[vector_type]; ++ const struct qla_init_msix_entry *intr = ++ &msix_entries[QLA_MSIX_QPAIR_MULTIQ_RSP_Q]; + scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev); + int ret; + +diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c +index 8b71ac0b1d99..0abc47e72e0b 100644 +--- a/drivers/scsi/qla2xxx/qla_mid.c ++++ b/drivers/scsi/qla2xxx/qla_mid.c +@@ -899,9 +899,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options, + rsp->options, rsp->id, rsp->rsp_q_in, + rsp->rsp_q_out); + +- ret = qla25xx_request_irq(ha, qpair, qpair->msix, +- ha->flags.disable_msix_handshake ? +- QLA_MSIX_QPAIR_MULTIQ_RSP_Q : QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS); ++ ret = qla25xx_request_irq(ha, qpair, qpair->msix); + if (ret) + goto que_failed; + +-- +2.51.0 + diff --git a/queue-6.18/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch b/queue-6.18/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch new file mode 100644 index 0000000000..308edbe2b9 --- /dev/null +++ b/queue-6.18/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch @@ -0,0 +1,45 @@ +From 75835cf3e9ab3c67c3674c8643f46c3d8203e75e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:51:28 -0500 +Subject: scsi: qla2xxx: Use reinit_completion on mbx_intr_comp + +From: Tony Battersby + +[ Upstream commit 957aa5974989fba4ae4f807ebcb27f12796edd4d ] + +If a mailbox command completes immediately after +wait_for_completion_timeout() times out, ha->mbx_intr_comp could be left +in an inconsistent state, causing the next mailbox command not to wait +for the hardware. Fix by reinitializing the completion before use. + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/11b6485e-0bfd-4784-8f99-c06a196dad94@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_mbx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 32eb0ce8b170..1f01576f044b 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -253,6 +253,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + /* Issue set host interrupt command to send cmd out. */ + ha->flags.mbox_int = 0; + clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags); ++ reinit_completion(&ha->mbx_intr_comp); + + /* Unlock mbx registers and wait for interrupt */ + ql_dbg(ql_dbg_mbx, vha, 0x100f, +@@ -279,6 +280,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + "cmd=%x Timeout.\n", command); + spin_lock_irqsave(&ha->hardware_lock, flags); + clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags); ++ reinit_completion(&ha->mbx_intr_comp); + spin_unlock_irqrestore(&ha->hardware_lock, flags); + + if (chip_reset != ha->chip_reset) { +-- +2.51.0 + diff --git a/queue-6.18/scsi-smartpqi-add-support-for-hurray-data-new-contro.patch b/queue-6.18/scsi-smartpqi-add-support-for-hurray-data-new-contro.patch new file mode 100644 index 0000000000..9ca766de4b --- /dev/null +++ b/queue-6.18/scsi-smartpqi-add-support-for-hurray-data-new-contro.patch @@ -0,0 +1,48 @@ +From 8170d9f6259383f531d91ab8f029a5cfc2b21215 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Nov 2025 10:38:21 -0600 +Subject: scsi: smartpqi: Add support for Hurray Data new controller PCI device + +From: David Strahan + +[ Upstream commit 48e6b7e708029cea451e53a8c16fc8c16039ecdc ] + +Add support for new Hurray Data controller. + +All entries are in HEX. + +Add PCI IDs for Hurray Data controllers: + VID / DID / SVID / SDID + ---- ---- ---- ---- + 9005 028f 207d 4840 + +Reviewed-by: Scott Benesh +Reviewed-by: Scott Teel +Reviewed-by: Mike McGowen +Signed-off-by: David Strahan +Signed-off-by: Don Brace +Link: https://patch.msgid.link/20251106163823.786828-4-don.brace@microchip.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi_init.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index fdc856845a05..98e93900254c 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -10127,6 +10127,10 @@ static const struct pci_device_id pqi_pci_id_table[] = { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + 0x207d, 0x4240) + }, ++ { ++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, ++ 0x207d, 0x4840) ++ }, + { + PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f, + PCI_VENDOR_ID_ADVANTECH, 0x8312) +-- +2.51.0 + diff --git a/queue-6.18/scsi-ufs-host-mediatek-fix-shutdown-suspend-race-con.patch b/queue-6.18/scsi-ufs-host-mediatek-fix-shutdown-suspend-race-con.patch new file mode 100644 index 0000000000..0f0f6edb33 --- /dev/null +++ b/queue-6.18/scsi-ufs-host-mediatek-fix-shutdown-suspend-race-con.patch @@ -0,0 +1,41 @@ +From 6c827dee72e180e671f65e58f2feec086fa5e102 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 17:43:27 +0800 +Subject: scsi: ufs: host: mediatek: Fix shutdown/suspend race condition + +From: Peter Wang + +[ Upstream commit 014de20bb36ba03e0e0b0a7e0a1406ab900c9fda ] + +Address a race condition between shutdown and suspend operations in the +UFS Mediatek driver. Before entering suspend, check if a shutdown is in +progress to prevent conflicts and ensure system stability. + +Signed-off-by: Peter Wang +Acked-by: Chun-Hung Wu +Link: https://patch.msgid.link/20250924094527.2992256-6-peter.wang@mediatek.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/host/ufs-mediatek.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c +index 758a393a9de1..d0cbd96ad29d 100644 +--- a/drivers/ufs/host/ufs-mediatek.c ++++ b/drivers/ufs/host/ufs-mediatek.c +@@ -2373,6 +2373,11 @@ static int ufs_mtk_system_suspend(struct device *dev) + struct arm_smccc_res res; + int ret; + ++ if (hba->shutting_down) { ++ ret = -EBUSY; ++ goto out; ++ } ++ + ret = ufshcd_system_suspend(dev); + if (ret) + goto out; +-- +2.51.0 + diff --git a/queue-6.18/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch b/queue-6.18/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch new file mode 100644 index 0000000000..0e41efaf2b --- /dev/null +++ b/queue-6.18/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch @@ -0,0 +1,63 @@ +From bb6f000f360cba14062355382489097acb3f4f7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Oct 2025 11:08:40 +0800 +Subject: serial: sprd: Return -EPROBE_DEFER when uart clock is not ready + +From: Wenhua Lin + +[ Upstream commit 29e8a0c587e328ed458380a45d6028adf64d7487 ] + +In sprd_clk_init(), when devm_clk_get() returns -EPROBE_DEFER +for either uart or source clock, we should propagate the +error instead of just warning and continuing with NULL clocks. + +Currently the driver only emits a warning when clock acquisition +fails and proceeds with NULL clock pointers. This can lead to +issues later when the clocks are actually needed. More importantly, +when the clock provider is not ready yet and returns -EPROBE_DEFER, +we should return this error to allow deferred probing. + +This change adds explicit checks for -EPROBE_DEFER after both: +1. devm_clk_get(uport->dev, uart) +2. devm_clk_get(uport->dev, source) + +When -EPROBE_DEFER is encountered, the function now returns +-EPROBE_DEFER to let the driver framework retry probing +later when the clock dependencies are resolved. + +Signed-off-by: Wenhua Lin +Link: https://patch.msgid.link/20251022030840.956589-1-Wenhua.Lin@unisoc.com +Reviewed-by: Cixi Geng +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sprd_serial.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index 8c9366321f8e..092755f35683 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -1133,6 +1133,9 @@ static int sprd_clk_init(struct uart_port *uport) + + clk_uart = devm_clk_get(uport->dev, "uart"); + if (IS_ERR(clk_uart)) { ++ if (PTR_ERR(clk_uart) == -EPROBE_DEFER) ++ return -EPROBE_DEFER; ++ + dev_warn(uport->dev, "uart%d can't get uart clock\n", + uport->line); + clk_uart = NULL; +@@ -1140,6 +1143,9 @@ static int sprd_clk_init(struct uart_port *uport) + + clk_parent = devm_clk_get(uport->dev, "source"); + if (IS_ERR(clk_parent)) { ++ if (PTR_ERR(clk_parent) == -EPROBE_DEFER) ++ return -EPROBE_DEFER; ++ + dev_warn(uport->dev, "uart%d can't get source clock\n", + uport->line); + clk_parent = NULL; +-- +2.51.0 + diff --git a/queue-6.18/series b/queue-6.18/series index 50425919e7..22258da402 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -163,3 +163,50 @@ dt-bindings-mmc-sdhci-of-aspeed-switch-ref-to-sdhci-common.yaml.patch net-hsr-fix-null-pointer-dereference-in-prp_get_untagged_frame.patch x86-bug-fix-old-gcc-compile-fails.patch x86-msi-make-irq_retrigger-functional-for-posted-msi.patch +x86-fpu-fix-fpu-state-core-dump-truncation-on-cpus-w.patch +x86-mm-tlb-trace-export-the-tlb_remote_wrong_cpu-enu.patch +asoc-fsl_sai-constrain-sample-rates-from-audio-plls-.patch +alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch +alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch +alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch +asoc-ak4458-remove-the-reset-operation-in-probe-and-.patch +nfsd-fix-memory-leak-in-nfsd_create_serv-error-paths.patch +asoc-sdca-support-q7.8-volume-format.patch +asoc-ops-fix-snd_soc_get_volsw-for-sx-controls.patch +ipmi-fix-the-race-between-__scan_channels-and-delive.patch +ipmi-fix-__scan_channels-failing-to-rescan-channels.patch +scsi-ufs-host-mediatek-fix-shutdown-suspend-race-con.patch +firmware-imx-scu-irq-init-workqueue-before-request-m.patch +um-init-cpu_tasks-earlier.patch +ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch +scsi-smartpqi-add-support-for-hurray-data-new-contro.patch +scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp_dro.patch +clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch +powerpc-addnote-fix-overflow-on-32-bit-builds.patch +scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch +scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch +scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch +fuse-always-flush-the-page-cache-before-fopen_direct.patch +fuse-invalidate-the-page-cache-after-fopen_direct_io.patch +via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch +functionfs-fix-the-open-removal-races.patch +reset-fix-bit-macro-reference.patch +exfat-fix-remount-failure-in-different-process-envir.patch +exfat-zero-out-post-eof-page-cache-on-file-extension.patch +usbip-fix-locking-bug-in-rt-enabled-kernels.patch +usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch +iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch +usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch +usb-usb-storage-no-additional-quirks-need-to-be-adde.patch +usb-xhci-don-t-unchain-link-trbs-on-quirky-hcs.patch +serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch +libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch +clk-qcom-dispcc-sm7150-fix-dispcc_mdss_pclk0_clk_src.patch +i2c-designware-disable-smbus-interrupts-to-prevent-s.patch +platform-x86-wmi-gamezone-add-legion-go-2-quirks.patch +nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch +hwmon-emc2305-fix-device-node-refcount-leak-in-error.patch +nvme-fabrics-add-enokey-to-no-retry-criteria-for-aut.patch +hwmon-emc2305-fix-double-put-in-emc2305_probe_childs.patch +platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch +mips-ftrace-fix-memory-corruption-when-kernel-is-loc.patch diff --git a/queue-6.18/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch b/queue-6.18/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch new file mode 100644 index 0000000000..8bbb61d1f4 --- /dev/null +++ b/queue-6.18/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch @@ -0,0 +1,64 @@ +From ae503c7c4bce7777289aedfdd01d0d5162a94871 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 15:11:13 +0200 +Subject: ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx + +From: Matthias Schiffer + +[ Upstream commit 3f61783920504b2cf99330b372d82914bb004d8e ] + +am33xx.dtsi has the same clock setup as am35xx.dtsi, setting +ti,no-reset-on-init and ti,no-idle on timer1_target and timer2_target, +so AM33 needs the same workaround as AM35 to avoid ti-sysc probe +failing on certain target modules. + +Signed-off-by: Matthias Schiffer +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20250825131114.2206804-1-alexander.stein@ew.tq-group.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 5566ad11399e..610354ce7f8f 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -48,6 +48,7 @@ enum sysc_soc { + SOC_UNKNOWN, + SOC_2420, + SOC_2430, ++ SOC_AM33, + SOC_3430, + SOC_AM35, + SOC_3630, +@@ -2912,6 +2913,7 @@ static void ti_sysc_idle(struct work_struct *work) + static const struct soc_device_attribute sysc_soc_match[] = { + SOC_FLAG("OMAP242*", SOC_2420), + SOC_FLAG("OMAP243*", SOC_2430), ++ SOC_FLAG("AM33*", SOC_AM33), + SOC_FLAG("AM35*", SOC_AM35), + SOC_FLAG("OMAP3[45]*", SOC_3430), + SOC_FLAG("OMAP3[67]*", SOC_3630), +@@ -3117,10 +3119,15 @@ static int sysc_check_active_timer(struct sysc *ddata) + * can be dropped if we stop supporting old beagleboard revisions + * A to B4 at some point. + */ +- if (sysc_soc->soc == SOC_3430 || sysc_soc->soc == SOC_AM35) ++ switch (sysc_soc->soc) { ++ case SOC_AM33: ++ case SOC_3430: ++ case SOC_AM35: + error = -ENXIO; +- else ++ break; ++ default: + error = -EBUSY; ++ } + + if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) && + (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE)) +-- +2.51.0 + diff --git a/queue-6.18/um-init-cpu_tasks-earlier.patch b/queue-6.18/um-init-cpu_tasks-earlier.patch new file mode 100644 index 0000000000..62628b91df --- /dev/null +++ b/queue-6.18/um-init-cpu_tasks-earlier.patch @@ -0,0 +1,59 @@ +From fa8f531c8fc02fad26f2b05a799805a28a2378f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Sep 2025 11:32:13 +0200 +Subject: um: init cpu_tasks[] earlier + +From: Johannes Berg + +[ Upstream commit 7b5d4416964c07c902163822a30a622111172b01 ] + +This is currently done in uml_finishsetup(), but e.g. with +KCOV enabled we'll crash because some init code can call +into e.g. memparse(), which has coverage annotations, and +then the checks in check_kcov_mode() crash because current +is NULL. + +Simply initialize the cpu_tasks[] array statically, which +fixes the crash. For the later SMP work, it seems to have +not really caused any problems yet, but initialize all of +the entries anyway. + +Link: https://patch.msgid.link/20250924113214.c76cd74d0583.I974f691ebb1a2b47915bd2b04cc38e5263b9447f@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/um/kernel/process.c | 4 +++- + arch/um/kernel/um_arch.c | 2 -- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c +index 9c9c66dc45f0..13d461712c99 100644 +--- a/arch/um/kernel/process.c ++++ b/arch/um/kernel/process.c +@@ -43,7 +43,9 @@ + * cares about its entry, so it's OK if another processor is modifying its + * entry. + */ +-struct task_struct *cpu_tasks[NR_CPUS]; ++struct task_struct *cpu_tasks[NR_CPUS] = { ++ [0 ... NR_CPUS - 1] = &init_task, ++}; + EXPORT_SYMBOL(cpu_tasks); + + void free_stack(unsigned long stack, int order) +diff --git a/arch/um/kernel/um_arch.c b/arch/um/kernel/um_arch.c +index cfbbbf8500c3..ed2f67848a50 100644 +--- a/arch/um/kernel/um_arch.c ++++ b/arch/um/kernel/um_arch.c +@@ -239,8 +239,6 @@ static struct notifier_block panic_exit_notifier = { + + void uml_finishsetup(void) + { +- cpu_tasks[0] = &init_task; +- + atomic_notifier_chain_register(&panic_notifier_list, + &panic_exit_notifier); + +-- +2.51.0 + diff --git a/queue-6.18/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch b/queue-6.18/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch new file mode 100644 index 0000000000..64ba1e6fd1 --- /dev/null +++ b/queue-6.18/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch @@ -0,0 +1,49 @@ +From 8ccee6d20f99f8c3cb86227a3fc60e8cc09cb310 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 14:53:07 -0400 +Subject: usb: typec: ucsi: Handle incorrect num_connectors capability + +From: Mark Pearson + +[ Upstream commit 30cd2cb1abf4c4acdb1ddb468c946f68939819fb ] + +The UCSI spec states that the num_connectors field is 7 bits, and the +8th bit is reserved and should be set to zero. +Some buggy FW has been known to set this bit, and it can lead to a +system not booting. +Flag that the FW is not behaving correctly, and auto-fix the value +so that the system boots correctly. + +Found on Lenovo P1 G8 during Linux enablement program. The FW will +be fixed, but seemed worth addressing in case it hit platforms that +aren't officially Linux supported. + +Signed-off-by: Mark Pearson +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250821185319.2585023-1-mpearson-lenovo@squebb.ca +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index 3f568f790f39..3995483a0aa0 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1807,6 +1807,12 @@ static int ucsi_init(struct ucsi *ucsi) + ret = -ENODEV; + goto err_reset; + } ++ /* Check if reserved bit set. This is out of spec but happens in buggy FW */ ++ if (ucsi->cap.num_connectors & 0x80) { ++ dev_warn(ucsi->dev, "UCSI: Invalid num_connectors %d. Likely buggy FW\n", ++ ucsi->cap.num_connectors); ++ ucsi->cap.num_connectors &= 0x7f; // clear bit and carry on ++ } + + /* Allocate the connectors. Released in ucsi_unregister() */ + connector = kcalloc(ucsi->cap.num_connectors + 1, sizeof(*connector), GFP_KERNEL); +-- +2.51.0 + diff --git a/queue-6.18/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch b/queue-6.18/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch new file mode 100644 index 0000000000..f58fba2426 --- /dev/null +++ b/queue-6.18/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch @@ -0,0 +1,65 @@ +From 4846de73fe267ccffe66a5bff7c7def201c34df1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 14:40:20 +0800 +Subject: usb: usb-storage: No additional quirks need to be added to the EL-R12 + optical drive. + +From: Chen Changcheng + +[ Upstream commit 955a48a5353f4fe009704a9a4272a3adf627cd35 ] + +The optical drive of EL-R12 has the same vid and pid as INIC-3069, +as follows: +T: Bus=02 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0 +D: Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=13fd ProdID=3940 Rev= 3.10 +S: Manufacturer=HL-DT-ST +S: Product= DVD+-RW GT80N +S: SerialNumber=423349524E4E38303338323439202020 +C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=144mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=02 Prot=50 Driver=usb-storage +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=0a(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +This will result in the optical drive device also adding +the quirks of US_FL_NO_ATA_1X. When performing an erase operation, +it will fail, and the reason for the failure is as follows: +[ 388.967742] sr 5:0:0:0: [sr0] tag#0 Send: scmd 0x00000000d20c33a7 +[ 388.967742] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00 +[ 388.967773] sr 5:0:0:0: [sr0] tag#0 Done: SUCCESS Result: hostbyte=DID_TARGET_FAILURE driverbyte=DRIVER_OK cmd_age=0s +[ 388.967773] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00 +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Sense Key : Illegal Request [current] +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Add. Sense: Invalid field in cdb +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 scsi host busy 1 failed 0 +[ 388.967803] sr 5:0:0:0: Notifying upper driver of completion (result 8100002) +[ 388.967834] sr 5:0:0:0: [sr0] tag#0 0 sectors total, 0 bytes done. + +For the EL-R12 standard optical drive, all operational commands +and usage scenarios were tested without adding the IGNORE_RESIDUE quirks, +and no issues were encountered. It can be reasonably concluded +that removing the IGNORE_RESIDUE quirks has no impact. + +Signed-off-by: Chen Changcheng +Link: https://patch.msgid.link/20251121064020.29332-1-chenchangcheng@kylinos.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/storage/unusual_uas.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index 1477e31d7763..b695f5ba9a40 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -98,7 +98,7 @@ UNUSUAL_DEV(0x125f, 0xa94a, 0x0160, 0x0160, + US_FL_NO_ATA_1X), + + /* Reported-by: Benjamin Tissoires */ +-UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, ++UNUSUAL_DEV(0x13fd, 0x3940, 0x0309, 0x0309, + "Initio Corporation", + "INIC-3069", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, +-- +2.51.0 + diff --git a/queue-6.18/usb-xhci-don-t-unchain-link-trbs-on-quirky-hcs.patch b/queue-6.18/usb-xhci-don-t-unchain-link-trbs-on-quirky-hcs.patch new file mode 100644 index 0000000000..c2564bf822 --- /dev/null +++ b/queue-6.18/usb-xhci-don-t-unchain-link-trbs-on-quirky-hcs.patch @@ -0,0 +1,126 @@ +From 31bcf826b0f750c3c84a349851337e9378f7f9c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 16:24:04 +0200 +Subject: usb: xhci: Don't unchain link TRBs on quirky HCs + +From: Michal Pecio + +[ Upstream commit e6aec6d9f5794e85d2312497a5d81296d885090e ] + +Some old HCs ignore transfer ring link TRBs whose chain bit is unset. +This breaks endpoint operation and sometimes makes it execute other +ring's TDs, which may corrupt their buffers or cause unwanted device +action. We avoid this by chaining all link TRBs on affected rings. + +Fix an omission which allows them to be unchained by cancelling TDs. + +The patch was tested by reproducing this condition on an isochronous +endpoint (non-power-of-two TDs are sometimes split not to cross 64K) +and printing link TRBs in trb_to_noop() on good and buggy HCs. + +Actual hardware malfunction is rare since it requires Missed Service +Error shortly before the unchained link TRB, at least on NEC and AMD. +I have never seen it after commit bb0ba4cb1065 ("usb: xhci: Apply the +link chain quirk on NEC isoc endpoints"), but it's Russian roulette +and I can't test all affected hosts and workloads. Fairly often MSEs +happen after cancellation because the endpoint was stopped. + +Signed-off-by: Michal Pecio +Signed-off-by: Mathias Nyman +Link: https://patch.msgid.link/20251119142417.2820519-11-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-ring.c | 27 ++++++++++++++++----------- + 1 file changed, 16 insertions(+), 11 deletions(-) + +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 5bdcf9ab2b99..25185552287c 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -128,11 +128,11 @@ static void inc_td_cnt(struct urb *urb) + urb_priv->num_tds_done++; + } + +-static void trb_to_noop(union xhci_trb *trb, u32 noop_type) ++static void trb_to_noop(union xhci_trb *trb, u32 noop_type, bool unchain_links) + { + if (trb_is_link(trb)) { +- /* unchain chained link TRBs */ +- trb->link.control &= cpu_to_le32(~TRB_CHAIN); ++ if (unchain_links) ++ trb->link.control &= cpu_to_le32(~TRB_CHAIN); + } else { + trb->generic.field[0] = 0; + trb->generic.field[1] = 0; +@@ -465,7 +465,7 @@ static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci, + xhci_dbg(xhci, "Turn aborted command %p to no-op\n", + i_cmd->command_trb); + +- trb_to_noop(i_cmd->command_trb, TRB_CMD_NOOP); ++ trb_to_noop(i_cmd->command_trb, TRB_CMD_NOOP, false); + + /* + * caller waiting for completion is called when command +@@ -797,13 +797,18 @@ static int xhci_move_dequeue_past_td(struct xhci_hcd *xhci, + * (The last TRB actually points to the ring enqueue pointer, which is not part + * of this TD.) This is used to remove partially enqueued isoc TDs from a ring. + */ +-static void td_to_noop(struct xhci_td *td, bool flip_cycle) ++static void td_to_noop(struct xhci_hcd *xhci, struct xhci_virt_ep *ep, ++ struct xhci_td *td, bool flip_cycle) + { ++ bool unchain_links; + struct xhci_segment *seg = td->start_seg; + union xhci_trb *trb = td->start_trb; + ++ /* link TRBs should now be unchained, but some old HCs expect otherwise */ ++ unchain_links = !xhci_link_chain_quirk(xhci, ep->ring ? ep->ring->type : TYPE_STREAM); ++ + while (1) { +- trb_to_noop(trb, TRB_TR_NOOP); ++ trb_to_noop(trb, TRB_TR_NOOP, unchain_links); + + /* flip cycle if asked to */ + if (flip_cycle && trb != td->start_trb && trb != td->end_trb) +@@ -1091,16 +1096,16 @@ static int xhci_invalidate_cancelled_tds(struct xhci_virt_ep *ep) + "Found multiple active URBs %p and %p in stream %u?\n", + td->urb, cached_td->urb, + td->urb->stream_id); +- td_to_noop(cached_td, false); ++ td_to_noop(xhci, ep, cached_td, false); + cached_td->cancel_status = TD_CLEARED; + } +- td_to_noop(td, false); ++ td_to_noop(xhci, ep, td, false); + td->cancel_status = TD_CLEARING_CACHE; + cached_td = td; + break; + } + } else { +- td_to_noop(td, false); ++ td_to_noop(xhci, ep, td, false); + td->cancel_status = TD_CLEARED; + } + } +@@ -1125,7 +1130,7 @@ static int xhci_invalidate_cancelled_tds(struct xhci_virt_ep *ep) + continue; + xhci_warn(xhci, "Failed to clear cancelled cached URB %p, mark clear anyway\n", + td->urb); +- td_to_noop(td, false); ++ td_to_noop(xhci, ep, td, false); + td->cancel_status = TD_CLEARED; + } + } +@@ -4273,7 +4278,7 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags, + */ + urb_priv->td[0].end_trb = ep_ring->enqueue; + /* Every TRB except the first & last will have its cycle bit flipped. */ +- td_to_noop(&urb_priv->td[0], true); ++ td_to_noop(xhci, xep, &urb_priv->td[0], true); + + /* Reset the ring enqueue back to the first TRB and its cycle bit. */ + ep_ring->enqueue = urb_priv->td[0].start_trb; +-- +2.51.0 + diff --git a/queue-6.18/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch b/queue-6.18/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch new file mode 100644 index 0000000000..e3eb8b3a75 --- /dev/null +++ b/queue-6.18/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch @@ -0,0 +1,82 @@ +From 51be315e80aa45f63d0b5155701538420673b311 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 16:23:55 +0200 +Subject: usb: xhci: limit run_graceperiod for only usb 3.0 devices + +From: Hongyu Xie + +[ Upstream commit 8d34983720155b8f05de765f0183d9b0e1345cc0 ] + +run_graceperiod blocks usb 2.0 devices from auto suspending after +xhci_start for 500ms. + +Log shows: +[ 13.387170] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.387177] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.387182] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.387188] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.387191] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.387193] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.387296] hub_event:5779: hub 3-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.393343] handle_port_status:2034: xhci-hcd PNP0D10:02: handle_port_status: starting usb5 port polling. +[ 13.393353] xhci_hub_control:1271: xhci-hcd PNP0D10:02: Get port status 5-1 read: 0x206e1, return 0x10101 +[ 13.400047] hub_suspend:3903: hub 3-0:1.0: hub_suspend +[ 13.403077] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.403080] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.403085] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.403087] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.403090] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.403093] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.403095] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.405002] handle_port_status:1913: xhci-hcd PNP0D10:04: Port change event, 9-1, id 1, portsc: 0x6e1 +[ 13.405016] hub_activate:1169: usb usb5-port1: status 0101 change 0001 +[ 13.405026] xhci_clear_port_change_bit:658: xhci-hcd PNP0D10:02: clear port1 connect change, portsc: 0x6e1 +[ 13.413275] hcd_bus_suspend:2250: usb usb3: bus auto-suspend, wakeup 1 +[ 13.419081] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.419086] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.419095] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.419100] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.419106] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.419110] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.419112] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.420455] handle_port_status:2034: xhci-hcd PNP0D10:04: handle_port_status: starting usb9 port polling. +[ 13.420493] handle_port_status:1913: xhci-hcd PNP0D10:05: Port change event, 10-1, id 1, portsc: 0x6e1 +[ 13.425332] hcd_bus_suspend:2279: usb usb3: suspend raced with wakeup event +[ 13.431931] handle_port_status:2034: xhci-hcd PNP0D10:05: handle_port_status: starting usb10 port polling. +[ 13.435080] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.435084] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.435092] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.435096] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.435102] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.435106] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event + +usb7 and other usb 2.0 root hub were rapidly toggling between suspend +and resume states. More, "suspend raced with wakeup event" confuses people. + +So, limit run_graceperiod for only usb 3.0 devices + +Signed-off-by: Hongyu Xie +Signed-off-by: Mathias Nyman +Link: https://patch.msgid.link/20251119142417.2820519-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-hub.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index b3a59ce1b3f4..5e1442e91743 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1671,7 +1671,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf) + * SS devices are only visible to roothub after link training completes. + * Keep polling roothubs for a grace period after xHC start + */ +- if (xhci->run_graceperiod) { ++ if (hcd->speed >= HCD_USB3 && xhci->run_graceperiod) { + if (time_before(jiffies, xhci->run_graceperiod)) + status = 1; + else +-- +2.51.0 + diff --git a/queue-6.18/usbip-fix-locking-bug-in-rt-enabled-kernels.patch b/queue-6.18/usbip-fix-locking-bug-in-rt-enabled-kernels.patch new file mode 100644 index 0000000000..b1898010c6 --- /dev/null +++ b/queue-6.18/usbip-fix-locking-bug-in-rt-enabled-kernels.patch @@ -0,0 +1,64 @@ +From edfc197c373f8102cf5a14afa7c1c13e8471a74f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 09:41:43 +0800 +Subject: usbip: Fix locking bug in RT-enabled kernels + +From: Lizhi Xu + +[ Upstream commit 09bf21bf5249880f62fe759b53b14b4b52900c6c ] + +Interrupts are disabled before entering usb_hcd_giveback_urb(). +A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be +acquired with disabled interrupts. + +Save the interrupt status and restore it after usb_hcd_giveback_urb(). + +syz reported: +BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 +Call Trace: + dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 + rt_spin_lock+0xc7/0x2c0 kernel/locking/spinlock_rt.c:57 + spin_lock include/linux/spinlock_rt.h:44 [inline] + mon_bus_complete drivers/usb/mon/mon_main.c:134 [inline] + mon_complete+0x5c/0x200 drivers/usb/mon/mon_main.c:147 + usbmon_urb_complete include/linux/usb/hcd.h:738 [inline] + __usb_hcd_giveback_urb+0x254/0x5e0 drivers/usb/core/hcd.c:1647 + vhci_urb_enqueue+0xb4f/0xe70 drivers/usb/usbip/vhci_hcd.c:818 + +Reported-by: syzbot+205ef33a3b636b4181fb@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=205ef33a3b636b4181fb +Signed-off-by: Lizhi Xu +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20250916014143.1439759-1-lizhi.xu@windriver.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vhci_hcd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index 0d6c10a8490c..f7e405abe608 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -831,15 +831,15 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + no_need_xmit: + usb_hcd_unlink_urb_from_ep(hcd, urb); + no_need_unlink: +- spin_unlock_irqrestore(&vhci->lock, flags); + if (!ret) { + /* usb_hcd_giveback_urb() should be called with + * irqs disabled + */ +- local_irq_disable(); ++ spin_unlock(&vhci->lock); + usb_hcd_giveback_urb(hcd, urb, urb->status); +- local_irq_enable(); ++ spin_lock(&vhci->lock); + } ++ spin_unlock_irqrestore(&vhci->lock, flags); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.18/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch b/queue-6.18/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch new file mode 100644 index 0000000000..3df20a19d3 --- /dev/null +++ b/queue-6.18/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch @@ -0,0 +1,43 @@ +From c2310c4927a15b923f7f5875f0b0cfecd83e7656 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Sep 2025 16:33:32 +0800 +Subject: via_wdt: fix critical boot hang due to unnamed resource allocation + +From: Li Qiang + +[ Upstream commit 7aa31ee9ec92915926e74731378c009c9cc04928 ] + +The VIA watchdog driver uses allocate_resource() to reserve a MMIO +region for the watchdog control register. However, the allocated +resource was not given a name, which causes the kernel resource tree +to contain an entry marked as "" under /proc/iomem on x86 +platforms. + +During boot, this unnamed resource can lead to a critical hang because +subsequent resource lookups and conflict checks fail to handle the +invalid entry properly. + +Signed-off-by: Li Qiang +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/via_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/via_wdt.c b/drivers/watchdog/via_wdt.c +index d647923d68fe..f55576392651 100644 +--- a/drivers/watchdog/via_wdt.c ++++ b/drivers/watchdog/via_wdt.c +@@ -165,6 +165,7 @@ static int wdt_probe(struct pci_dev *pdev, + dev_err(&pdev->dev, "cannot enable PCI device\n"); + return -ENODEV; + } ++ wdt_res.name = "via_wdt"; + + /* + * Allocate a MMIO region which contains watchdog control register +-- +2.51.0 + diff --git a/queue-6.18/x86-fpu-fix-fpu-state-core-dump-truncation-on-cpus-w.patch b/queue-6.18/x86-fpu-fix-fpu-state-core-dump-truncation-on-cpus-w.patch new file mode 100644 index 0000000000..7ff6f4e300 --- /dev/null +++ b/queue-6.18/x86-fpu-fix-fpu-state-core-dump-truncation-on-cpus-w.patch @@ -0,0 +1,54 @@ +From 38e07ce4630e45c200e466753d1b0f3f9316e3ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Dec 2025 08:02:20 +0800 +Subject: x86/fpu: Fix FPU state core dump truncation on CPUs with no extended + xfeatures + +From: Yongxin Liu + +[ Upstream commit c8161e5304abb26e6c0bec6efc947992500fa6c5 ] + +Zero can be a valid value of num_records. For example, on Intel Atom x6425RE, +only x87 and SSE are supported (features 0, 1), and fpu_user_cfg.max_features +is 3. The for_each_extended_xfeature() loop only iterates feature 2, which is +not enabled, so num_records = 0. This is valid and should not cause core dump +failure. + +The issue is that dump_xsave_layout_desc() returns 0 for both genuine errors +(dump_emit() failure) and valid cases (no extended features). Use negative +return values for errors and only abort on genuine failures. + +Fixes: ba386777a30b ("x86/elf: Add a new FPU buffer layout info to x86 core files") +Signed-off-by: Yongxin Liu +Signed-off-by: Ingo Molnar +Link: https://patch.msgid.link/20251210000219.4094353-2-yongxin.liu@windriver.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/fpu/xstate.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c +index 28e4fd65c9da..5f54a207ace4 100644 +--- a/arch/x86/kernel/fpu/xstate.c ++++ b/arch/x86/kernel/fpu/xstate.c +@@ -1945,7 +1945,7 @@ static int dump_xsave_layout_desc(struct coredump_params *cprm) + }; + + if (!dump_emit(cprm, &xc, sizeof(xc))) +- return 0; ++ return -1; + + num_records++; + } +@@ -1983,7 +1983,7 @@ int elf_coredump_extra_notes_write(struct coredump_params *cprm) + return 1; + + num_records = dump_xsave_layout_desc(cprm); +- if (!num_records) ++ if (num_records < 0) + return 1; + + /* Total size should be equal to the number of records */ +-- +2.51.0 + diff --git a/queue-6.18/x86-mm-tlb-trace-export-the-tlb_remote_wrong_cpu-enu.patch b/queue-6.18/x86-mm-tlb-trace-export-the-tlb_remote_wrong_cpu-enu.patch new file mode 100644 index 0000000000..c8b6f49498 --- /dev/null +++ b/queue-6.18/x86-mm-tlb-trace-export-the-tlb_remote_wrong_cpu-enu.patch @@ -0,0 +1,50 @@ +From 6b5e2ce29e5151b4b1d4e550557b7d043780111a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Dec 2025 04:08:07 -0500 +Subject: x86/mm/tlb/trace: Export the TLB_REMOTE_WRONG_CPU enum in + + +From: Tal Zussman + +[ Upstream commit 8b62e64e6d30fa047b3aefb1a36e1f80c8acb3d2 ] + +When the TLB_REMOTE_WRONG_CPU enum was introduced for the tlb_flush +tracepoint, the enum was not exported to user-space. Add it to the +appropriate macro definition to enable parsing by userspace tools, as +per: + + Link: https://lore.kernel.org/all/20150403013802.220157513@goodmis.org + +[ mingo: Capitalize IPI, etc. ] + +Fixes: 2815a56e4b72 ("x86/mm/tlb: Add tracepoint for TLB flush IPI to stale CPU") +Signed-off-by: Tal Zussman +Signed-off-by: Ingo Molnar +Reviewed-by: Steven Rostedt (Google) +Reviewed-by: David Hildenbrand +Reviewed-by: Rik van Riel +Link: https://patch.msgid.link/20251212-tlb-trace-fix-v2-1-d322e0ad9b69@columbia.edu +Signed-off-by: Sasha Levin +--- + include/trace/events/tlb.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/trace/events/tlb.h b/include/trace/events/tlb.h +index b4d8e7dc38f8..fb8369511685 100644 +--- a/include/trace/events/tlb.h ++++ b/include/trace/events/tlb.h +@@ -12,8 +12,9 @@ + EM( TLB_FLUSH_ON_TASK_SWITCH, "flush on task switch" ) \ + EM( TLB_REMOTE_SHOOTDOWN, "remote shootdown" ) \ + EM( TLB_LOCAL_SHOOTDOWN, "local shootdown" ) \ +- EM( TLB_LOCAL_MM_SHOOTDOWN, "local mm shootdown" ) \ +- EMe( TLB_REMOTE_SEND_IPI, "remote ipi send" ) ++ EM( TLB_LOCAL_MM_SHOOTDOWN, "local MM shootdown" ) \ ++ EM( TLB_REMOTE_SEND_IPI, "remote IPI send" ) \ ++ EMe( TLB_REMOTE_WRONG_CPU, "remote wrong CPU" ) + + /* + * First define the enums in TLB_FLUSH_REASON to be exported to userspace +-- +2.51.0 + diff --git a/queue-6.6/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch b/queue-6.6/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch new file mode 100644 index 0000000000..fbbf8c36b6 --- /dev/null +++ b/queue-6.6/alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch @@ -0,0 +1,48 @@ +From a996d526643eb7459a27714c905dcd405d1e179e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 17:04:33 +0800 +Subject: ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path + +From: Haotian Zhang + +[ Upstream commit 5032347c04ba7ff9ba878f262e075d745c06a2a8 ] + +When pdacf_config() fails, snd_pdacf_probe() returns the error code +directly without freeing the sound card resources allocated by +snd_card_new(), which leads to a memory leak. + +Add proper error handling to free the sound card and clear the card +list entry when pdacf_config() fails. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Suggested-by: Takashi Iwai +Signed-off-by: Haotian Zhang +Link: https://patch.msgid.link/20251215090433.211-1-vulab@iscas.ac.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c +index 8363ec08df5d..4468d81683ec 100644 +--- a/sound/pcmcia/pdaudiocf/pdaudiocf.c ++++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c +@@ -132,7 +132,13 @@ static int snd_pdacf_probe(struct pcmcia_device *link) + link->config_index = 1; + link->config_regs = PRESENT_OPTION; + +- return pdacf_config(link); ++ err = pdacf_config(link); ++ if (err < 0) { ++ card_list[i] = NULL; ++ snd_card_free(card); ++ return err; ++ } ++ return 0; + } + + +-- +2.51.0 + diff --git a/queue-6.6/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch b/queue-6.6/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch new file mode 100644 index 0000000000..01de52fbd8 --- /dev/null +++ b/queue-6.6/alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch @@ -0,0 +1,74 @@ +From d223ca66fa11564fa439440d243117a60d1e655d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Dec 2025 10:46:30 +0800 +Subject: ALSA: usb-mixer: us16x08: validate meter packet indices + +From: Shipei Qu + +[ Upstream commit 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e ] + +get_meter_levels_from_urb() parses the 64-byte meter packets sent by +the device and fills the per-channel arrays meter_level[], +comp_level[] and master_level[] in struct snd_us16x08_meter_store. + +Currently the function derives the channel index directly from the +meter packet (MUB2(meter_urb, s) - 1) and uses it to index those +arrays without validating the range. If the packet contains a +negative or out-of-range channel number, the driver may write past +the end of these arrays. + +Introduce a local channel variable and validate it before updating the +arrays. We reject negative indices, limit meter_level[] and +comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[] +updates with ARRAY_SIZE(master_level). + +Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk") +Reported-by: DARKNAVY (@DarkNavyOrg) +Closes: https://lore.kernel.org/tencent_21C112743C44C1A2517FF219@qq.com +Signed-off-by: Shipei Qu +Link: https://patch.msgid.link/20251217024630.59576-1-qu@darknavy.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_us16x08.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c +index 20ac32635f1f..d05cb54de788 100644 +--- a/sound/usb/mixer_us16x08.c ++++ b/sound/usb/mixer_us16x08.c +@@ -656,17 +656,25 @@ static void get_meter_levels_from_urb(int s, + u8 *meter_urb) + { + int val = MUC2(meter_urb, s) + (MUC3(meter_urb, s) << 8); ++ int ch = MUB2(meter_urb, s) - 1; ++ ++ if (ch < 0) ++ return; + + if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 && + MUA2(meter_urb, s) == 0x04 && MUB0(meter_urb, s) == 0x62) { +- if (MUC0(meter_urb, s) == 0x72) +- store->meter_level[MUB2(meter_urb, s) - 1] = val; +- if (MUC0(meter_urb, s) == 0xb2) +- store->comp_level[MUB2(meter_urb, s) - 1] = val; ++ if (ch < SND_US16X08_MAX_CHANNELS) { ++ if (MUC0(meter_urb, s) == 0x72) ++ store->meter_level[ch] = val; ++ if (MUC0(meter_urb, s) == 0xb2) ++ store->comp_level[ch] = val; ++ } + } + if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 && +- MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) +- store->master_level[MUB2(meter_urb, s) - 1] = val; ++ MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) { ++ if (ch < ARRAY_SIZE(store->master_level)) ++ store->master_level[ch] = val; ++ } + } + + /* Function to retrieve current meter values from the device. +-- +2.51.0 + diff --git a/queue-6.6/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch b/queue-6.6/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch new file mode 100644 index 0000000000..94f607ec1f --- /dev/null +++ b/queue-6.6/alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch @@ -0,0 +1,47 @@ +From 013b5cf44713aba5b2d3d4bae4419f3455e5ba1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Dec 2025 12:26:52 +0800 +Subject: ALSA: vxpocket: Fix resource leak in vxpocket_probe error path + +From: Haotian Zhang + +[ Upstream commit 2a03b40deacbd293ac9aed0f9b11197dad54fe5f ] + +When vxpocket_config() fails, vxpocket_probe() returns the error code +directly without freeing the sound card resources allocated by +snd_card_new(), which leads to a memory leak. + +Add proper error handling to free the sound card and clear the +allocation bit when vxpocket_config() fails. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Haotian Zhang +Link: https://patch.msgid.link/20251215042652.695-1-vulab@iscas.ac.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pcmcia/vx/vxpocket.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c +index 7a0f0e73ceb2..867a477d53ae 100644 +--- a/sound/pcmcia/vx/vxpocket.c ++++ b/sound/pcmcia/vx/vxpocket.c +@@ -295,7 +295,13 @@ static int vxpocket_probe(struct pcmcia_device *p_dev) + + vxp->p_dev = p_dev; + +- return vxpocket_config(p_dev); ++ err = vxpocket_config(p_dev); ++ if (err < 0) { ++ card_alloc &= ~(1 << i); ++ snd_card_free(card); ++ return err; ++ } ++ return 0; + } + + static void vxpocket_detach(struct pcmcia_device *link) +-- +2.51.0 + diff --git a/queue-6.6/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch b/queue-6.6/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch new file mode 100644 index 0000000000..7ce54e3f6c --- /dev/null +++ b/queue-6.6/clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch @@ -0,0 +1,79 @@ +From 9923b9c4220cadd8f6cd429f860745ffa0a100ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 16:16:26 +0100 +Subject: clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & + pcie_x4 + +From: Josua Mayer + +[ Upstream commit f0e6bc0c3ef4b4afb299bd6912586cafd5d864e9 ] + +CP110 based platforms rely on the bootloader for pci port +initialization. +TF-A actively prevents non-uboot re-configuration of pci lanes, and many +boards do not have software control over the pci card reset. + +If a pci port had link at boot-time and the clock is stopped at a later +point, the link fails and can not be recovered. + +PCI controller driver probe - and by extension ownership of a driver for +the pci clocks - may be delayed especially on large modular kernels, +causing the clock core to start disabling unused clocks. + +Add the CLK_IGNORE_UNUSED flag to the three pci port's clocks to ensure +they are not stopped before the pci controller driver has taken +ownership and tested for an existing link. + +This fixes failed pci link detection when controller driver probes late, +e.g. with arm64 defconfig and CONFIG_PHY_MVEBU_CP110_COMPHY=m. + +Closes: https://lore.kernel.org/r/b71596c7-461b-44b6-89ab-3cfbd492639f@solid-run.com +Signed-off-by: Josua Mayer +Reviewed-by: Andrew Lunn +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/cp110-system-controller.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c +index 03c59bf22106..b47c86906046 100644 +--- a/drivers/clk/mvebu/cp110-system-controller.c ++++ b/drivers/clk/mvebu/cp110-system-controller.c +@@ -110,6 +110,25 @@ static const char * const gate_base_names[] = { + [CP110_GATE_EIP197] = "eip197" + }; + ++static unsigned long gate_flags(const u8 bit_idx) ++{ ++ switch (bit_idx) { ++ case CP110_GATE_PCIE_X1_0: ++ case CP110_GATE_PCIE_X1_1: ++ case CP110_GATE_PCIE_X4: ++ /* ++ * If a port had an active link at boot time, stopping ++ * the clock creates a failed state from which controller ++ * driver can not recover. ++ * Prevent stopping this clock till after a driver has taken ++ * ownership. ++ */ ++ return CLK_IGNORE_UNUSED; ++ default: ++ return 0; ++ } ++}; ++ + struct cp110_gate_clk { + struct clk_hw hw; + struct regmap *regmap; +@@ -171,6 +190,7 @@ static struct clk_hw *cp110_register_gate(const char *name, + init.ops = &cp110_gate_ops; + init.parent_names = &parent_name; + init.num_parents = 1; ++ init.flags = gate_flags(bit_idx); + + gate->regmap = regmap; + gate->bit_idx = bit_idx; +-- +2.51.0 + diff --git a/queue-6.6/exfat-fix-remount-failure-in-different-process-envir.patch b/queue-6.6/exfat-fix-remount-failure-in-different-process-envir.patch new file mode 100644 index 0000000000..b684dcb575 --- /dev/null +++ b/queue-6.6/exfat-fix-remount-failure-in-different-process-envir.patch @@ -0,0 +1,60 @@ +From a6ade131edcb3809866850e9f8a068e60e07b040 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Nov 2025 17:51:10 +0800 +Subject: exfat: fix remount failure in different process environments + +From: Yuezhang Mo + +[ Upstream commit 51fc7b4ce10ccab8ea5e4876bcdc42cf5202a0ef ] + +The kernel test robot reported that the exFAT remount operation +failed. The reason for the failure was that the process's umask +is different between mount and remount, causing fs_fmask and +fs_dmask are changed. + +Potentially, both gid and uid may also be changed. Therefore, when +initializing fs_context for remount, inherit these mount options +from the options used during mount. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-lkp/202511251637.81670f5c-lkp@intel.com +Signed-off-by: Yuezhang Mo +Signed-off-by: Namjae Jeon +Signed-off-by: Sasha Levin +--- + fs/exfat/super.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/fs/exfat/super.c b/fs/exfat/super.c +index 957135f20cb6..da3e03b059cf 100644 +--- a/fs/exfat/super.c ++++ b/fs/exfat/super.c +@@ -764,10 +764,21 @@ static int exfat_init_fs_context(struct fs_context *fc) + ratelimit_state_init(&sbi->ratelimit, DEFAULT_RATELIMIT_INTERVAL, + DEFAULT_RATELIMIT_BURST); + +- sbi->options.fs_uid = current_uid(); +- sbi->options.fs_gid = current_gid(); +- sbi->options.fs_fmask = current->fs->umask; +- sbi->options.fs_dmask = current->fs->umask; ++ if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE && fc->root) { ++ struct super_block *sb = fc->root->d_sb; ++ struct exfat_mount_options *cur_opts = &EXFAT_SB(sb)->options; ++ ++ sbi->options.fs_uid = cur_opts->fs_uid; ++ sbi->options.fs_gid = cur_opts->fs_gid; ++ sbi->options.fs_fmask = cur_opts->fs_fmask; ++ sbi->options.fs_dmask = cur_opts->fs_dmask; ++ } else { ++ sbi->options.fs_uid = current_uid(); ++ sbi->options.fs_gid = current_gid(); ++ sbi->options.fs_fmask = current->fs->umask; ++ sbi->options.fs_dmask = current->fs->umask; ++ } ++ + sbi->options.allow_utime = -1; + sbi->options.iocharset = exfat_default_iocharset; + sbi->options.errors = EXFAT_ERRORS_RO; +-- +2.51.0 + diff --git a/queue-6.6/firmware-imx-scu-irq-init-workqueue-before-request-m.patch b/queue-6.6/firmware-imx-scu-irq-init-workqueue-before-request-m.patch new file mode 100644 index 0000000000..87f9a80e24 --- /dev/null +++ b/queue-6.6/firmware-imx-scu-irq-init-workqueue-before-request-m.patch @@ -0,0 +1,46 @@ +From feac99df61f77b2bd225d0a69c3085c99f745ac8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Oct 2025 09:56:26 +0800 +Subject: firmware: imx: scu-irq: Init workqueue before request mbox channel + +From: Peng Fan + +[ Upstream commit 81fb53feb66a3aefbf6fcab73bb8d06f5b0c54ad ] + +With mailbox channel requested, there is possibility that interrupts may +come in, so need to make sure the workqueue is initialized before +the queue is scheduled by mailbox rx callback. + +Reviewed-by: Frank Li +Signed-off-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/firmware/imx/imx-scu-irq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/imx/imx-scu-irq.c b/drivers/firmware/imx/imx-scu-irq.c +index f2b902e95b73..b9f6128d56f7 100644 +--- a/drivers/firmware/imx/imx-scu-irq.c ++++ b/drivers/firmware/imx/imx-scu-irq.c +@@ -214,6 +214,8 @@ int imx_scu_enable_general_irq_channel(struct device *dev) + cl->dev = dev; + cl->rx_callback = imx_scu_irq_callback; + ++ INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler); ++ + /* SCU general IRQ uses general interrupt channel 3 */ + ch = mbox_request_channel_byname(cl, "gip3"); + if (IS_ERR(ch)) { +@@ -223,8 +225,6 @@ int imx_scu_enable_general_irq_channel(struct device *dev) + return ret; + } + +- INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler); +- + if (!of_parse_phandle_with_args(dev->of_node, "mboxes", + "#mbox-cells", 0, &spec)) { + i = of_alias_get_id(spec.np, "mu"); +-- +2.51.0 + diff --git a/queue-6.6/fuse-always-flush-the-page-cache-before-fopen_direct.patch b/queue-6.6/fuse-always-flush-the-page-cache-before-fopen_direct.patch new file mode 100644 index 0000000000..473aeb2064 --- /dev/null +++ b/queue-6.6/fuse-always-flush-the-page-cache-before-fopen_direct.patch @@ -0,0 +1,36 @@ +From 5aa8f338c94d6c73f5c4f39665175d6f15523871 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 00:21:18 +0200 +Subject: fuse: Always flush the page cache before FOPEN_DIRECT_IO write + +From: Bernd Schubert + +[ Upstream commit 1ce120dcefc056ce8af2486cebbb77a458aad4c3 ] + +This was done as condition on direct_io_allow_mmap, but I believe +this is not right, as a file might be open two times - once with +write-back enabled another time with FOPEN_DIRECT_IO. + +Signed-off-by: Bernd Schubert +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index 2055af1ffaf3..1dd9ef5398d7 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -1463,7 +1463,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, + if (!ia) + return -ENOMEM; + +- if (fopen_direct_io && fc->direct_io_allow_mmap) { ++ if (fopen_direct_io) { + res = filemap_write_and_wait_range(mapping, pos, pos + count - 1); + if (res) { + fuse_io_free(ia); +-- +2.51.0 + diff --git a/queue-6.6/fuse-invalidate-the-page-cache-after-fopen_direct_io.patch b/queue-6.6/fuse-invalidate-the-page-cache-after-fopen_direct_io.patch new file mode 100644 index 0000000000..5a9a8cb543 --- /dev/null +++ b/queue-6.6/fuse-invalidate-the-page-cache-after-fopen_direct_io.patch @@ -0,0 +1,45 @@ +From 2dcc501014f84bc50e9f6c61b35dff082e6e5569 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Oct 2025 00:21:17 +0200 +Subject: fuse: Invalidate the page cache after FOPEN_DIRECT_IO write + +From: Bernd Schubert + +[ Upstream commit b359af8275a982a458e8df6c6beab1415be1f795 ] + +generic_file_direct_write() also does this and has a large +comment about. + +Reproducer here is xfstest's generic/209, which is exactly to +have competing DIO write and cached IO read. + +Signed-off-by: Bernd Schubert +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/file.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index 1dd9ef5398d7..ae62f47ef004 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -1537,6 +1537,15 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter, + if (res > 0) + *ppos = pos; + ++ if (res > 0 && write && fopen_direct_io) { ++ /* ++ * As in generic_file_direct_write(), invalidate after the ++ * write, to invalidate read-ahead cache that may have competed ++ * with the write. ++ */ ++ invalidate_inode_pages2_range(mapping, idx_from, idx_to); ++ } ++ + return res > 0 ? res : err; + } + EXPORT_SYMBOL_GPL(fuse_direct_io); +-- +2.51.0 + diff --git a/queue-6.6/i2c-designware-disable-smbus-interrupts-to-prevent-s.patch b/queue-6.6/i2c-designware-disable-smbus-interrupts-to-prevent-s.patch new file mode 100644 index 0000000000..e183b98b04 --- /dev/null +++ b/queue-6.6/i2c-designware-disable-smbus-interrupts-to-prevent-s.patch @@ -0,0 +1,60 @@ +From 1e8eed7b529e23511ff61e8e8ec7c6e15f8159e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Oct 2025 15:57:14 +0800 +Subject: i2c: designware: Disable SMBus interrupts to prevent storms from + mis-configured firmware + +From: Jinhui Guo + +[ Upstream commit d3429178ee51dd7155445d15a5ab87a45fae3c73 ] + +When probing the I2C master, disable SMBus interrupts to prevent +storms caused by broken firmware mis-configuring IC_SMBUS=1; the +handler never services them and a mis-configured SMBUS Master +extend-clock timeout or SMBUS Slave extend-clock timeout can +flood the CPU. + +Signed-off-by: Jinhui Guo +Reviewed-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20251021075714.3712-2-guojinhui.liam@bytedance.com +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-core.h | 1 + + drivers/i2c/busses/i2c-designware-master.c | 7 +++++++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h +index e93870a0f9a4..f8feae20a7b2 100644 +--- a/drivers/i2c/busses/i2c-designware-core.h ++++ b/drivers/i2c/busses/i2c-designware-core.h +@@ -79,6 +79,7 @@ + #define DW_IC_TX_ABRT_SOURCE 0x80 + #define DW_IC_ENABLE_STATUS 0x9c + #define DW_IC_CLR_RESTART_DET 0xa8 ++#define DW_IC_SMBUS_INTR_MASK 0xcc + #define DW_IC_COMP_PARAM_1 0xf4 + #define DW_IC_COMP_VERSION 0xf8 + #define DW_IC_SDA_HOLD_MIN_VERS 0x3131312A /* "111*" == v1.11* */ +diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c +index e865869ccc50..56f124f32cac 100644 +--- a/drivers/i2c/busses/i2c-designware-master.c ++++ b/drivers/i2c/busses/i2c-designware-master.c +@@ -184,6 +184,13 @@ static int i2c_dw_init_master(struct dw_i2c_dev *dev) + /* Disable the adapter */ + __i2c_dw_disable(dev); + ++ /* ++ * Mask SMBus interrupts to block storms from broken ++ * firmware that leaves IC_SMBUS=1; the handler never ++ * services them. ++ */ ++ regmap_write(dev->map, DW_IC_SMBUS_INTR_MASK, 0); ++ + /* Write standard speed timing parameters */ + regmap_write(dev->map, DW_IC_SS_SCL_HCNT, dev->ss_hcnt); + regmap_write(dev->map, DW_IC_SS_SCL_LCNT, dev->ss_lcnt); +-- +2.51.0 + diff --git a/queue-6.6/iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch b/queue-6.6/iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch new file mode 100644 index 0000000000..67f0a6c9d1 --- /dev/null +++ b/queue-6.6/iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch @@ -0,0 +1,49 @@ +From 5e5dc8ea242627a3c7c16d5a0324ba9aeda7c01c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Oct 2025 17:12:50 +0800 +Subject: iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc + complains + +From: Pei Xiao + +[ Upstream commit c9fb952360d0c78bbe98239bd6b702f05c2dbb31 ] + +FIELD_PREP() checks that a value fits into the available bitfield, add a +check for step_avg to fix gcc complains. + +which gcc complains about: + drivers/iio/adc/ti_am335x_adc.c: In function 'tiadc_step_config': + include/linux/compiler_types.h:572:38: error: call to +'__compiletime_assert_491' declared with attribute error: FIELD_PREP: value +too large for the field include/linux/mfd/ti_am335x_tscadc.h:58:29: note: +in expansion of macro 'FIELD_PREP' + #define STEPCONFIG_AVG(val) FIELD_PREP(GENMASK(4, 2), (val)) + ^~~~~~~~~~ +drivers/iio/adc/ti_am335x_adc.c:127:17: note: in expansion of macro 'STEPCONFIG_AVG' + stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1) + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202510102117.Jqxrw1vF-lkp@intel.com/ +Signed-off-by: Pei Xiao +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ti_am335x_adc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c +index 32f1f91e2720..9e009b035eb5 100644 +--- a/drivers/iio/adc/ti_am335x_adc.c ++++ b/drivers/iio/adc/ti_am335x_adc.c +@@ -123,7 +123,7 @@ static void tiadc_step_config(struct iio_dev *indio_dev) + + chan = adc_dev->channel_line[i]; + +- if (adc_dev->step_avg[i]) ++ if (adc_dev->step_avg[i] && adc_dev->step_avg[i] <= STEPCONFIG_AVG_16) + stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1) | + STEPCONFIG_FIFO1; + else +-- +2.51.0 + diff --git a/queue-6.6/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch b/queue-6.6/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch new file mode 100644 index 0000000000..55b505569e --- /dev/null +++ b/queue-6.6/ipmi-fix-__scan_channels-failing-to-rescan-channels.patch @@ -0,0 +1,85 @@ +From 1708e4178c9777fb2655e50fd02d857c8abaa284 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:42:38 +0800 +Subject: ipmi: Fix __scan_channels() failing to rescan channels + +From: Jinhui Guo + +[ Upstream commit 6bd30d8fc523fb880b4be548e8501bc0fe8f42d4 ] + +channel_handler() sets intf->channels_ready to true but never +clears it, so __scan_channels() skips any rescan. When the BMC +firmware changes a rescan is required. Allow it by clearing +the flag before starting a new scan. + +Signed-off-by: Jinhui Guo +Message-ID: <20250930074239.2353-3-guojinhui.liam@bytedance.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_msghandler.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 4619ee5c744c..fc5f9d757b94 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -613,7 +613,8 @@ static void __ipmi_bmc_unregister(struct ipmi_smi *intf); + static int __ipmi_bmc_register(struct ipmi_smi *intf, + struct ipmi_device_id *id, + bool guid_set, guid_t *guid, int intf_num); +-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id); ++static int __scan_channels(struct ipmi_smi *intf, ++ struct ipmi_device_id *id, bool rescan); + + + /* +@@ -2665,7 +2666,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, + if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num)) + need_waiter(intf); /* Retry later on an error. */ + else +- __scan_channels(intf, &id); ++ __scan_channels(intf, &id, false); + + + if (!intf_set) { +@@ -2685,7 +2686,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc, + goto out_noprocessing; + } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id))) + /* Version info changes, scan the channels again. */ +- __scan_channels(intf, &bmc->fetch_id); ++ __scan_channels(intf, &bmc->fetch_id, true); + + bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY; + +@@ -3435,10 +3436,17 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) + /* + * Must be holding intf->bmc_reg_mutex to call this. + */ +-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id) ++static int __scan_channels(struct ipmi_smi *intf, ++ struct ipmi_device_id *id, ++ bool rescan) + { + int rv; + ++ if (rescan) { ++ /* Clear channels_ready to force channels rescan. */ ++ intf->channels_ready = false; ++ } ++ + if (ipmi_version_major(id) > 1 + || (ipmi_version_major(id) == 1 + && ipmi_version_minor(id) >= 5)) { +@@ -3641,7 +3649,7 @@ int ipmi_add_smi(struct module *owner, + } + + mutex_lock(&intf->bmc_reg_mutex); +- rv = __scan_channels(intf, &id); ++ rv = __scan_channels(intf, &id, false); + mutex_unlock(&intf->bmc_reg_mutex); + if (rv) + goto out_err_bmc_reg; +-- +2.51.0 + diff --git a/queue-6.6/ipmi-fix-the-race-between-__scan_channels-and-delive.patch b/queue-6.6/ipmi-fix-the-race-between-__scan_channels-and-delive.patch new file mode 100644 index 0000000000..47d40ab072 --- /dev/null +++ b/queue-6.6/ipmi-fix-the-race-between-__scan_channels-and-delive.patch @@ -0,0 +1,90 @@ +From 22b389391b969db583aa7703a478e0f703c382b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Sep 2025 15:42:37 +0800 +Subject: ipmi: Fix the race between __scan_channels() and deliver_response() + +From: Jinhui Guo + +[ Upstream commit 936750fdba4c45e13bbd17f261bb140dd55f5e93 ] + +The race window between __scan_channels() and deliver_response() causes +the parameters of some channels to be set to 0. + +1.[CPUA] __scan_channels() issues an IPMI request and waits with + wait_event() until all channels have been scanned. + wait_event() internally calls might_sleep(), which might + yield the CPU. (Moreover, an interrupt can preempt + wait_event() and force the task to yield the CPU.) +2.[CPUB] deliver_response() is invoked when the CPU receives the + IPMI response. After processing a IPMI response, + deliver_response() directly assigns intf->wchannels to + intf->channel_list and sets intf->channels_ready to true. + However, not all channels are actually ready for use. +3.[CPUA] Since intf->channels_ready is already true, wait_event() + never enters __wait_event(). __scan_channels() immediately + clears intf->null_user_handler and exits. +4.[CPUB] Once intf->null_user_handler is set to NULL, deliver_response() + ignores further IPMI responses, leaving the remaining + channels zero-initialized and unusable. + +CPUA CPUB +------------------------------- ----------------------------- +__scan_channels() + intf->null_user_handler + = channel_handler; + send_channel_info_cmd(intf, + 0); + wait_event(intf->waitq, + intf->channels_ready); + do { + might_sleep(); + deliver_response() + channel_handler() + intf->channel_list = + intf->wchannels + set; + intf->channels_ready = true; + send_channel_info_cmd(intf, + intf->curr_channel); + if (condition) + break; + __wait_event(wq_head, + condition); + } while(0) + intf->null_user_handler + = NULL; + deliver_response() + if (!msg->user) + if (intf->null_user_handler) + rv = -EINVAL; + return rv; +------------------------------- ----------------------------- + +Fix the race between __scan_channels() and deliver_response() by +deferring both the assignment intf->channel_list = intf->wchannels +and the flag intf->channels_ready = true until all channels have +been successfully scanned or until the IPMI request has failed. + +Signed-off-by: Jinhui Guo +Message-ID: <20250930074239.2353-2-guojinhui.liam@bytedance.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_msghandler.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index b7d8bf202ed2..4619ee5c744c 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -3414,8 +3414,6 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg) + intf->channels_ready = true; + wake_up(&intf->waitq); + } else { +- intf->channel_list = intf->wchannels + set; +- intf->channels_ready = true; + rv = send_channel_info_cmd(intf, intf->curr_channel); + } + +-- +2.51.0 + diff --git a/queue-6.6/libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch b/queue-6.6/libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch new file mode 100644 index 0000000000..3be94487f9 --- /dev/null +++ b/queue-6.6/libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch @@ -0,0 +1,47 @@ +From b7833dbbb8351b03383698e99bfcffd4bf14aa4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Dec 2025 13:47:01 -0800 +Subject: libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map + +From: Ian Rogers + +[ Upstream commit a0a4173631bfcfd3520192c0a61cf911d6a52c3a ] + +Passing an empty map to perf_cpu_map__max triggered a SEGV. Explicitly +test for the empty map. + +Reported-by: Ingo Molnar +Closes: https://lore.kernel.org/linux-perf-users/aSwt7yzFjVJCEmVp@gmail.com/ +Tested-by: Ingo Molnar +Signed-off-by: Ian Rogers +Tested-by: Thomas Richter +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/lib/perf/cpumap.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/perf/cpumap.c b/tools/lib/perf/cpumap.c +index 2a5a29217374..97f76d5457b9 100644 +--- a/tools/lib/perf/cpumap.c ++++ b/tools/lib/perf/cpumap.c +@@ -367,10 +367,12 @@ struct perf_cpu perf_cpu_map__max(const struct perf_cpu_map *map) + .cpu = -1 + }; + +- // cpu_map__trim_new() qsort()s it, cpu_map__default_new() sorts it as well. +- return __perf_cpu_map__nr(map) > 0 +- ? __perf_cpu_map__cpu(map, __perf_cpu_map__nr(map) - 1) +- : result; ++ if (!map) ++ return result; ++ ++ // The CPUs are always sorted and nr is always > 0 as 0 length map is ++ // encoded as NULL. ++ return __perf_cpu_map__cpu(map, __perf_cpu_map__nr(map) - 1); + } + + /** Is 'b' a subset of 'a'. */ +-- +2.51.0 + diff --git a/queue-6.6/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch b/queue-6.6/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch new file mode 100644 index 0000000000..1be44c5508 --- /dev/null +++ b/queue-6.6/nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch @@ -0,0 +1,64 @@ +From dbc55d9efb97fe5346430f7bb065cce5ff9f77fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Oct 2025 11:05:45 +0100 +Subject: nvme-fc: don't hold rport lock when putting ctrl + +From: Daniel Wagner + +[ Upstream commit b71cbcf7d170e51148d5467820ae8a72febcb651 ] + +nvme_fc_ctrl_put can acquire the rport lock when freeing the +ctrl object: + +nvme_fc_ctrl_put + nvme_fc_ctrl_free + spin_lock_irqsave(rport->lock) + +Thus we can't hold the rport lock when calling nvme_fc_ctrl_put. + +Justin suggested use the safe list iterator variant because +nvme_fc_ctrl_put will also modify the rport->list. + +Cc: Justin Tee +Reviewed-by: Christoph Hellwig +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 37fede155b92..2954f0a27474 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -1462,14 +1462,14 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport, + { + struct fcnvme_ls_disconnect_assoc_rqst *rqst = + &lsop->rqstbuf->rq_dis_assoc; +- struct nvme_fc_ctrl *ctrl, *ret = NULL; ++ struct nvme_fc_ctrl *ctrl, *tmp, *ret = NULL; + struct nvmefc_ls_rcv_op *oldls = NULL; + u64 association_id = be64_to_cpu(rqst->associd.association_id); + unsigned long flags; + + spin_lock_irqsave(&rport->lock, flags); + +- list_for_each_entry(ctrl, &rport->ctrl_list, ctrl_list) { ++ list_for_each_entry_safe(ctrl, tmp, &rport->ctrl_list, ctrl_list) { + if (!nvme_fc_ctrl_get(ctrl)) + continue; + spin_lock(&ctrl->lock); +@@ -1482,7 +1482,9 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport, + if (ret) + /* leave the ctrl get reference */ + break; ++ spin_unlock_irqrestore(&rport->lock, flags); + nvme_fc_ctrl_put(ctrl); ++ spin_lock_irqsave(&rport->lock, flags); + } + + spin_unlock_irqrestore(&rport->lock, flags); +-- +2.51.0 + diff --git a/queue-6.6/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch b/queue-6.6/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch new file mode 100644 index 0000000000..75cf7da05e --- /dev/null +++ b/queue-6.6/platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch @@ -0,0 +1,56 @@ +From 68e292e2eab20f03c39bd3bcfab4a85abbb9a776 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Nov 2025 15:04:07 +0800 +Subject: platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI + quirks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chia-Lin Kao (AceLan) + +[ Upstream commit b169e1733cadb614e87f69d7a5ae1b186c50d313 ] + +Dell Pro Rugged 10/12 tablets has a reliable VGBS method. +If VGBS is not called on boot, the on-screen keyboard won't appear if the +device is booted without a keyboard. + +Call VGBS on boot on thess devices to get the initial state of +SW_TABLET_MODE in a reliable way. + +Signed-off-by: Chia-Lin Kao (AceLan) +Reviewed-by: Hans de Goede +Link: https://patch.msgid.link/20251127070407.656463-1-acelan.kao@canonical.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/hid.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c +index 36209997ba98..ac88119a73b8 100644 +--- a/drivers/platform/x86/intel/hid.c ++++ b/drivers/platform/x86/intel/hid.c +@@ -163,6 +163,18 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite Dragonfly G2 Notebook PC"), + }, + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 10 Tablet RA00260"), ++ }, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 12 Tablet RA02260"), ++ }, ++ }, + { } + }; + +-- +2.51.0 + diff --git a/queue-6.6/powerpc-addnote-fix-overflow-on-32-bit-builds.patch b/queue-6.6/powerpc-addnote-fix-overflow-on-32-bit-builds.patch new file mode 100644 index 0000000000..d9155e3753 --- /dev/null +++ b/queue-6.6/powerpc-addnote-fix-overflow-on-32-bit-builds.patch @@ -0,0 +1,50 @@ +From a41cf5e4f90cab5f1f523d260e90695327b3e96d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Apr 2025 22:31:13 -0400 +Subject: powerpc/addnote: Fix overflow on 32-bit builds + +From: Ben Collins + +[ Upstream commit 825ce89a3ef17f84cf2c0eacfa6b8dc9fd11d13f ] + +The PUT_64[LB]E() macros need to cast the value to unsigned long long +like the GET_64[LB]E() macros. Caused lots of warnings when compiled +on 32-bit, and clobbered addresses (36-bit P4080). + +Signed-off-by: Ben Collins +Reviewed-by: Christophe Leroy +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/2025042122-mustard-wrasse-694572@boujee-and-buff +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/addnote.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/boot/addnote.c b/arch/powerpc/boot/addnote.c +index 53b3b2621457..78704927453a 100644 +--- a/arch/powerpc/boot/addnote.c ++++ b/arch/powerpc/boot/addnote.c +@@ -68,8 +68,8 @@ static int e_class = ELFCLASS32; + #define PUT_16BE(off, v)(buf[off] = ((v) >> 8) & 0xff, \ + buf[(off) + 1] = (v) & 0xff) + #define PUT_32BE(off, v)(PUT_16BE((off), (v) >> 16L), PUT_16BE((off) + 2, (v))) +-#define PUT_64BE(off, v)((PUT_32BE((off), (v) >> 32L), \ +- PUT_32BE((off) + 4, (v)))) ++#define PUT_64BE(off, v)((PUT_32BE((off), (unsigned long long)(v) >> 32L), \ ++ PUT_32BE((off) + 4, (unsigned long long)(v)))) + + #define GET_16LE(off) ((buf[off]) + (buf[(off)+1] << 8)) + #define GET_32LE(off) (GET_16LE(off) + (GET_16LE((off)+2U) << 16U)) +@@ -78,7 +78,8 @@ static int e_class = ELFCLASS32; + #define PUT_16LE(off, v) (buf[off] = (v) & 0xff, \ + buf[(off) + 1] = ((v) >> 8) & 0xff) + #define PUT_32LE(off, v) (PUT_16LE((off), (v)), PUT_16LE((off) + 2, (v) >> 16L)) +-#define PUT_64LE(off, v) (PUT_32LE((off), (v)), PUT_32LE((off) + 4, (v) >> 32L)) ++#define PUT_64LE(off, v) (PUT_32LE((off), (unsigned long long)(v)), \ ++ PUT_32LE((off) + 4, (unsigned long long)(v) >> 32L)) + + #define GET_16(off) (e_data == ELFDATA2MSB ? GET_16BE(off) : GET_16LE(off)) + #define GET_32(off) (e_data == ELFDATA2MSB ? GET_32BE(off) : GET_32LE(off)) +-- +2.51.0 + diff --git a/queue-6.6/reset-fix-bit-macro-reference.patch b/queue-6.6/reset-fix-bit-macro-reference.patch new file mode 100644 index 0000000000..aa6d1f2b4f --- /dev/null +++ b/queue-6.6/reset-fix-bit-macro-reference.patch @@ -0,0 +1,40 @@ +From 25f485e8747d4ed0ec51de91f3b8a1f43d24f59f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 14:10:37 +0800 +Subject: reset: fix BIT macro reference + +From: Encrow Thorne + +[ Upstream commit f3d8b64ee46c9b4b0b82b1a4642027728bac95b8 ] + +RESET_CONTROL_FLAGS_BIT_* macros use BIT(), but reset.h does not +include bits.h. This causes compilation errors when including +reset.h standalone. + +Include bits.h to make reset.h self-contained. + +Suggested-by: Troy Mitchell +Reviewed-by: Troy Mitchell +Reviewed-by: Philipp Zabel +Signed-off-by: Encrow Thorne +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + include/linux/reset.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/reset.h b/include/linux/reset.h +index 514ddf003efc..4b31d683776e 100644 +--- a/include/linux/reset.h ++++ b/include/linux/reset.h +@@ -2,6 +2,7 @@ + #ifndef _LINUX_RESET_H_ + #define _LINUX_RESET_H_ + ++#include + #include + #include + #include +-- +2.51.0 + diff --git a/queue-6.6/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch b/queue-6.6/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch new file mode 100644 index 0000000000..c65ed76479 --- /dev/null +++ b/queue-6.6/scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch @@ -0,0 +1,45 @@ +From c7368cf4f01d64a71152e63b13fe715ea74feb3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:48:45 -0500 +Subject: scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive + +From: Tony Battersby + +[ Upstream commit 8f58fc64d559b5fda1b0a5e2a71422be61e79ab9 ] + +When given the module parameter qlini_mode=exclusive, qla2xxx in +initiator mode is initially unable to successfully send SCSI commands to +devices it finds while scanning, resulting in an escalating series of +resets until an adapter reset clears the issue. Fix by checking the +active mode instead of the module parameter. + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/1715ec14-ba9a-45dc-9cf2-d41aa6b81b5e@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_os.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 0a3a5af67f0a..4c7cf581bc86 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3459,13 +3459,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + ha->mqenable = 0; + + if (ha->mqenable) { +- bool startit = false; +- +- if (QLA_TGT_MODE_ENABLED()) +- startit = false; +- +- if (ql2x_ini_mode == QLA2XXX_INI_MODE_ENABLED) +- startit = true; ++ bool startit = !!(host->active_mode & MODE_INITIATOR); + + /* Create start of day qpairs for Block MQ */ + for (i = 0; i < ha->max_qpairs; i++) +-- +2.51.0 + diff --git a/queue-6.6/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch b/queue-6.6/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch new file mode 100644 index 0000000000..a88e473484 --- /dev/null +++ b/queue-6.6/scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch @@ -0,0 +1,193 @@ +From 8b535bc7d9c6f90d364195cb40d37ac3613da71a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:50:05 -0500 +Subject: scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled + +From: Tony Battersby + +[ Upstream commit 4f6aaade2a22ac428fa99ed716cf2b87e79c9837 ] + +When qla2xxx is loaded with qlini_mode=disabled, +ha->flags.disable_msix_handshake is used before it is set, resulting in +the wrong interrupt handler being used on certain HBAs +(qla2xxx_msix_rsp_q_hs() is used when qla2xxx_msix_rsp_q() should be +used). The only difference between these two interrupt handlers is that +the _hs() version writes to a register to clear the "RISC" interrupt, +whereas the other version does not. So this bug results in the RISC +interrupt being cleared when it should not be. This occasionally causes +a different interrupt handler qla24xx_msix_default() for a different +vector to see ((stat & HSRX_RISC_INT) == 0) and ignore its interrupt, +which then causes problems like: + +qla2xxx [0000:02:00.0]-d04c:6: MBX Command timeout for cmd 20, + iocontrol=8 jiffies=1090c0300 mb[0-3]=[0x4000 0x0 0x40 0xda] mb7 0x500 + host_status 0x40000010 hccr 0x3f00 +qla2xxx [0000:02:00.0]-101e:6: Mailbox cmd timeout occurred, cmd=0x20, + mb[0]=0x20. Scheduling ISP abort +(the cmd varies; sometimes it is 0x20, 0x22, 0x54, 0x5a, 0x5d, or 0x6a) + +This problem can be reproduced with a 16 or 32 Gbps HBA by loading +qla2xxx with qlini_mode=disabled and running a high IOPS test while +triggering frequent RSCN database change events. + +While analyzing the problem I discovered that even with +disable_msix_handshake forced to 0, it is not necessary to clear the +RISC interrupt from qla2xxx_msix_rsp_q_hs() (more below). So just +completely remove qla2xxx_msix_rsp_q_hs() and the logic for selecting +it, which also fixes the bug with qlini_mode=disabled. + +The test below describes the justification for not needing +qla2xxx_msix_rsp_q_hs(): + +Force disable_msix_handshake to 0: +qla24xx_config_rings(): +if (0 && (ha->fw_attributes & BIT_6) && (IS_MSIX_NACK_CAPABLE(ha)) && + (ha->flags.msix_enabled)) { + +In qla24xx_msix_rsp_q() and qla2xxx_msix_rsp_q_hs(), check: + (rd_reg_dword(®->host_status) & HSRX_RISC_INT) + +Count the number of calls to each function with HSRX_RISC_INT set and +the number with HSRX_RISC_INT not set while performing some I/O. + +If qla2xxx_msix_rsp_q_hs() clears the RISC interrupt (original code): +qla24xx_msix_rsp_q: 50% of calls have HSRX_RISC_INT set +qla2xxx_msix_rsp_q_hs: 5% of calls have HSRX_RISC_INT set +(# of qla2xxx_msix_rsp_q_hs interrupts) = + (# of qla24xx_msix_rsp_q interrupts) * 3 + +If qla2xxx_msix_rsp_q_hs() does not clear the RISC interrupt (patched +code): +qla24xx_msix_rsp_q: 100% of calls have HSRX_RISC_INT set +qla2xxx_msix_rsp_q_hs: 9% of calls have HSRX_RISC_INT set +(# of qla2xxx_msix_rsp_q_hs interrupts) = + (# of qla24xx_msix_rsp_q interrupts) * 3 + +In the case of the original code, qla24xx_msix_rsp_q() was seeing +HSRX_RISC_INT set only 50% of the time because qla2xxx_msix_rsp_q_hs() +was clearing it when it shouldn't have been. In the patched code, +qla24xx_msix_rsp_q() sees HSRX_RISC_INT set 100% of the time, which +makes sense if that interrupt handler needs to clear the RISC interrupt +(which it does). qla2xxx_msix_rsp_q_hs() sees HSRX_RISC_INT only 9% of +the time, which is just overlap from the other interrupt during the +high IOPS test. + +Tested with SCST on: +QLE2742 FW:v9.08.02 (32 Gbps 2-port) +QLE2694L FW:v9.10.11 (16 Gbps 4-port) +QLE2694L FW:v9.08.02 (16 Gbps 4-port) +QLE2672 FW:v8.07.12 (16 Gbps 2-port) +both initiator and target mode + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/56d378eb-14ad-49c7-bae9-c649b6c7691e@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_def.h | 1 - + drivers/scsi/qla2xxx/qla_gbl.h | 2 +- + drivers/scsi/qla2xxx/qla_isr.c | 32 +++----------------------------- + drivers/scsi/qla2xxx/qla_mid.c | 4 +--- + 4 files changed, 5 insertions(+), 34 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index 78a10d4979e9..4f7248643335 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -3504,7 +3504,6 @@ struct isp_operations { + #define QLA_MSIX_RSP_Q 0x01 + #define QLA_ATIO_VECTOR 0x02 + #define QLA_MSIX_QPAIR_MULTIQ_RSP_Q 0x03 +-#define QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS 0x04 + + #define QLA_MIDX_DEFAULT 0 + #define QLA_MIDX_RSP_Q 1 +diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h +index e556f57c91af..59f448e2e319 100644 +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -768,7 +768,7 @@ extern int qla2x00_dfs_remove(scsi_qla_host_t *); + + /* Globa function prototypes for multi-q */ + extern int qla25xx_request_irq(struct qla_hw_data *, struct qla_qpair *, +- struct qla_msix_entry *, int); ++ struct qla_msix_entry *); + extern int qla25xx_init_req_que(struct scsi_qla_host *, struct req_que *); + extern int qla25xx_init_rsp_que(struct scsi_qla_host *, struct rsp_que *); + extern int qla25xx_create_req_que(struct qla_hw_data *, uint16_t, uint8_t, +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index d48007e18288..a85d3a40ee49 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -4473,32 +4473,6 @@ qla2xxx_msix_rsp_q(int irq, void *dev_id) + return IRQ_HANDLED; + } + +-irqreturn_t +-qla2xxx_msix_rsp_q_hs(int irq, void *dev_id) +-{ +- struct qla_hw_data *ha; +- struct qla_qpair *qpair; +- struct device_reg_24xx __iomem *reg; +- unsigned long flags; +- +- qpair = dev_id; +- if (!qpair) { +- ql_log(ql_log_info, NULL, 0x505b, +- "%s: NULL response queue pointer.\n", __func__); +- return IRQ_NONE; +- } +- ha = qpair->hw; +- +- reg = &ha->iobase->isp24; +- spin_lock_irqsave(&ha->hardware_lock, flags); +- wrt_reg_dword(®->hccr, HCCRX_CLR_RISC_INT); +- spin_unlock_irqrestore(&ha->hardware_lock, flags); +- +- queue_work(ha->wq, &qpair->q_work); +- +- return IRQ_HANDLED; +-} +- + /* Interrupt handling helpers. */ + + struct qla_init_msix_entry { +@@ -4511,7 +4485,6 @@ static const struct qla_init_msix_entry msix_entries[] = { + { "rsp_q", qla24xx_msix_rsp_q }, + { "atio_q", qla83xx_msix_atio_q }, + { "qpair_multiq", qla2xxx_msix_rsp_q }, +- { "qpair_multiq_hs", qla2xxx_msix_rsp_q_hs }, + }; + + static const struct qla_init_msix_entry qla82xx_msix_entries[] = { +@@ -4798,9 +4771,10 @@ qla2x00_free_irqs(scsi_qla_host_t *vha) + } + + int qla25xx_request_irq(struct qla_hw_data *ha, struct qla_qpair *qpair, +- struct qla_msix_entry *msix, int vector_type) ++ struct qla_msix_entry *msix) + { +- const struct qla_init_msix_entry *intr = &msix_entries[vector_type]; ++ const struct qla_init_msix_entry *intr = ++ &msix_entries[QLA_MSIX_QPAIR_MULTIQ_RSP_Q]; + scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev); + int ret; + +diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c +index 79879c4743e6..9946899dd83b 100644 +--- a/drivers/scsi/qla2xxx/qla_mid.c ++++ b/drivers/scsi/qla2xxx/qla_mid.c +@@ -899,9 +899,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options, + rsp->options, rsp->id, rsp->rsp_q_in, + rsp->rsp_q_out); + +- ret = qla25xx_request_irq(ha, qpair, qpair->msix, +- ha->flags.disable_msix_handshake ? +- QLA_MSIX_QPAIR_MULTIQ_RSP_Q : QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS); ++ ret = qla25xx_request_irq(ha, qpair, qpair->msix); + if (ret) + goto que_failed; + +-- +2.51.0 + diff --git a/queue-6.6/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch b/queue-6.6/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch new file mode 100644 index 0000000000..c4853407ea --- /dev/null +++ b/queue-6.6/scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch @@ -0,0 +1,45 @@ +From a0d2e982f0ac92771513eeed6272dd422fc2b6f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Nov 2025 10:51:28 -0500 +Subject: scsi: qla2xxx: Use reinit_completion on mbx_intr_comp + +From: Tony Battersby + +[ Upstream commit 957aa5974989fba4ae4f807ebcb27f12796edd4d ] + +If a mailbox command completes immediately after +wait_for_completion_timeout() times out, ha->mbx_intr_comp could be left +in an inconsistent state, causing the next mailbox command not to wait +for the hardware. Fix by reinitializing the completion before use. + +Signed-off-by: Tony Battersby +Link: https://patch.msgid.link/11b6485e-0bfd-4784-8f99-c06a196dad94@cybernetics.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_mbx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 13b6cb1b93ac..41435e98092a 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -253,6 +253,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + /* Issue set host interrupt command to send cmd out. */ + ha->flags.mbox_int = 0; + clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags); ++ reinit_completion(&ha->mbx_intr_comp); + + /* Unlock mbx registers and wait for interrupt */ + ql_dbg(ql_dbg_mbx, vha, 0x100f, +@@ -279,6 +280,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + "cmd=%x Timeout.\n", command); + spin_lock_irqsave(&ha->hardware_lock, flags); + clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags); ++ reinit_completion(&ha->mbx_intr_comp); + spin_unlock_irqrestore(&ha->hardware_lock, flags); + + if (chip_reset != ha->chip_reset) { +-- +2.51.0 + diff --git a/queue-6.6/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch b/queue-6.6/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch new file mode 100644 index 0000000000..2978035cbf --- /dev/null +++ b/queue-6.6/serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch @@ -0,0 +1,63 @@ +From 1f41874874cf23ccd22157098f14d93a5ebcdb42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Oct 2025 11:08:40 +0800 +Subject: serial: sprd: Return -EPROBE_DEFER when uart clock is not ready + +From: Wenhua Lin + +[ Upstream commit 29e8a0c587e328ed458380a45d6028adf64d7487 ] + +In sprd_clk_init(), when devm_clk_get() returns -EPROBE_DEFER +for either uart or source clock, we should propagate the +error instead of just warning and continuing with NULL clocks. + +Currently the driver only emits a warning when clock acquisition +fails and proceeds with NULL clock pointers. This can lead to +issues later when the clocks are actually needed. More importantly, +when the clock provider is not ready yet and returns -EPROBE_DEFER, +we should return this error to allow deferred probing. + +This change adds explicit checks for -EPROBE_DEFER after both: +1. devm_clk_get(uport->dev, uart) +2. devm_clk_get(uport->dev, source) + +When -EPROBE_DEFER is encountered, the function now returns +-EPROBE_DEFER to let the driver framework retry probing +later when the clock dependencies are resolved. + +Signed-off-by: Wenhua Lin +Link: https://patch.msgid.link/20251022030840.956589-1-Wenhua.Lin@unisoc.com +Reviewed-by: Cixi Geng +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sprd_serial.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c +index f328fa57231f..c6d2258d719b 100644 +--- a/drivers/tty/serial/sprd_serial.c ++++ b/drivers/tty/serial/sprd_serial.c +@@ -1111,6 +1111,9 @@ static int sprd_clk_init(struct uart_port *uport) + + clk_uart = devm_clk_get(uport->dev, "uart"); + if (IS_ERR(clk_uart)) { ++ if (PTR_ERR(clk_uart) == -EPROBE_DEFER) ++ return -EPROBE_DEFER; ++ + dev_warn(uport->dev, "uart%d can't get uart clock\n", + uport->line); + clk_uart = NULL; +@@ -1118,6 +1121,9 @@ static int sprd_clk_init(struct uart_port *uport) + + clk_parent = devm_clk_get(uport->dev, "source"); + if (IS_ERR(clk_parent)) { ++ if (PTR_ERR(clk_parent) == -EPROBE_DEFER) ++ return -EPROBE_DEFER; ++ + dev_warn(uport->dev, "uart%d can't get source clock\n", + uport->line); + clk_parent = NULL; +-- +2.51.0 + diff --git a/queue-6.6/series b/queue-6.6/series index f1c7c5a110..3927ec8361 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -379,3 +379,30 @@ spi-fsl-cpm-check-length-parity-before-switching-to-16-bit-mode.patch mmc-sdhci-esdhc-imx-add-alternate-arch_s32-dependency-to-kconfig.patch dt-bindings-mmc-sdhci-of-aspeed-switch-ref-to-sdhci-common.yaml.patch net-hsr-fix-null-pointer-dereference-in-prp_get_untagged_frame.patch +alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch +alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch +alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch +ipmi-fix-the-race-between-__scan_channels-and-delive.patch +ipmi-fix-__scan_channels-failing-to-rescan-channels.patch +firmware-imx-scu-irq-init-workqueue-before-request-m.patch +ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch +clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch +powerpc-addnote-fix-overflow-on-32-bit-builds.patch +scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch +scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch +scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch +fuse-always-flush-the-page-cache-before-fopen_direct.patch +fuse-invalidate-the-page-cache-after-fopen_direct_io.patch +via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch +reset-fix-bit-macro-reference.patch +exfat-fix-remount-failure-in-different-process-envir.patch +usbip-fix-locking-bug-in-rt-enabled-kernels.patch +usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch +iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch +usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch +usb-usb-storage-no-additional-quirks-need-to-be-adde.patch +serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch +libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch +i2c-designware-disable-smbus-interrupts-to-prevent-s.patch +nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch +platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch diff --git a/queue-6.6/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch b/queue-6.6/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch new file mode 100644 index 0000000000..917845b908 --- /dev/null +++ b/queue-6.6/ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch @@ -0,0 +1,64 @@ +From 5b7c02d1d6923c79ac36b5adcfc8f3e5daba4cfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Aug 2025 15:11:13 +0200 +Subject: ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx + +From: Matthias Schiffer + +[ Upstream commit 3f61783920504b2cf99330b372d82914bb004d8e ] + +am33xx.dtsi has the same clock setup as am35xx.dtsi, setting +ti,no-reset-on-init and ti,no-idle on timer1_target and timer2_target, +so AM33 needs the same workaround as AM35 to avoid ti-sysc probe +failing on certain target modules. + +Signed-off-by: Matthias Schiffer +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20250825131114.2206804-1-alexander.stein@ew.tq-group.com +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 46d7410f6f0f..b6a7d0d3f153 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -37,6 +37,7 @@ enum sysc_soc { + SOC_UNKNOWN, + SOC_2420, + SOC_2430, ++ SOC_AM33, + SOC_3430, + SOC_AM35, + SOC_3630, +@@ -2996,6 +2997,7 @@ static void ti_sysc_idle(struct work_struct *work) + static const struct soc_device_attribute sysc_soc_match[] = { + SOC_FLAG("OMAP242*", SOC_2420), + SOC_FLAG("OMAP243*", SOC_2430), ++ SOC_FLAG("AM33*", SOC_AM33), + SOC_FLAG("AM35*", SOC_AM35), + SOC_FLAG("OMAP3[45]*", SOC_3430), + SOC_FLAG("OMAP3[67]*", SOC_3630), +@@ -3201,10 +3203,15 @@ static int sysc_check_active_timer(struct sysc *ddata) + * can be dropped if we stop supporting old beagleboard revisions + * A to B4 at some point. + */ +- if (sysc_soc->soc == SOC_3430 || sysc_soc->soc == SOC_AM35) ++ switch (sysc_soc->soc) { ++ case SOC_AM33: ++ case SOC_3430: ++ case SOC_AM35: + error = -ENXIO; +- else ++ break; ++ default: + error = -EBUSY; ++ } + + if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) && + (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE)) +-- +2.51.0 + diff --git a/queue-6.6/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch b/queue-6.6/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch new file mode 100644 index 0000000000..1c9a5044ed --- /dev/null +++ b/queue-6.6/usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch @@ -0,0 +1,49 @@ +From 0bc3e000e9086753562b53e3ac44b9794b049ff3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Aug 2025 14:53:07 -0400 +Subject: usb: typec: ucsi: Handle incorrect num_connectors capability + +From: Mark Pearson + +[ Upstream commit 30cd2cb1abf4c4acdb1ddb468c946f68939819fb ] + +The UCSI spec states that the num_connectors field is 7 bits, and the +8th bit is reserved and should be set to zero. +Some buggy FW has been known to set this bit, and it can lead to a +system not booting. +Flag that the FW is not behaving correctly, and auto-fix the value +so that the system boots correctly. + +Found on Lenovo P1 G8 during Linux enablement program. The FW will +be fixed, but seemed worth addressing in case it hit platforms that +aren't officially Linux supported. + +Signed-off-by: Mark Pearson +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250821185319.2585023-1-mpearson-lenovo@squebb.ca +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index e5c001ee0cd7..b88f4e179a7a 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1428,6 +1428,12 @@ static int ucsi_init(struct ucsi *ucsi) + ret = -ENODEV; + goto err_reset; + } ++ /* Check if reserved bit set. This is out of spec but happens in buggy FW */ ++ if (ucsi->cap.num_connectors & 0x80) { ++ dev_warn(ucsi->dev, "UCSI: Invalid num_connectors %d. Likely buggy FW\n", ++ ucsi->cap.num_connectors); ++ ucsi->cap.num_connectors &= 0x7f; // clear bit and carry on ++ } + + /* Allocate the connectors. Released in ucsi_unregister() */ + connector = kcalloc(ucsi->cap.num_connectors + 1, sizeof(*connector), GFP_KERNEL); +-- +2.51.0 + diff --git a/queue-6.6/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch b/queue-6.6/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch new file mode 100644 index 0000000000..d9f02b7ab5 --- /dev/null +++ b/queue-6.6/usb-usb-storage-no-additional-quirks-need-to-be-adde.patch @@ -0,0 +1,65 @@ +From 68ea06da4ab0386ab681e6ee9acfd5dbffde32a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Nov 2025 14:40:20 +0800 +Subject: usb: usb-storage: No additional quirks need to be added to the EL-R12 + optical drive. + +From: Chen Changcheng + +[ Upstream commit 955a48a5353f4fe009704a9a4272a3adf627cd35 ] + +The optical drive of EL-R12 has the same vid and pid as INIC-3069, +as follows: +T: Bus=02 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0 +D: Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=13fd ProdID=3940 Rev= 3.10 +S: Manufacturer=HL-DT-ST +S: Product= DVD+-RW GT80N +S: SerialNumber=423349524E4E38303338323439202020 +C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=144mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=02 Prot=50 Driver=usb-storage +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=0a(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +This will result in the optical drive device also adding +the quirks of US_FL_NO_ATA_1X. When performing an erase operation, +it will fail, and the reason for the failure is as follows: +[ 388.967742] sr 5:0:0:0: [sr0] tag#0 Send: scmd 0x00000000d20c33a7 +[ 388.967742] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00 +[ 388.967773] sr 5:0:0:0: [sr0] tag#0 Done: SUCCESS Result: hostbyte=DID_TARGET_FAILURE driverbyte=DRIVER_OK cmd_age=0s +[ 388.967773] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00 +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Sense Key : Illegal Request [current] +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Add. Sense: Invalid field in cdb +[ 388.967803] sr 5:0:0:0: [sr0] tag#0 scsi host busy 1 failed 0 +[ 388.967803] sr 5:0:0:0: Notifying upper driver of completion (result 8100002) +[ 388.967834] sr 5:0:0:0: [sr0] tag#0 0 sectors total, 0 bytes done. + +For the EL-R12 standard optical drive, all operational commands +and usage scenarios were tested without adding the IGNORE_RESIDUE quirks, +and no issues were encountered. It can be reasonably concluded +that removing the IGNORE_RESIDUE quirks has no impact. + +Signed-off-by: Chen Changcheng +Link: https://patch.msgid.link/20251121064020.29332-1-chenchangcheng@kylinos.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/storage/unusual_uas.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index 1477e31d7763..b695f5ba9a40 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -98,7 +98,7 @@ UNUSUAL_DEV(0x125f, 0xa94a, 0x0160, 0x0160, + US_FL_NO_ATA_1X), + + /* Reported-by: Benjamin Tissoires */ +-UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, ++UNUSUAL_DEV(0x13fd, 0x3940, 0x0309, 0x0309, + "Initio Corporation", + "INIC-3069", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, +-- +2.51.0 + diff --git a/queue-6.6/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch b/queue-6.6/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch new file mode 100644 index 0000000000..e86e5459de --- /dev/null +++ b/queue-6.6/usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch @@ -0,0 +1,82 @@ +From fe368d1c05fe1b610105d55e6db027f425f71e52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Nov 2025 16:23:55 +0200 +Subject: usb: xhci: limit run_graceperiod for only usb 3.0 devices + +From: Hongyu Xie + +[ Upstream commit 8d34983720155b8f05de765f0183d9b0e1345cc0 ] + +run_graceperiod blocks usb 2.0 devices from auto suspending after +xhci_start for 500ms. + +Log shows: +[ 13.387170] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.387177] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.387182] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.387188] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.387191] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.387193] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.387296] hub_event:5779: hub 3-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.393343] handle_port_status:2034: xhci-hcd PNP0D10:02: handle_port_status: starting usb5 port polling. +[ 13.393353] xhci_hub_control:1271: xhci-hcd PNP0D10:02: Get port status 5-1 read: 0x206e1, return 0x10101 +[ 13.400047] hub_suspend:3903: hub 3-0:1.0: hub_suspend +[ 13.403077] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.403080] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.403085] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.403087] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.403090] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.403093] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.403095] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.405002] handle_port_status:1913: xhci-hcd PNP0D10:04: Port change event, 9-1, id 1, portsc: 0x6e1 +[ 13.405016] hub_activate:1169: usb usb5-port1: status 0101 change 0001 +[ 13.405026] xhci_clear_port_change_bit:658: xhci-hcd PNP0D10:02: clear port1 connect change, portsc: 0x6e1 +[ 13.413275] hcd_bus_suspend:2250: usb usb3: bus auto-suspend, wakeup 1 +[ 13.419081] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.419086] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.419095] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.419100] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.419106] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.419110] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event +[ 13.419112] hcd_bus_resume:2303: usb usb7: usb auto-resume +[ 13.420455] handle_port_status:2034: xhci-hcd PNP0D10:04: handle_port_status: starting usb9 port polling. +[ 13.420493] handle_port_status:1913: xhci-hcd PNP0D10:05: Port change event, 10-1, id 1, portsc: 0x6e1 +[ 13.425332] hcd_bus_suspend:2279: usb usb3: suspend raced with wakeup event +[ 13.431931] handle_port_status:2034: xhci-hcd PNP0D10:05: handle_port_status: starting usb10 port polling. +[ 13.435080] hub_resume:3948: hub 7-0:1.0: hub_resume +[ 13.435084] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100 +[ 13.435092] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000 +[ 13.435096] hub_suspend:3903: hub 7-0:1.0: hub_suspend +[ 13.435102] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1 +[ 13.435106] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event + +usb7 and other usb 2.0 root hub were rapidly toggling between suspend +and resume states. More, "suspend raced with wakeup event" confuses people. + +So, limit run_graceperiod for only usb 3.0 devices + +Signed-off-by: Hongyu Xie +Signed-off-by: Mathias Nyman +Link: https://patch.msgid.link/20251119142417.2820519-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-hub.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index d3d535ed00b5..61642c8d529f 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1669,7 +1669,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf) + * SS devices are only visible to roothub after link training completes. + * Keep polling roothubs for a grace period after xHC start + */ +- if (xhci->run_graceperiod) { ++ if (hcd->speed >= HCD_USB3 && xhci->run_graceperiod) { + if (time_before(jiffies, xhci->run_graceperiod)) + status = 1; + else +-- +2.51.0 + diff --git a/queue-6.6/usbip-fix-locking-bug-in-rt-enabled-kernels.patch b/queue-6.6/usbip-fix-locking-bug-in-rt-enabled-kernels.patch new file mode 100644 index 0000000000..dd844560bf --- /dev/null +++ b/queue-6.6/usbip-fix-locking-bug-in-rt-enabled-kernels.patch @@ -0,0 +1,64 @@ +From eb9c1d5d70093ac4467fd85e507101a8fb01e234 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Sep 2025 09:41:43 +0800 +Subject: usbip: Fix locking bug in RT-enabled kernels + +From: Lizhi Xu + +[ Upstream commit 09bf21bf5249880f62fe759b53b14b4b52900c6c ] + +Interrupts are disabled before entering usb_hcd_giveback_urb(). +A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be +acquired with disabled interrupts. + +Save the interrupt status and restore it after usb_hcd_giveback_urb(). + +syz reported: +BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 +Call Trace: + dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 + rt_spin_lock+0xc7/0x2c0 kernel/locking/spinlock_rt.c:57 + spin_lock include/linux/spinlock_rt.h:44 [inline] + mon_bus_complete drivers/usb/mon/mon_main.c:134 [inline] + mon_complete+0x5c/0x200 drivers/usb/mon/mon_main.c:147 + usbmon_urb_complete include/linux/usb/hcd.h:738 [inline] + __usb_hcd_giveback_urb+0x254/0x5e0 drivers/usb/core/hcd.c:1647 + vhci_urb_enqueue+0xb4f/0xe70 drivers/usb/usbip/vhci_hcd.c:818 + +Reported-by: syzbot+205ef33a3b636b4181fb@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=205ef33a3b636b4181fb +Signed-off-by: Lizhi Xu +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20250916014143.1439759-1-lizhi.xu@windriver.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/vhci_hcd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index b22e0881bfaf..0bc4805cfa3e 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -830,15 +830,15 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag + no_need_xmit: + usb_hcd_unlink_urb_from_ep(hcd, urb); + no_need_unlink: +- spin_unlock_irqrestore(&vhci->lock, flags); + if (!ret) { + /* usb_hcd_giveback_urb() should be called with + * irqs disabled + */ +- local_irq_disable(); ++ spin_unlock(&vhci->lock); + usb_hcd_giveback_urb(hcd, urb, urb->status); +- local_irq_enable(); ++ spin_lock(&vhci->lock); + } ++ spin_unlock_irqrestore(&vhci->lock, flags); + return ret; + } + +-- +2.51.0 + diff --git a/queue-6.6/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch b/queue-6.6/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch new file mode 100644 index 0000000000..301d23b8d0 --- /dev/null +++ b/queue-6.6/via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch @@ -0,0 +1,43 @@ +From 878a2ac28d544f6aca2aca19f16b34ccd6d0ef9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Sep 2025 16:33:32 +0800 +Subject: via_wdt: fix critical boot hang due to unnamed resource allocation + +From: Li Qiang + +[ Upstream commit 7aa31ee9ec92915926e74731378c009c9cc04928 ] + +The VIA watchdog driver uses allocate_resource() to reserve a MMIO +region for the watchdog control register. However, the allocated +resource was not given a name, which causes the kernel resource tree +to contain an entry marked as "" under /proc/iomem on x86 +platforms. + +During boot, this unnamed resource can lead to a critical hang because +subsequent resource lookups and conflict checks fail to handle the +invalid entry properly. + +Signed-off-by: Li Qiang +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/via_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/via_wdt.c b/drivers/watchdog/via_wdt.c +index eeb39f96e72e..c1ed3ce153cf 100644 +--- a/drivers/watchdog/via_wdt.c ++++ b/drivers/watchdog/via_wdt.c +@@ -165,6 +165,7 @@ static int wdt_probe(struct pci_dev *pdev, + dev_err(&pdev->dev, "cannot enable PCI device\n"); + return -ENODEV; + } ++ wdt_res.name = "via_wdt"; + + /* + * Allocate a MMIO region which contains watchdog control register +-- +2.51.0 +