From: Greg Kroah-Hartman Date: Tue, 3 Feb 2026 12:53:54 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v5.10.249~43 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5bc5d6753bbdfee2b7b3e47996278fac35c5c4d9;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: asoc-amd-yc-add-dmi-quirk-for-acer-travelmate-p216-41-tco.patch asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch efivarfs-fix-error-propagation-in-efivar_entry_get.patch flex_proportions-make-fprop_new_period-hardirq-safe.patch gpio-pca953x-mask-interrupts-in-irq-shutdown.patch mptcp-only-reset-subflow-errors-when-propagated.patch pinctrl-meson-mark-the-gpio-controller-as-sleeping.patch riscv-compat-fix-compat_uts_machine-definition.patch rust-kbuild-give-config-path-to-rustfmt-in-.rsi-target.patch scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch selftests-mptcp-check-no-dup-close-events-after-error.patch selftests-mptcp-check-subflow-errors-in-close-events.patch selftests-mptcp-join-fix-local-endp-not-being-tracked.patch --- diff --git a/queue-6.6/asoc-amd-yc-add-dmi-quirk-for-acer-travelmate-p216-41-tco.patch b/queue-6.6/asoc-amd-yc-add-dmi-quirk-for-acer-travelmate-p216-41-tco.patch new file mode 100644 index 0000000000..a3c905a732 --- /dev/null +++ b/queue-6.6/asoc-amd-yc-add-dmi-quirk-for-acer-travelmate-p216-41-tco.patch @@ -0,0 +1,39 @@ +From 9502b7df5a3c7e174f74f20324ac1fe781fc5c2d Mon Sep 17 00:00:00 2001 +From: Zhang Heng +Date: Mon, 26 Jan 2026 09:49:52 +0800 +Subject: ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO + +From: Zhang Heng + +commit 9502b7df5a3c7e174f74f20324ac1fe781fc5c2d upstream. + +Add a DMI quirk for the Acer TravelMate P216-41-TCO fixing the +issue where the internal microphone was not detected. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=220983 +Cc: stable@vger.kernel.org +Signed-off-by: Zhang Heng +Link: https://patch.msgid.link/20260126014952.3674450-1-zhangheng@kylinos.cn +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/amd/yc/acp6x-mach.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -661,6 +661,14 @@ static const struct dmi_system_id yc_acp + DMI_MATCH(DMI_PRODUCT_NAME, "GOH-X"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "RB"), ++ DMI_MATCH(DMI_BOARD_NAME, "XyloD5_RBU"), ++ } ++ }, ++ + {} + }; + diff --git a/queue-6.6/asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch b/queue-6.6/asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch new file mode 100644 index 0000000000..e153889fdf --- /dev/null +++ b/queue-6.6/asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch @@ -0,0 +1,47 @@ +From 9210f5ff6318163835d9e42ee68006be4da0f531 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Sun, 18 Jan 2026 17:50:30 -0300 +Subject: ASoC: fsl: imx-card: Do not force slot width to sample width + +From: Fabio Estevam + +commit 9210f5ff6318163835d9e42ee68006be4da0f531 upstream. + +imx-card currently sets the slot width to the physical sample width +for I2S links. This breaks controllers that use fixed-width slots +(e.g. 32-bit FIFO words), causing the unused bits in the slot to +contain undefined data when playing 16-bit streams. + +Do not override the slot width in the machine driver and let the CPU +DAI select an appropriate default instead. This matches the behavior +of simple-audio-card and avoids embedding controller-specific policy +in the machine driver. + +On an i.MX8MP-based board using SAI as the I2S master with 32-bit slots, +playing 16-bit audio resulted in spurious frequencies and an incorrect +SAI data waveform, as the slot width was forced to 16 bits. After this +change, audio artifacts are eliminated and the 16-bit samples correctly +occupy the first half of the 32-bit slot, with the remaining bits padded +with zeroes. + +Cc: stable@vger.kernel.org +Fixes: aa736700f42f ("ASoC: imx-card: Add imx-card machine driver") +Signed-off-by: Fabio Estevam +Acked-by: Shengjiu Wang +Link: https://patch.msgid.link/20260118205030.1532696-1-festevam@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/fsl/imx-card.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/sound/soc/fsl/imx-card.c ++++ b/sound/soc/fsl/imx-card.c +@@ -314,7 +314,6 @@ static int imx_aif_hw_params(struct snd_ + SND_SOC_DAIFMT_PDM; + } else { + slots = 2; +- slot_width = params_physical_width(params); + fmt = (rtd->dai_link->dai_fmt & ~SND_SOC_DAIFMT_FORMAT_MASK) | + SND_SOC_DAIFMT_I2S; + } diff --git a/queue-6.6/efivarfs-fix-error-propagation-in-efivar_entry_get.patch b/queue-6.6/efivarfs-fix-error-propagation-in-efivar_entry_get.patch new file mode 100644 index 0000000000..e9ab4a4771 --- /dev/null +++ b/queue-6.6/efivarfs-fix-error-propagation-in-efivar_entry_get.patch @@ -0,0 +1,37 @@ +From 4b22ec1685ce1fc0d862dcda3225d852fb107995 Mon Sep 17 00:00:00 2001 +From: Kohei Enju +Date: Sat, 17 Jan 2026 16:00:45 +0000 +Subject: efivarfs: fix error propagation in efivar_entry_get() + +From: Kohei Enju + +commit 4b22ec1685ce1fc0d862dcda3225d852fb107995 upstream. + +efivar_entry_get() always returns success even if the underlying +__efivar_entry_get() fails, masking errors. + +This may result in uninitialized heap memory being copied to userspace +in the efivarfs_file_read() path. + +Fix it by returning the error from __efivar_entry_get(). + +Fixes: 2d82e6227ea1 ("efi: vars: Move efivar caching layer into efivarfs") +Cc: # v6.1+ +Signed-off-by: Kohei Enju +Signed-off-by: Ard Biesheuvel +Signed-off-by: Greg Kroah-Hartman +--- + fs/efivarfs/vars.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/efivarfs/vars.c ++++ b/fs/efivarfs/vars.c +@@ -609,7 +609,7 @@ int efivar_entry_get(struct efivar_entry + err = __efivar_entry_get(entry, attributes, size, data); + efivar_unlock(); + +- return 0; ++ return err; + } + + /** diff --git a/queue-6.6/flex_proportions-make-fprop_new_period-hardirq-safe.patch b/queue-6.6/flex_proportions-make-fprop_new_period-hardirq-safe.patch new file mode 100644 index 0000000000..9c7b2625bb --- /dev/null +++ b/queue-6.6/flex_proportions-make-fprop_new_period-hardirq-safe.patch @@ -0,0 +1,79 @@ +From dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 21 Jan 2026 12:27:30 +0100 +Subject: flex_proportions: make fprop_new_period() hardirq safe + +From: Jan Kara + +commit dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc upstream. + +Bernd has reported a lockdep splat from flexible proportions code that is +essentially complaining about the following race: + + +run_timer_softirq - we are in softirq context + call_timer_fn + writeout_period + fprop_new_period + write_seqcount_begin(&p->sequence); + + + ... + blk_mq_end_request() + blk_update_request() + ext4_end_bio() + folio_end_writeback() + __wb_writeout_add() + __fprop_add_percpu_max() + if (unlikely(max_frac < FPROP_FRAC_BASE)) { + fprop_fraction_percpu() + seq = read_seqcount_begin(&p->sequence); + - sees odd sequence so loops indefinitely + +Note that a deadlock like this is only possible if the bdi has configured +maximum fraction of writeout throughput which is very rare in general but +frequent for example for FUSE bdis. To fix this problem we have to make +sure write section of the sequence counter is irqsafe. + +Link: https://lkml.kernel.org/r/20260121112729.24463-2-jack@suse.cz +Fixes: a91befde3503 ("lib/flex_proportions.c: remove local_irq_ops in fprop_new_period()") +Signed-off-by: Jan Kara +Reported-by: Bernd Schubert +Link: https://lore.kernel.org/all/9b845a47-9aee-43dd-99bc-1a82bea00442@bsbernd.com/ +Reviewed-by: Matthew Wilcox (Oracle) +Cc: Joanne Koong +Cc: Miklos Szeredi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + lib/flex_proportions.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/lib/flex_proportions.c ++++ b/lib/flex_proportions.c +@@ -64,13 +64,14 @@ void fprop_global_destroy(struct fprop_g + bool fprop_new_period(struct fprop_global *p, int periods) + { + s64 events = percpu_counter_sum(&p->events); ++ unsigned long flags; + + /* + * Don't do anything if there are no events. + */ + if (events <= 1) + return false; +- preempt_disable_nested(); ++ local_irq_save(flags); + write_seqcount_begin(&p->sequence); + if (periods < 64) + events -= events >> periods; +@@ -78,7 +79,7 @@ bool fprop_new_period(struct fprop_globa + percpu_counter_add(&p->events, -events); + p->period += periods; + write_seqcount_end(&p->sequence); +- preempt_enable_nested(); ++ local_irq_restore(flags); + + return true; + } diff --git a/queue-6.6/gpio-pca953x-mask-interrupts-in-irq-shutdown.patch b/queue-6.6/gpio-pca953x-mask-interrupts-in-irq-shutdown.patch new file mode 100644 index 0000000000..ebdf1aca76 --- /dev/null +++ b/queue-6.6/gpio-pca953x-mask-interrupts-in-irq-shutdown.patch @@ -0,0 +1,34 @@ +From d02f20a4de0c498fbba2b0e3c1496e72c630a91e Mon Sep 17 00:00:00 2001 +From: Martin Larsson +Date: Wed, 21 Jan 2026 12:57:22 +0000 +Subject: gpio: pca953x: mask interrupts in irq shutdown + +From: Martin Larsson + +commit d02f20a4de0c498fbba2b0e3c1496e72c630a91e upstream. + +In the existing implementation irq_shutdown does not mask the interrupts +in hardware. This can cause spurious interrupts from the IO expander. +Add masking to irq_shutdown to prevent spurious interrupts. + +Cc: stable@vger.kernel.org +Signed-off-by: Martin Larsson +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20260121125631.2758346-1-martin.larsson@actia.se +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-pca953x.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -811,6 +811,8 @@ static void pca953x_irq_shutdown(struct + clear_bit(hwirq, chip->irq_trig_fall); + clear_bit(hwirq, chip->irq_trig_level_low); + clear_bit(hwirq, chip->irq_trig_level_high); ++ ++ pca953x_irq_mask(d); + } + + static void pca953x_irq_print_chip(struct irq_data *data, struct seq_file *p) diff --git a/queue-6.6/mptcp-only-reset-subflow-errors-when-propagated.patch b/queue-6.6/mptcp-only-reset-subflow-errors-when-propagated.patch new file mode 100644 index 0000000000..d9ab093ce2 --- /dev/null +++ b/queue-6.6/mptcp-only-reset-subflow-errors-when-propagated.patch @@ -0,0 +1,57 @@ +From dccf46179ddd6c04c14be8ed584dc54665f53f0e Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Tue, 27 Jan 2026 20:27:25 +0100 +Subject: mptcp: only reset subflow errors when propagated + +From: Matthieu Baerts (NGI0) + +commit dccf46179ddd6c04c14be8ed584dc54665f53f0e upstream. + +Some subflow socket errors need to be reported to the MPTCP socket: the +initial subflow connect (MP_CAPABLE), and the ones from the fallback +sockets. The others are not propagated. + +The issue is that sock_error() was used to retrieve the error, which was +also resetting the sk_err field. Because of that, when notifying the +userspace about subflow close events later on from the MPTCP worker, the +ssk->sk_err field was always 0. + +Now, the error (sk_err) is only reset when propagating it to the msk. + +Fixes: 15cc10453398 ("mptcp: deliver ssk errors to msk") +Cc: stable@vger.kernel.org +Reviewed-by: Geliang Tang +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-3-7f71e1bc4feb@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -796,11 +796,8 @@ static bool __mptcp_ofo_queue(struct mpt + + static bool __mptcp_subflow_error_report(struct sock *sk, struct sock *ssk) + { +- int err = sock_error(ssk); + int ssk_state; +- +- if (!err) +- return false; ++ int err; + + /* only propagate errors on fallen-back sockets or + * on MPC connect +@@ -808,6 +805,10 @@ static bool __mptcp_subflow_error_report + if (sk->sk_state != TCP_SYN_SENT && !__mptcp_check_fallback(mptcp_sk(sk))) + return false; + ++ err = sock_error(ssk); ++ if (!err) ++ return false; ++ + /* We need to propagate only transition to CLOSE state. + * Orphaned socket will see such state change via + * subflow_sched_work_if_closed() and that path will properly diff --git a/queue-6.6/pinctrl-meson-mark-the-gpio-controller-as-sleeping.patch b/queue-6.6/pinctrl-meson-mark-the-gpio-controller-as-sleeping.patch new file mode 100644 index 0000000000..a7459ea28b --- /dev/null +++ b/queue-6.6/pinctrl-meson-mark-the-gpio-controller-as-sleeping.patch @@ -0,0 +1,90 @@ +From 28f24068387169722b508bba6b5257cb68b86e74 Mon Sep 17 00:00:00 2001 +From: Bartosz Golaszewski +Date: Mon, 5 Jan 2026 16:05:08 +0100 +Subject: pinctrl: meson: mark the GPIO controller as sleeping + +From: Bartosz Golaszewski + +commit 28f24068387169722b508bba6b5257cb68b86e74 upstream. + +The GPIO controller is configured as non-sleeping but it uses generic +pinctrl helpers which use a mutex for synchronization. + +This can cause the following lockdep splat with shared GPIOs enabled on +boards which have multiple devices using the same GPIO: + +BUG: sleeping function called from invalid context at +kernel/locking/mutex.c:591 +in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 142, name: +kworker/u25:3 +preempt_count: 1, expected: 0 +RCU nest depth: 0, expected: 0 +INFO: lockdep is turned off. +irq event stamp: 46379 +hardirqs last enabled at (46379): [] +_raw_spin_unlock_irqrestore+0x74/0x78 +hardirqs last disabled at (46378): [] +_raw_spin_lock_irqsave+0x84/0x88 +softirqs last enabled at (46330): [] +handle_softirqs+0x4c4/0x4dc +softirqs last disabled at (46295): [] +__do_softirq+0x14/0x20 +CPU: 1 UID: 0 PID: 142 Comm: kworker/u25:3 Tainted: G C +6.19.0-rc4-next-20260105+ #11963 PREEMPT +Tainted: [C]=CRAP +Hardware name: Khadas VIM3 (DT) +Workqueue: events_unbound deferred_probe_work_func +Call trace: + show_stack+0x18/0x24 (C) + dump_stack_lvl+0x90/0xd0 + dump_stack+0x18/0x24 + __might_resched+0x144/0x248 + __might_sleep+0x48/0x98 + __mutex_lock+0x5c/0x894 + mutex_lock_nested+0x24/0x30 + pinctrl_get_device_gpio_range+0x44/0x128 + pinctrl_gpio_set_config+0x40/0xdc + gpiochip_generic_config+0x28/0x3c + gpio_do_set_config+0xa8/0x194 + gpiod_set_config+0x34/0xfc + gpio_shared_proxy_set_config+0x6c/0xfc [gpio_shared_proxy] + gpio_do_set_config+0xa8/0x194 + gpiod_set_transitory+0x4c/0xf0 + gpiod_configure_flags+0xa4/0x480 + gpiod_find_and_request+0x1a0/0x574 + gpiod_get_index+0x58/0x84 + devm_gpiod_get_index+0x20/0xb4 + devm_gpiod_get+0x18/0x24 + mmc_pwrseq_emmc_probe+0x40/0xb8 + platform_probe+0x5c/0xac + really_probe+0xbc/0x298 + __driver_probe_device+0x78/0x12c + driver_probe_device+0xdc/0x164 + __device_attach_driver+0xb8/0x138 + bus_for_each_drv+0x80/0xdc + __device_attach+0xa8/0x1b0 + +Fixes: 6ac730951104 ("pinctrl: add driver for Amlogic Meson SoCs") +Cc: stable@vger.kernel.org +Reported-by: Marek Szyprowski +Closes: https://lore.kernel.org/all/00107523-7737-4b92-a785-14ce4e93b8cb@samsung.com/ +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/meson/pinctrl-meson.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/meson/pinctrl-meson.c ++++ b/drivers/pinctrl/meson/pinctrl-meson.c +@@ -618,7 +618,7 @@ static int meson_gpiolib_register(struct + pc->chip.set = meson_gpio_set; + pc->chip.base = -1; + pc->chip.ngpio = pc->data->num_pins; +- pc->chip.can_sleep = false; ++ pc->chip.can_sleep = true; + + ret = gpiochip_add_data(&pc->chip, pc); + if (ret) { diff --git a/queue-6.6/riscv-compat-fix-compat_uts_machine-definition.patch b/queue-6.6/riscv-compat-fix-compat_uts_machine-definition.patch new file mode 100644 index 0000000000..17d03e3d92 --- /dev/null +++ b/queue-6.6/riscv-compat-fix-compat_uts_machine-definition.patch @@ -0,0 +1,34 @@ +From 0ea05c4f7527a98f5946f96c829733788934311d Mon Sep 17 00:00:00 2001 +From: Han Gao +Date: Wed, 28 Jan 2026 03:07:11 +0800 +Subject: riscv: compat: fix COMPAT_UTS_MACHINE definition + +From: Han Gao + +commit 0ea05c4f7527a98f5946f96c829733788934311d upstream. + +The COMPAT_UTS_MACHINE for riscv was incorrectly defined as "riscv". +Change it to "riscv32" to reflect the correct 32-bit compat name. + +Fixes: 06d0e3723647 ("riscv: compat: Add basic compat data type implementation") +Cc: stable@vger.kernel.org +Signed-off-by: Han Gao +Reviewed-by: Guo Ren (Alibaba Damo Academy) +Link: https://patch.msgid.link/20260127190711.2264664-1-gaohan@iscas.ac.cn +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/include/asm/compat.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/riscv/include/asm/compat.h ++++ b/arch/riscv/include/asm/compat.h +@@ -2,7 +2,7 @@ + #ifndef __ASM_COMPAT_H + #define __ASM_COMPAT_H + +-#define COMPAT_UTS_MACHINE "riscv\0\0" ++#define COMPAT_UTS_MACHINE "riscv32\0\0" + + /* + * Architecture specific compatibility types diff --git a/queue-6.6/rust-kbuild-give-config-path-to-rustfmt-in-.rsi-target.patch b/queue-6.6/rust-kbuild-give-config-path-to-rustfmt-in-.rsi-target.patch new file mode 100644 index 0000000000..4145ccf31c --- /dev/null +++ b/queue-6.6/rust-kbuild-give-config-path-to-rustfmt-in-.rsi-target.patch @@ -0,0 +1,66 @@ +From af20ae33e7dd949f2e770198e74ac8f058cb299d Mon Sep 17 00:00:00 2001 +From: Miguel Ojeda +Date: Thu, 15 Jan 2026 19:38:32 +0100 +Subject: rust: kbuild: give `--config-path` to `rustfmt` in `.rsi` target + +From: Miguel Ojeda + +commit af20ae33e7dd949f2e770198e74ac8f058cb299d upstream. + +`rustfmt` is configured via the `.rustfmt.toml` file in the source tree, +and we apply `rustfmt` to the macro expanded sources generated by the +`.rsi` target. + +However, under an `O=` pointing to an external folder (i.e. not just +a subdir), `rustfmt` will not find the file when checking the parent +folders. Since the edition is configured in this file, this can lead to +errors when it encounters newer syntax, e.g. + + error: expected one of `!`, `.`, `::`, `;`, `?`, `where`, `{`, or an operator, found `"rust_minimal"` + --> samples/rust/rust_minimal.rsi:29:49 + | + 28 | impl ::kernel::ModuleMetadata for RustMinimal { + | - while parsing this item list starting here + 29 | const NAME: &'static ::kernel::str::CStr = c"rust_minimal"; + | ^^^^^^^^^^^^^^ expected one of 8 possible tokens + 30 | } + | - the item list ends here + | + = note: you may be trying to write a c-string literal + = note: c-string literals require Rust 2021 or later + = help: pass `--edition 2024` to `rustc` + = note: for more on editions, read https://doc.rust-lang.org/edition-guide + +A workaround is to use `RUSTFMT=n`, which is documented in the `Makefile` +help for cases where macro expanded source may happen to break `rustfmt` +for other reasons, but this is not one of those cases. + +One solution would be to pass `--edition`, but we want `rustfmt` to +use the entire configuration, even if currently we essentially use the +default configuration. + +Thus explicitly give the path to the config file to `rustfmt` instead. + +Reported-by: Alice Ryhl +Fixes: 2f7ab1267dc9 ("Kbuild: add Rust support") +Cc: stable@vger.kernel.org +Reviewed-by: Nathan Chancellor +Reviewed-by: Gary Guo +Link: https://patch.msgid.link/20260115183832.46595-1-ojeda@kernel.org +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + scripts/Makefile.build | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/scripts/Makefile.build ++++ b/scripts/Makefile.build +@@ -294,7 +294,7 @@ $(obj)/%.o: $(src)/%.rs FORCE + quiet_cmd_rustc_rsi_rs = $(RUSTC_OR_CLIPPY_QUIET) $(quiet_modtag) $@ + cmd_rustc_rsi_rs = \ + $(rust_common_cmd) -Zunpretty=expanded $< >$@; \ +- command -v $(RUSTFMT) >/dev/null && $(RUSTFMT) $@ ++ command -v $(RUSTFMT) >/dev/null && $(RUSTFMT) --config-path $(srctree)/.rustfmt.toml $@ + + $(obj)/%.rsi: $(src)/%.rs FORCE + $(call if_changed_dep,rustc_rsi_rs) diff --git a/queue-6.6/scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch b/queue-6.6/scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch new file mode 100644 index 0000000000..fdc257fdf5 --- /dev/null +++ b/queue-6.6/scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch @@ -0,0 +1,32 @@ +From 4747bafaa50115d9667ece446b1d2d4aba83dc7f Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Sat, 13 Dec 2025 16:36:43 +0800 +Subject: scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() + +From: Haoxiang Li + +commit 4747bafaa50115d9667ece446b1d2d4aba83dc7f upstream. + +If nonemb_cmd->va fails to be allocated, free the allocation previously +made by alloc_mcc_wrb(). + +Fixes: 50a4b824be9e ("scsi: be2iscsi: Fix to make boot discovery non-blocking") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Link: https://patch.msgid.link/20251213083643.301240-1-lihaoxiang@isrc.iscas.ac.cn +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/be2iscsi/be_mgmt.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/be2iscsi/be_mgmt.c ++++ b/drivers/scsi/be2iscsi/be_mgmt.c +@@ -1025,6 +1025,7 @@ unsigned int beiscsi_boot_get_sinfo(stru + &nonemb_cmd->dma, + GFP_KERNEL); + if (!nonemb_cmd->va) { ++ free_mcc_wrb(ctrl, tag); + mutex_unlock(&ctrl->mbox_lock); + return 0; + } diff --git a/queue-6.6/scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch b/queue-6.6/scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch new file mode 100644 index 0000000000..a68fa7df58 --- /dev/null +++ b/queue-6.6/scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch @@ -0,0 +1,34 @@ +From 56bd3c0f749f45793d1eae1d0ddde4255c749bf6 Mon Sep 17 00:00:00 2001 +From: Thomas Fourier +Date: Mon, 12 Jan 2026 14:43:24 +0100 +Subject: scsi: qla2xxx: edif: Fix dma_free_coherent() size + +From: Thomas Fourier + +commit 56bd3c0f749f45793d1eae1d0ddde4255c749bf6 upstream. + +Earlier in the function, the ha->flt buffer is allocated with size +sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE but freed in the error +path with size SFP_DEV_SIZE. + +Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Fourier +Link: https://patch.msgid.link/20260112134326.55466-2-fourier.thomas@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_os.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -4482,7 +4482,7 @@ fail_lsrjt: + fail_elsrej: + dma_pool_destroy(ha->purex_dma_pool); + fail_flt: +- dma_free_coherent(&ha->pdev->dev, SFP_DEV_SIZE, ++ dma_free_coherent(&ha->pdev->dev, sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE, + ha->flt, ha->flt_dma); + + fail_flt_buffer: diff --git a/queue-6.6/selftests-mptcp-check-no-dup-close-events-after-error.patch b/queue-6.6/selftests-mptcp-check-no-dup-close-events-after-error.patch new file mode 100644 index 0000000000..bb4183cd4f --- /dev/null +++ b/queue-6.6/selftests-mptcp-check-no-dup-close-events-after-error.patch @@ -0,0 +1,110 @@ +From 8467458dfa61b37e259e3485a5d3e415d08193c1 Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Tue, 27 Jan 2026 20:27:24 +0100 +Subject: selftests: mptcp: check no dup close events after error + +From: Matthieu Baerts (NGI0) + +commit 8467458dfa61b37e259e3485a5d3e415d08193c1 upstream. + +This validates the previous commit: subflow closed events are re-sent +with less info when the initial subflow is disconnected after an error +and each time a subflow is closed after that. + +In this new test, the userspace PM is involved because that's how it was +discovered, but it is not specific to it. The initial subflow is +terminated with a RESET, and that will cause the subflow disconnect. +Then, a new subflow is initiated, but also got rejected, which cause a +second subflow closed event, but not a third one. + +While at it, in case of failure to get the expected amount of events, +the events are printed. + +The 'Fixes' tag here below is the same as the one from the previous +commit: this patch here is not fixing anything wrong in the selftests, +but it validates the previous fix for an issue introduced by this commit +ID. + +Fixes: d82809b6c5f2 ("mptcp: avoid duplicated SUB_CLOSED events") +Cc: stable@vger.kernel.org +Reviewed-by: Geliang Tang +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-2-7f71e1bc4feb@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/mptcp_join.sh | 51 ++++++++++++++++++++++++ + 1 file changed, 51 insertions(+) + +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -3569,11 +3569,32 @@ chk_evt_nr() + count=$(grep -cw "type:${evt}" "${evts}") + if [ "${count}" != "${exp}" ]; then + fail_test "got ${count} events, expected ${exp}" ++ cat "${evts}" + else + print_ok + fi + } + ++# $1: ns ; $2: event type ; $3: expected count ++wait_event() ++{ ++ local ns="${1}" ++ local evt_name="${2}" ++ local exp="${3}" ++ ++ local evt="${!evt_name}" ++ local evts="${evts_ns1}" ++ local count ++ ++ [ "${ns}" == "ns2" ] && evts="${evts_ns2}" ++ ++ for _ in $(seq 100); do ++ count=$(grep -cw "type:${evt}" "${evts}") ++ [ "${count}" -ge "${exp}" ] && break ++ sleep 0.1 ++ done ++} ++ + userspace_tests() + { + # userspace pm type prevents add_addr +@@ -3730,6 +3751,36 @@ userspace_tests() + kill_events_pids + mptcp_lib_kill_group_wait $tests_pid + fi ++ ++ # userspace pm no duplicated spurious close events after an error ++ if reset_with_events "userspace pm no dup close events after error" && ++ continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then ++ set_userspace_pm $ns2 ++ pm_nl_set_limits $ns1 0 2 ++ { timeout_test=120 test_linkfail=128 speed=slow \ ++ run_tests $ns1 $ns2 10.0.1.1 & } 2>/dev/null ++ local tests_pid=$! ++ wait_event ns2 MPTCP_LIB_EVENT_ESTABLISHED 1 ++ userspace_pm_add_sf $ns2 10.0.3.2 20 ++ chk_mptcp_info subflows 1 subflows 1 ++ chk_subflows_total 2 2 ++ ++ # force quick loss ++ ip netns exec $ns2 sysctl -q net.ipv4.tcp_syn_retries=1 ++ if ip netns exec "${ns1}" ${iptables} -A INPUT -s "10.0.1.2" \ ++ -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset && ++ ip netns exec "${ns2}" ${iptables} -A INPUT -d "10.0.1.2" \ ++ -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset; then ++ wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 1 ++ wait_event ns1 MPTCP_LIB_EVENT_SUB_CLOSED 1 ++ chk_subflows_total 1 1 ++ userspace_pm_add_sf $ns2 10.0.1.2 0 ++ wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 ++ chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 ++ fi ++ kill_events_pids ++ mptcp_lib_kill_group_wait $tests_pid ++ fi + } + + endpoint_tests() diff --git a/queue-6.6/selftests-mptcp-check-subflow-errors-in-close-events.patch b/queue-6.6/selftests-mptcp-check-subflow-errors-in-close-events.patch new file mode 100644 index 0000000000..b10e7b5696 --- /dev/null +++ b/queue-6.6/selftests-mptcp-check-subflow-errors-in-close-events.patch @@ -0,0 +1,93 @@ +From 2ef9e3a3845d0a20b62b01f5b731debd0364688d Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Tue, 27 Jan 2026 20:27:26 +0100 +Subject: selftests: mptcp: check subflow errors in close events + +From: Matthieu Baerts (NGI0) + +commit 2ef9e3a3845d0a20b62b01f5b731debd0364688d upstream. + +This validates the previous commit: subflow closed events should contain +an error field when a subflow got closed with an error, e.g. reset or +timeout. + +For this test, the chk_evt_nr helper has been extended to check +attributes in the matched events. + +In this test, the 2 subflow closed events should have an error. + +The 'Fixes' tag here below is the same as the one from the previous +commit: this patch here is not fixing anything wrong in the selftests, +but it validates the previous fix for an issue introduced by this commit +ID. + +Fixes: 15cc10453398 ("mptcp: deliver ssk errors to msk") +Cc: stable@vger.kernel.org +Reviewed-by: Geliang Tang +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-4-7f71e1bc4feb@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/mptcp_join.sh | 23 ++++++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -3544,21 +3544,28 @@ userspace_pm_chk_get_addr() + fi + } + +-# $1: ns ; $2: event type ; $3: count ++# $1: ns ; $2: event type ; $3: count ; [ $4: attr ; $5: attr count ] + chk_evt_nr() + { + local ns=${1} + local evt_name="${2}" + local exp="${3}" ++ local attr="${4}" ++ local attr_exp="${5}" + + local evts="${evts_ns1}" + local evt="${!evt_name}" ++ local attr_name + local count + ++ if [ -n "${attr}" ]; then ++ attr_name=", ${attr}: ${attr_exp}" ++ fi ++ + evt_name="${evt_name:16}" # without MPTCP_LIB_EVENT_ + [ "${ns}" == "ns2" ] && evts="${evts_ns2}" + +- print_check "event ${ns} ${evt_name} (${exp})" ++ print_check "event ${ns} ${evt_name} (${exp}${attr_name})" + + if [[ "${evt_name}" = "LISTENER_"* ]] && + ! mptcp_lib_kallsyms_has "mptcp_event_pm_listener$"; then +@@ -3570,6 +3577,16 @@ chk_evt_nr() + if [ "${count}" != "${exp}" ]; then + fail_test "got ${count} events, expected ${exp}" + cat "${evts}" ++ return ++ elif [ -z "${attr}" ]; then ++ print_ok ++ return ++ fi ++ ++ count=$(grep -w "type:${evt}" "${evts}" | grep -c ",${attr}:") ++ if [ "${count}" != "${attr_exp}" ]; then ++ fail_test "got ${count} event attributes, expected ${attr_exp}" ++ grep -w "type:${evt}" "${evts}" + else + print_ok + fi +@@ -3776,7 +3793,7 @@ userspace_tests() + chk_subflows_total 1 1 + userspace_pm_add_sf $ns2 10.0.1.2 0 + wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 +- chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 ++ chk_evt_nr ns2 MPTCP_LIB_EVENT_SUB_CLOSED 2 error 2 + fi + kill_events_pids + mptcp_lib_kill_group_wait $tests_pid diff --git a/queue-6.6/selftests-mptcp-join-fix-local-endp-not-being-tracked.patch b/queue-6.6/selftests-mptcp-join-fix-local-endp-not-being-tracked.patch new file mode 100644 index 0000000000..c79b71af36 --- /dev/null +++ b/queue-6.6/selftests-mptcp-join-fix-local-endp-not-being-tracked.patch @@ -0,0 +1,60 @@ +From c5d5ecf21fdd9ce91e6116feb3aa83cee73352cc Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Tue, 27 Jan 2026 20:27:27 +0100 +Subject: selftests: mptcp: join: fix local endp not being tracked + +From: Matthieu Baerts (NGI0) + +commit c5d5ecf21fdd9ce91e6116feb3aa83cee73352cc upstream. + +When running this mptcp_join.sh selftest on older kernel versions not +supporting local endpoints tracking, this test fails because 3 MP_JOIN +ACKs have been received, while only 2 were expected. + +It is not clear why only 2 MP_JOIN ACKs were expected on old kernel +versions, while 3 MP_JOIN SYN and SYN+ACK were expected. When testing on +the v5.15.197 kernel, 3 MP_JOIN ACKs are seen, which is also what is +expected in the selftests included in this kernel version, see commit +f4480eaad489 ("selftests: mptcp: add missing join check"). + +Switch the expected MP_JOIN ACKs to 3. While at it, move this +chk_join_nr helper out of the special condition for older kernel +versions as it is now the same as with more recent ones. Also, invert +the condition to be more logical: what's expected on newer kernel +versions having such helper first. + +Fixes: d4c81bbb8600 ("selftests: mptcp: join: support local endpoint being tracked or not") +Cc: stable@vger.kernel.org +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-5-7f71e1bc4feb@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/mptcp_join.sh | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -2203,17 +2203,16 @@ signal_address_tests() + ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=1 + speed=slow \ + run_tests $ns1 $ns2 10.0.1.1 ++ chk_join_nr 3 3 3 + + # It is not directly linked to the commit introducing this + # symbol but for the parent one which is linked anyway. +- if ! mptcp_lib_kallsyms_has "mptcp_pm_subflow_check_next$"; then +- chk_join_nr 3 3 2 +- chk_add_nr 4 4 +- else +- chk_join_nr 3 3 3 ++ if mptcp_lib_kallsyms_has "mptcp_pm_subflow_check_next$"; then + # the server will not signal the address terminating + # the MPC subflow + chk_add_nr 3 3 ++ else ++ chk_add_nr 4 4 + fi + fi + } diff --git a/queue-6.6/series b/queue-6.6/series index b849f50873..95dfee585b 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -20,3 +20,17 @@ scsi-firewire-sbp-target-fix-overflow-in-sbp_make_tp.patch asoc-intel-sof_es8336-fix-headphone-gpio-logic-inver.patch gpiolib-acpi-use-bit_ull-for-u64-mask-in-address-spa.patch dma-pool-distinguish-between-missing-and-exhausted-a.patch +pinctrl-meson-mark-the-gpio-controller-as-sleeping.patch +riscv-compat-fix-compat_uts_machine-definition.patch +rust-kbuild-give-config-path-to-rustfmt-in-.rsi-target.patch +asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch +scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch +asoc-amd-yc-add-dmi-quirk-for-acer-travelmate-p216-41-tco.patch +gpio-pca953x-mask-interrupts-in-irq-shutdown.patch +scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch +efivarfs-fix-error-propagation-in-efivar_entry_get.patch +mptcp-only-reset-subflow-errors-when-propagated.patch +selftests-mptcp-check-no-dup-close-events-after-error.patch +selftests-mptcp-check-subflow-errors-in-close-events.patch +selftests-mptcp-join-fix-local-endp-not-being-tracked.patch +flex_proportions-make-fprop_new_period-hardirq-safe.patch